joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801af990
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, r9d
mov rdi, r8
mov rsi, rcx
call fcn.1801afa50
test eax, eax
je 0x1801afa27
mov rcx, rdi
test ebx, ebx
je 0x1801afa16
xor edx, edx
mov r8d, ebx
nop dword [rax]
mov rax, rdx
lea rcx, [rcx + 1]
and eax, 0x1f
inc rdx
movzx eax, byte [rax + rsi + 0x88]
add byte [rcx - 1], al
sub r8, 1
jne 0x1801af9c0
mov ecx, dword [rsi + 0x3c]
mov r8, rbx
mov eax, ecx
mov rdx, rdi
shr eax, 0x10
add ax, cx
nop
xor byte [rdx], al
lea rdx, [rdx + 1]
movzx ecx, ax
add ax, ax
shr cx, 0xf
add cx, ax
movzx eax, cx
add cx, cx
shr ax, 0xf
add ax, cx
sub r8, 1
jne 0x1801af9f0
cmp dword [rbx + rdi - 4], 0
je 0x1801afa39
mov dword [0x18029ccf4], 0x65
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1801afa50
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ebx, r9d
mov rsi, r8
mov rdi, rcx
xor r9d, r9d
mov rcx, qword [rcx + 0x28]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x1801afa90
mov dword [0x18029ccf4], 0x65
jmp 0x1801afac9
mov rcx, qword [rdi + 0x28]
lea r9, [rsp + 0x30]
mov r8d, ebx
mov qword [rsp + 0x20], 0
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1801afabf
cmp dword [rsp + 0x30], ebx
jne 0x1801afabf
mov eax, 1
jmp 0x1801afacb
mov dword [0x18029ccf4], 0x62
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1801afae0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx eax, byte [rcx + 0x4c]
lea r8, [rdx + 0x14]
mov byte [r8], al
lea r9, [rdx + 0x18]
mov eax, dword [rcx + 0x4c]
mov rbx, rcx
shr eax, 8
mov byte [rdx + 0x15], al
movzx eax, byte [rcx + 0x50]
mov byte [rdx + 0x16], al
mov eax, dword [rcx + 0x50]
shr eax, 8
mov byte [rdx + 0x17], al
movzx eax, byte [rcx + 0x60]
mov byte [r9], al
mov eax, dword [rcx + 0x60]
shr eax, 8
mov byte [rdx + 0x19], al
mov edx, 0x18
movzx eax, word [rcx + 0x50]
add ax, word [rcx + 0x4c]
nop dword [rax]
xor byte [r9], al
lea r9, [r9 + 1]
movzx ecx, ax
add ax, ax
shr cx, 0xf
add cx, ax
movzx eax, cx
add cx, cx
shr ax, 0xf
add ax, cx
sub rdx, 1
jne 0x1801afb40
mov edx, dword [rbx + 0x6c]
mov r9d, 0x1c
add edx, 0x14
mov rcx, rbx
call fcn.1801b1c30
test eax, eax
je 0x1801afc06
cmp dword [rbx + 0x78], 0
mov al, 0xfa
jne 0x1801afb8f
movzx eax, byte [rbx + 0x5c]
mov edx, dword [rbx + 0x68]
xor r9d, r9d
mov rcx, qword [rbx + 0x28]
xor r8d, r8d
mov byte [rsp + 0x30], al
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x1801afbb6
mov dword [0x18029ccf4], 0x65
jmp 0x1801afc06
mov rcx, qword [rbx + 0x28]
lea r9, [rsp + 0x34]
mov r8d, 1
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1801afbfc
cmp dword [rsp + 0x34], 1
jne 0x1801afbfc
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x40
pop rbx
ret
mov dword [0x18029ccf4], 0x61
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x40
pop rbx
ret
Function at 0x1801b09f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [0x18029cd68]
xor esi, esi
mov ecx, dword [rbx + 0x74]
lea r15, [rbx + 0x74]
call fcn.1801af330
mov r14, rax
test rax, rax
jne 0x1801b0c1c
mov edx, dword [rbx + 0x38]
test edx, edx
jne 0x1801b0a44
mov dword [0x18029ccf4], 0xb
jmp 0x1801b0c1c
mov rcx, qword [rbx + 0x28]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x78], rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x1801b0ad7
mov rcx, qword [rbx + 0x28]
lea r9, [rsp + 0x38]
mov r8d, 4
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1801b0c0b
cmp dword [rsp + 0x38], 4
jne 0x1801b0c0b
movzx eax, byte [rsp + 0x37]
xor r9d, r9d
mov edi, dword [rbx + 0x38]
xor r8d, r8d
shl ax, 8
movzx edx, ax
movzx eax, byte [rsp + 0x36]
or edx, eax
movzx eax, byte [rsp + 0x35]
shl edx, 0x10
shl ax, 8
movzx ecx, ax
movzx eax, byte [rsp + 0x34]
or edx, ecx
mov rcx, qword [rbx + 0x28]
or edx, eax
mov dword [rbx + 0x3c], edx
lea edx, [rdi + 4]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x1801b0ae6
mov dword [0x18029ccf4], 0x65
jmp 0x1801b0c15
mov rcx, qword [rbx + 0x28]
lea r9, [rsp + 0x38]
mov r8d, 2
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1801b0c0b
cmp dword [rsp + 0x38], 2
jne 0x1801b0c0b
movzx ecx, word [rsp + 0x30]
mov qword [rsp + 0x70], rbp
call fcn.1801aecb0
mov rbp, rax
test rax, rax
je 0x1801b0bf1
movzx r9d, word [rsp + 0x30]
lea edx, [rdi + 8]
mov r8, rax
mov rcx, rbx
call fcn.1801af990
test eax, eax
je 0x1801b0bf1
movzx ecx, byte [rbp + 1]
lea rdi, [rbp + 2]
movzx eax, byte [rbp]
shl rcx, 8
or rcx, rax
lea rdi, [rdi + rcx*2]
movzx ecx, word [rsp + 0x30]
shr ecx, 1
call fcn.1801aecb0
mov rsi, rax
test rax, rax
je 0x1801b0bf1
movzx ecx, byte [rdi]
mov rbx, rax
test cl, cl
je 0x1801b0bc2
movzx edx, cl
test cl, cl
je 0x1801b0ba2
lea rcx, [rdi + 6]
nop
movzx eax, byte [rcx]
lea rcx, [rcx + 2]
mov byte [rbx], al
inc rbx
sub rdx, 1
jne 0x1801b0b90
mov byte [rbx], 0x7c
inc rbx
movzx eax, byte [rdi]
lea rdi, [rdi + rax*2]
add rdi, 6
movzx ecx, byte [rdi]
test cl, cl
jne 0x1801b0b84
cmp rbx, rsi
je 0x1801b0bc2
dec rbx
mov byte [rbx], 0
mov r8, r15
sub ebx, esi
mov edx, 0x2710
inc ebx
mov ecx, ebx
call fcn.1801aec10
mov rdi, rax
test rax, rax
je 0x1801b0bf1
movsxd r8, ebx
mov rdx, rsi
mov rcx, rax
call fcn.18020b840
mov r14, rdi
mov rcx, rsi
call fcn.18010fbc0
mov rcx, rbp
call fcn.18010fbc0
mov rbp, qword [rsp + 0x70]
mov rax, r14
jmp 0x1801b0c17
mov dword [0x18029ccf4], 0x62
xor eax, eax
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801e68c0
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rsi
ret
Function at 0x1801b0f80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r14
sub rsp, 0x40
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx r10d, word [r8 + 4]
mov rsi, r8
add r8, 8
xor ebx, ebx
mov ebp, r9d
mov r14d, ecx
test r10d, r10d
je 0x1801b0fd9
movzx r9d, word [rdx + 4]
nop word [rax + rax]
cmp r9w, word [r8 + 4]
jne 0x1801b0fce
mov eax, dword [r8]
cmp dword [rdx], eax
je 0x1801b0fe7
inc ebx
add r8, 8
cmp ebx, r10d
jl 0x1801b0fc0
mov dword [0x18029ccf4], 0x12
xor eax, eax
jmp 0x1801b101b
mov qword [rsp + 0x68], rdi
xor r9d, r9d
mov rdi, qword [0x18029cd68]
xor r8d, r8d
mov edx, r14d
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x1801b1036
mov dword [0x18029ccf4], 0x65
xor eax, eax
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1801e68c0
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
mov rcx, qword [rdi + 0x28]
lea r9, [rsp + 0x34]
mov r8d, 2
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1801b10a9
cmp dword [rsp + 0x34], 2
jne 0x1801b10a9
movzx r9d, word [rsp + 0x30]
cmp r9d, ebp
jbe 0x1801b107b
mov dword [0x18029ccf4], 5
jmp 0x1801b1014
mov rcx, qword [0x18029cd68]
lea edx, [r9 + 4]
imul edx, ebx
mov r8, rsi
add edx, 4
add edx, r14d
call fcn.1801af990
test eax, eax
je 0x1801b1014
mov eax, 1
jmp 0x1801b1016
mov dword [0x18029ccf4], 0x62
jmp 0x1801b1014

Function at 0x1801b10c0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, r8
mov r14, rdx
mov rdx, rbp
mov r8d, r9d
mov esi, r9d
call fcn.1801b0c40
test rax, rax
je 0x1801b11c0
movzx eax, word [rax + 4]
test ax, ax
jne 0x1801b110f
mov dword [0x18029ccf4], 8
jmp 0x1801b11c0
mov rdi, qword [0x18029cd68]
mov ebx, eax
and ebx, 0xff00
movzx eax, al
or ebx, eax
xor r9d, r9d
xor r8d, r8d
add ebx, dword [rdi + 0x38]
mov rcx, qword [rdi + 0x28]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x1801b1148
mov dword [0x18029ccf4], 0x65
jmp 0x1801b11c0
mov rcx, qword [rdi + 0x28]
lea r9, [rsp + 0x34]
mov r8d, 2
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1801b11b6
cmp dword [rsp + 0x34], 2
jne 0x1801b11b6
movzx r9d, word [rsp + 0x30]
cmp r9d, esi
jbe 0x1801b118d
mov dword [0x18029ccf4], 5
jmp 0x1801b11c0
mov rcx, qword [0x18029cd68]
add ebx, 4
mov edx, ebx
mov r8, rbp
call fcn.1801af990
test eax, eax
je 0x1801b11c0
movzx eax, word [rsp + 0x30]
add eax, ebx
mov dword [r14], eax
mov eax, 1
jmp 0x1801b11c2
mov dword [0x18029ccf4], 0x62
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1801b11e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, qword [0x18029cd68]
xor edi, edi
mov ebx, edi
mov esi, edi
mov edx, dword [rbp + 0x38]
test edx, edx
je 0x1801b1338
mov rcx, qword [rbp + 0x28]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x1801b1240
mov dword [0x18029ccf4], 0x65
xor eax, eax
jmp 0x1801b1380
mov rcx, qword [rbp + 0x28]
lea r9, [rsp + 0x38]
mov r8d, 4
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1801b13a2
cmp dword [rsp + 0x38], 4
jne 0x1801b13a2
movzx eax, byte [rsp + 0x37]
xor r9d, r9d
mov ebx, dword [rbp + 0x38]
xor r8d, r8d
shl ax, 8
movzx edx, ax
movzx eax, byte [rsp + 0x36]
or edx, eax
movzx eax, byte [rsp + 0x35]
shl edx, 0x10
shl ax, 8
movzx ecx, ax
movzx eax, byte [rsp + 0x34]
or edx, ecx
mov rcx, qword [rbp + 0x28]
or edx, eax
mov dword [rbp + 0x3c], edx
lea edx, [rbx + 4]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x1801b122f
mov rcx, qword [rbp + 0x28]
lea r9, [rsp + 0x38]
mov r8d, 4
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1801b13a2
cmp dword [rsp + 0x38], 4
jne 0x1801b13a2
mov ecx, dword [rsp + 0x30]
call fcn.1801aecb0
mov rdi, rax
test rax, rax
je 0x1801b13ac
mov r9d, dword [rsp + 0x30]
lea edx, [rbx + 8]
mov r8, rax
mov rcx, rbp
call fcn.1801af990
test eax, eax
jne 0x1801b1328
mov rcx, rdi
call fcn.18010fbc0
xor eax, eax
jmp 0x1801b1380
movzx esi, byte [rdi + 1]
lea rbx, [rdi + 2]
movzx eax, byte [rdi]
shl esi, 8
or esi, eax
lea ecx, [rsi + 1]
call fcn.1801aecb0
mov rbp, rax
test rax, rax
je 0x1801b131c
mov rcx, rax
test esi, esi
je 0x1801b1372
mov edx, esi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx]
lea rbx, [rbx + 2]
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1801b1360
mov byte [rcx], 0
mov rcx, rdi
call fcn.18010fbc0
mov rax, rbp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801e68c0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov dword [0x18029ccf4], 0x62
xor eax, eax
jmp 0x1801b1380
Function at 0x1801b17f0
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0x98
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rbp + 0x17], rax
movzx eax, byte [rdx]
xor r15d, r15d
and al, 7
mov qword [r11 - 0x28], rsi
cmp al, 1
mov qword [r11 - 0x38], r14
mov rbx, rcx
mov qword [rbp - 0x21], r15
mov ecx, r15d
mov dword [rbp - 9], r15d
sete cl
mov qword [rbp + 0xb], r15
mov r14, r8
mov dword [rbp + 0x13], r15d
mov r8, rdx
mov esi, r9d
movzx edx, cx
mov byte [rbp + 7], sil
or dx, 2
xorps xmm0, xmm0
mov edi, r15d
movzx eax, byte [r8 + 0x1c]
cmp dword [r8 + 0x3c], r15d
mov byte [rbp - 5], al
movzx eax, byte [r8 + 0x1d]
cmove dx, cx
mov byte [rbp - 4], al
mov rcx, rbx
movzx eax, byte [r8 + 0x1e]
mov byte [rbp - 3], al
movzx eax, byte [r8 + 0x1f]
mov byte [rbp - 2], al
movzx eax, byte [r8 + 0x20]
mov byte [rbp - 1], al
movzx eax, byte [r8 + 0x21]
mov byte [rbp], al
movzx eax, byte [r8 + 0x22]
mov byte [rbp + 1], al
movzx eax, byte [r8 + 0x23]
mov byte [rbp + 2], al
movzx eax, byte [r8 + 0x38]
mov byte [rbp + 3], al
movzx eax, byte [r8 + 0x39]
mov byte [rbp + 4], al
movzx eax, byte [r8 + 0x3a]
mov byte [rbp + 5], al
movzx eax, byte [r8 + 0x3b]
mov byte [rbp + 6], al
mov eax, r9d
mov byte [rbp + 9], dl
shr dx, 8
shr eax, 8
mov byte [rbp + 0xa], dl
lea rdx, [rbp - 0x21]
mov byte [rbp + 8], al
movdqu xmmword [rbp - 0x19], xmm0
call fcn.1801afae0
test eax, eax
je 0x1801b1974
mov edx, dword [rbx + 0x6c]
xor r9d, r9d
mov rcx, qword [rbx + 0x28]
add edx, 0x30
xor r8d, r8d
mov byte [rbp - 0x29], 9
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x1801b1914
mov dword [0x18029ccf4], 0x65
jmp 0x1801b1974
mov rcx, qword [rbx + 0x28]
lea r9, [rbp - 0x25]
mov qword [rsp + 0x88], r12
lea rdx, [rbp - 0x29]
mov r12d, 1
mov qword [rsp + 0x20], r15
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1801b1962
cmp dword [rbp - 0x25], r12d
jne 0x1801b1962
mov edx, dword [rbx + 0x70]
mov r9d, esi
add edx, dword [rbx + 0x6c]
mov r8, r14
mov rcx, rbx
call fcn.1801b1c30
test eax, eax
cmovne edi, r12d
jmp 0x1801b196c
mov dword [0x18029ccf4], 0x61
mov r12, qword [rsp + 0x88]
mov r14, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x90]
cmp dword [rbx + 0x30], r15d
je 0x1801b19aa
mov rcx, qword [rbx + 0x28]
mov r9d, 0x24
xor r8d, r8d
mov dword [rsp + 0x20], r15d
lea edx, [r9 + 0x18]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rbx + 0x30], r15d
mov eax, edi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x98
pop r15
pop rdi
pop rbx
pop rbp
ret
Function at 0x1801b19d0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
xor eax, eax
mov rbx, rdx
mov qword [rsp + 0x30], rax
mov rdi, rcx
mov rcx, qword [rcx + 0x20]
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov edx, 0xc0000000
lea r8d, [rax + 3]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rdi + 0x28], rax
cmp rax, 0xffffffffffffffff
jne 0x1801b1a2a
mov dword [0x18029ccf4], 0x60
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
test rbx, rbx
jne 0x1801b1a3d
lea eax, [rbx + 1]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov r9d, 0x40
mov r8, rbx
mov rcx, rdi
lea edx, [r9 - 0x20]
call fcn.1801afa50
test eax, eax
je 0x1801b1a1d
mov rax, qword [rbx]
cmp rax, qword [0x18029cd80]
je 0x1801b1a79
mov dword [0x18029ccf4], 0x65
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
movzx eax, byte [rbx + 8]
mov byte [rdi + 0x18], al
movzx eax, byte [rbx + 9]
mov byte [rdi + 0x19], al
movzx ecx, byte [rbx + 0xd]
movzx eax, byte [rbx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [rdi + 8], ecx
cmp byte [rbx + 8], 2
jb 0x1801b1abf
movzx eax, byte [rbx + 0x1a]
movzx ecx, byte [rbx + 0x1b]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x18]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x38], ecx
mov rcx, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
jmp fcn.1801af6c0

Function at 0x1801b1ae0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
call fcn.1801af6c0
test eax, eax
je 0x1801b1bca
mov rcx, qword [0x18029cd68]
xor r8d, r8d
mov qword [rsp + 0x58], rsi
xor edx, edx
mov qword [rsp + 0x60], rdi
call fcn.1801afc20
xor esi, esi
test eax, eax
je 0x1801b1b8b
mov rdi, qword [0x18029cd68]
xor r9d, r9d
mov byte [rsp + 0x30], 0xff
xor r8d, r8d
mov edx, dword [rdi + 0x68]
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x1801b1b55
mov dword [0x18029ccf4], 0x65
jmp 0x1801b1b9d
mov rcx, qword [rdi + 0x28]
lea r9, [rsp + 0x34]
mov r8d, 1
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1801b1b7f
cmp dword [rsp + 0x34], 1
je 0x1801b1b8b
mov dword [0x18029ccf4], 0x61
jmp 0x1801b1b9d
mov eax, dword [0x18029ccf4]
cmp eax, 0x67
cmove eax, esi
mov dword [0x18029ccf4], eax
mov rdi, qword [rsp + 0x60]
cmp dword [rbx + 0x30], esi
je 0x1801b1bc5
mov rcx, qword [rbx + 0x28]
mov r9d, 0x24
xor r8d, r8d
mov dword [rsp + 0x20], esi
lea edx, [r9 + 0x18]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rbx + 0x30], esi
mov rsi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x40
pop rbx
ret
Function at 0x1801b1c30
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ebx, r9d
mov rsi, r8
mov rdi, rcx
xor r9d, r9d
mov rcx, qword [rcx + 0x28]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x1801b1c70
mov dword [0x18029ccf4], 0x65
jmp 0x1801b1ca9
mov rcx, qword [rdi + 0x28]
lea r9, [rsp + 0x30]
mov r8d, ebx
mov qword [rsp + 0x20], 0
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1801b1c9f
cmp dword [rsp + 0x30], ebx
jne 0x1801b1c9f
mov eax, 1
jmp 0x1801b1cab
mov dword [0x18029ccf4], 0x61
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1801b1cc0
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x130], rax
xor esi, esi
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, pe_nt_image_headers64
movzx ebx, si
call fcn.18020bef0
mov r8d, 0xff
lea rdx, [rsp + 0x30]
lea rcx, [0x18006c6c0]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
lea ecx, [rdi - 1]
cmp ecx, 0x1e
ja 0x1801b1d44
mov edx, esi
lea rax, [rsp + 0x30]
lea r8, [0x18006c6d0]
nop dword [rax + rax]
movzx ecx, byte [rax + rdx]
inc rdx
cmp cl, byte [r8 + rdx - 1]
jne 0x1801b1d6b
cmp rdx, 8
jne 0x1801b1d30
xor al, al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1801e68c0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov rcx, rsi
lea rdx, [rsp + 0x30]
lea r8, [0x18006c6d8]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x1801b1d96
cmp rcx, 8
jne 0x1801b1d80
jmp 0x1801b1d44
mov r8d, 8
lea rdx, [0x18006c6e8]
lea rcx, [rsp + 0x30]
call fcn.180113f40
test eax, eax
jne 0x1801b1e2a
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], esi
lea rdx, [0x18006c6f8]
lea rcx, [rsp + 0x30]
call fcn.180155940
cmp eax, 1
jne 0x1801b1df5
mov eax, dword [rsp + 0x20]
inc eax
and eax, 0x800000ff
jge 0x1801b1de6
dec eax
or eax, 0xffffff00
inc eax
cdqe
lea rdx, [0x18029cdb0]
movzx ebx, byte [rax + rdx]
jmp 0x1801b1e58
test edi, edi
je 0x1801b1e5d
lea r8, [rsp + 0x30]
mov r9, rdi
lea rdx, [0x18029cdb0]
nop dword [rax + rax]
movsx rcx, byte [r8]
lea r8, [r8 + 1]
movzx eax, bx
xor rcx, rax
movzx ebx, byte [rcx + rdx]
sub r9, 1
jne 0x1801b1e10
jmp 0x1801b1e58
test edi, edi
je 0x1801b1e5d
lea r8, [rsp + 0x30]
mov r9, rdi
lea rdx, [0x18029cdb0]
nop dword [rax]
movsx rcx, byte [r8]
lea r8, [r8 + 1]
movzx eax, bx
xor rcx, rax
movzx ebx, byte [rcx + rdx]
sub r9, 1
jne 0x1801b1e40
cmp si, bx
jne 0x1801b1e62
mov ebx, 0xff
movzx eax, bl
jmp 0x1801b1d46
Function at 0x1801b1e70
Capabilities:
Get hostname
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
mov edx, pe_nt_image_headers64
lea rcx, [rsp + 0x140]
call sub.WS2_32.dll_gethostname
cmp eax, 0xffffffff
je 0x1801b1fed
lea rcx, [rsp + 0x140]
call sub.WS2_32.dll_gethostbyname
test rax, rax
je 0x1801b1fed
mov rax, qword [rax + 0x18]
lea rdx, [rsp + 0x2c]
mov r8d, 1
mov rcx, qword [rax]
mov ebx, dword [rcx]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x2c], 0x10c
call fcn.1801b68b0
test eax, eax
jne 0x1801b1fed
mov edx, dword [rsp + 0x30]
test edx, edx
jle 0x1801b1fed
lea rcx, [rsp + 0x34]
cmp dword [rcx], ebx
je 0x1801b1f15
inc eax
add rcx, 0x18
cmp eax, edx
jl 0x1801b1f02
jmp 0x1801b1fed
movsxd rcx, eax
lea rax, [rcx + rcx*2]
mov edx, dword [rsp + rax*8 + 0x3c]
test edx, edx
je 0x1801b1fed
mov ecx, dword [rdi + 8]
mov eax, ebx
shr eax, 0x18
and ecx, edx
mov byte [rsp + 0x2c], al
not edx
mov eax, ebx
mov byte [rsp + 0x27], cl
shr eax, 0x10
mov byte [rsp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [rsp + 0x2e], al
movzx eax, byte [rdi + 0xb]
mov byte [rsp + 0x28], al
movzx eax, byte [rdi + 0xa]
mov byte [rsp + 0x29], al
movzx eax, byte [rdi + 9]
mov byte [rsp + 0x2a], al
movzx eax, byte [rdi + 8]
mov byte [rsp + 0x2b], al
mov eax, ecx
shr eax, 0x18
mov byte [rsp + 0x24], al
mov eax, ecx
shr eax, 0x10
mov byte [rsp + 0x25], al
mov eax, ecx
mov ecx, dword [rsp + 0x28]
shr eax, 8
mov byte [rsp + 0x26], al
mov eax, edx
mov r8d, dword [rsp + 0x24]
shr eax, 0x18
mov byte [rsp + 0x20], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x21], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x22], al
mov byte [rsp + 0x23], dl
mov eax, dword [rsp + 0x20]
or eax, r8d
mov byte [rsp + 0x2f], bl
cmp ecx, r8d
jbe 0x1801b1fd5
cmp ecx, eax
jae 0x1801b1fd2
mov edx, dword [rsp + 0x2c]
cmp edx, r8d
jbe 0x1801b1fd2
cmp edx, eax
jb 0x1801b1fdb
cmp ecx, r8d
je 0x1801b1fe6
cmp ecx, eax
je 0x1801b1fe6
mov dword [rdi + 0xc], 1
mov al, 1
jmp 0x1801b1fef
mov dword [rdi + 0xc], 0
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1801e68c0
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x1801b21a0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, r8
mov esi, r9d
mov r15d, edx
mov rbp, rcx
xor ebx, ebx
mov r12d, 2
xor r8d, r8d
mov ecx, r12d
lea edx, [rbx + 1]
call sub.WS2_32.dll_socket
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1801b2319
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 1
lea edx, [rbx + 6]
mov dword [rsp + 0x20], 4
lea r8d, [rbx + 1]
mov rcx, rax
call sub.WS2_32.dll_setsockopt
xorps xmm0, xmm0
lea r8d, [rbx + 0x10]
movups xmmword [rsp + 0x38], xmm0
lea rdx, [rsp + 0x38]
mov word [rsp + 0x38], r12w
mov rcx, rdi
call sub.WS2_32.dll_bind
cmp eax, 0xffffffff
je 0x1801b2305
mov ecx, 0xa0
call fcn.1801aecb0
mov rbx, rax
test rax, rax
je 0x1801b2305
xor edx, edx
mov r8d, 0xa0
mov rcx, rax
call fcn.18020bef0
mov qword [rbx + 8], rdi
mov rcx, qword [0x1802b1e78]
mov qword [rbx], rcx
mov qword [0x1802b1e78], rbx
mov dword [rbx + 0x68], r15d
movups xmm0, xmmword [rbp]
movups xmmword [rbx + 0x18], xmm0
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rbx + 0x28], xmm1
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rbx + 0x38], xmm0
movups xmm1, xmmword [rbp + 0x30]
movups xmmword [rbx + 0x48], xmm1
movups xmm0, xmmword [rbp + 0x40]
mov qword [rbx + 0x98], 0
movups xmmword [rbx + 0x58], xmm0
mov qword [rbx + 0x38], 0
test esi, esi
je 0x1801b22e3
mov ecx, esi
call fcn.1801aecb0
mov qword [rbx + 0x98], rax
test rax, rax
je 0x1801b2305
mov edx, esi
mov r8, r14
mov rcx, rax
call fcn.180114d00
mov rax, rbx
jmp 0x1801b231b
mov ecx, r12d
call fcn.1801aecb0
mov qword [rbx + 0x98], rax
mov byte [rax], 0
mov rax, qword [rbx + 0x98]
mov byte [rax + 1], 0
mov rax, rbx
jmp 0x1801b231b
mov rcx, rdi
call sub.WS2_32.dll_closesocket
test rbx, rbx
jne 0x1801b2319
xor ecx, ecx
call fcn.18010fbc0
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1801e68c0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret