joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180039efd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0xe0], rax
mov r10, rdx
mov edx, edx
mov qword [rsp + 0x30], rdx
xor edx, edx
mov qword [rsp + 0x80], r9
mov qword [rsp + 0x90], rcx
mov rax, r8
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x88], rdx
test r9, r9
je 0x18003a483
mov r8d, dword [rcx]
mov edx, dword [rcx + 0x14]
mov qword [r11 + 0x10], rbx
mov ebx, dword [rcx + 0x34]
mov qword [r11 - 8], rbp
mov ebp, dword [rcx + 0xc]
mov qword [r11 - 0x10], rsi
mov esi, dword [rcx + 8]
mov qword [r11 - 0x18], rdi
mov edi, dword [rcx + 4]
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov r13d, dword [rcx + 0x10]
mov qword [r11 - 0x30], r14
mov r14d, dword [rcx + 0x38]
mov qword [r11 - 0x38], r15
mov r11d, dword [rcx + 0x18]
mov dword [rsp + 0x64], r11d
mov r11d, dword [rcx + 0x1c]
mov dword [rsp + 0x68], r11d
mov r11d, dword [rcx + 0x20]
mov dword [rsp + 0x38], r11d
mov r11d, dword [rcx + 0x24]
mov dword [rsp + 0x3c], r11d
mov r11d, dword [rcx + 0x28]
mov dword [rsp + 0x40], r11d
mov r11d, dword [rcx + 0x2c]
mov dword [rsp + 0x44], r11d
mov r11d, dword [rcx + 0x30]
mov ecx, dword [rcx + 0x3c]
mov dword [rsp + 0x4c], ecx
mov dword [rsp + 0x50], r8d
mov dword [rsp + 0x54], edi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x5c], ebp
mov dword [rsp + 0x60], r13d
mov dword [rsp + 0x20], edx
mov dword [rsp + 0x10], r11d
mov dword [rsp + 0x14], ebx
mov dword [rsp + 0x48], r14d
cmp r9, 0x40
jae 0x18003a070
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xc8], rcx
mov qword [rsp + 0xd0], rcx
mov qword [rsp + 0xd8], rcx
test r9, r9
je 0x18003a04a
xor eax, eax
nop word [rax + rax]
movzx ecx, byte [rax + r10]
inc edx
mov byte [rsp + rax + 0xa0], cl
mov eax, edx
cmp rax, r9
jb 0x18003a030
mov rax, qword [rsp + 0x28]
mov edx, dword [rsp + 0x20]
lea r10, [rsp + 0xa0]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], r10
mov eax, dword [rsp + 0x64]
mov r14d, r8d
mov r10d, dword [rsp + 0x3c]
mov r15d, edi
mov r8d, dword [rsp + 0x44]
mov r12d, esi
mov edi, dword [rsp + 0x48]
mov r9d, r13d
mov r13d, dword [rsp + 0x38]
mov ecx, edx
mov edx, dword [rsp + 0x40]
mov esi, dword [rsp + 0x4c]
mov dword [rsp], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x18], eax
mov dword [rsp + 0x1c], 0x14
jmp 0x18003a0bf
Function at 0x18003a358
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [r13 + 4], eax
mov rax, qword [rsp + 0x28]
mov r13d, dword [rsp + 0x74]
mov dword [rax + 8], r13d
mov dword [rax + 0xc], r12d
mov dword [rax + 0x10], r15d
mov dword [rax + 0x14], r14d
mov dword [rax + 0x18], ebp
mov dword [rax + 0x1c], esi
mov dword [rax + 0x20], edi
mov dword [rax + 0x24], ebx
mov dword [rax + 0x28], r11d
mov dword [rax + 0x2c], r10d
mov dword [rax + 0x30], r9d
mov r9, qword [rsp + 0x80]
mov dword [rax + 0x34], r8d
mov dword [rax + 0x38], edx
mov dword [rax + 0x3c], ecx
cmp r9, 0x40
jbe 0x18003a3f1
mov r10, qword [rsp + 0x30]
sub r9, 0x40
mov ebx, dword [rsp + 0x14]
add rax, 0x40
mov r11d, dword [rsp + 0x10]
add r10, 0x40
mov r8d, dword [rsp + 0x50]
mov edi, dword [rsp + 0x54]
mov esi, dword [rsp + 0x58]
mov ebp, dword [rsp + 0x5c]
pop rsp
mov r13d, dword [rsp + 0x60]
mov edx, dword [rsp + 0x20]
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x80], r9
mov qword [rsp + 0x28], rax
jmp 0x1800737c3
mov r15, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xf8]
mov r13, qword [rsp + 0x100]
mov r12, qword [rsp + 0x108]
mov rdi, qword [rsp + 0x110]
mov rsi, qword [rsp + 0x118]
mov rbp, qword [rsp + 0x120]
cmp r9, 0x40
jae fcn.18003a465
test r9d, r9d
je fcn.18003a465
mov rcx, qword [rsp + 0x88]
sub rax, rcx
mov edx, r9d
mov qword [rsp + 0x28], rax
nop word [rax + rax]
movzx eax, byte [rax + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
mov rax, qword [rsp + 0x28]
sub rdx, 1
jne 0x18003a450
or byte [rax - 0x7d], cl
in al, dx
cmp qword [rsp + 0x68], 0
jne 0x1800737d7
xor eax, eax
jmp 0x1800e64bb
cmp qword [rsp + 0x50], 0
je 0x1800737e9
mov dword [rsp + 0x20], 1
jmp 0x1800737f1
mov dword [rsp + 0x20], 0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
jne 0x18007381a
call 0x1800c31ad
mov dword [rax], 0x16
call 0x1800bf604
mov eax, 0x16
jmp 0x1800e64fe
cmp qword [rsp + 0x60], 0
je 0x180073832
mov rax, qword [rsp + 0x68]
cmp qword [rsp + 0x58], rax
jae 0x1800738ce
mov r8, qword [rsp + 0x58]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call 0x1800b95e3
cmp qword [rsp + 0x60], 0
je 0x180073855
mov dword [rsp + 0x24], 1
jmp 0x18007385d
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x180073883
call 0x1800c3219
mov dword [rax], 0x16
call 0x1800bf670
mov eax, 0x16
jmp 0x1800738e4
mov rax, qword [rsp + 0x68]
cmp qword [rsp + 0x58], rax
jb 0x180073899
mov dword [rsp + 0x28], 1
jmp 0x1800738a1
mov dword [rsp + 0x28], 0
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x1800738c7
call 0x1800c325d
mov dword [rax], 0x22
call 0x1800bf6b4
mov eax, 0x22
jmp 0x1800738e4
mov eax, 0x16
jmp 0x1800738e4
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call 0x1800b9112
xor eax, eax
add rsp, 0x48
ret

Function at 0x18003ba5d
Capabilities:
Encode data using xor

Disassembly:
add byte [rcx], al
add byte [rax], al
movdqa xmm5, xmmword [rbp + 0x280]
sub r13, 1
jne 0x18003b240
Function at 0x18003bd4e
Capabilities:
Encode data using xor

Disassembly:
pxor xmm1, xmm2
movdqa xmm2, xmm1
pslld xmm1, 7
psrld xmm2, 0x19
pxor xmm2, xmm1
sub r12, 1
jne 0x18003bc80
xor ecx, ecx
paddd xmm4, xmm9
paddd xmm2, xmm10
paddd xmm0, xmm11
paddd xmm5, xmm12
mov edx, ecx
movdqu xmmword [rbp + 0x3c0], xmm4
movdqu xmmword [rbp + 0x3d0], xmm2
movdqu xmmword [rbp + 0x3e0], xmm0
movdqu xmmword [rbp + 0x3f0], xmm5
cmp r9, 0x20
jb 0x18003be2f
lea eax, [r9 - 1]
mov r11d, eax
lea rbx, [rax + r8]
add rax, r10
cmp r8, rax
ja 0x18003bdc8
cmp rbx, r10
jae 0x18003be2f
lea rax, [rbp + 0x3c0]
add rax, r11
cmp r8, rax
ja 0x18003bde3
lea rax, [rbp + 0x3c0]
cmp rbx, rax
jae 0x18003be2f
mov r11, r9
and r11, 0xffffffffffffffe0
nop word [rax + rax]
movdqu xmm1, xmmword [r10 + rcx]
lea eax, [rdx + 0x10]
add edx, 0x20
movdqu xmm0, xmmword [rbp + rcx + 0x3c0]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax + 0x3c0]
movdqu xmmword [r8 + rcx], xmm1
mov ecx, edx
movdqu xmm1, xmmword [r10 + rax]
pxor xmm1, xmm0
movdqu xmmword [r8 + rax], xmm1
cmp rcx, r11
jb 0x18003bdf0
mov ecx, edx
cmp rcx, r9
jae 0x18003be59
nop word [rax + rax]
movzx eax, byte [r10 + rcx]
inc edx
xor al, byte [rbp + rcx + 0x3c0]
mov byte [r8 + rcx], al
mov ecx, edx
cmp rcx, r9
jb 0x18003be40
mov edx, 0x40
lea rcx, [rbp + 0x3c0]
call fcn.18006bf5a
Function at 0x18003e8ed
Capabilities:
Encode data using xor

Disassembly:
lea r10, [r8 + rax]
add rax, r11
cmp r8, rax
ja 0x18003e8fe
cmp r10, r11
jae 0x18003e961
lea rax, [rsp + 0x1e0]
add rax, r9
cmp r8, rax
ja 0x18003e91b
lea rax, [rsp + 0x1e0]
cmp r10, rax
jae 0x18003e961
mov r9, r14
and r9, 0xffffffffffffffe0
movdqu xmm0, xmmword [r11 + rcx]
lea eax, [rdx + 0x10]
add edx, 0x20
movdqu xmm1, xmmword [rsp + rcx + 0x1e0]
pxor xmm1, xmm0
movdqu xmmword [r8 + rcx], xmm1
mov ecx, edx
movdqu xmm0, xmmword [r11 + rax]
movdqu xmm1, xmmword [rsp + rax + 0x1e0]
pxor xmm1, xmm0
movdqu xmmword [r8 + rax], xmm1
cmp rcx, r9
jb 0x18003e922
mov ecx, edx
cmp rcx, r14
jae 0x18003e989
nop dword [rax + rax]
movzx eax, byte [rsp + rcx + 0x1e0]
inc edx
xor al, byte [r11 + rcx]
mov byte [r8 + rcx], al
mov ecx, edx
cmp rcx, r14
jb 0x18003e970
mov edx, 0x40
lea rcx, [rsp + 0x1e0]
call fcn.18006ea8b
movaps xmm12, xmmword [rsp + 0x260]
movaps xmm11, xmmword [rsp + 0x270]
movaps xmm10, xmmword [rsp + 0x280]
movaps xmm9, xmmword [rsp + 0x290]
movaps xmm8, xmmword [rsp + 0x2a0]
movaps xmm7, xmmword [rsp + 0x2b0]
movaps xmm6, xmmword [rsp + 0x2c0]
mov rsi, qword [rsp + 0x2e0]
movaps xmm13, xmmword [rsp + 0x250]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.180082cb9
add rsp, 0x2e8
pop r14
pop rbx
ret

Function at 0x18003ea52
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
jns 0x18003ea1b
or al, 0x74
and byte gs:[rbx - 0x3d], ch
int3
Function at 0x1800404c9
Capabilities:
Encode data using xor

Disassembly:
psrld xmm1, 0x19
pslld xmm0, 7
pxor xmm3, xmm0
pxor xmm3, xmm1
movdqa xmm1, xmm3
pshufd xmm6, xmm3, 0x93
paddd xmm1, xmm7
movdqa xmm0, xmm1
psrld xmm1, 0x17
pslld xmm0, 9
pxor xmm5, xmm0
pxor xmm5, xmm1
paddd xmm3, xmm5
movdqa xmm2, xmm3
psrld xmm3, 0x13
pslld xmm2, 0xd
pxor xmm2, xmm8
pxor xmm2, xmm3
movdqa xmm0, xmm5
movdqa xmm1, xmm6
paddd xmm0, xmm2
movdqa xmm4, xmm0
psrld xmm0, 0xe
pslld xmm4, 0x12
pxor xmm4, xmm7
pxor xmm4, xmm0
pshufd xmm0, xmm2, 0x39
paddd xmm1, xmm4
movdqa xmm3, xmm1
psrld xmm1, 0x19
pslld xmm3, 7
pxor xmm3, xmm0
pshufd xmm0, xmm5, 0x4e
pxor xmm3, xmm1
pshufd xmm8, xmm3, 0x93
movdqa xmm1, xmm3
paddd xmm1, xmm4
movdqa xmm2, xmm1
psrld xmm1, 0x17
pslld xmm2, 9
pxor xmm2, xmm0
pxor xmm2, xmm1
pshufd xmm9, xmm2, 0x4e
paddd xmm3, xmm2
movdqa xmm0, xmm3
psrld xmm3, 0x13
pslld xmm0, 0xd
pxor xmm0, xmm6
pxor xmm0, xmm3
pshufd xmm5, xmm0, 0x39
paddd xmm2, xmm0
movdqa xmm3, xmm2
psrld xmm2, 0xe
pslld xmm3, 0x12
pxor xmm3, xmm4
pxor xmm3, xmm2
sub rsi, 1
jne 0x1800403b2
paddd xmm10, xmm3
paddd xmm13, xmm5
pshufd xmm0, xmm10, 0x39
paddd xmm11, xmm8
pshufd xmm1, xmm11, 0x39
paddd xmm12, xmm9
pshufd xmm4, xmm0, 0x39
xor ecx, ecx
pshufd xmm5, xmm1, 0x39
pshufd xmm2, xmm12, 0x39
movd edx, xmm2
pshufd xmm3, xmm13, 0x39
movd dword [rbp + 0x454], xmm0
movd dword [rbp + 0x444], xmm1
pshufd xmm0, xmm4, 0x39
pshufd xmm1, xmm5, 0x39
movd r9d, xmm3
pshufd xmm2, xmm2, 0x39
pshufd xmm3, xmm3, 0x39
movd dword [rbp + 0x47c], xmm0
movd dword [rbp + 0x46c], xmm1
pshufd xmm0, xmm2, 0x39
pshufd xmm1, xmm3, 0x39
pshufw mm1, mm3, 0x39
mov dword [rbp + 0x474], edx
mov edx, ecx
movd dword [rbp + 0x45c], xmm0
movd dword [rbp + 0x44c], xmm1
movd dword [rbp + 0x440], xmm10
movd dword [rbp + 0x470], xmm11
movd dword [rbp + 0x460], xmm12
movd dword [rbp + 0x450], xmm13
mov dword [rbp + 0x464], r9d
movd dword [rbp + 0x468], xmm4
movd dword [rbp + 0x458], xmm5
movd dword [rbp + 0x448], xmm2
movd dword [rbp + 0x478], xmm3
js 0x1800406b0
add byte [rax], al
cmp r15, 0x20
jb 0x180040731
lea eax, [r15 - 1]
mov r9d, eax
lea r10, [rax + r8]
add rax, r11
cmp r8, rax
ja 0x1800406d0
cmp r10, r11
jae 0x180040731
lea rax, [rbp + 0x440]
add rax, r9
cmp r8, rax
ja 0x1800406eb
lea rax, [rbp + 0x440]
cmp r10, rax
jae 0x180040731
mov r9, r15
and r9, 0xffffffffffffffe0
movdqu xmm1, xmmword [rcx + r11]
lea eax, [rdx + 0x10]
add edx, 0x20
movdqu xmm0, xmmword [rbp + rcx + 0x440]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax + 0x440]
movdqu xmmword [rcx + r8], xmm1
mov ecx, edx
movdqu xmm1, xmmword [rax + r11]
pxor xmm1, xmm0
movdqu xmmword [rax + r8], xmm1
cmp rcx, r9
jb 0x1800406f2
mov ecx, edx
cmp rcx, r15
jae 0x180040759
nop dword [rax + rax]
movzx eax, byte [rcx + r11]
inc edx
xor al, byte [rbp + rcx + 0x440]
mov byte [rcx + r8], al
mov ecx, edx
cmp rcx, r15
jb 0x180040740
mov edx, 0x40
lea rcx, [rbp + 0x440]
call fcn.18007085a
Function at 0x1800446a2
Capabilities:
Link many functions at runtime

Disassembly:
loop 0x1800446fe
add al, 0
xor rax, qword [0x1800cf1b8]
lea rdx, str.FlsSetValue
mov rcx, rbx
mov qword [0x1800d2050], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1800cf1b8]
lea rdx, str.InitializeCriticalSectionEx
mov rcx, rbx
mov qword [0x1800d2058], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1800cf1b8]
lea rdx, str.InitOnceExecuteOnce
mov rcx, rbx
mov qword [0x1800d2060], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add al, 0
xor rax, qword [0x1800cf1b8]
lea rdx, str.CreateEventExW
mov rcx, rbx
mov qword [0x1800d2068], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1800cf1b8]
lea rdx, str.CreateSemaphoreW
mov rcx, rbx
mov qword [0x1800d2070], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1800cf1b8]
lea rdx, str.CreateSemaphoreExW
mov rcx, rbx
mov qword [0x1800d2078], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1800cf1b8]
lea rdx, str.CreateThreadpoolTimer
mov rcx, rbx
mov qword [0x1800d2080], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1800cf1b8]
lea rdx, str.SetThreadpoolTimer
mov rcx, rbx
mov qword [0x1800d2088], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1800cf1b8]
lea rdx, str.WaitForThreadpoolTimerCallbacks
mov rcx, rbx
mov qword [0x1800d2090], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1800cf1b8]
lea rdx, str.CloseThreadpoolTimer
mov rcx, rbx
mov qword [0x1800d2098], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1800cf1b8]
lea rdx, str.CreateThreadpoolWait
mov rcx, rbx
invalid
invalid

Function at 0x18004494f
Capabilities:
Link many functions at runtime

Disassembly:
xlatb
or byte [rax], al
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1800cf1b8]
lea rdx, str.WakeConditionVariable
mov rcx, rbx
mov qword [0x1800d2108], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1800cf1b8]
lea rdx, str.WakeAllConditionVariable
mov rcx, rbx
mov qword [0x1800d2110], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1800cf1b8]
lea rdx, str.SleepConditionVariableCS
mov rcx, rbx
mov qword [0x1800d2118], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1800cf1b8]
lea rdx, str.InitializeSRWLock
mov rcx, rbx
mov qword [0x1800d2120], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1800cf1b8]
lea rdx, str.AcquireSRWLockExclusive
mov rcx, rbx
mov qword [0x1800d2128], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1800cf1b8]
lea rdx, str.TryAcquireSRWLockExclusive
mov rcx, rbx
mov qword [0x1800d2130], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1800cf1b8]
lea rdx, str.ReleaseSRWLockExclusive
mov qword [0x1800d2138], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x1800cf1b8]
lea rdx, str.SleepConditionVariableSRW
mov rcx, rbx
mov qword [0x1800d2140], rax
Function at 0x1800456c5
Capabilities:
Query environment variable

Disassembly:
and al, 0x38
mov qword [0x1800d2508], rax
lea rax, [rsp + 0x38]
add rax, 8
mov qword [0x1800d24a8], rax
mov rax, qword [0x1800d2508]
invalid

Function at 0x18005dac7
Capabilities:
Write file on windows

Disassembly:
lea rdi, [rsp + 0x40]
cmp rsi, rbp
jae 0x18005dad5
mov al, byte [rsi]
inc rsi
cmp al, 0xa
jne 0x18005dac3
inc dword [rbx + 8]
mov byte [rdi], 0xd
inc rdi
mov byte [rdi], al
inc rdi
invalid
lea rax, [rsp + 0x143f]
cmp rdi, rax
jb 0x18005daac
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub edi, eax
lea r9, [rsp + 0x30]
mov r8d, edi
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18005db0e
mov eax, dword [rsp + 0x30]
add dword [rbx + 4], eax
cmp eax, edi
jb 0x18005db16
cmp rsi, rbp
jb 0x18005daa7
jmp 0x18005db16
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
mov rax, rbx
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call 0x1800a1de9
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x18005decd
Capabilities:
Write file on windows

Disassembly:
push rsi
push r15
mov rbp, rsp
sub rsp, 0x60
xor edi, edi
mov r15d, r8d
movsxd r12, ecx
mov rsi, rdx
test r8d, r8d
jne 0x18005deee
test rdx, rdx
jne 0x18005df12
call 0x1800ad880
mov dword [rax], edi
call 0x1800ad8a7
mov dword [rax], 0x16
call 0x1800a9cfe
or eax, 0xffffffff
jmp 0x1800bb49b
mov r14, r12
lea rax, [0x1800d2e90]
and r14d, 0x3f
mov r13, r12
sar r13, 6
shl r14, 6
mov qword [rbp - 0x10], r13
mov rcx, qword [rax + r13*8]
mov bl, byte [rcx + r14 + 0x39]
lea eax, [rbx - 1]
cmp al, 1
ja 0x18005df48
mov eax, r15d
not eax
test al, 1
je 0x18005def3
test byte [rcx + r14 + 0x38], 0x20
je 0x18005df5e
xor edx, edx
mov ecx, r12d
lea r8d, [rdx + 2]
call 0x1800bb82a
mov ecx, r12d
mov qword [rbp - 0x20], rdi
call 0x1800bf0ea
test eax, eax
je 0x18005e073
lea rax, [0x1800d2e90]
mov rax, qword [rax + r13*8]
test byte [rax + r14 + 0x38], 0x80
je 0x18005e073
call 0x1800b561a
mov rcx, qword [rax + 0x90]
cmp qword [rcx + 0x138], rdi
jne 0x18005dfb4
lea rax, [0x1800d2e90]
mov rax, qword [rax + r13*8]
cmp byte [rax + r14 + 0x39], dil
je 0x18005e073
lea rax, [0x1800d2e90]
mov rcx, qword [rax + r13*8]
lea rdx, [rbp - 8]
mov rcx, qword [rcx + r14 + 0x28]
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x18005e073
test bl, bl
je 0x18005e055
dec bl
cmp bl, 1
ja 0x18005e110
and dword [rbp - 0x30], edi
lea r12, [rsi + r15]
xor ebx, ebx
mov r15, rsi
mov dword [rbp - 0x2c], ebx
cmp rsi, r12
jae 0x18005e106
movzx r13d, word [r15]
movzx ecx, r13w
call 0x1800c1f02
cmp ax, r13w
jne 0x18005e043
add ebx, 2
mov dword [rbp - 0x2c], ebx
cmp r13w, 0xa
jne 0x18005e038
mov r13d, 0xd
mov ecx, r13d
call 0x1800c1f23
cmp ax, r13w
jne 0x18005e043
inc ebx
mov dword [rbp - 0x2c], ebx
inc edi
add r15, 2
cmp r15, r12
jae 0x18005e04c
jmp 0x18005dffd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x30], eax
mov r13, qword [rbp - 0x10]
jmp 0x1800bb55b
mov r9d, r15d
lea rcx, [rbp - 0x30]
mov r8, rsi
mov edx, r12d
call 0x1800bac9b
lea rax, [0x1800d2e90]
mov rcx, qword [rax + r13*8]
test byte [rcx + r14 + 0x38], 0x80

Function at 0x18006a1df
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str.HTTP_1.0
lea r8, [0x1800a15d4]
jae 0x18006a201
add byte [rax - 0x75], cl
ror byte [rax - 0x75], 1
test byte [rax + rax], ah
add dword [rax], eax
add byte [rax - 0x75], cl
mov byte [rax + 4], bh
add byte [rax], al
call qword [0x18008a5b0]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x88]
call fcn.180070119
cmp qword [rsp + 0x48], 0
je 0x18006a29d
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [0x18008a5c0]
mov dword [rsp + 0xc8], 0
mov dword [rsp + 0xcc], 4
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xcc]
lea r8, [rsp + 0xc8]
mov edx, 0x20000013
mov rcx, qword [rsp + 0x48]
call qword [0x18008a588]
cmp dword [rsp + 0xc8], 0xc8
jne 0x18006a29d
mov byte [rsp + 0x40], 1
mov rcx, qword [rsp + 0x48]
call qword [0x18008a580]
mov rcx, qword [rsp + 0x100]
call 0x1800d5815
movzx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call 0x1800ae58a
add rsp, 0xf8
ret
Function at 0x18006a740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [rax], al
push rsi
mov eax, 1
imul rax, rax, 0x29
mov byte [rsp + rax + 0x170], 0x5c
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x170], 0x72
mov eax, 1
imul rax, rax, 0x2e
mov byte [rsp + rax + 0x170], 0x72
mov eax, 1
imul rax, rax, 0x18
mov byte [rsp + rax + 0x170], 0x77
add byte [rdi - 0x48], dh
add dword [rax], eax
add byte [rax], al
add byte [rax], al
ja 0x18006a6eb
add dword [rax], eax
add byte [rax], al
imul rax, rax, 0x39
mov byte [rsp + rax + 0x170], 0x67
add byte [rax], al
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x170], 0x53
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x170], 0x66
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x170], 0x74
mov eax, 1
add byte [rax], al
add byte [rax], al
je 0x18006a72f
add dword [rax], eax
add byte [rax], al
je 0x18006a773
add dword [rax], eax
add byte [rax], al
jb 0x18006a7b7
add dword [rax], eax
add byte [rax], al

Function at 0x18006a7c7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add dword [rax], eax
add byte [rbx - 0x48], dl
add dword [rax], eax
add byte [rax], al

Function at 0x18006a81b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [rax], al
imul rax, rax, 0x1b
mov byte [rsp + rax + 0x170], 0x43
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x170], 0x77
mov eax, 1
imul rax, rax, 0x23
mov byte [rsp + rax + 0x170], 0x65
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x170], 0x74
mov eax, 1
imul rax, rax, 0x33
mov byte [rsp + rax + 0x170], 0x53
add dword [rax], eax
add byte [rbx - 0x48], dl
add dword [rax], eax
add byte [rax], al
imul rax, rax, 0x36
mov byte [rsp + rax + 0x170], 0x74
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x170], 0x61
mov eax, 1
imul rax, rax, 0x1e
mov byte [rsp + rax + 0x170], 0x72
jb 0x18006a7b7
add dword [rax], eax
add byte [rax], al
imul rax, rax, 0x2c
mov byte [rsp + rax + 0x170], 0x74
mov eax, 1
imul rax, rax, 0x19
mov byte [rsp + rax + 0x170], 0x73
jo 0x18006a81e
add byte [rax], al
jae 0x18006a7d9
add dword [rax], eax
add byte [rax], al
imul rax, rax, 8
mov byte [rsp + rax + 0x170], 0x5c
mov eax, 1
imul rax, rax, 0x31
mov byte [rsp + rax + 0x170], 0x74
mov eax, 1
imul rax, rax, 0x1f
mov byte [rsp + rax + 0x170], 0x65
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x170], 0x5c
mov eax, 1
imul rax, rax, 0x13
mov byte [rsp + rax + 0x170], 0x57
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x170], 0x73
mov eax, 1
imul rax, rax, 0x3a
mov byte [rsp + rax + 0x170], 0x73
mov eax, 1
imul rax, rax, 0x24
mov byte [rsp + rax + 0x170], 0x72
mov eax, 1
imul rax, rax, 0x26
mov byte [rsp + rax + 0x170], 0x69
mov eax, 1
imul rax, rax, 0x2a
mov byte [rsp + rax + 0x170], 0x49
mov eax, 1
imul rax, rax, 0x2d
mov byte [rsp + rax + 0x170], 0x65
add dword [rax], eax
add byte [rbp - 0x48], ah
add dword [rax], eax
add byte [rax], al
imul rax, rax, 0x34
mov byte [rsp + rax + 0x170], 0x65
add dword [rax], eax
add byte [rbp - 0x48], ah
add dword [rax], eax
add byte [rax], al
Function at 0x18006a9f7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jo 0x18006a9fa
add byte [rax], al
movabs r8, 0xac06b4800000001
add byte [rbp - 0x48], cl
add dword [rax], eax
add byte [rax], al

Function at 0x18006b8f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [rsi - 0x48], ah
add dword [rax], eax
add byte [rax], al
imul rax, rax, 0x1d
mov byte [rsp + rax + 0x1b0], 0x77
add al, 0xb0
add dword [rax], eax
add byte [rdi - 0x48], dh
add dword [rax], eax
add byte [rax], al
imul rax, rax, 0x1f
mov byte [rsp + rax + 0x1b0], 0x2d
mov eax, 1
imul rax, rax, 0x29
mov byte [rsp + rax + 0x1b0], 0x6e
mov eax, 1
imul rax, rax, 0x2d
mov byte [rsp + rax + 0x1b0], 0x65
mov eax, 1
add byte [rax], al
add byte [rax + 0x6b], cl
ror byte [rbx], 0xc6
test byte [rax + rsi*4], al
add dword [rax], eax
add byte [rbp - 0x48], ah
add dword [rax], eax
add byte [rax], al
imul rax, rax, 0x11
mov byte [rsp + rax + 0x1b0], 0x6c
add byte [rax + rdi*4 + 1], ch
add byte [rax], al
add byte [rax + 0x6b], cl
rol byte [rbx], 0xc6
test byte [rax + rsi*4], al
add dword [rax], eax
add byte [rax + rdi*4 + 1], dh
je 0x18006b922
add dword [rax], eax
add byte [rax], al
invalid
imul rax, rax, 0x2b
mov byte [rsp + rax + 0x1b0], 0x6f
mov eax, 1

Function at 0x18006b938
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [rsi - 0x48], ah
add dword [rax], eax
add byte [rax], al
imul rax, rax, 0x1d
mov byte [rsp + rax + 0x1b0], 0x77
add al, 0xb0
add dword [rax], eax
add byte [rdi - 0x48], dh
add dword [rax], eax
add byte [rax], al
imul rax, rax, 0x1f
mov byte [rsp + rax + 0x1b0], 0x2d
mov eax, 1
imul rax, rax, 0x29
mov byte [rsp + rax + 0x1b0], 0x6e
mov eax, 1
imul rax, rax, 0x2d
mov byte [rsp + rax + 0x1b0], 0x65
mov eax, 1
add byte [rax], al
add byte [rax + 0x6b], cl
ror byte [rbx], 0xc6
test byte [rax + rsi*4], al
add dword [rax], eax
add byte [rbp - 0x48], ah
add dword [rax], eax
add byte [rax], al
imul rax, rax, 0x11
mov byte [rsp + rax + 0x1b0], 0x6c
add byte [rax + rdi*4 + 1], ch
add byte [rax], al
add byte [rax + 0x6b], cl
rol byte [rbx], 0xc6
test byte [rax + rsi*4], al
add dword [rax], eax
add byte [rax + rdi*4 + 1], dh
je 0x18006b922
add dword [rax], eax
add byte [rax], al
invalid
imul rax, rax, 0x2b
mov byte [rsp + rax + 0x1b0], 0x6f
mov eax, 1