joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002d60
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x180002d24
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180002d46
lea rdx, str.RegDeleteKeyTransactedA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180002d46
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je 0x180002d46
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x180002d8e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180002cb0
cmp byte [0x18006a998], 0
jne 0x180002dd9
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180002dc9
lea rdx, str.RegDeleteKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x18006a998], 1
mov qword [0x18006a990], rax
jmp 0x180002de0
mov rax, qword [0x18006a990]
mov byte [0x18006a998], 1
jmp 0x180002de0
mov rax, qword [0x18006a990]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x180002dff
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
Function at 0x180002e10
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x180066180]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rsi, rcx
xor ecx, ecx
xor r8d, r8d
mov edi, dword [rsi + 8]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsi]
or edi, 0x2001f
mov r9d, edi
mov qword [rsp + 0x70], rdx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test eax, eax
jne 0x180002f67
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180002e93
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
and edi, 0x300
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], edi
test ebx, ebx
jne 0x180002f67
xor edi, edi
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea r8, [rbp - 0x80]
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], pe_nt_image_headers64
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x180002f3f
nop word [rax + rax]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x48]
call fcn.180002e10
mov ebx, eax
test eax, eax
jne 0x180002f67
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea r8, [rbp - 0x80]
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], pe_nt_image_headers64
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x180002ef0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180002f54
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rdi
mov rdx, qword [rsp + 0x70]
mov rcx, rsi
mov dword [rsp + 0x50], edi
call fcn.180002d60
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180002f77
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1800289d0
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x190
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800030a0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xorps xmm0, xmm0
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
cvtsi2sd xmm0, rdx
test rdx, rdx
jns 0x1800030d5
addsd xmm0, qword [0x1800577c0]
divsd xmm0, qword [0x1800577a0]
call fcn.18003d840
movsd xmm1, qword [0x1800577b8]
xor eax, eax
mulsd xmm0, qword [0x1800577a8]
comisd xmm0, xmm1
jb 0x180003111
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x180003111
movabs rcx, 0x8000000000000000
mov rax, rcx
cvttsd2si r11, xmm0
add r11, rax
mov eax, dword [0x180069c80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 0xb
jne 0x180003148
dec dword [0x180069ef0]
test rdi, rdi
je 0x180003260
test rsi, rsi
je 0x180003260
cmp r11, rbp
ja 0x180003260
xor r8d, r8d
lea rbp, [0x180000000]
mov edx, r8d
test rbx, rbx
je 0x180003216
mov r10, rsi
cmp rdx, rbx
jae 0x18000318a
movzx eax, byte [rdx + rdi]
inc rdx
jmp 0x18000318d
mov eax, r8d
cmp rdx, rbx
jae 0x18000319c
movzx r9d, byte [rdx + rdi]
inc rdx
jmp 0x18000319f
mov r9d, r8d
cmp rdx, rbx
jae 0x1800031ad
movzx ecx, byte [rdx + rdi]
inc rdx
jmp 0x1800031b0
mov ecx, r8d
shl eax, 8
add r10, 4
add eax, r9d
shl eax, 8
add eax, ecx
mov ecx, eax
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbp + 0x67f60]
mov byte [r10 - 4], al
mov eax, ecx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbp + 0x67f60]
mov byte [r10 - 3], al
mov eax, ecx
and ecx, 0x3f
shr rax, 6
and eax, 0x3f
movzx eax, byte [rax + rbp + 0x67f60]
mov byte [r10 - 2], al
movzx eax, byte [rcx + rbp + 0x67f60]
mov byte [r10 - 1], al
cmp rdx, rbx
jb 0x180003181
movabs rax, 0xaaaaaaaaaaaaaaab
mul rbx
shr rdx, 1
lea rax, [rdx + rdx*2]
sub rbx, rax
cmp dword [rbp + rbx*4 + 0x55e68], r8d
jle 0x180003254
lea rax, [rsi - 1]
add rax, r11
nop
mov byte [rax], 0x3d
inc r8d
lea rax, [rax - 1]
cmp r8d, dword [rbp + rbx*4 + 0x55e68]
jl 0x180003240
mov rax, qword [rsp + 0x50]
mov qword [rax], r11
mov al, 1
jmp 0x180003262
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180008f70
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xd0], rbx
mov rdi, rdx
mov rsi, rcx
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x30]
call fcn.18002c930
mov dword [rsp + 0x30], 0x70
lea rax, str.open
mov qword [rsp + 0x40], rax
mov rax, qword [rsi]
mov ebx, 1
mov ecx, ebx
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
or eax, ecx
jge 0x180008fdd
xor edx, edx
mov rcx, rsi
call fcn.180002c50
mov rax, qword [rsi]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x60], 5
call fcn.180008370
mov dword [rsp + 0x34], 0x440
mov rax, qword [rdi]
sub ebx, dword [rax - 8]
mov eax, dword [rax - 0xc]
or eax, ebx
jge 0x180009011
xor edx, edx
mov rcx, rdi
call fcn.180002c50
mov rax, qword [rdi]
mov qword [rsp + 0x50], rax
mov ecx, dword [0x180069c80]
lea eax, [rcx + 1]
imul eax, eax
imul eax, ecx
imul eax, ecx
and eax, 0x80000003
jge 0x180009039
dec eax
or eax, 0xfffffffc
inc eax
or rbx, 0xffffffffffffffff
test eax, eax
je 0x180009079
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub ecx, edx
add ecx, 0x63
movsxd rcx, ecx
mov eax, 4
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.1800289f0
mov rcx, rax
call fcn.180028a24
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp eax, 1
sete bpl
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x1800090a7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1800090bf
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rVariantCopy + 8]
movzx eax, bpl
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800090e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rcx, qword [rcx]
mov rdi, r8
mov rsi, rdx
mov qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18000916e
mov eax, dword [0x180069c80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 2
jne 0x18000915c
inc dword [0x18006a1c0]
xor al, al
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x50]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov al, 1
add rsp, 0x40
pop rdi
ret
Function at 0x1800091e0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rsi, r9
mov rdi, rdx
mov qword [rax - 0x18], rbp
mov dword [rax - 0x20], ebp
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rax - 0x28], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800092b2
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rbx
cmp eax, 0x4c85d8
ja 0x1800092ac
lea r9, [rsp + 0x60]
mov r8d, eax
mov rdx, rdi
mov dword [rsp + 0x60], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [0x180069c80]
lea edx, [r8 + 2]
lea ecx, [r8 + 1]
imul edx, ecx
imul edx, r8d
and edx, 0x8000000f
jge 0x18000928b
dec edx
or edx, 0xfffffff0
inc edx
cmp edx, 7
jne 0x18000929a
dec r8d
mov dword [0x180069c80], r8d
test edi, edi
je 0x1800092b2
mov eax, dword [rsp + 0x60]
mov qword [rsi], rax
mov eax, 1
jmp 0x1800092b4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x180009d50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x180066180]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov qword [rbp - 0x40], rcx
mov dword [rbp - 0x50], 0
mov dword [rbp - 0x38], 0x52435f5f
mov dword [rbp - 0x34], 0x4146405f
mov dword [rbp - 0x30], 0x44454c49
mov dword [rbp - 0x2c], 0x574f445f
mov dword [rbp - 0x28], 0x414f4c4e
mov dword [rbp - 0x24], 0x45525f44
mov dword [rbp - 0x20], 0x5f404441
mov dword [rbp - 0x1c], 0x5f5f5243
mov byte [rbp - 0x18], 0
lea rcx, [0x180066048]
mov rax, qword [0x180066048]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea rcx, [rbp - 0x38]
lea rax, [rbp - 0x38]
test rax, 0xffffffffffff0000
jne 0x180009e0a
movzx edi, cx
mov ecx, edi
call fcn.180002840
test rax, rax
je 0x180009e2b
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.1800023e0
jmp 0x180009e2b
lea rcx, [rbp - 0x38]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x180009e12
mov r8d, eax
lea rdx, [rbp - 0x38]
mov rcx, rbx
call fcn.180002020
nop
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800289d0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18000ad20
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x170
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x180066180]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbp, rcx
mov qword [rsp + 0x48], rcx
xor r14d, r14d
mov dword [rsp + 0x38], r14d
lea rcx, [0x180066048]
mov rax, qword [0x180066048]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp], rax
mov r15d, 1
mov dword [rsp + 0x38], r15d
mov byte [rsp + 0x50], r14b
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x51]
call fcn.18002c930
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r14 + 5]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x18000af34
lea rcx, [0x180066048]
mov rax, qword [0x180066048]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x50]
lea rax, [rsp + 0x50]
or rsi, 0xffffffffffffffff
test rax, 0xffffffffffff0000
jne 0x18000ae21
movzx edi, cx
mov ecx, edi
call fcn.180002840
test rax, rax
je 0x18000af03
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1800023e0
mov rbx, qword [rsp + 0x30]
jmp 0x18000af03
lea rax, [rsp + 0x50]
mov rdi, rsi
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x18000ae30
test edi, edi
jne 0x18000ae95
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x18000af03
cmp dword [rdx + 0x10], 0
jge 0x18000ae71
cmp dword [rbx - 0xc], 0
jge 0x18000ae65
mov ecx, 0x80070057
call fcn.180002bd0
int3
mov dword [rbx - 0x10], r14d
mov byte [rbx], 0
jmp 0x18000af03
lock add dword [rdx + 0x10], 0xffffffff
jg 0x18000ae81
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
jmp 0x18000af03
mov r12d, dword [rbx - 0x10]
lea r14, [rsp + 0x50]
sub r14, rbx
test edi, edi
jns 0x18000aeb0
mov ecx, 0x80070057
call fcn.180002bd0
int3
sub r15d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, r15d
jge 0x18000aecf
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.180002c50
mov rbx, qword [rsp + 0x30]
movsxd r15, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
mov r9, r15
cmp r14, r12
ja 0x18000aeec
lea r8, [r14 + rbx]
call fcn.180029ae8
jmp 0x18000aef6
lea r8, [rsp + 0x50]
call fcn.180028f24
cmp edi, dword [rbx - 0xc]
jg 0x18000af29
mov dword [rbx - 0x10], edi
mov byte [r15 + rbx], 0
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
mov rcx, rbp
call fcn.1800022e0
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x18000af49
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x18000af49
mov ecx, 0x80070057
call fcn.180002bd0
nop
mov r8d, 3
lea rdx, [0x1800563ac]
mov rcx, rbp
call fcn.1800022e0
mov rax, rbp
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1800289d0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x18000af80
Capabilities:
Query environment variable

Disassembly:
push rdi
sub rsp, 0x150
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x168], rbx
mov rax, qword [0x180066180]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x20], 0
mov byte [rsp + 0x40], 0
xor edx, edx
mov r8d, 0xf9
lea rcx, [rsp + 0x41]
call fcn.18002c930
mov r8d, 0xfa
lea rdx, [rsp + 0x40]
lea rcx, str._userprofile_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea rcx, [0x180066048]
mov rax, qword [0x180066048]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea rcx, [rsp + 0x40]
lea rax, [rsp + 0x40]
test rax, 0xffffffffffff0000
jne 0x18000b034
movzx edi, cx
mov ecx, edi
call fcn.180002840
test rax, rax
je 0x18000b05a
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.1800023e0
jmp 0x18000b05a
lea rcx, [rsp + 0x40]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x18000b040
mov r8d, eax
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180002020
nop
mov dword [rsp + 0x20], 1
mov rcx, qword [rbx]
cmp dword [rcx - 0x10], 0
mov rcx, rbx
je 0x18000b07d
mov r8d, 0x11
lea rdx, str.AppDataLocalLow
jmp 0x18000b08a
mov r8d, 3
lea rdx, [0x1800563ac]
call fcn.1800022e0
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1800289d0
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x18000b3d0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x50
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rdi, rdx
mov qword [rax - 0x28], 0
mov dword [rax - 0x30], 0x80
mov dword [rax - 0x38], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x18000b444
mov rdx, qword [rdi]
sub rdx, 0x18
or eax, eax
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x18000b43d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor al, al
jmp 0x18000b4dc
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x60], 0
mov rax, qword [rdi]
mov ebx, dword [rax - 0x10]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
or eax, ecx
jge 0x18000b47c
xor edx, edx
mov rcx, rdi
call fcn.180002c50
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov r8d, ebx
mov rdx, qword [rdi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 1
sete bl
mov rdx, qword [rdi]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x18000b4d9
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rVariantCopy + 8]
movzx eax, bl
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x18000b4f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor r13d, r13d
mov r14, r9
mov r15, r8
mov r12, rdx
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x18000b546
xor eax, eax
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r9d, dword [0x180069c80]
mov ebp, eax
lea r8d, [r9 + 1]
mov eax, 0x2aaaaaab
imul r8d, r9d
imul r8d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
add ecx, ecx
sub r8d, ecx
cmp r8d, 3
jne 0x18000b5de
lea ecx, [r8 + 0x25]
mov qword [rsp + 0x90], rdi
call fcn.1800289f0
mov rbx, r13
mov rdi, rax
call fcn.1800289f8
inc rbx
add eax, dword [0x180069c80]
mov dword [rdi + rbx*4 - 4], eax
cmp rbx, 0xa
jl 0x18000b5a6
mov ecx, dword [rdi + 0x24]
mov dword [0x180069c80], ecx
mov rcx, rdi
call fcn.180028a24
mov r9d, dword [0x180069c80]
mov rdi, qword [rsp + 0x90]
cmp ebp, 0xffffffff
je 0x18000b672
cmp rbp, r15
ja 0x18000b672
lea ecx, [r9 + 1]
mov eax, 0x38e38e39
mov dword [rsp + 0x40], r13d
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 5
jne 0x18000b63c
mov ecx, 4
call fcn.180029700
mov rbx, rax
call fcn.1800289f8
mov rcx, rbx
mov dword [rbx], eax
mov dword [0x180069c80], eax
call fcn.1800289b0
lea r9, [rsp + 0x40]
mov r8d, ebp
mov rdx, r12
mov rcx, rsi
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x18000b67b
mov eax, dword [rsp + 0x40]
mov qword [r14], rax
mov eax, 1
jmp 0x18000b67d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x18000cdd0
Capabilities:
Parse url

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x90
mov rbp, rdx
xor edx, edx
mov r15, r8
mov qword [rsp + 0xb8], rsi
mov rsi, rcx
lea r8d, [rdx + 0x60]
lea rcx, [rsp + 0x28]
mov r14, r9
call fcn.18002c930
mov r11d, dword [0x180069c80]
lea eax, [r11 + 1]
lea r10d, [r11 + 2]
imul r10d, eax
mov eax, 0x66666667
imul r10d, r11d
imul r10d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r10d, eax
cmp r10d, 0x11
jne 0x18000ce4c
mov eax, 1
test r11d, r11d
cmove r11d, eax
mov dword [0x180069c80], r11d
mov ecx, 0x800
mov qword [rsp + 0xb0], rbx
mov dword [rsp + 0x20], 0x68
call fcn.1800289f0
mov ecx, 0x800
mov dword [rsp + 0x40], 0x800
mov qword [rsp + 0x38], rax
call fcn.1800289f0
mov ecx, dword [0x180069c80]
mov qword [rsp + 0x68], rax
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x78787879
imul r8d, ecx
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub r8d, edx
cmp r8d, 0xf
jne 0x18000cf01
lea ecx, [r8 + 0x19]
mov qword [rsp + 0xc0], rdi
call fcn.1800289f0
xor ebx, ebx
mov rdi, rax
nop dword [rax + rax]
call fcn.1800289f8
inc rbx
add eax, dword [0x180069c80]
mov dword [rdi + rbx*4 - 4], eax
cmp rbx, 0xa
jl 0x18000ced0
mov ecx, dword [rdi + 0x24]
mov dword [0x180069c80], ecx
mov rcx, rdi
call fcn.180028a24
mov rdi, qword [rsp + 0xc0]
mov rcx, qword [rsi]
mov dword [rsp + 0x70], 0x800
lea r9, [rsp + 0x20]
mov edx, dword [rcx - 0x10]
xor r8d, r8d
call qword [sym.imp.WININET.dll_InternetCrackUrlA]
mov rsi, qword [rsp + 0xb8]
test eax, eax
jne 0x18000cf4a
mov rcx, qword [rsp + 0x38]
call fcn.180028a24
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x38], 0
call fcn.180028a24
xor al, al
jmp 0x18000cfbd
mov rdx, qword [rsp + 0x38]
or rbx, 0xffffffffffffffff
test rdx, rdx
jne 0x18000cf5c
xor eax, eax
jmp 0x18000cf69
mov rax, rbx
nop
inc rax
cmp byte [rdx + rax], 0
jne 0x18000cf60
mov r8d, eax
mov rcx, rbp
call fcn.180002020
mov rdx, qword [rsp + 0x68]
test rdx, rdx
jne 0x18000cf82
xor ebx, ebx
jmp 0x18000cf8b
inc rbx
cmp byte [rdx + rbx], 0
jne 0x18000cf82
mov r8d, ebx
mov rcx, r15
call fcn.180002020
movzx eax, word [rsp + 0x44]
mov rcx, qword [rsp + 0x38]
mov dword [r14], eax
call fcn.180028a24
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x38], 0
call fcn.180028a24
mov al, 1
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop r15
pop r14
pop rbp
ret