joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d2f7c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x140136ab0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x1400d2fd3
cmp word [rdx], r13w
jne 0x1400d2fd3
or byte [rax + rdi*8 + 0x38], cl
jmp 0x1400d2fd8
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x1400d30fd
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x1400d311e
lea r9, [rdx + 2]
cmp cx, r11w
je 0x1400d3011
mov rdx, r9
mov word [rbx], cx
jmp 0x1400d3038
cmp r9, r8
jae 0x1400d3048
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x1400d2ff2
jmp 0x1400d30fd
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400d30f2
cmp dword [rsp + 0x80], esi
je 0x1400d30f2
lea r8, [0x140136ab0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x1400d30ca
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x1400d309a
mov word [rbx], r13w
jmp 0x1400d30fa
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x1400d30a7
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x1400d30fa
cmp word [rsp + 0x70], r13w
jne 0x1400d30d7
cmp rbx, r14
je 0x1400d3094
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1400d2118
cmp word [rsp + 0x70], r13w
je 0x1400d30fd
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140136ab0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x1400d30f7
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x1400d30fd
Function at 0x1400da7cc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400d2118
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400d2118
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400da91c
cmp rax, 0xffffffffffffffff
je 0x1400da91c
xor edi, edi
test rbp, rbp
jle 0x1400da8c7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400c2a38
mov rbx, rax
test rax, rax
jne 0x1400da854
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400da8bd
mov edx, 0x8000
mov ecx, r14d
call fcn.1400b9630
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400c03e0
cmp eax, 0xffffffff
je 0x1400da89d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400da864
mov edx, r15d
mov ecx, r14d
call fcn.1400b9630
jmp 0x1400da8bd
cmp byte [rsi + 0x38], dil
je 0x1400da8b4
cmp dword [rsi + 0x34], 5
jne 0x1400da8b4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400da8bd
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400bd8a0
jmp 0x1400da930
jns 0x1400da930
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400d2118
cmp rax, 0xffffffffffffffff
jne 0x1400da8e8
cmp byte [rsi + 0x30], dil
je 0x1400da930
mov edi, dword [rsi + 0x2c]
jmp 0x1400da930
mov ecx, r14d
call fcn.1400cd4b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400da930
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400da930
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400da929
mov eax, dword [rsi + 0x2c]
jmp 0x1400da92e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400d2118
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x180003740
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword gs:[0x60]
mov rbp, rdx
mov r14, rcx
mov rsi, qword [rax + 0x18]
add rsi, 0x10
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1800037e6
movzx ebx, word [rdi + 0x58]
xor eax, eax
shr rbx, 1
je 0x1800037d5
mov r10, qword [rdi + 0x60]
nop dword [rax]
nop dword [rax + rax]
movzx edx, word [r10]
movsx r11d, byte [rax + rbp]
movzx r9d, r11w
lea ecx, [rdx - 0x61]
cmp cx, 0x19
lea r8d, [rdx - 0x20]
lea ecx, [r9 - 0x61]
cmova r8w, dx
cmp cx, 0x19
lea edx, [r9 - 0x20]
cmova dx, r11w
cmp r8w, dx
jne 0x1800037de
test r11b, r11b
je 0x1800037de
inc rax
add r10, 2
cmp rax, rbx
jb 0x180003790
mov rax, qword [rdi + 0x30]
mov qword [r14], rax
jmp 0x1800037ed
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x180003775
mov qword [r14], 0
mov rbx, qword [rsp + 0x10]
mov rax, r14
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x180008a50
Capabilities:
Parse pe header

Disassembly:
push rbx
push r13
sub rsp, 0x18
mov r11, qword [rcx]
xor r9d, r9d
mov r13, r8
mov rbx, rdx
test r11, r11
je 0x180008b89
mov qword [rsp + 0x30], rbp
mov eax, 0x5a4d
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x10], r12
mov qword [rsp + 8], r14
mov qword [rsp], r15
cmp word [r11], ax
jne 0x180008b5e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
cmp dword [rax], 0x4550
cmovne rax, r9
test rax, rax
je 0x180008b5e
add rax, 0x18
mov ecx, 0x20b
cmp word [rax], cx
jne 0x180008b5e
test rax, rax
je 0x180008b5e
cmp dword [rax + 0x6c], r9d
jbe 0x180008b5e
lea r14, [rax + 0x70]
test r14, r14
je 0x180008b5e
mov r15d, dword [r14]
mov r10d, r9d
mov edi, dword [r11 + r15 + 0x18]
lea rsi, [r11 + r15]
test edi, edi
je 0x180008b5e
mov r12d, dword [rsi + 0x20]
nop dword [rax]
mov ebp, r10d
mov r8, r13
lea rax, [r12 + rbp*4]
mov eax, dword [rax + r11]
add rax, r11
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180008b27
inc rax
test ecx, ecx
jne 0x180008b14
test edx, edx
je 0x180008b35
inc r10d
cmp r10d, edi
jb 0x180008b00
jmp 0x180008b5e
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + rbp*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov r8d, dword [rcx + rdx*4]
cmp r8d, r15d
jb 0x180008b5a
mov eax, r8d
sub eax, r15d
cmp eax, dword [r14 + 4]
jb 0x180008b5e
lea r9, [r11 + r8]
mov qword [rbx], r9
mov rax, rbx
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r12, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
add rsp, 0x18
pop r13
pop rbx
ret
mov qword [rdx], r9
mov rax, rbx
add rsp, 0x18
pop r13
pop rbx
ret

Function at 0x180008fe0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r9, qword [rcx]
mov r8, rdx
xor edx, edx
test r9, r9
je 0x180009052
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x180009052
movsxd rcx, dword [r9 + 0x3c]
add rcx, r9
cmp dword [rcx], 0x4550
cmovne rcx, rdx
test rcx, rcx
je 0x180009052
movzx eax, word [rcx + 0x14]
add rax, 0x18
add rax, rcx
movzx ecx, word [rcx + 6]
lea rcx, [rcx + rcx*4]
lea r10, [rax + rcx*8]
cmp rax, r10
je 0x180009052
nop word [rax + rax]
test dword [rax + 0x24], 0x40000000
je 0x180009049
cmp dword [rax], 0x6164722e
jne 0x180009049
cmp word [rax + 4], 0x6174
je 0x18000905d
add rax, 0x28
cmp rax, r10
jne 0x180009030
mov qword [r8 + 8], rdx
mov rax, r8
mov qword [r8], rdx
ret
mov edx, dword [rax + 0xc]
mov ecx, dword [rax + 8]
add rdx, r9
mov qword [r8], rdx
mov rax, r8
mov qword [r8 + 8], rcx
ret
Function at 0x14227f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14227f1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14227f089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14227f06f
add dl, dl
jne 0x14227f096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14227f0f6
xor eax, eax
add dl, dl
jne 0x14227f0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14227f1ad
add dl, dl
jne 0x14227f0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14227f0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14227f0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14227f0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14227f0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14227f07e
mov eax, 1
add dl, dl
jne 0x14227f106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14227f113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14227f0fb
sub eax, ebx
mov ebx, 1
jne 0x14227f14c
mov ecx, 1
add dl, dl
jne 0x14227f12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14227f13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14227f123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14227f07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14227f168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14227f175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14227f15d
cmp eax, 0x7d00
jae 0x14227f19b
cmp eax, 0x500
jb 0x14227f196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14227f07e
cmp eax, 0x7f
ja 0x14227f19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14227f07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14227f1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14227f07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180002270
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
mov eax, 0x2048
call fcn.1800335e0
sub rsp, rax
mov rax, qword [0x1800b7240]
xor rax, rsp
mov qword [rsp + 0x2030], rax
movsd xmm0, qword [str.define]
mov rbx, rcx
movzx eax, byte [0x1800939a8]
lea rcx, [rsp + 0x39]
xor edx, edx
movsd qword [rsp + 0x30], xmm0
mov r8d, 0xff6
mov byte [rsp + 0x38], al
call fcn.18008fc40
lea rdi, [rsp + 0x2068]
call fcn.180002580
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x1030]
mov r9, rbx
mov qword [rsp + 0x20], 0
mov r8d, 0xfff
mov rcx, qword [rax]
call fcn.18006467c
lea r8, [rsp + 0x1030]
mov edx, 0xfff
lea rcx, [rsp + 0x30]
call fcn.18006147c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.180033640
add rsp, 0x2048
pop rdi
pop rbx
ret
Function at 0x180002350
Capabilities:
Read .ini file

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x180002575
mov qword [rsp + 0x40], rsi
lea rdx, str.BlackDesert64.exe
lea rcx, [0x1800b88e0]
mov qword [rsp + 0x48], rdi
call fcn.180029580
mov edx, eax
lea rcx, [0x1800b88e0]
mov qword [0x1800b8c00], rdx
call fcn.1800294c0
mov r8, qword [0x1800b8c00]
lea rdx, str.InitAA__d_d
mov r9, rax
mov qword [0x1800b8c08], rax
lea rcx, [0x1800b88e0]
call fcn.180029340
mov rcx, qword [0x1800b8c08]
lea rdx, str.Welcome_to_the_black_desert_world
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov qword [0x1800b8c58], rbx
lea rsi, str.C:config.ini
lea rbx, [0x1800b88f0]
mov qword [rsp + 0x28], rsi
mov r9, rbx
mov dword [rsp + 0x20], 0xff
lea r8, str.Default
lea rdx, str.path
lea rcx, str.path
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rbx + r8], 0
jne 0x180002416
mov rdx, rbx
lea rbx, [0x1800b7178]
mov rcx, rbx
call fcn.1800020f0
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
lea rdx, str.path__s
lea rcx, [0x1800b88e0]
cmova rbx, qword [0x1800b7178]
mov r8, rbx
call fcn.180029340
lea rbx, [0x1800b89f0]
mov qword [rsp + 0x28], rsi
mov r9, rbx
mov dword [rsp + 0x20], 0xff
lea r8, str.Default
lea rdx, str.Script
lea rcx, str.Script
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x180002490
mov rdx, rbx
lea rbx, [0x1800b7118]
mov rcx, rbx
call fcn.1800020f0
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
lea rdx, str.Script__s
lea rcx, [0x1800b88e0]
cmova rbx, qword [0x1800b7118]
mov r8, rbx
call fcn.180029340
lea rbx, [0x1800b8af0]
mov qword [rsp + 0x28], rsi
mov r9, rbx
mov dword [rsp + 0x20], 0xff
lea r8, str.Default
lea rdx, [0x180093a3c]
lea rcx, [0x180093a3c]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov rsi, qword [rsp + 0x40]
nop dword [rax]
inc rdi
cmp byte [rbx + rdi], 0
jne 0x180002510
mov rdx, rbx
mov r8, rdi
lea rbx, [0x1800b70d8]
mov rcx, rbx
call fcn.1800020f0
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
lea rdx, str.Key__s
lea rcx, [0x1800b88e0]
cmova rbx, qword [0x1800b70d8]
mov r8, rbx
call fcn.180029340
call fcn.18002de50
mov rdi, qword [rsp + 0x48]
lea rcx, str.Init_Thread_Fail
test al, al
je 0x180002570
lea rcx, str.Init_Thread_OK
call fcn.180002270
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x18000ff20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx + 0x18]
mov r15, r8
xor r8d, r8d
mov r14, rdx
mov rbp, rcx
movzx r12d, byte [rax + 0x54]
mov r13d, r12d
and r12d, 3
xor r13d, 3
cmp qword [rdx], r8
je 0x1800100d5
mov qword [rsp + 0x50], rbx
lea rdx, [0x180000000]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
nop dword [rax]
mov rax, r15
dec r15
test rax, rax
je 0x1800100c6
mov rbx, qword [r14]
movzx ecx, byte [rbx + 9]
mov eax, ecx
xor eax, 3
test r13d, eax
jne 0x1800100b0
mov rax, qword [rbx]
mov qword [r14], rax
movzx eax, byte [rbx + 8]
add eax, 0xfffffffc
cmp eax, 0x22
ja case.0x18000ffbe.12
cdqe
movzx eax, byte [rdx + rax + 0x10114]
mov ecx, dword [rdx + rax*4 + 0x100f0]
add rcx, rdx
jmp rcx
mov rdx, rbx
mov rcx, rbp
call fcn.18000e0d0
lea rdx, [0x180000000]
xor r8d, r8d
jmp case.0x18000ffbe.12
movzx eax, byte [rbx + 0xa]
mov esi, r8d
test al, al
je 0x180010027
lea rdi, [rbx + 0x20]
nop dword [rax]
mov rdx, qword [rdi]
test rdx, rdx
je 0x180010019
sub qword [rdx + 8], 1
jne 0x180010019
lea rax, [rdx + 0x10]
cmp qword [rdx], rax
jne 0x180010019
xor r9d, r9d
mov r8d, 0x20
mov rcx, rbp
call fcn.180014dd0
movzx eax, byte [rbx + 0xa]
inc esi
add rdi, 8
cmp esi, eax
jl 0x18000fff0
movzx r8d, al
lea r8, [r8*8 + 0x20]
jmp 0x180010096
movzx r8d, byte [rbx + 0xa]
add r8, 2
shl r8, 4
jmp 0x180010096
mov rdx, rbx
mov rcx, rbp
call fcn.180020320
lea rdx, [0x180000000]
xor r8d, r8d
jmp case.0x18000ffbe.12
mov rdx, rbx
mov rcx, rbp
call fcn.18001b9e0
lea rdx, [0x180000000]
xor r8d, r8d
jmp case.0x18000ffbe.12
mov r8, qword [rbx + 0x18]
add r8, 0x28
jmp 0x180010096
mov rdx, rbx
mov rcx, rbp
call fcn.18001c6e0
movzx r8d, byte [rbx + 0xb]
jmp 0x180010092
mov r8, qword [rbx + 0x10]
add r8, 0x19
xor r9d, r9d
mov rdx, rbx
mov rcx, rbp
call fcn.180014dd0
lea rdx, [0x180000000]
xor r8d, r8d
jmp case.0x18000ffbe.12
and cl, 0xf8
mov r14, rbx
or cl, r12b
mov byte [rbx + 9], cl
cmp qword [r14], 0
jne 0x18000ff70
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
cmp qword [r14], 0
cmove r14, r8
mov rax, r14
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbp
ret

Function at 0x180011e00
Capabilities:
Read file on windows

Disassembly:
push rbx
mov eax, 0x2050
call fcn.1800335e0
sub rsp, rax
mov rax, qword [0x1800b7240]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rbx, rdx
lea rdx, [rsp + 0x20]
call fcn.1800049b0
nop
mov edx, 0x2000
lea rcx, [rsp + 0x20]
call fcn.180005970
mov r9, rbx
mov edx, 1
mov r8d, 0x2000
mov rcx, rax
call fcn.1800654ac
add qword [rsp + 0x30], rax
cmp rax, 0x2000
je 0x180011e30
lea rcx, [rsp + 0x20]
call fcn.180005b00
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.180033640
add rsp, 0x2050
pop rbx
ret
Function at 0x180011e90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
mov eax, 0x2050
call fcn.1800335e0
sub rsp, rax
mov rax, qword [0x1800b7240]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rbx, rdx
mov rdi, r8
lea rdx, [rsp + 0x20]
call fcn.1800049b0
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.180005970
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.1800654ac
add qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov rbx, rax
call fcn.180005b00
xor eax, eax
test rbx, rbx
setne al
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.180033640
mov rbx, qword [rsp + 0x2078]
add rsp, 0x2050
pop rdi
ret

Function at 0x1800169d0
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x110
mov rax, qword [0x1800b7240]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r14, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
call fcn.180016050
test rax, rax
je 0x180016a28
mov r8, qword [rsp + 0x20]
mov ecx, reloc.WS2_32.dll_send
sub rax, rbx
mov qword [r14], r8
mov dword [r14 + 8], ecx
inc rax
jmp 0x180016baa
lea rdx, [0x180095d10]
mov rcx, rbx
call fcn.18006f980
test rax, rax
je 0x180016a5f
movzx edi, byte [rax]
or edi, 0x20
cmp edi, 0x6e
je 0x180016ba8
cmp edi, 0x78
jne 0x180016a61
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180016d10
jmp 0x180016a6e
xor edi, edi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.18006f8cc
mov rcx, qword [rsp + 0x20]
lea rbp, [0x180094580]
cmp rcx, rbx
jne 0x180016a83
xor eax, eax
jmp 0x180016aad
movzx edx, byte [rcx]
test byte [rdx + rbp + 1], 8
je 0x180016aa5
nop dword [rax]
inc rcx
mov qword [rsp + 0x20], rcx
movzx eax, byte [rcx]
test byte [rax + rbp + 1], 8
jne 0x180016a90
movzx edx, al
xor eax, eax
test dl, dl
cmove rax, rcx
test rax, rax
jne 0x180016b92
mov edx, 0x2e
mov rcx, rbx
call fcn.18005d228
mov rsi, rax
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x180016ad0
cmp rcx, 0xc8
ja 0x180016ba8
test rsi, rsi
je 0x180016ba8
lea rdx, [rsp + 0x30]
mov rcx, rbx
sub rdx, rbx
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x180016b00
call fcn.180066dc8
sub rsi, rbx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov rax, qword [rax]
movzx eax, byte [rax]
mov byte [rsp + rsi + 0x30], al
cmp edi, 0x78
jne 0x180016b36
call fcn.180016d10
jmp 0x180016b3b
call fcn.18006f8cc
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x30]
cmp rcx, rax
jne 0x180016b4e
xor eax, eax
jmp 0x180016b8d
movzx edx, byte [rcx]
test byte [rdx + rbp + 1], 8
je 0x180016b75
nop dword [rax + rax]
inc rcx
mov qword [rsp + 0x20], rcx
movzx eax, byte [rcx]
test byte [rax + rbp + 1], 8
jne 0x180016b60
movzx edx, al
xor eax, eax
test dl, dl
cmove rax, rcx
test rax, rax
je 0x180016ba8
lea rcx, [rsp + 0x30]
sub rax, rcx
add rax, rbx
test rax, rax
je 0x180016ba8
mov ecx, 3
movsd qword [r14], xmm0
sub rax, rbx
mov dword [r14 + 8], ecx
inc rax
jmp 0x180016baa
xor eax, eax
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.180033640
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180016d10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x38
mov qword [rsp + 0x80], rbx
mov r13, rdx
mov rbx, rcx
mov qword [rsp + 0x20], rdx
call fcn.180066dc8
xor esi, esi
lea r11, [0x180094580]
xorps xmm1, xmm1
mov r10d, esi
mov r14d, esi
mov r9d, esi
mov r8, qword [rax]
mov edi, esi
movsx r15d, byte [r8]
mov qword [r13], rbx
movzx eax, byte [rbx]
test byte [rax + r11 + 1], 8
je 0x180016d7f
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
inc rbx
test byte [rax + r11 + 1], 8
jne 0x180016d70
mov qword [rsp + 0x30], r12
lea rdx, [rbx + 1]
mov ebp, 1
cmp al, 0x2d
jne 0x180016d96
mov r12d, ebp
jmp 0x180016da0
cmp byte [rbx], 0x2b
mov r12d, esi
cmovne rdx, rbx
cmp byte [rdx], 0x30
mov rbx, qword [rsp + 0x80]
jne 0x180016ef8
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x180016ef8
movsd xmm2, qword [0x180095d80]
lea r13, [0x180094580]
add rdx, 2
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [rdx]
mov r11, rdx
movsx rcx, r8b
cmp ecx, r15d
jne 0x180016dfb
test edi, edi
jne 0x180016e50
mov edi, ebp
inc rdx
jmp 0x180016de0
test byte [r8 + r13 + 1], 0x10
je 0x180016e50
test r10d, r10d
jne 0x180016e13
cmp r8b, 0x30
jne 0x180016e13
inc r14d
jmp 0x180016e44
inc r10d
cmp r10d, 0x1e
jg 0x180016e41
test byte [rcx + r13 + 1], 2
je 0x180016e29
add ecx, 0xffffffd0
jmp 0x180016e2f
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x180016e44
inc r9d
test edi, edi
je 0x180016e4b
dec r9d
inc rdx
jmp 0x180016de0
mov r13, qword [rsp + 0x20]
lea eax, [r14 + r10]
test eax, eax
je 0x180016ef8
mov qword [r13], rdx
lea r9d, [r9*4]
movzx eax, byte [rdx]
sub al, 0x50
test al, 0xdf
jne 0x180016edf
movzx eax, byte [rdx + 1]
inc rdx
cmp al, 0x2d
jne 0x180016e87
lea rdx, [r11 + 2]
jmp 0x180016e91
cmp al, 0x2b
jne 0x180016e8f
lea rdx, [r11 + 2]
mov ebp, esi
movzx r8d, byte [rdx]
lea r11, [0x180094580]
test byte [r8 + r11 + 1], 2
je 0x180016ef8
nop dword [rax]
nop dword [rax + rax]
movsx eax, r8b
lea esi, [rsi + rsi*4]
inc rdx
lea esi, [rsi - 0x18]
lea esi, [rax + rsi*2]
movzx eax, byte [rdx]
movzx r8d, al
test byte [rax + r11 + 1], 2
jne 0x180016eb0
mov eax, esi
mov qword [r13], rdx
neg eax
test ebp, ebp
cmove eax, esi
add r9d, eax
test r12d, r12d
je 0x180016eeb
xorps xmm1, xmmword [0x180095d90]
mov edx, r9d
movaps xmm0, xmm1
call fcn.18006c178
jmp 0x180016efb
xorps xmm0, xmm0
mov r12, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret

Function at 0x18001c370
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
mov r9, rdx
xor eax, r8d
mov r10, rcx
mov r8, rdx
shr r8, 5
inc r8
cmp rdx, r8
jb 0x18001c3ae
nop word [rax + rax]
movzx edx, byte [r10 + r9 - 1]
mov ecx, eax
shl ecx, 5
sub r9, r8
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
cmp r9, r8
jae 0x18001c390
ret