joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180047010
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9, qword [rdx + 0x20]
lea rax, [rdx + 8]
cmp r9, 8
jb 0x18004702c
mov r8, qword [rax]
jmp 0x18004702f
mov r8, rax
mov rcx, qword [rdx + 0x18]
lea rcx, [r8 + rcx*2]
cmp r9, 8
jb 0x180047040
mov rax, qword [rax]
mov r8d, 0x811c9dc5
cmp rax, rcx
je 0x180047066
nop dword [rax + rax]
movzx edx, word [rax]
imul r8, r8, 0x1000193
add rax, 2
xor r8, rdx
cmp rax, rcx
jne 0x180047050
mov edx, 0x1f31d
mov ecx, r8d
call qword [sym.imp.msvcrt.dll_ldiv]
mov qword [rsp + 0x30], rax
shr rax, 0x20
imul ecx, eax, 0x41a7
imul eax, dword [rsp + 0x30], 0xb14
sub ecx, eax
jns 0x18004709c
lea eax, [rcx + 0x7fffffff]
cdqe
add rsp, 0x28
ret
movsxd rax, ecx
add rsp, 0x28
ret

Function at 0x18005cb10
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x1a0
mov rax, qword [0x1800b0070]
xor rax, rsp
mov qword [rsp + 0x190], rax
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x51]
lea r8d, [rdx + 0x63]
mov byte [rsp + 0x50], 0
call sub.msvcrt.dll_memset
xor eax, eax
lea rcx, [rsp + 0xc2]
xor edx, edx
mov r8d, 0xc6
mov word [rsp + 0xc0], ax
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x50]
mov edx, 0x64
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x18005cbeb
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
test eax, eax
jle 0x18005cb8b
movzx ebx, ax
or ebx, 0x80070000
mov dword [rsp + 0x40], ebx
lea rcx, [0x180002040]
test ebx, ebx
lea rax, [0x180002050]
lea r8, [0x180011c00]
lea rdx, [0x18000fa90]
cmovs rax, rcx
mov r9d, 0x3b5
mov ecx, 1
mov qword [rsp + 0x38], rax
lea rax, [0x180011bc0]
mov qword [rsp + 0x30], rax
lea rax, [0x180002090]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_qriteLog
jmp 0x18005ccb9
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x50]
mov r8d, 0xc8
call qword [sym.imp.SHLWAPI.dll_SHAnsiToUnicode]
test eax, eax
jne 0x18005cc61
mov dword [rsp + 0x40], 0x80004005
lea rcx, [0x180002040]
lea rax, [0x180002090]
mov qword [rsp + 0x38], rcx
lea rcx, [0x180011c70]
lea r8, [0x180011c00]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea rdx, [0x18000fa90]
mov ecx, 1
mov r9d, 0x3b6
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_qriteLog
mov eax, 0x80004005
jmp 0x18005ccbb
lea rcx, [rsp + 0xc0]
mov rdx, rbx
call fcn.18005cce0
mov ebx, eax
test eax, eax
jns 0x18005ccbb
mov dword [rsp + 0x38], eax
lea rax, [0x180011cb8]
lea r8, [0x180011c00]
mov qword [rsp + 0x30], rax
lea rax, [0x180002160]
lea rdx, [0x18000fa90]
mov qword [rsp + 0x28], rax
mov r9d, 0x3b7
mov ecx, 1
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_qriteLog
mov eax, ebx
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.18003b8c0
add rsp, 0x1a0
pop rbx
ret
Function at 0x18005cce0
Capabilities:
Resolve dns

Disassembly:
push rbx
sub rsp, 0x50
xor ebx, ebx
mov qword [rsp + 0x68], rsi
mov rsi, rdx
mov qword [rsp + 0x70], rbx
test rcx, rcx
jne 0x18005cd11
mov ebx, 0x80070057
lea rax, [0x180011cd8]
mov r9d, 0x3c2
jmp 0x18005cd9a
lea r9, [rsp + 0x70]
lea r8, [0x1800b1db0]
xor edx, edx
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
test eax, eax
je 0x18005cd6f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jg 0x18005cd37
mov ebx, eax
jmp 0x18005cd40
movzx ebx, ax
or ebx, 0x80070000
lea rcx, [0x180002040]
lea rax, [0x180002050]
test ebx, ebx
cmovs rax, rcx
mov dword [rsp + 0x40], ebx
mov r9d, 0x3c6
mov qword [rsp + 0x38], rax
lea rax, [0x180011d50]
jmp 0x18005ce59
lea rdx, [0x1800b1510]
mov ecx, 0xc8
call fcn.18003b8e8
mov qword [rsi], rax
test rax, rax
jne 0x18005cdd4
mov ebx, 0x8007000e
lea rax, [0x180011940]
mov r9d, 0x3c9
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rax
lea rax, [0x180001ef0]
mov qword [rsp + 0x28], rax
lea r8, [0x180011cf0]
lea rdx, [0x18000fa90]
mov ecx, 1
mov dword [rsp + 0x20], 2
call sym.StorageClientLib.dll_qriteLog
jmp 0x18005ce8a
mov qword [rsp + 0x78], rdi
mov rdi, rax
xor eax, eax
mov ecx, 0xc8
xor r8d, r8d
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x70]
mov r9, qword [rsi]
mov dword [rsp + 0x60], 0x64
mov edx, dword [rcx + 0x10]
mov rcx, qword [rcx + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSAAddressToStringW]
mov rdi, qword [rsp + 0x78]
test eax, eax
je 0x18005ce8a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jg 0x18005ce26
mov ebx, eax
jmp 0x18005ce2f
movzx ebx, ax
or ebx, 0x80070000
lea rcx, [0x180002040]
lea rax, [0x180002050]
test ebx, ebx
cmovs rax, rcx
mov dword [rsp + 0x40], ebx
mov r9d, 0x3d2
mov qword [rsp + 0x38], rax
lea rax, [0x180011da0]
mov qword [rsp + 0x30], rax
lea rax, [0x180002090]
lea r8, [0x180011cf0]
mov qword [rsp + 0x28], rax
lea rdx, [0x18000fa90]
mov ecx, 1
mov dword [rsp + 0x20], 2
call sym.StorageClientLib.dll_qriteLog
mov rcx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
test rcx, rcx
je 0x18005ce9f
call qword [sym.imp.WS2_32.dll_FreeAddrInfoW]
mov eax, ebx
add rsp, 0x50
pop rbx
ret
Function at 0x18005d440
Capabilities:
Read http header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x50
mov rsi, r8
mov rbx, rdx
mov rbp, rcx
mov dword [rsp + 0x70], 0
test r8, r8
jne 0x18005d4be
mov dword [rsp + 0x38], 0x80070057
lea rax, [0x180012010]
lea r8, [0x180012020]
mov qword [rsp + 0x30], rax
lea rax, [0x180001ef0]
lea rdx, [0x18000fa90]
mov qword [rsp + 0x28], rax
lea ecx, [rsi + 1]
mov r9d, 0x479
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_qriteLog
mov eax, 0x80070057
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop rsi
ret
lea rax, [rsp + 0x70]
mov r8, rdx
xor r9d, r9d
mov edx, 0xffff
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x7a
jne 0x18005d624
mov ecx, dword [rsp + 0x70]
mov eax, 2
inc ecx
mul rcx
mov rcx, 0xffffffffffffffff
lea rdx, [0x1800b1510]
cmovo rax, rcx
mov rcx, rax
call fcn.18003b8e8
mov qword [rsi], rax
test rax, rax
jne 0x18005d576
mov dword [rsp + 0x38], 0x8007000e
lea rax, [0x180012090]
lea r8, [0x180012020]
mov qword [rsp + 0x30], rax
lea rax, [0x180001ef0]
lea rdx, [0x18000fa90]
mov qword [rsp + 0x28], rax
lea ecx, [rdi - 0x79]
mov r9d, 0x487
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_qriteLog
mov eax, 0x8007000e
jmp 0x18005d67a
mov ecx, dword [rsp + 0x70]
mov rdi, rax
xor eax, eax
add rcx, 2
mov qword [rsp + 0x28], rax
mov r8, rbx
rep stosb byte [rdi], al
mov r9, qword [rsi]
lea rax, [rsp + 0x70]
mov edx, 0xffff
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x18005d678
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x18005d5c5
movzx edi, ax
or edi, 0x80070000
mov dword [rsp + 0x40], edi
lea rcx, [0x180002040]
test edi, edi
lea rax, [0x180002050]
lea r8, [0x180012020]
lea rdx, [0x18000fa90]
cmovs rax, rcx
mov r9d, 0x491
mov ecx, 1
mov qword [rsp + 0x38], rax
lea rax, [0x1800120a0]
mov qword [rsp + 0x30], rax
lea rax, [0x180002090]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_qriteLog
mov eax, edi
jmp 0x18005d67a
cmp eax, 0x2f76
je 0x18005d678
test eax, eax
je 0x18005d678
mov dword [rsp + 0x38], eax
lea rax, [0x180012100]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea r8, [0x180012020]
lea rdx, [0x18000fa90]
mov r9d, 0x499
mov ecx, 1
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_qriteLog
test edi, edi
jle 0x18005d620
movzx eax, di
or eax, 0x80070000
jmp 0x18005d67a
xor eax, eax
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop rsi
ret
Function at 0x18005d6a0
Capabilities:
Read http header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2050
call fcn.18003c0b0
sub rsp, rax
mov rax, qword [0x1800b0070]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rbx, rcx
mov rdi, r8
lea rcx, [rsp + 0x42]
xor esi, esi
xor edx, edx
mov r8d, 0x1ffe
mov word [rsp + 0x40], si
call sub.msvcrt.dll_memset
lea rdx, [0x180001308]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x30], 0x1000
call fcn.180046e10
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
lea r8, [0x180001848]
mov edx, 0xffff
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x18005d738
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18005d75a
lea rax, [rsp + 0x40]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], si
jne 0x18005d741
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.180046e10
xor eax, eax
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.18003b8c0
lea r11, [rsp + 0x2050]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x18005d790
Capabilities:
Read http header

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x870
mov rax, qword [0x1800b0070]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov rdi, rcx
mov rsi, r8
mov rbx, rdx
lea rcx, [rsp + 0x62]
xor ebp, ebp
xor edx, edx
mov r8d, 0x7fe
mov dword [rsp + 0x54], 4
mov word [rsp + 0x60], bp
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x54]
mov r9, rbx
xor r8d, r8d
mov edx, 0x20000013
mov rcx, rdi
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x50], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x18005d84b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x18005d81f
movzx ebx, ax
or ebx, 0x80070000
lea rcx, [0x180002040]
lea rax, [0x180002050]
test ebx, ebx
cmovs rax, rcx
mov dword [rsp + 0x40], ebx
mov r9d, 0x4cc
mov qword [rsp + 0x38], rax
lea rax, [0x180012160]
jmp 0x18005d8b2
xor r8d, r8d
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x60]
lea edx, [r8 + 0x14]
mov rcx, rdi
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x18005d8e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x18005d888
movzx ebx, ax
or ebx, 0x80070000
lea rcx, [0x180002040]
lea rax, [0x180002050]
test ebx, ebx
cmovs rax, rcx
mov dword [rsp + 0x40], ebx
mov r9d, 0x4d4
mov qword [rsp + 0x38], rax
lea rax, [0x180012230]
mov qword [rsp + 0x30], rax
lea rax, [0x180002090]
lea r8, [0x1800121c0]
mov qword [rsp + 0x28], rax
lea rdx, [0x18000fa90]
mov ecx, 1
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_qriteLog
mov eax, ebx
jmp 0x18005d909
lea rcx, [rsp + 0x60]
or r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], bp
jne 0x18005d8f0
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.180046e10
mov eax, ebp
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.18003b8c0
mov rbx, qword [rsp + 0x8a8]
add rsp, 0x870
pop rdi
pop rsi
pop rbp
ret
Function at 0x18005de50
Capabilities:
Set http header

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x90
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x1800b0070]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, rdx
mov rbp, rcx
xor r14d, r14d
mov edi, r14d
mov qword [r11 - 0x30], 7
mov qword [r11 - 0x38], r14
mov word [r11 - 0x48], r14w
mov rax, qword [rdx + 8]
mov rbx, qword [rax]
cmp rbx, rax
je 0x18005dffb
nop dword [rax]
lea rdx, [rbx + 0x18]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x58]
call fcn.18003e0a0
mov r8d, 2
lea rdx, [0x18001251c]
lea rcx, [rsp + 0x58]
call fcn.180045020
lea rdx, [rbx + 0x40]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x58]
call fcn.180044ef0
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r9d, 0x20000000
or r8d, 0xffffffff
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
je 0x18005df8a
cmp byte [rbx + 0x69], 0
je 0x18005df35
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18003b960
jmp 0x18005df7e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x69], 0
jne 0x18005df5e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x69], 0
jne 0x18005df7e
nop dword [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x69], 0
je 0x18005df50
jmp 0x18005df7e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x69], 0
jne 0x18005df7b
cmp rbx, qword [rax + 0x10]
jne 0x18005df7b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x69], 0
je 0x18005df68
mov rbx, rax
cmp rbx, qword [rsi + 8]
jne 0x18005deb0
jmp 0x18005dffb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x18005df9f
movzx edi, ax
or edi, 0x80070000
lea rcx, [0x180002040]
lea rax, [0x180002050]
test edi, edi
cmovs rax, rcx
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rax
lea rax, [0x180012530]
mov qword [rsp + 0x30], rax
lea rax, [0x180002090]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 0x590
lea r8, [0x180012580]
lea rdx, [0x18000fa90]
mov ecx, 1
call sym.StorageClientLib.dll_qriteLog
nop
cmp qword [rsp + 0x78], 8
jb 0x18005e00d
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_free
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], r14
mov word [rsp + 0x60], r14w
mov eax, edi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18003b8c0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x18005e210
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x80
mov qword [r11 + 8], rbp
mov qword [r11 + 0x10], rsi
xor ebx, ebx
xor eax, eax
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
mov qword [r11 - 0x18], r15
mov r12, rcx
mov r15, r9
mov rdi, r8
mov rbp, rdx
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
lea r9d, [rbx + 1]
lea rcx, [r11 - 0x50]
xor r8d, r8d
xor edx, edx
mov qword [r11 - 0x50], rbx
mov qword [r11 - 0x48], rbx
mov qword [r11 - 0x58], rbx
mov esi, ebx
mov dword [rsp + 0x48], 0x800c
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x18005e291
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x18005e3a5
mov qword [rsp + 0x78], r14
lea r14d, [rbp + 0xc]
lea rdx, [0x1800b1510]
mov ecx, r14d
call fcn.18003b8e8
mov rsi, rax
test rax, rax
jne 0x18005e2b9
lea ebx, [rax + 8]
jmp 0x18005e3a0
mov dword [rax], 0x208
mov dword [rax + 4], 0x6602
lea rcx, [rax + 0xc]
mov r9, rbp
mov r8, r12
mov rdx, rbp
mov dword [rax + 8], ebp
call qword [sym.imp.msvcrt.dll_memcpy_s]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov r8d, r14d
mov qword [rsp + 0x28], rax
mov rdx, rsi
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x18005e398
mov r8, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov edx, 0x8009
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x18005e398
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
lea r8, [rsp + 0x48]
lea edx, [r9 + 5]
call qword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x18005e398
cmp qword [rdi + 0x20], 0x10
mov rax, qword [rdi + 0x18]
jb 0x18005e35c
mov rdx, qword [rdi + 8]
jmp 0x18005e360
lea rdx, [rdi + 8]
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
mov r8d, eax
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x18005e398
mov r9, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x30]
mov r8, r15
mov edx, 2
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x18005e3a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r14, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x30]
mov r15, qword [rsp + 0x70]
mov r12, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
test rcx, rcx
je 0x18005e3d2
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18005e3e2
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x18005e3f4
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rsi
call sub.msvcrt.dll_free
mov rsi, qword [rsp + 0x98]
test ebx, ebx
jg 0x18005e413
mov eax, ebx
add rsp, 0x80
pop rbx
ret
movzx eax, bx
or eax, 0x80070000
add rsp, 0x80
pop rbx
ret
Function at 0x18005f3d0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
push r12
push r15
sub rsp, 0x30
mov rbx, r9
movzx r12d, r8b
mov r15, rdx
mov rdi, rcx
test r9, r9
je 0x18005f416
mov rsi, qword [rsp + 0x80]
test rsi, rsi
je 0x18005f416
lea rdx, [rsp + 0x78]
mov rcx, r15
call fcn.18005f600
mov r9, qword [rsi]
cmp r9, qword [rsp + 0x78]
jae 0x18005f427
mov eax, 0x80070057
add rsp, 0x30
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
xor esi, esi
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
movabs rax, 0xaaaaaaaaaaaaaaab
lea r11d, [rsi + 0x13]
mov ebp, esi
mul r15
mov rax, rdx
shr rax, 1
mov qword [rsp + 0x78], rax
lea r13, [rax*4]
movabs rax, 0xd79435e50d79435f
mul r13
mov eax, esi
mov r14, rdx
shr r14, 6
cmp rsi, r14
jne 0x18005f487
imul rcx, r14, 0x4c
mov r11, r13
sub r11, rcx
shr r11, 2
mov r10, rsi
test r11, r11
je 0x18005f4f4
nop
movzx ecx, byte [rdi + 1]
movzx edx, byte [rdi]
mov r8, rsi
shl rdx, 8
or rdx, rcx
movzx ecx, byte [rdi + 2]
shl rdx, 8
or rdx, rcx
shl rdx, 8
add rdi, 3
cmp rax, r9
jae 0x18005f5da
mov rcx, rdx
lea r15, [0x180013b50]
inc r8
shr rcx, 0x1a
inc rax
shl rdx, 6
and ecx, 0x3f
movzx ecx, byte [rcx + r15]
mov r15, qword [rsp + 0x68]
mov byte [rax + rbx - 1], cl
cmp r8, 4
jb 0x18005f4b4
inc r10
cmp r10, r11
jb 0x18005f490
lea rcx, [rax + 1]
cmp rcx, r9
jae 0x18005f5da
test r12b, r12b
jne 0x18005f517
cmp rbp, r14
je 0x18005f517
mov byte [rax + rbx], 0xd
mov byte [rcx + rbx], 0xa
lea rax, [rcx + 1]
inc rbp
cmp rbp, r14
jbe 0x18005f477
mov rcx, qword [rsp + 0x78]
lea rcx, [rcx + rcx*2]
sub r15, rcx
je 0x18005f5cb
lea r10, [r15 + 1]
test r10, r10
je 0x18005f5cb
mov rdx, rsi
test r15, r15
je 0x18005f550
movzx edx, byte [rdi]
inc rdi
shl rdx, 8
cmp r15, 1
jbe 0x18005f563
movzx ecx, byte [rdi]
or rdx, rcx
inc rdi
shl rdx, 8
cmp r15, 2
jbe 0x18005f573
movzx ecx, byte [rdi]
or rdx, rcx
shl rdx, 8
mov r8, rsi
test r10, r10
je 0x18005f5ad
lea r11, [0x180013b50]
cmp rax, r9
jae 0x18005f5da
mov rcx, rdx
inc r8
inc rax
shr rcx, 0x1a
shl rdx, 6
and ecx, 0x3f
movzx ecx, byte [rcx + r11]
mov byte [rax + rbx - 1], cl
cmp r8, r10
jb 0x18005f586
mov ecx, 4
sub rcx, r10
je 0x18005f5cb
cmp rax, r9
jae 0x18005f5da
inc rsi
mov byte [rax + rbx], 0x3d
inc rax
cmp rsi, rcx
jb 0x18005f5b7
mov rcx, qword [rsp + 0x80]
mov qword [rcx], rax
xor eax, eax
jmp 0x18005f5df
mov eax, 0x80070057
mov r13, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800604a0
Capabilities:
Receive http response

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rcx, rcx
je 0x1800605d2
test rdx, rdx
je 0x1800605d2
test rbx, rbx
je 0x1800605d2
cmp qword [rdx], r14
jne 0x1800605d2
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], r14d
call qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x1800605ae
mov ecx, dword [rsp + 0x40]
mov qword [rbx], rcx
inc rcx
call qword [sym.imp.msvcrt.dll_malloc]
mov rcx, rax
mov qword [rsi], rax
test rax, rax
jne 0x18006051f
mov edi, 8
jmp 0x1800605ba
mov rax, qword [rbx]
mov edi, r14d
mov byte [rcx + rax], r14b
cmp qword [rbx], rdi
jbe 0x180060598
nop
mov r8d, dword [rsp + 0x40]
mov edx, edi
lea r9, [rsp + 0x58]
add rdx, qword [rsi]
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x1800605ae
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x180060598
lea rdx, [rsp + 0x40]
mov rcx, rbp
add edi, eax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x1800605ae
mov edx, dword [rsp + 0x40]
add edx, edi
cmp rdx, qword [rbx]
jbe 0x180060591
mov qword [rbx], rdx
mov rcx, qword [rsi]
inc rdx
call qword [sym.imp.msvcrt.dll_realloc]
test rax, rax
je 0x180060515
mov rcx, qword [rbx]
mov byte [rax + rcx], r14b
mov qword [rsi], rax
mov eax, edi
cmp qword [rbx], rax
ja 0x180060530
mov eax, r14d
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
je 0x1800605ce
mov rcx, qword [rsi]
test rcx, rcx
je 0x1800605ce
call qword [sym.imp.msvcrt.dll_free]
mov qword [rsi], r14
mov qword [rbx], r14
mov eax, edi
jmp 0x18006059b
mov rbx, qword [rsp + 0x50]
mov qword [rdx], r14
mov eax, 0x57
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
Function at 0x180071810
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
lea rax, [rsp + 0x50]
mov rbx, rcx
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x180071910]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x58], rax
test rax, rax
jne 0x1800718c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x180071865
movzx ebx, ax
or ebx, 0x80070000
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x180071877
movzx eax, ax
or eax, 0x80070000
mov dword [rsp + 0x38], eax
lea rax, [0x18001a288]
lea r8, [0x18001a2b0]
mov qword [rsp + 0x30], rax
lea rax, [0x180001ef0]
lea rdx, [0x180019580]
mov qword [rsp + 0x28], rax
mov r9d, 0x172
mov ecx, 1
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_qriteLog
mov eax, ebx
add rsp, 0x40
pop rbx
ret
lea rcx, [0x18001a350]
lea r8, [0x18001a2b0]
lea rdx, [0x180019580]
mov qword [rsp + 0x28], rcx
mov ecx, 1
mov r9d, 0x173
mov dword [rsp + 0x20], 3
call sym.StorageClientLib.dll_qriteLog
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x180075320
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
lea rax, [rsp + 0x50]
mov rbx, rcx
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x180075e40]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0xa8], rax
test rax, rax
jne 0x1800753d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x180075378
movzx ebx, ax
or ebx, 0x80070000
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x18007538a
movzx eax, ax
or eax, 0x80070000
mov dword [rsp + 0x38], eax
lea rax, [0x18001cab0]
lea r8, [0x18001cae0]
mov qword [rsp + 0x30], rax
lea rax, [0x180001ef0]
lea rdx, [0x18001c7d0]
mov qword [rsp + 0x28], rax
mov r9d, 0xeb
mov ecx, 1
mov dword [rsp + 0x20], 1
call sym.StorageClientLib.dll_qriteLog
mov eax, ebx
add rsp, 0x40
pop rbx
ret
lea rcx, [0x18001cb90]
lea r8, [0x18001cae0]
lea rdx, [0x18001c7d0]
mov qword [rsp + 0x28], rcx
mov ecx, 1
mov r9d, 0xed
mov dword [rsp + 0x20], 3
call sym.StorageClientLib.dll_qriteLog
xor eax, eax
add rsp, 0x40
pop rbx
ret