joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180009a80
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1800d5100]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
lea rcx, [0x1800be7d8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x180009c85
mov rcx, qword [rbx + 0x10]
movabs rdi, 0x7ffffffffffffffe
mov rax, rdi
sub rax, rcx
cmp rax, 0x34
jb 0x180009cb0
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x180009af1
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], gethostname
lea r9, [0x1800c7a90]
lea rcx, [rbp + 0x1f]
call fcn.180007840
nop
lea rdx, [rbp + 0x1f]
cmp qword [rbp + 0x37], 8
cmovae rdx, qword [rbp + 0x1f]
lea rcx, [rbp + 0x3f]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, qword [rbx + 0x10]
sub rdi, rax
cmp rdi, 0x22
jb 0x180009cb6
cmp qword [rbx + 0x18], 8
jb 0x180009b48
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], Ordinal_35
lea r9, [0x1800c79e0]
lea rcx, [rbp - 1]
call fcn.180007840
nop
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
lea r8, [rbp - 9]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x180009b97
cmp eax, 2
sete bl
jmp 0x180009bf4
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x1800c7b00]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp + 0x3f]
call rax
lea rdx, [rbp - 1]
mov rcx, 0xffffffff80000002
test eax, eax
je 0x180009bda
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor bl, bl
jmp 0x180009bf4
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x180009bf2
xor bl, bl
jmp 0x180009bf4
mov bl, 1
mov rdx, qword [rbp + 0x17]
cmp rdx, 8
jb 0x180009c34
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009c2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009cbc
call fcn.180071ba8
xor eax, eax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], 7
mov word [rbp - 1], ax
mov rdx, qword [rbp + 0x37]
cmp rdx, 8
jb 0x180009c82
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009c7d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009caa
call fcn.180071ba8
movzx eax, bl
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.180071b80
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.18007a274
int3
call fcn.1800012c0
nop
call fcn.1800012c0
nop
call fcn.18007a274
int3
Function at 0x180009d70
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x50
mov rax, qword [0x1800d5100]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
lea r9, [rsp + 0x20]
mov r14, rcx
mov dword [rsp + 0x20], ebp
xor r8d, r8d
xor edx, edx
mov ebx, ebp
lea ecx, [rbp + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x180009dfe
nop dword [rax]
test rbx, rbx
je 0x180009dc6
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, ntohs
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x180009db0
test eax, eax
jns 0x180009e1f
test rbx, rbx
je 0x180009e24
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x180009f15
test rbx, rbx
jne 0x180009e2b
xor eax, eax
jmp 0x180009f15
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rdi
mov edi, ebp
cmp dword [rbx], ebp
jbe 0x180009ef5
mov esi, edi
lea rdx, [rbx + 0x30]
imul rax, rsi, 0x128
mov qword [rsp + 0x28], rbp
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
add rdx, rcx
inc r8
cmp byte [rdx + r8], bpl
jne 0x180009e74
lea rcx, [rsp + 0x28]
call fcn.180005f90
cmp qword [r14 + 0x18], 0x10
mov rdx, r14
jb 0x180009e94
mov rdx, qword [r14]
cmp qword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
call fcn.1800797f4
test eax, eax
je 0x180009f2b
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x180009eeb
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009ee6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009f86
call fcn.180071ba8
inc edi
cmp edi, dword [rbx]
jb 0x180009e42
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180071b80
add rsp, 0x50
pop r14
pop rbp
pop rbx
ret
imul rax, rsi, 0x128
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
mov rdi, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x180009f81
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009f7c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009f86
call fcn.180071ba8
mov rax, rdi
jmp 0x180009f08
call fcn.18007a274
int3
Function at 0x18000a8a0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1800d5100]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov ecx, 0x1f4
mov rdi, rdx
call fcn.18007a58c
xor edx, edx
mov r8d, 0x1f4
mov rcx, rax
mov rsi, rax
call fcn.180074680
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
lea r8, [0x1800c7b60]
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x18000a91e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
xor eax, eax
jmp 0x18000aa66
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x18000a960
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x38]
xor edx, edx
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov dword [rdi], ebx
jmp 0x18000aa66
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x18000a970
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x18000a9b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x38]
xor edx, edx
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor eax, eax
mov dword [rdi], ebx
jmp 0x18000aa66
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x48]
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x18000aa04
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x38]
xor edx, edx
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor eax, eax
mov dword [rdi], ebx
jmp 0x18000aa66
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x18000aa4b
lea r8, [rsp + 0x48]
mov rdx, rsi
mov r9d, eax
lea r10, [0x1800c7b48]
nop
movzx ecx, byte [r8]
lea rdx, [rdx + 2]
mov eax, ecx
lea r8, [r8 + 1]
shr rax, 4
and ecx, 0xf
movzx eax, byte [rax + r10]
mov byte [rdx - 2], al
movzx eax, byte [rcx + r10]
mov byte [rdx - 1], al
sub r9, 1
jne 0x18000aa20
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rax, rsi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180071b80
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18000ac50
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push rbx
push rsi
push rdi
push r15
sub rsp, 0x58
mov rax, qword [0x1800d5100]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, qword [r8]
xor edi, edi
mov qword [rsp + 0x20], rcx
mov r15, rdx
mov rbx, rcx
test rsi, rsi
jne 0x18000aca4
mov qword [rcx], rdi
lea rdx, [0x1800c7553]
mov qword [rcx + 0x10], rdi
xor r8d, r8d
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], dil
call fcn.180005f90
jmp 0x18000ae11
mov qword [rsp + 0x88], rbp
mov rax, rsi
mov qword [rsp + 0x98], r12
mov rbp, rdi
mov qword [rsp + 0x50], r14
and eax, 3
jne 0x18000acd3
cmp byte [rsi + rdx - 1], 0x3d
je 0x18000acd3
mov r14, rdi
mov r12, rdi
jmp 0x18000acee
mov r14d, 1
cmp rax, 2
ja 0x18000aceb
cmp byte [rsi + rdx - 2], 0x3d
jne 0x18000aceb
mov r12, rdi
jmp 0x18000acee
mov r12, r14
sub rsi, r14
mov qword [rsp + 0x28], rdi
and rsi, 0xfffffffffffffffc
mov qword [rsp + 0x38], rdi
mov rdx, rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
shr rdx, 2
lea rcx, [rsp + 0x28]
xor r8d, r8d
lea rax, [r12 + rdx*2]
add rdx, rax
add rdx, r14
call fcn.180011d40
cmp qword [rsp + 0x40], 0x10
lea r9, [rsp + 0x28]
lea r10, [0x1800c7110]
cmovae r9, qword [rsp + 0x28]
test rsi, rsi
je 0x18000ada5
lea rdx, [rsi - 1]
shr rdx, 2
lea r8, [r15 + 2]
inc rdx
movzx eax, byte [r8 - 2]
lea r8, [r8 + 4]
mov ecx, dword [r10 + rax*4]
movzx eax, byte [r8 - 5]
shl ecx, 6
or ecx, dword [r10 + rax*4]
movzx eax, byte [r8 - 4]
shl ecx, 6
or ecx, dword [r10 + rax*4]
movzx eax, byte [r8 - 3]
shl ecx, 6
or ecx, dword [r10 + rax*4]
mov eax, ecx
sar eax, 0x10
mov byte [r9 + rbp], al
mov eax, ecx
sar eax, 8
mov byte [r9 + rbp + 1], al
mov byte [r9 + rbp + 2], cl
add rbp, 3
sub rdx, 1
jne 0x18000ad52
test r14, r14
mov r14, qword [rsp + 0x50]
je 0x18000adf0
movzx eax, byte [rsi + r15]
movzx ecx, byte [rsi + r15 + 1]
mov edx, dword [r10 + rax*4]
shl edx, 6
or edx, dword [r10 + rcx*4]
shl edx, 0xc
mov eax, edx
sar eax, 0x10
mov byte [r9 + rbp], al
test r12, r12
je 0x18000adf0
movzx eax, byte [rsi + r15 + 2]
sar edx, 8
mov ecx, dword [r10 + rax*4]
shl ecx, 6
sar ecx, 8
or cl, dl
mov byte [r9 + rbp + 1], cl
movups xmm0, xmmword [rsp + 0x28]
mov r12, qword [rsp + 0x98]
movups xmm1, xmmword [rsp + 0x38]
mov rbp, qword [rsp + 0x88]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180071b80
add rsp, 0x58
pop r15
pop rdi
pop rsi
pop rbx
ret
Function at 0x18000c080
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1800d5100]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r9, qword [rcx]
mov edi, 1
mov eax, dword [rdx]
mov r14, r8
mov rsi, rcx
xor eax, dword [r9]
mov dword [rsp + 0x20], eax
mov eax, dword [r9 + 4]
xor eax, dword [rdx + 4]
mov dword [rsp + 0x24], eax
mov eax, dword [r9 + 8]
xor eax, dword [rdx + 8]
mov dword [rsp + 0x28], eax
mov eax, dword [r9 + 0xc]
xor eax, dword [rdx + 0xc]
mov dword [rsp + 0x2c], eax
mov rax, qword [rcx + 8]
sub rax, r9
sar rax, 4
dec rax
cmp rax, rdi
jbe 0x18000c14d
mov qword [rsp + 0x50], rbx
mov ebx, edi
lea rcx, [rsp + 0x20]
call fcn.18000ae30
lea rcx, [rsp + 0x20]
call fcn.18000b0b0
lea rcx, [rsp + 0x20]
call fcn.18000b310
shl rbx, 4
inc edi
add rbx, qword [rsi]
mov eax, dword [rbx]
xor dword [rsp + 0x20], eax
mov eax, dword [rbx + 4]
xor dword [rsp + 0x24], eax
mov eax, dword [rbx + 8]
xor dword [rsp + 0x28], eax
mov eax, dword [rbx + 0xc]
xor dword [rsp + 0x2c], eax
mov rax, qword [rsi + 8]
sub rax, qword [rsi]
sar rax, 4
dec rax
mov ebx, edi
cmp rbx, rax
jb 0x18000c0f1
mov rbx, qword [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.18000ae30
lea rcx, [rsp + 0x20]
call fcn.18000b0b0
mov r9, qword [rsi + 8]
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x28]
xor r8d, dword [r9 - 0x10]
xor edx, dword [r9 - 0xc]
xor ecx, dword [r9 - 8]
mov eax, dword [rsp + 0x2c]
xor eax, dword [r9 - 4]
mov dword [r14 + 0xc], eax
mov dword [r14], r8d
mov dword [r14 + 4], edx
mov dword [r14 + 8], ecx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180071b80
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18000c1c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1800d5100]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r9, qword [rcx + 8]
mov rsi, rcx
lea rcx, [rsp + 0x20]
mov r14, r8
mov eax, dword [r9 - 0x10]
xor eax, dword [rdx]
mov dword [rsp + 0x20], eax
mov eax, dword [r9 - 0xc]
xor eax, dword [rdx + 4]
mov dword [rsp + 0x24], eax
mov eax, dword [r9 - 8]
xor eax, dword [rdx + 8]
mov dword [rsp + 0x28], eax
mov eax, dword [r9 - 4]
xor eax, dword [rdx + 0xc]
mov dword [rsp + 0x2c], eax
call fcn.18000b1e0
lea rcx, [rsp + 0x20]
call fcn.18000af70
mov r9, qword [rsi]
mov rdi, qword [rsi + 8]
sub rdi, r9
sar rdi, 4
sub rdi, 2
je 0x18000c2a1
mov qword [rsp + 0x50], rbx
mov rbx, rdi
shl rbx, 4
nop dword [rax + rax]
mov rcx, qword [rsi]
add rcx, rbx
mov eax, dword [rcx]
xor dword [rsp + 0x20], eax
mov eax, dword [rcx + 4]
xor dword [rsp + 0x24], eax
mov eax, dword [rcx + 8]
xor dword [rsp + 0x28], eax
mov eax, dword [rcx + 0xc]
lea rcx, [rsp + 0x20]
xor dword [rsp + 0x2c], eax
call fcn.18000b650
lea rcx, [rsp + 0x20]
call fcn.18000b1e0
lea rcx, [rsp + 0x20]
call fcn.18000af70
add rbx, 0xfffffffffffffff0
sub rdi, 1
jne 0x18000c250
mov r9, qword [rsi]
mov rbx, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x20]
xor r8d, dword [r9]
mov edx, dword [rsp + 0x24]
xor edx, dword [r9 + 4]
mov ecx, dword [rsp + 0x28]
xor ecx, dword [r9 + 8]
mov eax, dword [rsp + 0x2c]
xor eax, dword [r9 + 0xc]
mov dword [r14 + 0xc], eax
mov dword [r14], r8d
mov dword [r14 + 4], edx
mov dword [r14 + 8], ecx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180071b80
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18001a6d0
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push r12
push r15
sub rsp, 0x10
mov r11d, dword [rdx + 0xb0]
mov r15, r8
mov rsi, rdx
mov r12, rcx
test r11d, r11d
je 0x18001a84c
movzx eax, word [rdx + 0x14]
lea r9, [rdx + 0x18]
movzx r8d, word [rdx + 6]
add r9, rax
xor r10d, r10d
test r8d, r8d
je 0x18001a84c
nop
mov edx, dword [r9 + 0xc]
cmp r11d, edx
jb 0x18001a724
mov ecx, dword [r9 + 8]
add ecx, edx
cmp r11d, ecx
jb 0x18001a73a
inc r10d
add r9, 0x28
cmp r10d, r8d
jl 0x18001a710
add rsp, 0x10
pop r15
pop r12
pop rsi
ret
sub r11d, edx
mov qword [rsp], r14
mov r14d, dword [r9 + 0x14]
mov eax, r11d
add rax, r12
add r14, rax
je 0x18001a848
mov qword [rsp + 0x38], rbp
xor ebp, ebp
cmp dword [rsi + 0xb4], ebp
jbe 0x18001a843
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 8], r13
mov r13d, 0xf000
nop dword [rax]
mov edi, dword [r14 + 4]
lea rdx, [rsi + 0x18]
movzx eax, word [rsi + 0x14]
lea r10, [r14 + 8]
movzx ebx, word [rsi + 6]
sub rdi, 8
mov r11d, dword [r14]
add rdx, rax
shr rdi, 1
xor r9d, r9d
test ebx, ebx
je 0x18001a7d5
nop dword [rax + rax]
mov r8d, dword [rdx + 0xc]
cmp r11d, r8d
jb 0x18001a7c9
mov eax, dword [rdx + 8]
lea ecx, [r8 + rax]
cmp r11d, ecx
jb 0x18001a856
inc r9d
add rdx, 0x28
cmp r9d, ebx
jl 0x18001a7b0
xor r8d, r8d
xor edx, edx
test rdi, rdi
je 0x18001a821
mov r9d, 0xa000
nop word [rax + rax]
movzx eax, word [r10]
movzx ecx, ax
and cx, r13w
cmp cx, r9w
jne 0x18001a814
and eax, 0xfff
lea rcx, [rax + r8]
mov rax, r15
sub rax, qword [rsi + 0x30]
add qword [rcx], rax
inc edx
add r10, 2
mov eax, edx
cmp rax, rdi
jb 0x18001a7f0
add ebp, dword [r14 + 4]
mov r14, r10
cmp ebp, dword [rsi + 0xb4]
jb 0x18001a780
mov r13, qword [rsp + 8]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov r14, qword [rsp]
add rsp, 0x10
pop r15
pop r12
pop rsi
ret
sub r11d, r8d
mov r8d, dword [rdx + 0x14]
mov eax, r11d
add rax, r12
add r8, rax
jmp 0x18001a7d8
Function at 0x18002f2b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0xae5], 0
mov rsi, r9
mov rbp, r8
movsxd rdi, edx
mov rbx, rcx
je 0x18002f362
cmp qword [rcx + 0x270], 0
je 0x18002f317
mov dl, 1
call fcn.18001eab0
mov rax, qword [rbx + 0x1d8]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, edi
mov rcx, rbx
call qword [rbx + 0x270]
xor edx, edx
mov rcx, rbx
call fcn.18001eab0
jmp 0x18002f362
mov ecx, edi
test edx, edx
je 0x18002f327
sub ecx, 1
je 0x18002f327
cmp ecx, 1
jne 0x18002f362
mov r9, qword [rbx + 0x1d0]
lea rax, [0x1800a33b8]
mov edx, 2
lea rcx, [rdi + rdi*2]
add rcx, rax
lea r8d, [rdx - 1]
call fcn.180079528
mov r9, qword [rbx + 0x1d0]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call fcn.180079528
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x18002f380
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x160
mov rax, qword [0x1800d5100]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xae5], 0
mov rbx, rcx
jne 0x18002f3c3
cmp qword [rcx + 0x1e0], 0
je 0x18002f495
mov r8, rdx
mov qword [rsp + 0x158], rdi
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.1800421c0
mov r8, qword [rbx + 0x1e0]
movsxd r9, eax
test r8, r8
je 0x18002f429
cmp byte [rbx + 0x1313], 0
jne 0x18002f429
lea rdx, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
mov byte [r8], cl
lea r8, [r8 + 1]
test cl, cl
jne 0x18002f410
mov byte [rbx + 0x1313], 1
mov byte [rsp + r9 + 0x30], 0xa
inc r9d
movsxd rdi, r9d
cmp rdi, 0x102
jae 0x18002f4e6
cmp byte [rbx + 0xae5], 0
mov byte [rsp + rdi + 0x30], 0
je 0x18002f48d
cmp qword [rbx + 0x270], 0
je 0x18002f4ae
mov dl, 1
mov rcx, rbx
call fcn.18001eab0
mov rax, qword [rbx + 0x1d8]
lea r8, [rsp + 0x30]
mov r9, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rbx
call qword [rbx + 0x270]
xor edx, edx
mov rcx, rbx
call fcn.18001eab0
mov rdi, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180071b80
add rsp, 0x160
pop rbx
ret
mov r9, qword [rbx + 0x1d0]
lea rcx, [0x1800a33b8]
mov edx, 2
lea r8d, [rdx - 1]
call fcn.180079528
mov r9, qword [rbx + 0x1d0]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rdi
call fcn.180079528
jmp 0x18002f48d
call fcn.180072340
int3

Function at 0x18002f610
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x18002f652
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x18002f7f0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x1800d5100]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rsi, qword [rsp + 0x190]
mov rbp, rcx
mov rcx, qword [rcx + 0x18]
mov r15, r8
movsxd r8, edx
mov r12, r9
mov rax, r8
shl rax, 5
lea rbx, [rcx + 0x218]
mov r14, qword [rcx + r8*8 + 0x1d0]
add rbx, rax
mov rax, qword [rcx + 0x3e8]
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x84], 3
je 0x18002f8fa
lea rax, [0x18002f6a0]
cmp qword [rcx + r8*8 + 0x1f8], rax
jne 0x18002f8fa
cmp qword [rbx], 0
je 0x18002f881
test rdi, rdi
je 0x18002f8fa
mov rdx, 0xffffffffffffffff
xor r9d, r9d
mov r8, rdx
mov rcx, r14
call fcn.180040870
cmp eax, 0xffffffff
je 0x18002f8fa
test al, 1
je 0x18002f8fa
mov rcx, qword [rbx]
test rcx, rcx
jne 0x18002f8d9
mov eax, dword [rbp + 0x6ec]
lea ecx, [rax + rax]
mov qword [rbx + 8], rcx
call qword [section.el___6]
mov qword [rbx], rax
mov rcx, rax
test rax, rax
je 0x18002f934
mov rdi, qword [rbx + 8]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rcx
mov r8d, edi
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x18002f8fa
add qword [rbx + 0x10], rcx
xor r9d, r9d
mov r8d, r12d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
mov dword [rsi], 0
cmp rbx, 0xffffffffffffffff
jne 0x18002f973
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp eax, 0x2733
jne 0x18002f943
xor ebx, ebx
mov dword [rsi], 0x51
jmp 0x18002f973
mov dword [rsi], reloc.WLDAP32.dll_Ordinal_27
mov rax, 0xffffffffffffffff
jmp 0x18002f976
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov ecx, edi
call fcn.180043c90
mov r8, rax
lea rdx, [0x1800a33d0]
mov rcx, rbp
call fcn.18002f380
mov dword [rbp + 0xda4], edi
mov dword [rsi], gethostname
mov rax, rbx
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180071b80
add rsp, 0x130
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x18002fe70
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x268], 0
je 0x18002fe8d
call fcn.180029060
test eax, eax
jne 0x18002feb3
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x1d0]
cmp rcx, 0xffffffffffffffff
je 0x18002fe86
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x18002fe86
mov al, 1
add rsp, 0x28
ret