joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180149ac0
Capabilities:
Create http request

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x90
mov qword [r11 - 0x68], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1802d1460]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
mov qword [r11 - 0x60], rcx
movdqa xmm0, xmmword [0x18026b300]
movdqu xmmword [rsp + 0x50], xmm0
xor ebp, ebp
mov word [rsp + 0x40], bp
mov rdx, qword [rcx + 0x18]
cmp rdx, 0x10
jb 0x180149b1a
mov rcx, qword [rcx]
mov rbx, qword [rdi + 0x10]
add rbx, rcx
mov rsi, rdi
cmp rdx, 0x10
jb 0x180149b2d
mov rsi, qword [rdi]
movdqa xmm0, xmmword [0x18026b300]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], bp
mov rdx, rbx
sub rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.180114890
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.18014cba0
nop
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rax, qword [rsp + 0x40]
lea rdx, [rsp + 0x40]
sub rdx, rax
sar rdx, 1
lea r9, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae r9, qword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.18012a860
nop
lea rcx, [rsp + 0x60]
call fcn.180114210
lea rsi, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rsi, qword [rsp + 0x40]
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbx, rax
test rax, rax
je 0x180149c14
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 0x4000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
test rax, rax
je 0x180149c0a
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
lea rcx, [rsp + 0x40]
call fcn.180114210
nop
mov rcx, rdi
call fcn.180114430
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1801c74b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18014e1e0
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x190
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x1e0], rbx
mov rax, qword [0x1802d1460]
xor rax, rsp
mov qword [rbp + 0x78], rax
mov rdi, rdx
mov qword [rbp - 0x80], rdx
mov rbx, rcx
mov qword [rbp - 0x78], rcx
mov qword [rbp + 0x40], rdx
movdqa xmm0, xmmword [0x18026b310]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov r8d, 9
lea rdx, str.MachineId
lea rcx, [rbp - 0x48]
call fcn.180114020
nop
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x68]
mov rcx, rbx
call fcn.18014e3f0
nop
lea rcx, [rbp - 0x48]
call fcn.180114430
xor eax, eax
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rax
mov byte [rbp + 0x70], al
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rdx, qword [rbp - 0x68]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rax
test rdx, rdx
je 0x18014e385
mov r8d, dword [rbp - 0x58]
test r8d, r8d
jle 0x18014e385
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x20], 0x67452301
mov dword [rbp - 0x1c], 0xefcdab89
mov dword [rbp - 0x18], 0x98badcfe
mov dword [rbp - 0x14], 0x10325476
lea rcx, [rbp - 0x20]
call fcn.1801c0be0
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x40]
call fcn.1801c0cf0
movzx eax, byte [rbp + 0x4f]
movzx ecx, byte [rbp + 0x4e]
movzx edx, byte [rbp + 0x4d]
movzx r10d, byte [rbp + 0x4c]
movzx r11d, byte [rbp + 0x4b]
movzx ebx, byte [rbp + 0x4a]
movzx edi, byte [rbp + 0x49]
movzx esi, byte [rbp + 0x48]
movzx r14d, byte [rbp + 0x47]
movzx r15d, byte [rbp + 0x46]
movzx r12d, byte [rbp + 0x45]
movzx r13d, byte [rbp + 0x44]
movzx r9d, byte [rbp + 0x41]
movzx r8d, byte [rbp + 0x40]
mov dword [rsp + 0x88], eax
mov dword [rsp + 0x80], ecx
mov dword [rsp + 0x78], edx
mov dword [rsp + 0x70], r10d
mov dword [rsp + 0x68], r11d
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r13d
movzx eax, byte [rbp + 0x43]
mov dword [rsp + 0x28], eax
movzx eax, byte [rbp + 0x42]
mov dword [rsp + 0x20], eax
lea rdx, str._02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x
lea rcx, [rbp + 0x50]
call fcn.1801c0800
mov rdi, qword [rbp - 0x80]
mov rbx, qword [rbp - 0x78]
lea rax, [rbp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x18014e390
lea rdx, [rbp + 0x50]
lea rcx, [rbx + 0x58]
call fcn.180114020
lea rdx, [rbx + 0x58]
mov rcx, rdi
call fcn.18011d1d0
nop
lea rcx, [rbp - 0x68]
call fcn.180114430
mov rax, rdi
mov rcx, qword [rbp + 0x78]
xor rcx, rsp
call fcn.1801c74b0
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18015c520
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x870], 0
mov rbx, rdx
mov rdi, rcx
je 0x18015c5a0
cmp qword [rdx + 0x10], 0
je 0x18015c573
cmp qword [rdx + 0x18], 8
mov rcx, rdx
jb 0x18015c54e
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18015c573
test al, 0x10
jne 0x18015c573
mov byte [rdi + 0x95a], 0
cmp qword [rbx + 0x18], 8
jb 0x18015c56e
mov rbx, qword [rbx]
mov rdx, rbx
jmp 0x18015c594
cmp byte [rdi + 0x95a], 0
jne 0x18015c5a0
lea rdx, [rdi + 0x9d8]
mov byte [rdi + 0x95a], 1
cmp qword [rdx + 0x18], 8
jb 0x18015c594
mov rdx, qword [rdx]
mov rcx, qword [rdi + 0x870]
call fcn.180175870
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18015ce10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x1802d1460]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14d, edx
mov rsi, rcx
cmp qword [rcx + 0x9e8], 0
je 0x18015ce71
add rcx, 0x9d8
cmp qword [rsi + 0x9f0], 8
jb 0x18015ce62
mov rcx, qword [rsi + 0x9d8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18015ce71
test al, 0x10
je 0x18015ce8a
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.user_default_logo.png
lea rcx, [rsi + 0x9d8]
call fcn.1801142a0
lea rbx, [rsi + 0x9f8]
cmp qword [rbx + 0x10], 0
je 0x18015ceb4
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18015cea5
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18015ceb4
test al, 0x10
je 0x18015ceec
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.list_default_logo.png
mov rcx, rbx
call fcn.1801142a0
call fcn.18014ce40
cmp dword [rax + 0xd4], 0xb
jne 0x18015ceec
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Icon_mine.png
mov rcx, rbx
call fcn.1801142a0
movdqa xmm0, xmmword [0x18026b300]
movdqu xmmword [rsp + 0x48], xmm0
xor ebp, ebp
mov word [rsp + 0x38], bp
lea r8d, [rbp + 0x19]
lea rdx, str.accname_MainUIContainer_
lea rcx, [rsp + 0x38]
call fcn.1801144b0
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rdx, qword [rsp + 0x38]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x338]
call fcn.18014ce40
cmp dword [rax + 0xd4], 0xb
jne 0x18015cf96
mov qword [rsp + 0x28], rsi
lea rcx, [rsp + 0x20]
call fcn.1801682b0
lea rcx, [rsp + 0x20]
call fcn.180168520
lea rcx, [rsp + 0x20]
call fcn.180167380
lea rcx, [rsp + 0x20]
call fcn.180167da0
lea rcx, [rsp + 0x20]
call fcn.1801676d0
call fcn.18014ce40
mov dword [rax + 0x118], 0x136
lea rcx, [rsp + 0x20]
call fcn.1801662f0
jmp 0x18015d039
call fcn.18014ce40
mov dword [rax + 0x11c], r14d
call fcn.18014ce40
mov ebx, dword [rax + 0xd4]
call fcn.18014ce40
mov edi, dword [rax + 0x114]
mov qword [rsp + 0x28], rsi
mov edx, r14d
lea rcx, [rsp + 0x20]
call fcn.180164b50
lea rcx, [rsp + 0x20]
call fcn.180165b10
mov edx, r14d
lea rcx, [rsp + 0x20]
call fcn.180164e00
lea rcx, [rsp + 0x20]
call fcn.1801658e0
mov edx, r14d
lea rcx, [rsp + 0x20]
call fcn.1801651f0
mov ecx, 0x19c
mov eax, 0x162
cmp ebx, 0xa
cmovne ecx, eax
sub edi, ecx
cmp ebx, 0xa
sete bpl
add ebp, 5
xor edx, edx
mov eax, edi
div ebp
lea ebx, [rax + 0xe2]
call fcn.18014ce40
mov dword [rax + 0x118], ebx
mov edx, r14d
lea rcx, [rsp + 0x20]
call fcn.180163920
nop
lea rcx, [rsp + 0x38]
call fcn.180114210
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1801c74b0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1801626e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov byte [rcx + 0xa39], dl
mov rcx, qword [rcx + 0x8e0]
test rcx, rcx
je 0x18016271a
movzx eax, dl
xor al, 1
cmp byte [rcx + 0x7ed], al
je 0x18016271a
mov byte [rcx + 0x7ed], al
call fcn.180176e70
movzx edx, byte [rbx + 0xa39]
mov rbx, qword [rbx + 0x8f0]
test rbx, rbx
je 0x1801627b1
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
test dl, dl
je 0x1801627b7
mov r9, qword [rbx + 0x7f8]
lea rsi, str.fileopeneye_77.png
xor r8d, r8d
nop dword [rax]
movzx eax, word [r9 + r8*2]
cmp ax, word [rsi + r8*2]
jne 0x18016277e
movzx eax, word [r9 + r8*2 + 2]
cmp ax, word [rsi + r8*2 + 2]
jne 0x18016277e
add r8, 2
cmp r8, 0x16
jne 0x180162750
cmp qword [rbx + 0x910], 0
jne 0x1801627a7
lea rcx, [rbx + 0x7f8]
call fcn.18016c020
mov r8d, 0xffffffff
lea rcx, [rbx + 0x7f8]
mov rdx, rsi
call fcn.18016b370
mov rcx, rbx
call fcn.180176e70
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x7f8]
lea rsi, str.filecloseeye_77.png
mov rcx, 0xffffffffffffffff
nop dword [rax]
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [rsi + rcx*2 + 2]
jne 0x18016277e
add rcx, 2
cmp rcx, 0x17
je 0x180162774
movzx eax, word [rdx + rcx*2]
cmp ax, word [rsi + rcx*2]
je 0x1801627d0
jmp 0x18016277e
Function at 0x18016bfb0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
lea ecx, [rbx + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 8
test ax, ax
cmovs ebx, ecx
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18016bfdf
or ebx, 2
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18016bff2
or ebx, 1
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18016c005
or ebx, 4
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18016c018
or ebx, 0x20
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x18016cb70
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
xor r12d, r12d
mov r15, r9
mov r14, r8
mov ebp, edx
mov rbx, rcx
mov edi, r12d
cmp dword [rcx + 0x350], r12d
jle 0x18016cbf9
mov esi, r12d
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbx + 0x348]
lea rdx, [rsp + 0x90]
mov byte [rsp + 0x90], r12b
mov r9, r15
mov qword [rsp + 0x20], rdx
mov r8, r14
mov edx, ebp
mov rcx, qword [rsi + rax]
mov rax, qword [rcx]
call qword [rax]
cmp byte [rsp + 0x90], r12b
jne 0x18016cd27
inc edi
add rsi, 8
cmp edi, dword [rbx + 0x350]
jl 0x18016cbb0
sub ebp, 0x100
je 0x18016cd09
sub ebp, 4
je 0x18016cc85
cmp ebp, 2
jne 0x18016ccee
cmp qword [rbx + 0x120], r12
je 0x18016ccee
mov ecx, r14d
mov dword [rsp + 0x90], r12d
call fcn.1801d75fc
mov rcx, qword [rbx + 0x120]
lea r8, [rsp + 0x90]
mov word [rsp + 0x90], ax
lea rdx, [0x180172b20]
mov r9d, 0x80000012
mov rax, qword [rcx]
call qword [rax + 0x2f8]
mov rbx, rax
test rax, rax
je 0x18016ccee
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x2e0]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x108]
mov al, 1
jmp 0x18016ccf0
mov rax, qword [rbx + 0x128]
test rax, rax
je 0x18016ccee
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
mov rax, qword [rbx + 0x150]
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x30], 6
mov dword [rsp + 0x40], r12d
movdqu xmmword [rsp + 0x4e], xmm0
mov word [rsp + 0x5e], r12w
mov word [rsp + 0x4c], r14w
call fcn.18016bfb0
mov word [rsp + 0x4e], ax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rbx + 0x128]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov rax, qword [rcx]
call qword [rax + 0x310]
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
cmp r14, 9
jne 0x18016ccee
lea ecx, [r14 + 7]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov rcx, rbx
setns dl
call fcn.1801702b0
mov al, 1
jmp 0x18016ccf0
Function at 0x180180230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r10, rcx
lea r11, str.selected
mov rax, 0xffffffffffffffff
movzx r9d, word [rdx + rax*2 + 2]
cmp r9w, word [r11 + rax*2 + 2]
jne 0x180180264
add rax, 2
cmp rax, 9
je 0x18018026c
movzx ecx, word [rdx + rax*2]
cmp cx, word [r11 + rax*2]
je 0x180180241
mov rcx, r10
jmp fcn.180177360
lea rcx, [r10 + 0x770]
mov r8b, 1
mov rax, qword [rcx]
movzx edx, r8b
jmp qword [rax + gethostname]
Function at 0x1801933a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r10d, r8d
mov r9, rdx
test rdx, rdx
jne 0x1801933b6
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rbx
lea rbx, [0x18024a860]
not ecx
cmp r10d, 8
jb 0x1801934a8
mov r11, r10
shr r11, 3
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r10d, 0xfffffff8
mov edx, dword [rbx + rax*4]
xor edx, ecx
movzx ecx, byte [r9 + 1]
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 2]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 3]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 4]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 5]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 6]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 7]
add r9, 8
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, edx
sub r11, 1
jne 0x1801933e0
test r10d, r10d
je 0x1801934d0
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov ecx, dword [rbx + r8*4]
xor ecx, eax
add r10d, 0xffffffff
jne 0x1801934b0
mov rbx, qword [rsp]
not ecx
mov eax, ecx
add rsp, 8
ret

Function at 0x180193df0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov r10, r8
mov rdi, r9
imul r10d, edx
mov rsi, rdx
cmp byte [r9], 0
mov r11, rcx
je 0x180193e4a
mov rdx, rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x48]
mov r8d, r10d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180193e36
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
xor edx, edx
div rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov edx, dword [r9 + 0x24]
mov ecx, dword [r9 + 0x20]
sub ecx, edx
mov qword [rsp + 0x40], rbx
lea eax, [rdx + r10]
cmp eax, dword [r9 + 0x20]
cmovbe ecx, r10d
add rdx, qword [r9 + 0x18]
mov ebx, ecx
mov r8d, ecx
mov rcx, r11
call fcn.1801c9a10
add dword [rdi + 0x24], ebx
mov eax, ebx
mov rbx, qword [rsp + 0x40]
xor edx, edx
div rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180193e90
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
sub rsp, 0x38
cmp byte [rcx], 0
mov r14, rdx
mov qword [rsp + 0x58], rbp
mov rbx, rcx
mov qword [rsp + 0x30], rdi
mov edi, 1
je 0x180193ee0
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x60]
mov r8d, edi
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180193eda
mov byte [rbx + 0x10], dil
mov ebp, dword [rsp + 0x60]
jmp 0x180193f17
mov qword [rsp + 0x68], rsi
mov esi, dword [rcx + 0x24]
mov ecx, dword [rcx + 0x20]
lea eax, [rsi + 1]
cmp eax, ecx
jbe 0x180193ef6
mov edi, ecx
sub edi, esi
mov rdx, rsi
mov r8d, edi
add rdx, qword [rbx + 0x18]
lea rcx, [rsp + 0x50]
mov ebp, edi
call fcn.1801c9a10
lea eax, [rsi + rdi]
mov rsi, qword [rsp + 0x68]
mov dword [rbx + 0x24], eax
mov rdi, qword [rsp + 0x30]
cmp ebp, 1
mov rbp, qword [rsp + 0x58]
jne 0x180193f38
movzx eax, byte [rsp + 0x50]
mov dword [r14], eax
xor eax, eax
add rsp, 0x38
pop r14
pop rbx
ret
cmp byte [rbx], 0
je 0x180193f2e
cmp byte [rbx + 0x10], 0
je 0x180193f2e
mov eax, 0xffffffff
add rsp, 0x38
pop r14
pop rbx
ret
Function at 0x1801958a0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbp, rcx
mov edi, r8d
mov ecx, 0x348
mov r15d, edx
call fcn.1801c7c04
mov qword [rsp + 0x88], rax
xor r12d, r12d
mov ecx, 0x104
mov r14, rax
lea rbx, [rax + 0x13c]
mov qword [rax], r12
mov rdx, rbx
mov dword [rax + 8], 0xffffffff
mov dword [rax + 0x138], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
sub rbx, 2
nop
cmp word [rbx + 2], r12w
lea rbx, [rbx + 2]
jne 0x180195900
mov eax, dword [0x1802651a0]
mov dword [rbx], eax
mov qword [rsp + 0x70], rsi
cmp edi, 1
jne 0x180195948
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, edi
je 0x18019595a
mov dword [0x1802f0d98], 0x2000000
mov edx, 0x348
mov rcx, r14
call fcn.1801c74d4
xor eax, eax
jmp 0x180195abb
lea eax, [rdi - 2]
cmp eax, 1
jbe 0x18019595a
mov eax, 0x10000
jmp 0x180195a8c
xor sil, sil
mov qword [rsp + 0x88], r12
cmp edi, 1
je 0x1801959b5
cmp edi, 2
jne 0x180195a13
mov qword [rsp + 0x30], r12
lea r8d, [rdi - 1]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x88], rax
cmp rax, 0xffffffffffffffff
jne 0x180195a03
mov eax, 0x200
jmp 0x180195a8c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x88]
mov rcx, rax
mov dword [rsp + 0x28], r12d
mov r8, rbx
mov dword [rsp + 0x20], r12d
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x1801959fb
mov eax, 0x100
jmp 0x180195a8c
mov rax, qword [rsp + 0x88]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
sete sil
mov ecx, Ordinal_41
call fcn.1801c7c04
lea ecx, [rdi - 1]
mov rbx, rax
cmp ecx, 1
jbe 0x180195a3f
mov word [rax], 0x100
mov qword [rax + 0x18], rbp
mov dword [rax + 0x20], r15d
mov dword [rax + 0x24], r12d
mov dword [rax + 0x14], r12d
jmp 0x180195a7b
mov byte [rax], 1
mov byte [rax + 1], sil
mov rax, qword [rsp + 0x88]
mov qword [rbx + 8], rax
mov byte [rbx + 0x10], r12b
mov dword [rbx + 0x14], r12d
test sil, sil
je 0x180195a7b
mov rcx, qword [rsp + 0x88]
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbx + 0x14], eax
mov rcx, rbx
call fcn.1801941b0
mov qword [r14], rax
mov eax, dword [0x1802f11cc]
mov dword [0x1802f0d98], eax
test eax, eax
je 0x180195aa7
mov edx, 0x348
mov rcx, r14
call fcn.1801c74d4
xor eax, eax
jmp 0x180195abb
mov ecx, reloc.WS2_32.dll_recv
call fcn.1801c7c04
mov dword [rax], 1
mov qword [rax + 8], r14
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x18019cf00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, rdx
mov r14, r9
shr rax, 0x10
mov rbp, r8
mov rdi, rcx
test ax, ax
je 0x18019cf58
cmp word [rdx], 0x3c
jne 0x18019cf51
call fcn.18019f6c0
test al, al
jne 0x18019d003
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
call fcn.18019f8b0
jmp 0x18019cf33
mov rcx, qword [0x1802f0d68]
test rcx, rcx
cmove rcx, qword [0x1802f0d58]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x18019cf3b
mov rcx, qword [0x1802f0d68]
mov rdx, rax
test rcx, rcx
cmove rcx, qword [0x1802f0d58]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
test rax, rax
jne 0x18019cfa6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x18019cf3b
mov rcx, qword [0x1802f0d68]
mov rdx, rsi
test rcx, rcx
mov qword [rsp + 0x40], rbx
mov qword [rdi + 0x148], r14
cmove rcx, qword [0x1802f0d58]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r8d, ebx
mov rcx, rdi
mov rdx, rax
call fcn.18019f7b0
mov rbx, qword [rsp + 0x40]
test al, al
je 0x18019cf3b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov qword [rdi + 0x150], rbp
mov r9, qword [rsp + 0x68]
mov rdx, r14
mov r8, qword [rsp + 0x60]
mov rcx, rdi
call fcn.18019d020
jmp 0x18019cf3d
Function at 0x1801aaec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x10]
mov rbx, rcx
mov r10d, edx
mov ecx, edx
and r10d, 7
je 0x1801aaf26
mov r8d, dword [rbx + 0x14]
cmp edx, r10d
jge 0x1801aaf14
mov r9, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r9
jb 0x1801aaef0
xor cl, cl
jmp 0x1801aaef9
movzx ecx, byte [rax]
inc rax
mov qword [rbx], rax
movzx eax, cl
mov ecx, edx
shl eax, cl
add edx, 8
or eax, r8d
mov dword [rbx + 0x10], edx
mov dword [rbx + 0x14], eax
mov r8d, eax
cmp edx, 0x18
jle 0x1801aaee4
mov ecx, r10d
shr r8d, cl
sub edx, r10d
mov dword [rbx + 0x14], r8d
mov dword [rbx + 0x10], edx
mov ecx, edx
xor r9d, r9d
test edx, edx
jle 0x1801aaf5e
mov edx, dword [rbx + 0x14]
lea r8, [rsp + 0x30]
nop word [rax + rax]
movzx eax, byte [rbx + 0x14]
inc r9d
shr edx, 8
sub ecx, 8
mov byte [r8], al
lea r8, [r8 + 1]
mov dword [rbx + 0x14], edx
test ecx, ecx
jg 0x1801aaf40
mov dword [rbx + 0x10], ecx
movsxd rcx, r9d
cmp rcx, 4
jge 0x1801aaf92
mov r8, qword [rbx + 8]
nop dword [rax + rax]
mov rax, qword [rbx]
cmp rax, r8
jb 0x1801aaf7c
xor dl, dl
jmp 0x1801aaf85
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x1801aaf70
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov qword [rsp + 0x38], rdi
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x1801ab013
mov rcx, qword [rbx]
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
ja 0x1801ab013
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x1801aafed
mov rcx, rbx
call fcn.1801aa6c0
test eax, eax
je 0x1801ab013
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call fcn.1801c9a10
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret