joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14138905c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x141389066
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x14138908f
pop rbp
sub rbp, 0x33
sub rbp, 0x138905c
sub rsp, 0x20
jmp 0x1413890ae
mov rax, 0x138905c
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffdf47e1b4
xor byte [rax], dl
inc rax
dec rcx
jne 0x1413890cd
jmp 0x1413890e4
cld
cmp eax, 0x883d3f5d
mov ah, 0xb4
mov ah, 0xfc
xor eax, 0xb4b5bc75
mov ah, 0xfc
mov ch, 0x5d
cld
jae 0x14138916e
mov ebp, 0xfcb4b4b4
jae 0x141389177
pushfq
mov ah, 0xb4
mov ah, 0xfc
push r14
cld
mov ch, 0x75
invalid
xor eax, 0xb4b4b4b8
cld
mov ch, 0x5c
in al, 0xe4
cld
or al, 0x70
pushfq
mov ah, 0xb4
mov ah, 0xb4
mov ah, 0xfc
or eax, 0xb5bb0b22
mov ah, 0xb4
mov ah, 0xb4
cld
mov ch, 0x5d
cld
invalid
test dword [rbp - 0x4f8aca04], esp
mov ah, 0xb4
mov ah, 0xfc
jl 0x14138910c
jl 0x14138910c
xor dword [rdx + 0x4b], ebx
ja 0x141389144
out dx, al
out 0xe4, al
cld
or al, 0x70
pushfq
mov ah, 0xb4
mov ah, 0xb4
mov ah, 0xfc
or eax, 0xb5bb0b22
mov ah, 0xb4
mov ah, 0xb4
cld
mov ah, 0xfc
mov ch, 0x5d
pop rsp
mov cl, 0xb4
mov ah, 0xb4
pop rbp
cmp dword [rsi + 0x5ce6b4b4], esi
leave
mov ah, 0xb4
mov ah, 0xee
jrcxz 0x141389181
cmp eax, 0x7d85fc63
cld
test dword [rsi + 0x37], esp
pop rsp
mov cl, 0xfc
jl 0x14138914f
xor al, dl
mov ah, 0xb4
mov ah, 0xbb
cmp al, 0xea
mov ah, 0xb4
mov ah, 0xd2
invalid
Function at 0x180003010
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x18014a610]
lea rcx, [rsp + 0x20]
lea edx, [rax + 8]
mov r9d, 0x2b09
mov dword [rsp + 0x20], 0x2b672b7c
mov dword [rsp + 0x24], 0x2b672b62
mov dword [rsp + 0x28], 0x2b7e2b66
mov qword [rsp + 0x2c], 0x2b092b67
mov qword [rsp + 0x34], rax
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180048330
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.18009a820
add rsp, 0x130
pop rbp
ret

Function at 0x18000da50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x18000da84
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x18000da70
mov rcx, rax
shr rcx, 0x20
xor eax, ecx
ret
Function at 0x18001a320
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
sub rsp, 0x160
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x170], rbx
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rsp + 0x150], rax
call fcn.180019be0
test al, al
je 0x18001a59b
lea rcx, [0x180149320]
call fcn.180049110
test al, al
jne 0x18001a3de
lea rcx, [0x1801492c0]
call fcn.180049110
test al, al
je 0x18001a385
call fcn.180048d80
test al, al
sete al
jmp 0x18001a3d2
lea rcx, [0x1801493e0]
call fcn.180049110
test al, al
je 0x18001a3a1
call fcn.180048dd0
test al, al
sete al
jmp 0x18001a3d2
lea rcx, [0x180149380]
call fcn.180049110
test al, al
je 0x18001a59b
lea rcx, [rsp + 0x90]
call fcn.180002da0
mov qword [rsp + 0x70], rax
cmp dword [rax + 0xc], 7
je 0x18001a3de
call fcn.180048d80
mov byte [rsp + 0x20], al
test al, al
je 0x18001a59b
lea rcx, [0x1801492c0]
call fcn.180049110
test al, al
je 0x18001a3f9
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
call fcn.18001a5e0
mov qword [rsp + 0x80], rax
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
or rdi, 0xffffffffffffffff
cmp word [rax], bx
jne 0x18001a445
mov r8d, ebx
jmp 0x18001a45a
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x18001a450
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180003b20
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call fcn.180063160
nop
cmp qword [rsp + 0x48], 8
jb 0x18001a48d
mov rcx, qword [rsp + 0x30]
call fcn.18007c990
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
lea rcx, [rsp + 0xb0]
call fcn.180002fa0
nop
call fcn.180038440
mov dl, 1
mov ecx, 0x2718
call fcn.18001bb20
lea rcx, [0x1801492c0]
call fcn.180049110
test al, al
je 0x18001a4ed
xor edx, edx
lea rcx, [0x18004a3b0]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x18004a3b0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
jne 0x18001a504
mov rcx, rbx
mov qword [rsp + 0x50], rbx
jmp 0x18001a50c
mov rcx, qword [rcx]
mov qword [rsp + 0x50], rcx
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.180039520
nop
cmp qword [rsp + 0xc8], 8
jb 0x18001a533
mov rcx, qword [rsp + 0xb0]
call fcn.18007c990
mov qword [rsp + 0xc8], 7
mov qword [rsp + 0xc0], rbx
mov word [rsp + 0xb0], bx
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x18001a59b
mov qword [rsp + 0x28], rcx
mov eax, edi
lock xadd dword [rcx + 8], eax
dec eax
jne 0x18001a59b
mov rbx, qword [rsp + 0x28]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
dec edi
jne 0x18001a59b
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
call fcn.180053210
mov rcx, qword [0x180149218]
test rcx, rcx
je 0x18001a5b5
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18009a820
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x18001af40
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x60
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14, rcx
cmp edx, 1
jne 0x18001b12b
xor esi, esi
mov ebx, esi
lea rdi, [0x1801492c0]
mov dword [rsp + 0x30], ebx
cmp ebx, 4
jge 0x18001afa7
movsxd rax, ebx
lea rcx, [rax + rax*2]
shl rcx, 5
add rcx, rdi
call fcn.180049110
test al, al
jne 0x18001afb7
inc ebx
jmp 0x18001af83
call fcn.1800494d0
test al, al
jne 0x18001afb7
xor eax, eax
jmp 0x18001b130
call fcn.1800494d0
test al, al
je 0x18001afca
mov eax, 1
jmp 0x18001b130
mov qword [0x180149218], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x180149210], eax
mov rcx, r14
call fcn.18001ad60
call fcn.18001b160
or rdi, 0xffffffffffffffff
cmp word [rax], 0
jne 0x18001aff9
mov r8, rsi
jmp 0x18001b00b
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001b000
mov rdx, rax
lea rcx, [0x18013c318]
call fcn.180003b20
mov rcx, r14
call fcn.18004a570
nop
lea rcx, [0x180149320]
call fcn.180049110
test al, al
je 0x18001b038
call fcn.180038440
lea rcx, [0x1801493e0]
call fcn.180049110
test al, al
je 0x18001b095
call fcn.180048dd0
test al, al
je 0x18001b058
xor eax, eax
jmp 0x18001b130
call fcn.180038440
mov dword [rsp + 0x44], esi
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x18001a790]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call fcn.18004a950
mov eax, 1
jmp 0x18001b130
mov dword [rsp + 0x40], esi
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x18001a790]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.180064e30
nop
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x18001b0e2
mov rsi, qword [rax]
mov rcx, rsi
call fcn.18004a950
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x18001b12b
mov eax, edi
lock xadd dword [rbx + 8], eax
dec eax
jne 0x18001b12b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
dec edi
jne 0x18001b12b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x18001b12b
mov eax, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18009a820
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x180036720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x224e
lea r8, [0x18014aea8]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x2226222d
mov dword [rsp + 0x24], 0x2221223c
mov dword [rsp + 0x28], 0x222b2223
mov dword [rsp + 0x2c], 0x222a2260
mov dword [rsp + 0x30], 0x22222222
mov qword [rsp + 0x34], r9
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180048330
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.18009a820
add rsp, 0x130
pop rbp
ret

Function at 0x1800368b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x5203
lea r8, [0x18014aed0]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x526b5260
mov dword [rsp + 0x24], 0x526c5271
mov dword [rsp + 0x28], 0x5266526e
mov dword [rsp + 0x2c], 0x5267522d
mov dword [rsp + 0x30], 0x526f526f
mov qword [rsp + 0x34], r9
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180048330
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.18009a820
add rsp, 0x130
pop rbp
ret
Function at 0x180037170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x18014af68]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xc]
mov r9d, 0x4948
mov dword [rsp + 0x20], 0x492d493b
mov dword [rsp + 0x24], 0x493d492b
mov dword [rsp + 0x28], 0x497b493a
mov dword [rsp + 0x2c], 0x4966497a
mov dword [rsp + 0x30], 0x4924492c
mov qword [rsp + 0x34], 0x49484924
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180048330
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.18009a820
add rsp, 0x130
pop rbp
ret

Function at 0x180039130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x265c
lea r8, [0x18014b158]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x262f260b
mov dword [rsp + 0x24], 0x2603266e
mov dword [rsp + 0x28], 0x266e266f
mov dword [rsp + 0x2c], 0x26382672
mov dword [rsp + 0x30], 0x26302630
mov qword [rsp + 0x34], r9
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180048330
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.18009a820
add rsp, 0x130
pop rbp
ret
Function at 0x180039320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x5611
lea r8, [0x18014b188]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x56625646
mov dword [rsp + 0x24], 0x564e5623
mov dword [rsp + 0x28], 0x56235622
mov dword [rsp + 0x2c], 0x5675563f
mov dword [rsp + 0x30], 0x567d567d
mov qword [rsp + 0x34], r9
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180048330
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.18009a820
add rsp, 0x130
pop rbp
ret
Function at 0x180048a90
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x68], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov edi, ecx
xor ebx, ebx
mov dword [rsp + 0x40], ebx
xor eax, eax
mov qword [r11 - 0x44], rax
mov qword [r11 - 0x3c], rax
mov qword [r11 - 0x34], rax
mov qword [r11 - 0x2c], rax
mov qword [r11 - 0x24], rax
mov dword [rsp + 0x6c], eax
lea rcx, [r11 - 0x48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsp + 0x40], bx
jne 0x180048af1
xor al, al
jmp 0x180048b6c
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov r8d, edi
call fcn.1800483a0
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180064e30
nop
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x180048b24
mov rbx, qword [rax]
lea rdx, [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x28], 0
sete sil
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x180048b68
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
dec eax
jne 0x180048b68
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock dec dword [rbx + 0xc]
jne 0x180048b68
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + reloc.WS2_32.dll_htonl]
movzx eax, sil
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18009a820
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x18004b930
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x110
call fcn.1800a3900
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
jne 0x18004b996
cmp dword [rsp + 0x28], 2
jb 0x18004b996
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18009a820
add rsp, 0x158
ret
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18009a820
add rsp, 0x158
ret
Function at 0x18004c660
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rsp + 0xd0], rbx
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov esi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18004c6a3
xor eax, eax
jmp 0x18004c8a6
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x18004c6dd
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x18004c6dd
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
mov eax, esi
jmp 0x18004c8a6
cmp qword [rbx + 0x90], 0
jne 0x18004c6ef
or eax, 0xffffffff
jmp 0x18004c8a6
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x80]
cmp qword [r8], rax
jne 0x18004c719
mov rdx, qword [rbx + 0x70]
mov rcx, qword [rbx + 0x68]
mov qword [r8], rcx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp qword [rbx + 0x78], 0
jne 0x18004c73d
movsx ecx, sil
mov rdx, qword [rbx + 0x90]
call fcn.18009c39c
or ebx, 0xffffffff
cmp eax, ebx
cmovne ebx, esi
jmp 0x18004c8a4
mov byte [rbp - 1], sil
xor r15d, r15d
mov qword [rbp + 0x17], r15
mov qword [rbp + 0x1f], r15
mov qword [rbp + 0x1f], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x17], r15
mov byte [rbp + 7], r15b
xor r8d, r8d
lea edx, [r15 + 8]
lea rcx, [rbp + 7]
call fcn.180018620
nop
mov r10, qword [rbp + 7]
mov r9, qword [rbp + 0x1f]
nop word [rax + rax]
lea rdx, [rbp + 7]
cmp r9, 0x10
cmovae rdx, r10
lea r8, [rbp + 7]
cmovae r8, r10
mov rcx, qword [rbx + 0x78]
mov r10, qword [rcx]
add rdx, qword [rbp + 0x17]
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r8
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
lea r9, [rbp]
lea r8, [rbp - 1]
lea rdx, [rbx + 0x84]
call qword [r10 + 0x38]
test eax, eax
js 0x18004c881
cmp eax, 1
jg 0x18004c862
lea rax, [rbp + 7]
mov r10, qword [rbp + 7]
mov r9, qword [rbp + 0x1f]
cmp r9, 0x10
cmovae rax, r10
mov rdi, qword [rbp - 9]
sub rdi, rax
je 0x18004c829
lea rcx, [rbp + 7]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rbx + 0x90]
mov r8, rdi
mov edx, 1
call fcn.18009ccb4
cmp rdi, rax
jne 0x18004c881
mov r9, qword [rbp + 0x1f]
mov r10, qword [rbp + 7]
mov byte [rbx + 0x81], 1
lea rax, [rbp - 1]
cmp qword [rbp - 0x11], rax
jne 0x18004c85e
test rdi, rdi
jne 0x18004c780
cmp qword [rbp + 0x17], 0x20
jae 0x18004c881
xor r8d, r8d
lea edx, [rdi + 8]
lea rcx, [rbp + 7]
call fcn.180009ff0
jmp 0x18004c76d
mov ebx, esi
jmp 0x18004c884
cmp eax, 3
jne 0x18004c881
movsx ecx, byte [rbp - 1]
mov rdx, qword [rbx + 0x90]
call fcn.18009c39c
or ebx, 0xffffffff
cmp eax, ebx
cmovne ebx, esi
jmp 0x18004c884
or ebx, 0xffffffff
cmp qword [rbp + 0x1f], 0x10
jb 0x18004c894
mov rcx, qword [rbp + 7]
call fcn.18007c990
mov qword [rbp + 0x1f], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x17], r15
mov byte [rbp + 7], 0
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.18009a820
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18004d590
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
cmp qword [rcx + 0x78], 0
je 0x18004d707
cmp byte [rcx + 0x81], 0
je 0x18004d707
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
jne 0x18004d5ec
xor al, al
jmp 0x18004d709
xor r14d, r14d
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x20], r14
mov byte [rbp - 0x30], r14b
xor r8d, r8d
lea edx, [r14 + 8]
lea rcx, [rbp - 0x30]
call fcn.180018620
nop
mov r10, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
lea rdx, [rbp - 0x30]
cmp r9, 0x10
cmovae rdx, r10
lea r8, [rbp - 0x30]
cmovae r8, r10
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x20]
add r9, rdx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x84]
call qword [r10 + 0x40]
test eax, eax
je 0x18004d660
dec eax
jne 0x18004d6d7
jmp 0x18004d667
mov byte [rdi + 0x81], 0
lea rax, [rbp - 0x30]
mov r10, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
cmp r9, 0x10
cmovae rax, r10
mov rbx, qword [rbp - 0x38]
sub rbx, rax
je 0x18004d6b1
lea rcx, [rbp - 0x30]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x90]
mov r8, rbx
mov edx, 1
call fcn.18009ccb4
cmp rbx, rax
jne 0x18004d6dc
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x30]
cmp byte [rdi + 0x81], 0
je 0x18004d6e0
test rbx, rbx
jne 0x18004d620
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rbp - 0x30]
call fcn.180009ff0
jmp 0x18004d618
sub eax, 2
je 0x18004d6e0
xor bl, bl
jmp 0x18004d6e2
mov bl, 1
cmp qword [rbp - 0x18], 0x10
jb 0x18004d6f2
mov rcx, qword [rbp - 0x30]
call fcn.18007c990
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x20], r14
mov byte [rbp - 0x30], 0
movzx eax, bl
jmp 0x18004d709
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18009a820
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret