joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d99f0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov rax, rsp
push r14
sub rsp, 0xf0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
xor r14d, r14d
mov dword [rsp + 0x50], r14d
test rdx, rdx
je 0x1400d9aed
test rbx, rbx
je 0x1400d9aed
mov rax, qword [rcx]
mov qword [rsp + 0x20], rbx
mov r9, rdx
lea r8, str.RunSetupExe_Start__s__s
lea edx, [r14 + 4]
call qword [rax + reloc.WS2_32.dll_recv]
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
xor edx, edx
lea r8d, [r14 + 0x68]
lea rcx, [rsp + 0x80]
call fcn.140141ad0
mov dword [rsp + 0x80], WSAGetLastError
mov word [rsp + 0xc0], r14w
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, eax
mov dword [rsp + 0x50], eax
mov r10, qword [rsi]
mov r9d, eax
lea r8, str.RunSetupExe_End___d_
lea edx, [r14 + 4]
mov rcx, rsi
call qword [r10 + reloc.WS2_32.dll_recv]
nop
jmp 0x1400d9ae9
mov eax, ebx
jmp 0x1400d9aef
xor eax, eax
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret

Function at 0x1400d9e40
Capabilities:
Create thread

Disassembly:
sub rsp, 0x28
test edx, edx
je 0x1400d9e57
call fcn.1400d9d70
mov eax, 1
add rsp, 0x28
ret
mov r8, rcx
xor edx, edx
lea rcx, [0x1400d9c60]
call fcn.14014b6f4
mov eax, 1
add rsp, 0x28
ret

Function at 0x1400dac90
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
lea rcx, [rsp + 0x48]
call fcn.1401541c8
call fcn.1400db630
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rax, qword [rsp + 0x48]
mov qword [0x140312228], rax
call fcn.1400db880
mov dword [0x140312238], 1
mov r8, rbx
xor edx, edx
lea rcx, [0x1400dad90]
call fcn.14014b6f4
nop
add rsp, 0x30
pop rbx
ret

Function at 0x1400dad40
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rbx, rcx
mov dword [rsp + 0x20], 0
lea rcx, [0x140312258]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov r8, rbx
xor edx, edx
lea rcx, [0x1400db310]
call fcn.14014b6f4
mov eax, 1
mov dword [rsp + 0x20], eax
jmp 0x1400dad87
add rsp, 0x30
pop rbx
ret
Function at 0x1400de1a0
Capabilities:
Hide graphical window

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov ebx, edx
mov rdi, rcx
mov rax, qword [rcx]
call qword [rax + 0x30]
test ebx, ebx
je 0x1400de206
mov qword [rsp + 0x20], 0
lea r9, [0x1400de0a0]
xor r8d, r8d
lea edx, [r8 + 0x65]
mov rcx, qword [0x140312348]
call qword [sym.imp.USER32.dll_CreateDialogParamA]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.USER32.dll_UpdateWindow]
mov edx, 5
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rdi
call fcn.1400ddf30
mov r14, rax
mov edx, 1
mov rcx, rdi
call fcn.1400de350
mov rbx, rax
test rax, rax
je 0x1400de230
mov qword [rax + 8], r14
mov dword [rax], 1
cmp dword [0x1403124d8], 0
je 0x1400de26b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_GetMessageA]
dec eax
cmp eax, 0xfffffffd
ja 0x1400de26b
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x1400de230
mov rcx, r14
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400de281
mov rcx, r14
call qword [sym.imp.USER32.dll_DestroyWindow]
mov dword [rbx], 0
mov qword [rbx + 8], 0
mov rdx, rbx
mov rcx, rdi
call fcn.1400de150
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + gethostname]
nop
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r14
ret
Function at 0x1400e2f70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x44]
mov rdi, rcx
mov qword [rsp + 0x30], rbp
nop word [rax + rax]
mov edx, dword [rdi + 0x94]
mov esi, dword [rdi + 0x58]
sub esi, dword [rdi + 0x9c]
mov ecx, dword [rdi + 0x44]
sub esi, edx
add ecx, 0xfffffefa
add ecx, ebx
cmp edx, ecx
jb 0x1400e302c
mov rcx, qword [rdi + 0x50]
mov r8, rbx
lea rdx, [rcx + rbx]
call fcn.1401415b0
mov r8d, dword [rdi + 0x74]
mov rax, qword [rdi + 0x68]
sub dword [rdi + 0x98], ebx
sub dword [rdi + 0x94], ebx
sub dword [rdi + 0x84], ebx
lea rdx, [rax + r8*2]
nop
movzx eax, word [rdx - 2]
lea rdx, [rdx - 2]
cmp eax, ebx
jb 0x1400e2ff0
sub eax, ebx
jmp 0x1400e2ff2
xor eax, eax
mov word [rdx], ax
add r8d, 0xffffffff
jne 0x1400e2fe0
mov rax, qword [rdi + 0x60]
mov edx, ebx
lea rcx, [rax + rbx*2]
nop word [rax + rax]
movzx eax, word [rcx - 2]
lea rcx, [rcx - 2]
cmp eax, ebx
jb 0x1400e3020
sub eax, ebx
jmp 0x1400e3022
xor eax, eax
mov word [rcx], ax
add edx, 0xffffffff
jne 0x1400e3010
add esi, ebx
mov rcx, qword [rdi]
cmp dword [rcx + 8], 0
je 0x1400e30a6
mov edx, dword [rdi + 0x9c]
mov r8d, esi
mov eax, dword [rdi + 0x94]
add rdx, rax
add rdx, qword [rdi + 0x50]
call fcn.1400e3400
add dword [rdi + 0x9c], eax
mov r9d, dword [rdi + 0x9c]
cmp r9d, 3
jb 0x1400e3090
mov eax, dword [rdi + 0x94]
mov rdx, qword [rdi + 0x50]
mov ecx, dword [rdi + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x7c]
mov dword [rdi + 0x70], r8d
cmp r9d, 0x106
jae 0x1400e30a6
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x1400e2f90
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e8a30
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
mov r10, rdx
movzx r9d, cx
movabs rax, 0x79baa6bb6398b6f7
shr ecx, 0x10
mul r8
mov rax, r8
mov rbx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0xc
imul rax, rax, 0x15b0
sub r8, rax
test r10, r10
jne 0x1400e8a78
lea eax, [r10 + 1]
mov rbx, qword [rsp + 8]
ret
test rbx, rbx
je 0x1400e8b4c
xor edx, edx
cmp r8, 7
jbe 0x1400e8afa
lea r11d, [rdx + 7]
nop dword [rax]
movzx eax, byte [r10]
add r11d, 8
add r9d, eax
add edx, 8
movzx eax, byte [r10 + 1]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 2]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 3]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 4]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 5]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 6]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 7]
add ecx, r9d
add r9d, eax
add r10, 8
add ecx, r9d
mov eax, r11d
cmp rax, r8
jb 0x1400e8a90
mov eax, edx
cmp rax, r8
jae 0x1400e8b17
movzx eax, byte [r10]
inc edx
add r9d, eax
inc r10
add ecx, r9d
mov eax, edx
cmp rax, r8
jb 0x1400e8b01
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
sub rbx, r8
mov r8d, 0x15b0
jne 0x1400e8a81
mov rbx, qword [rsp + 8]
shl ecx, 0x10
lea eax, [r9 + rcx]
ret

Function at 0x1400e8b60
Capabilities:
Encode data using xor

Disassembly:
mov r9, r8
mov r10, rdx
test rdx, rdx
jne 0x1400e8b6e
xor eax, eax
ret
not ecx
test r8, r8
je 0x1400e8bb4
lea r11, [0x1402200d0]
nop dword [rax]
movzx r8d, byte [r10]
lea r10, [r10 + 1]
mov eax, ecx
shr ecx, 4
xor rax, r8
shr r8, 4
and eax, 0xf
mov edx, dword [r11 + rax*4]
xor edx, ecx
mov eax, edx
shr edx, 4
and eax, 0xf
xor rax, r8
mov ecx, dword [r11 + rax*4]
xor ecx, edx
sub r9, 1
jne 0x1400e8b80
not ecx
mov eax, ecx
ret
Function at 0x1400e9490
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test rcx, rcx
je 0x1400e95d0
mov r9, qword [rcx + 0x58]
test r9, r9
je 0x1400e95d0
cmp edx, dword [rcx + 0x10]
jae 0x1400e95d0
cmp dword [rcx + 0x14], 1
jne 0x1400e95d0
mov eax, edx
lea r8, [rax*4]
mov rax, qword [r9 + 0x20]
mov edi, dword [rax + r8]
add rdi, qword [r9]
je 0x1400e95d0
test rsi, rsi
je 0x1400e95d0
mov dword [rsi], edx
mov rax, qword [rcx + 0x58]
mov qword [rsp + 0x30], rbx
mov rcx, qword [rax + 0x20]
mov eax, dword [r8 + rcx]
mov dword [rsi + 4], eax
movzx eax, word [rdi + 4]
mov word [rsi + 8], ax
movzx eax, word [rdi + 6]
mov word [rsi + 0xa], ax
movzx eax, word [rdi + 8]
mov word [rsi + 0xc], ax
movzx eax, word [rdi + 0xa]
mov word [rsi + 0xe], ax
movzx edx, word [rdi + 0xe]
movzx ecx, word [rdi + 0xc]
call fcn.1400e8bc0
mov qword [rsi + 0x10], rax
lea rdx, [rdi + 0x2e]
mov eax, dword [rdi + 0x10]
mov ecx, 0x103
mov dword [rsi + 0x18], eax
mov eax, dword [rdi + 0x14]
mov qword [rsi + 0x20], rax
mov eax, dword [rdi + 0x18]
mov qword [rsi + 0x28], rax
movzx eax, word [rdi + 0x24]
mov word [rsi + 0x30], ax
mov eax, dword [rdi + 0x26]
mov dword [rsi + 0x34], eax
mov eax, dword [rdi + 0x2a]
mov qword [rsi + 0x38], rax
movzx eax, word [rdi + 0x1c]
cmp eax, ecx
cmovb ecx, eax
mov ebx, ecx
lea rcx, [rsi + 0x44]
mov r8d, ebx
call fcn.1401415b0
mov byte [rbx + rsi + 0x44], 0
mov ecx, 0xff
movzx eax, word [rdi + 0x20]
cmp eax, ecx
cmovb ecx, eax
mov dword [rsi + 0x40], ecx
movzx edx, word [rdi + 0x1e]
mov ebx, ecx
add rdx, rdi
movzx ecx, word [rdi + 0x1c]
mov r8d, ebx
add rcx, 0x2e
add rdx, rcx
lea rcx, [rsi + 0x148]
call fcn.1401415b0
mov byte [rbx + rsi + 0x148], 0
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ef9f0
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rdi
push r14
push r15
sub rsp, 0xa0
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x14030bc70]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov r15d, edx
mov r14, rcx
mov qword [rsp + 0x60], rcx
xor esi, esi
mov dword [rsp + 0x40], esi
or rdi, 0xffffffffffffffff
mov qword [r11 - 0x70], rdi
lea rcx, [0x140312698]
call fcn.1400f2d80
nop
mov ebx, esi
mov dword [rsp + 0x50], ebx
nop dword [rax]
cmp ebx, 0x32
jge 0x1400efaa0
cmp rdi, 0xffffffffffffffff
jne 0x1400efaaa
test ebx, ebx
jle 0x1400efa68
lea ecx, [rdi + 0x15]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r14
call fcn.1400efd80
mov rdi, rax
mov qword [rsp + 0x48], rax
jmp 0x1400efa50
cmp rdi, 0xffffffffffffffff
je 0x1400efb67
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, esi
mov dword [rsp + 0x54], ebx
cmp ebx, 0xa
jae 0x1400efb13
mov rdx, qword [r14 + 0x108]
mov rax, qword [rdx - 0x10]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x58]
mov r8d, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400efb04
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, 1
mov dword [rsp + 0x40], esi
jmp 0x1400efb13
mov ecx, reloc.WS2_32.dll_sendto
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
jmp 0x1400efabd
test r15d, r15d
je 0x1400efb21
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x48], rdi
mov rdx, r14
lea rcx, [rsp + 0x78]
call fcn.140022180
nop
lea rcx, [rsp + 0x78]
call fcn.1400fd6d0
nop
lea rcx, [rsp + 0x78]
call fcn.1400091f0
nop
jmp 0x1400efb67
xor edx, edx
mov r8d, 0x104
mov rcx, r14
call fcn.140141ad0
lea rcx, [r14 + 0x108]
call fcn.1400f87f0
lea rcx, [r14 + 0x110]
call fcn.1400f87f0
lea rcx, [0x140312698]
call fcn.1400f3130
mov rbx, rax
nop
test rbx, rbx
je 0x1400efbea
mov rdx, rbx
lea rcx, [0x140312698]
call fcn.1400f3190
mov r15, rax
mov rcx, rbx
call fcn.1400494c0
test rax, rax
je 0x1400efbe5
mov rcx, rbx
call fcn.1400494c0
cmp r14, rax
jne 0x1400efbe5
xor r8d, r8d
mov rdx, rbx
lea rcx, [0x140312698]
call fcn.1400f3290
jmp 0x1400efbea
mov rbx, r15
jmp 0x1400efba0
mov qword [rsp + 0x68], r14
test r14, r14
je 0x1400efc1b
lea rcx, [r14 + 0x110]
call fcn.1400f81a0
nop
lea rcx, [r14 + 0x108]
call fcn.1400f81a0
mov edx, 0x118
mov rcx, r14
call fcn.1401139ac
nop
jmp 0x1400efc26
lea rcx, [0x140312698]
call fcn.1400f3270
cmp rdi, 0xffffffffffffffff
je 0x1400efc41
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140113910
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400f0e20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x450
mov rax, qword [0x14030bc70]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor edi, edi
mov rsi, r9
mov r14, r8
mov rbx, rdx
mov rbp, rcx
test rcx, rcx
je 0x1400f0f38
test rdx, rdx
je 0x1400f0f38
test r9, r9
je 0x1400f0f38
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x400
call fcn.140141ad0
lea rdx, [rsp + 0x40]
sub rdx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rdx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x1400f0e90
lea rax, [rsp + 0x38]
mov qword [rsp + 0x38], rdi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400f0f38
mov eax, dword [rsp + 0x4a8]
mov dword [rsp + 0x30], edi
sub eax, 1
je 0x1400f0ee2
sub eax, 3
je 0x1400f0f2e
cmp eax, 3
jne 0x1400f0eed
mov eax, dword [rsp + 0x4a0]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x4a8]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov ecx, 1
cmove edi, ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1400f0f3a
mov dword [rsp + 0x30], 4
jmp 0x1400f0eed
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140113910
add rsp, 0x450
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400f1440
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov r15, rdx
or r14, 0xffffffffffffffff
mov qword [rax - 0x60], r14
xor r13d, r13d
mov esi, r13d
mov qword [rax - 0x58], r13
mov r12d, r13d
mov qword [rax - 0x50], r13
test rdx, rdx
je 0x1400f16c2
cmp byte [rdx], sil
je 0x1400f16c2
lea rcx, [0x140312698]
call fcn.1400f2d80
nop
lea rdx, [0x140312698]
lea rcx, [rsp + 0x68]
call fcn.1400f2a90
nop
lea rcx, [rsp + 0x68]
call fcn.1400f31e0
mov r9, rax
test rax, rax
je 0x1400f14f3
mov r8, r15
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400f14e3
inc rax
test ecx, ecx
jne 0x1400f14d0
test edx, edx
jne 0x1400f14f1
mov rsi, r9
mov qword [rsp + 0x50], r9
jmp 0x1400f14f3
jmp 0x1400f14b0
test rsi, rsi
jne 0x1400f166c
mov ebx, r13d
mov dword [rsp + 0x40], ebx
cmp ebx, 0x32
jge 0x1400f1555
cmp r14, 0xffffffffffffffff
jne 0x1400f155f
test ebx, ebx
jle 0x1400f151c
lea ecx, [r14 + 0x15]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, r15
call fcn.1400efd80
mov r14, rax
mov qword [rsp + 0x48], rax
jmp 0x1400f1503
cmp r14, 0xffffffffffffffff
je 0x1400f166c
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea ecx, [rax + 1]
mov ebx, ecx
call fcn.140113934
mov r12, rax
mov qword [rsp + 0x58], rax
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.140141ad0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0xb8]
mov r8d, edi
mov rdx, r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400f165a
mov ecx, 0x118
call fcn.1400dba80
mov rsi, rax
mov qword [rsp + 0xc0], rax
test rax, rax
je 0x1400f1608
xor edx, edx
mov r8d, 0x118
mov rcx, rax
call fcn.140141ad0
mov rax, qword [0x14030b570]
mov qword [rsi + 0x108], rax
mov rax, qword [0x14030b570]
mov qword [rsi + 0x110], rax
jmp 0x1400f160b
mov rsi, r13
mov qword [rsp + 0x50], rsi
mov r8d, 0x103
mov rdx, r15
mov rcx, rsi
call fcn.140157390
lea rcx, [rsi + 0x108]
mov rdx, r12
call fcn.1400f82d0
mov rdx, r12
lea rcx, [rsi + 0x110]
call fcn.1400f82d0
lea rcx, [rsi + 0x110]
call fcn.1400f92b0
mov rdx, rsi
lea rcx, [0x140312698]
call fcn.1400f2cc0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or r14, 0xffffffffffffffff
mov qword [rsp + 0x48], r14
lea rcx, [rsp + 0x68]
call fcn.1400f2b30
nop
jmp 0x1400f1688
test r12, r12
je 0x1400f1696
mov rcx, r12
call fcn.1401139ac
nop
jmp 0x1400f16a2
lea rcx, [0x140312698]
call fcn.1400f3270
cmp r14, 0xffffffffffffffff
je 0x1400f16bd
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
jmp 0x1400f16c4
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400f20a0
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x60
lea rax, [r11 + 0x20]
mov rbx, r8
mov qword [r11 - 0x28], rax
xor r9d, r9d
lea rax, [r11 - 0x18]
xor r8d, r8d
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1400f2106
mov rcx, qword [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x60
pop rbx
ret
xor eax, eax
add rsp, 0x60
pop rbx
ret

Function at 0x1400f2e30
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rdi, rdx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x1400f2eb1
mov edx, 8
lea r8d, [rdx + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
jne 0x1400f2e92
lea rcx, str.____DataEvent::_Failed_to_allocate_memory_n_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [rsp + 0x40], 1
lea rdx, [0x140307c28]
lea rcx, [rsp + 0x40]
call fcn.1401419e8
int3
mov qword [rax + 8], rbx
mov qword [rsp + 0x50], rax
lea rdx, [0x1402214e0]
mov qword [rax], rdx
xor ecx, ecx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rdi
jmp 0x1400f2ef7
mov ecx, 0x20
call fcn.140113934
test rax, rax
jne 0x1400f2eda
mov dword [rsp + 0x40], 1
lea rdx, [0x140307c28]
lea rcx, [rsp + 0x40]
call fcn.1401419e8
int3
xor ecx, ecx
mov qword [rax + 8], rcx
mov qword [rsp + 0x40], rax
lea rdx, [0x1402214e0]
mov qword [rax], rdx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400f3a50
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [rcx + 0x4c], 0x67452301
mov dword [rcx + 0x50], 0xefcdab89
xor edx, edx
mov qword [rcx], rdx
mov dword [rcx + 0x54], 0x98badcfe
mov dword [rcx + 0x58], 0x10325476
mov dword [rcx + 0x5c], 0xc3d2e1f0
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
mov word [rcx + 0x48], dx
mov qword [rcx + 0x60], rax
mov qword [rcx + 0x68], rax
mov dword [rcx + 0x70], eax
ret
Function at 0x1400f6060
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x1e0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x14030bc70]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x20], 0
mov edx, 0x104
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x1400f60eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Could_not_obtain_Windows_Directory_path___i_.
lea rcx, [rsp + 0x40]
call fcn.1400222e0
nop
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.14003e850
lea rdx, [0x140305ef8]
lea rcx, [rsp + 0x80]
call fcn.1401419e8
nop
mov r8d, eax
lea rdx, [rsp + 0xc0]
mov rcx, rbx
call fcn.1400221c0
mov dword [rsp + 0x20], 1
lea rdx, str.Logs
lea rcx, [rsp + 0x40]
call fcn.140022180
nop
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.1400226d0
nop
lea rcx, [rsp + 0x40]
call fcn.1400091f0
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140030f50
nop
lea rcx, [rsp + 0x60]
call fcn.140048c20
test al, al
jne 0x1400f6156
lea rcx, [rsp + 0x60]
call fcn.140048c10
lea rdx, str._szalocx.log
lea rcx, [rsp + 0x40]
call fcn.140022180
nop
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.1400226d0
nop
lea rcx, [rsp + 0x40]
call fcn.1400091f0
nop
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x60]
call fcn.1400091f0
mov rax, rbx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140113910
add rsp, 0x1e0
pop rbx
ret
Function at 0x1400f72a0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x14030bc70]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r12d, r9d
mov r15, r8
mov rdi, rdx
mov r13, qword [rsp + 0x2e0]
mov r14, qword [rsp + 0x2e8]
mov qword [rsp + 0x48], r14
xor ebx, ebx
mov dword [rsp + 0x30], ebx
cmp dword [rcx], ebx
je 0x1400f73f3
test rdx, rdx
je 0x1400f73f3
test r8, r8
je 0x1400f73f3
test r13, r13
je 0x1400f73f3
mov esi, ebx
xor ecx, ecx
call qword [sym.imp.WSOCK32.dll_WSASetLastError]
nop
mov dword [rsp + 0x60], ebx
mov edx, ebx
mov dword [rsp + 0x40], ebx
nop word [rax + rax]
cmp edx, ebx
jae 0x1400f7348
mov ecx, edx
mov rax, qword [rdi]
cmp qword [rsp + rcx*8 + 0x68], rax
je 0x1400f7348
inc edx
mov dword [rsp + 0x40], edx
jmp 0x1400f7330
test edx, edx
jne 0x1400f735f
cmp ebx, 0x40
jae 0x1400f735f
mov rcx, qword [rdi]
mov eax, edx
mov qword [rsp + rax*8 + 0x68], rcx
inc dword [rsp + 0x60]
mov ecx, dword [r13 + 4]
inc ecx
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], ebx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x1400f73c2
lea rdx, [rsp + 0x60]
mov rcx, qword [rdi]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1400f73c2
xor r9d, r9d
mov r8d, r12d
mov rdx, r15
mov rcx, qword [rdi]
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
mov dword [rsp + 0x30], eax
test esi, esi
jne 0x1400f73e7
lea eax, [rbx + 1]
test eax, 0xfffffffe
jne 0x1400f73e7
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov esi, eax
jmp 0x1400f73e7
test r14, r14
je 0x1400f73ef
mov dword [r14], esi
mov eax, ebx
jmp 0x1400f73f5
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140113910
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400f76f0
Capabilities:
Send data
Send data on socket

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov r10d, r9d
mov r11, r8
mov rdi, rdx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
test rdx, rdx
je 0x1400f777c
test r8, r8
je 0x1400f777c
test r9d, r9d
je 0x1400f777c
xor r9d, r9d
mov r8d, r10d
cmp dword [rsp + 0x70], r9d
je 0x1400f7753
lea rcx, [rdx + 0x90]
mov eax, dword [rdx + 0x110]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rdx, r11
mov rcx, qword [rdi]
call qword [sym.imp.WS2_32.dll_sendto]
jmp 0x1400f7763
mov rcx, qword [rcx + 0x30]
mov rdx, r11
mov rcx, qword [rcx]
call qword [sym.imp.WS2_32.dll_send]
mov ecx, 1
cmp eax, 0xffffffff
cmovne ebx, ecx
mov dword [rsp + 0x30], ebx
jmp 0x1400f7778
mov eax, ebx
jmp 0x1400f777e
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret