joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140134820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov byte [rax + 0x18], r8b
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov r15, r9
mov r13, rdx
mov rsi, rcx
mov rax, qword [rcx]
mov qword [rsp + 0x30], rax
mov rbx, qword [rax + 8]
mov r12, rax
mov dil, 1
cmp byte [rbx + 0x19], 0
jne 0x140134958
mov rax, qword [r9 + 0x18]
mov r14, qword [r9 + 0x10]
mov r12, rbx
test r8b, r8b
je 0x1401348d6
lea rcx, [rbx + 0x20]
cmp rax, 0x10
jb 0x14013488c
mov rdx, qword [r15]
jmp 0x14013488f
mov rdx, r15
lea rsi, [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x14013489d
mov rcx, qword [rcx]
mov rsi, qword [rsi]
mov r8, r14
cmp rsi, r14
cmovb r8, rsi
test r8, r8
je 0x1401348ba
call fcn.1401420f0
mov edi, eax
test eax, eax
jne 0x1401348cd
cmp rsi, r14
jae 0x1401348c4
or edi, 0xffffffff
jmp 0x1401348cd
xor edi, edi
cmp rsi, r14
seta dil
shr edi, 0x1f
xor dil, 1
jmp 0x140134929
lea rdx, [rbx + 0x20]
lea rdi, [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1401348e8
mov rdx, qword [rdx]
cmp rax, 0x10
jb 0x1401348f3
mov rcx, qword [r15]
jmp 0x1401348f6
mov rcx, r15
mov rdi, qword [rdi]
mov r8, rdi
cmp r14, rdi
cmovb r8, r14
test r8, r8
je 0x140134911
call fcn.1401420f0
test eax, eax
jne 0x140134923
cmp r14, rdi
jae 0x14013491b
or eax, 0xffffffff
jmp 0x140134923
xor eax, eax
cmp r14, rdi
seta al
shr eax, 0x1f
movzx edi, al
test dil, dil
je 0x140134933
mov rbx, qword [rbx]
jmp 0x140134937
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x19], 0
mov rax, qword [r15 + 0x18]
movzx r8d, byte [rsp + 0x80]
je 0x140134875
mov rax, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x70]
mov rbx, r12
test dil, dil
je 0x140134a0a
cmp r12, qword [rax]
jne 0x1401349a1
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r15
mov r9, r12
mov r8b, 1
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.140134550
mov rax, qword [rax]
mov qword [r13], rax
mov byte [r13 + 8], 1
mov rax, r13
jmp 0x140134a5c
cmp byte [r12 + 0x19], 0
je 0x1401349b0
mov rbx, qword [r12 + 0x10]
jmp 0x140134a0a
mov rax, qword [r12]
cmp byte [rax + 0x19], 0
jne 0x1401349df
mov rbx, rax
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
jne 0x140134a0a
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
je 0x1401349d0
jmp 0x140134a0a
mov rax, qword [r12 + 8]
cmp byte [rax + 0x19], 0
jne 0x140134a02
nop word [rax + rax]
cmp rbx, qword [rax]
jne 0x140134a02
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401349f0
cmp byte [rbx + 0x19], 0
cmove rbx, rax
lea rcx, [rbx + 0x20]
mov rdx, r15
call fcn.14000d200
test al, al
je 0x140134a50
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r15
mov r9, r12
movzx r8d, dil
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.140134550
mov rax, qword [rax]
mov qword [r13], rax
mov byte [r13 + 8], 1
mov rax, r13
jmp 0x140134a5c
mov qword [r13], rbx
mov byte [r13 + 8], 0
mov rax, r13
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14013b720
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x10], 0
lea rbp, [rdx + 0x10]
mov rsi, rdx
mov dword [rsp + 0x20], 0
mov rdi, rcx
jne 0x14013b76f
call fcn.140121540
lea rax, vtable.Poco::Net::Impl::IPv4AddressImpl.0
mov qword [rdi], rax
xor eax, eax
mov dword [rdi + 0x10], eax
mov rax, rdi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp qword [rdx + 0x18], 0x10
mov qword [rsp + 0x40], rbx
jb 0x14013b780
mov rcx, qword [rdx]
jmp 0x14013b783
mov rcx, rsi
call qword [sym.imp.WSOCK32.dll_inet_addr]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14013b7e2
cmp qword [rsi + 0x18], 0x10
jb 0x14013b79a
mov rsi, qword [rsi]
mov rbp, qword [rbp]
mov r8d, reloc.WSOCK32.dll_ntohs
cmp rbp, r8
cmovb r8, rbp
test r8, r8
je 0x14013b7c3
lea rdx, str.255.255.255.255
mov rcx, rsi
call fcn.1401420f0
test eax, eax
jne 0x14013b7c9
cmp rbp, 0xf
je 0x14013b7e2
mov rcx, rdi
call fcn.140121540
lea rax, vtable.Poco::Net::Impl::IPv4AddressImpl.0
mov qword [rdi], rax
xor eax, eax
mov dword [rdi + 0x10], eax
jmp 0x14013b7f7
mov rcx, rdi
call fcn.140121540
lea rax, vtable.Poco::Net::Impl::IPv4AddressImpl.0
mov dword [rdi + 0x10], ebx
mov qword [rdi], rax
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14013b810
Capabilities:
Resolve dns

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
sub rsp, 0xa0
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x14030bc70]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rax, rdx
mov rsi, rcx
xor ebx, ebx
mov dword [rsp + 0x28], ebx
cmp qword [rdx + 0x10], rbx
je 0x14013b90d
xor ecx, ecx
mov qword [rsp + 0x30], rcx
mov qword [r11 - 0x80], rcx
mov qword [r11 - 0x78], rcx
mov qword [r11 - 0x70], rcx
mov qword [r11 - 0x68], rcx
mov qword [r11 - 0x60], rcx
mov dword [rsp + 0x30], 4
cmp qword [rdx + 0x18], 0x10
jb 0x14013b87e
mov rax, qword [rdx]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rax
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x14013b90a
mov rax, qword [rsp + 0x20]
mov rdi, qword [rax + 0x20]
mov ebx, dword [rdi + 0x18]
lea rcx, [rsp + 0x68]
call fcn.140121540
lea rbp, vtable.Poco::Net::Impl::IPv6AddressImpl.0
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x88], ebx
movups xmm0, xmmword [rdi + 8]
movups xmmword [rsp + 0x78], xmm0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rcx, rsi
call fcn.140121540
mov qword [rsi], rbp
mov eax, dword [rsp + 0x88]
mov dword [rsi + 0x20], eax
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [rsi + 0x10], xmm0
lea rax, vtable.Poco::Net::Impl::IPAddressImpl.0
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x68]
call fcn.140121570
jmp 0x14013b929
mov rcx, rsi
call fcn.140121540
lea rbp, vtable.Poco::Net::Impl::IPv6AddressImpl.0
mov qword [rsi], rbp
mov dword [rsi + 0x20], ebx
xor eax, eax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rax
mov rax, rsi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140113910
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret

Function at 0x14013ca00
Capabilities:
Resolve dns

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rdi
sub rsp, 0x60
xor eax, eax
mov dword [rsp + 0x28], 0
cmp qword [rdx + 0x18], 0x10
mov rbx, rdx
mov qword [r11 - 0x38], rax
mov rdi, rcx
mov dword [r11 - 0x38], r8d
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x10], rax
jb 0x14013ca44
mov rcx, qword [rdx]
jmp 0x14013ca47
mov rcx, rbx
lea r9, [rsp + 0x20]
xor edx, edx
lea r8, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x14013ca86
mov rdx, qword [rsp + 0x20]
mov rcx, rdi
call fcn.14013c4a0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rbx, qword [rsp + 0x88]
mov rax, rdi
add rsp, 0x60
pop rdi
ret
mov rdx, rbx
mov ecx, eax
call fcn.14013c870
int3
Function at 0x14013fa30
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x20
mov qword [rsp + 0x48], rbp
lea rdi, [rcx + 0x80]
mov r14, rcx
mov qword [rsp + 0x50], r15
mov ecx, 0x40
mov r15, rdx
mov rbp, r8
call fcn.140113934
mov ecx, 0x40
mov qword [rdi], rax
lea rsi, [r14 + 0x88]
call fcn.140113934
mov qword [rsi], rax
xor ecx, ecx
mov rax, qword [rdi]
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
mov qword [rax + 0x30], rcx
mov qword [rax + 0x38], rcx
mov rax, qword [rsi]
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
mov qword [rax + 0x30], rcx
mov qword [rax + 0x38], rcx
cmp rbp, 0x40
jbe 0x14013fb37
mov rax, qword [r14 + 8]
lea rcx, [r14 + 8]
mov qword [rsp + 0x40], rbx
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [r14 + 8]
lea rcx, [r14 + 8]
mov r8, rbp
mov rdx, r15
call qword [rax + 0x20]
mov rax, qword [r14 + 8]
lea rcx, [r14 + 8]
call qword [rax + 0x18]
mov r9, qword [rdi]
mov r8d, 0x40
mov r10, qword [rsi]
mov r11, rax
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rax]
cmp rcx, qword [rax + 8]
je 0x14013fb53
nop dword [rax]
mov edx, r8d
dec r8d
test edx, edx
jle 0x14013fb53
movzx eax, byte [rcx]
mov byte [r9], al
inc r9
movzx eax, byte [rcx]
inc rcx
mov byte [r10], al
inc r10
cmp rcx, qword [r11 + 8]
jne 0x14013fb10
jmp 0x14013fb53
mov rcx, qword [rdi]
mov r8, rbp
mov rdx, r15
call fcn.1401415b0
mov rcx, qword [rsi]
mov r8, rbp
mov rdx, r15
call fcn.1401415b0
mov rcx, qword [rsi]
xor r9d, r9d
mov rax, qword [rdi]
mov r15, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
lea rdx, [rcx + 0x3f]
lea r8, [rax + 0x3f]
cmp rcx, r8
ja 0x14013fb7c
cmp rdx, rax
jae 0x14013fc21
cmp rcx, rdi
ja 0x14013fb8a
cmp rdx, rdi
jae 0x14013fc21
cmp rcx, rsi
ja 0x14013fb98
cmp rdx, rsi
jae 0x14013fc21
cmp rax, rdi
ja 0x14013fba2
cmp r8, rdi
jae 0x14013fc21
cmp rax, rsi
ja 0x14013fbac
cmp r8, rsi
jae 0x14013fc21
movdqa xmm2, xmmword [str.6666666666666666_]
mov rdx, r9
movdqa xmm3, xmmword [0x1402217f0]
mov r9d, 0x40
nop word [rax + rax]
movdqu xmm0, xmmword [rax + rdx]
movdqa xmm1, xmm3
pxor xmm0, xmm2
movdqu xmmword [rax + rdx], xmm0
movdqu xmm0, xmmword [rcx + rdx]
pxor xmm1, xmm0
movdqu xmmword [rcx + rdx], xmm1
movdqu xmm0, xmmword [rax + rdx + 0x10]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax + rdx + 0x10], xmm1
movdqu xmm0, xmmword [rcx + rdx + 0x10]
movdqa xmm1, xmm3
pxor xmm1, xmm0
movdqu xmmword [rcx + rdx + 0x10], xmm1
add rdx, 0x20
cmp rdx, r9
jl 0x14013fbd0
movsxd rax, r9d
cmp rax, 0x40
jge 0x14013fc47
nop word [rax + rax]
mov rcx, qword [rdi]
xor byte [rax + rcx], 0x36
mov rcx, qword [rsi]
xor byte [rcx + rax], 0x5c
inc rax
cmp rax, 0x40
jl 0x14013fc30
mov rax, qword [r14]
mov rcx, r14
add rsp, 0x20
pop r14
pop rdi
pop rsi
jmp qword [rax + reloc.WS2_32.dll_recv]
Function at 0x140161160
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140114010
sub rsp, rax
mov rax, qword [0x14030bc70]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r14, rdx
mov rbx, rcx
call fcn.14016aef0
xor esi, esi
movsxd r12, eax
cmp dword [rbx + 0x10], esi
jne 0x1401611b4
mov rax, r14
jmp 0x1401612ce
mov rax, qword [rbx]
mov rdi, r12
sub rax, qword [rbx + 8]
xor r8d, r8d
cqo
sar rdi, 6
sub rax, rdx
mov rbx, r12
sar rax, 1
and ebx, 0x3f
mov r15, rax
shl rbx, 6
lea rax, [0x140000000]
mov ecx, r12d
mov rdx, qword [rax + rdi*8 + 0x315eb0]
mov rbp, r12
mov rdx, qword [rbx + rdx + 0x30]
call fcn.140170858
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rdi*8 + 0x315eb0]
cmp r13, qword [rbx + rcx + 0x30]
je 0x14016121b
or rax, 0xffffffffffffffff
jmp 0x1401612ce
mov rcx, rbp
mov qword [rsp + 0x20], rsi
sar rcx, 6
lea r9, [rsp + 0x30]
and ebp, 0x3f
lea rdx, [rsp + 0x40]
shl rbp, 6
mov r8d, 0x1000
mov rcx, qword [rax + rcx*8 + 0x315eb0]
mov rcx, qword [rcx + rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140161212
xor r8d, r8d
mov rdx, r14
mov ecx, r12d
call fcn.140170858
test rax, rax
js 0x140161212
mov eax, dword [rsp + 0x30]
cmp r15, rax
jg 0x140161212
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test r15, r15
je 0x1401612c2
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x1401612c2
cmp byte [rcx], 0xd
jne 0x1401612a8
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1401612b7
cmp byte [rcx + 1], 0xa
jne 0x1401612b7
inc rcx
jmp 0x1401612b7
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x30c300]
add rcx, rax
inc rsi
inc rcx
cmp rsi, r15
jne 0x14016128a
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140113910
lea r11, [rsp + 0x1050]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140162ff4
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140162e7f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140162e7f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140162e7f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140162e7f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140162e7f
cmp dword [rcx + 0x84], 0xe
jbe 0x140162e7f
cmp dword [rcx + 0xf8], 0
je 0x140162e7f
mov ecx, ebx
call fcn.140162f20
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140162cfc
cmp dword [rbp + 0x20], 0
je 0x140162ecc
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140162ed4
int3
xor r8d, r8d
xor edx, edx
jmp 0x140162e18
Function at 0x14016f870
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r10, [0x140315eb0]
mov r14, rdx
mov rax, r15
sar rax, 6
mov rdx, r15
and edx, 0x3f
mov rdi, r15
shl rdx, 6
mov r9, qword [r10 + rax*8]
mov r12, qword [r9 + rdx + 0x28]
test r8, r8
je 0x14016f8d5
cmp byte [r14], 0xa
jne 0x14016f8d5
mov rcx, r15
mov rax, r15
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r10 + rax*8]
or byte [rax + rcx + 0x38], 4
jmp 0x14016f8f6
mov dl, byte [r9 + rdx + 0x38]
mov rcx, rdi
and dl, 0xfb
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r10 + rax*8]
mov byte [rax + rcx + 0x38], dl
lea rbp, [r14 + r8]
mov rsi, r14
mov rbx, r14
cmp r14, rbp
jae 0x14016fa50
mov r13d, 1
mov al, byte [rsi]
cmp al, 0x1a
je 0x14016fa10
cmp al, 0xd
je 0x14016f92a
mov byte [rbx], al
add rbx, r13
add rsi, r13
jmp 0x14016fa05
lea rax, [rsi + 1]
cmp rax, rbp
jae 0x14016f950
cmp byte [rax], 0xa
jne 0x14016f942
mov byte [rbx], 0xa
mov eax, 2
jmp 0x14016f948
mov byte [rbx], reloc.WSOCK32.dll_listen
mov rax, r13
add rsi, rax
jmp 0x14016fa02
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, r13d
lea rdx, [rsp + 0x70]
mov rcx, r12
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14016f9f8
cmp dword [rsp + 0x78], 0
je 0x14016f9f8
mov rcx, rdi
lea r10, [0x140315eb0]
and ecx, 0x3f
mov rax, rdi
sar rax, 6
shl rcx, 6
mov rax, qword [r10 + rax*8]
test byte [rax + rcx + 0x38], 0x48
je 0x14016f9c8
mov dl, byte [rsp + 0x70]
cmp dl, 0xa
je 0x14016f9d4
mov rcx, rdi
mov byte [rbx], reloc.WSOCK32.dll_listen
mov rax, rdi
and ecx, 0x3f
sar rax, 6
shl rcx, 6
mov rax, qword [r10 + rax*8]
mov byte [rax + rcx + 0x3a], dl
jmp 0x14016fa02
cmp byte [rsp + 0x70], 0xa
jne 0x14016f9d9
cmp rbx, r14
jne 0x14016f9d9
mov byte [rbx], 0xa
jmp 0x14016fa02
mov r8d, r13d
or rdx, 0xffffffffffffffff
mov ecx, r15d
call fcn.140170860
cmp byte [rsp + 0x70], 0xa
lea r10, [0x140315eb0]
je 0x14016fa05
jmp 0x14016f9ff
lea r10, [0x140315eb0]
mov byte [rbx], reloc.WSOCK32.dll_listen
add rbx, r13
cmp rsi, rbp
jb 0x14016f90f
jmp 0x14016fa50
mov rcx, rdi
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r10 + rax*8]
mov dl, byte [rax + rcx + 0x38]
test dl, 0x40
jne 0x14016fa49
mov rax, rdi
or dl, 2
sar rax, 6
and edi, 0x3f
shl rdi, 6
mov rax, qword [r10 + rax*8]
mov byte [rax + rdi + 0x38], dl
jmp 0x14016fa50
mov cl, byte [rsi]
mov byte [rbx], cl
add rbx, r13
sub rbx, r14
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14016fa70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r11, [0x140315eb0]
mov r9, r15
mov rax, r15
sar rax, 6
and r9d, 0x3f
shl r9, 6
mov r14, rdx
mov rdi, r15
mov r10d, 0xa
mov rdx, qword [r11 + rax*8]
mov r12, qword [rdx + r9 + 0x28]
test r8, r8
je 0x14016fadc
cmp word [r14], r10w
jne 0x14016fadc
mov rcx, r15
mov rax, r15
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r11 + rax*8]
or byte [rax + rcx + 0x38], 4
jmp 0x14016fafd
mov dl, byte [rdx + r9 + 0x38]
mov rcx, rdi
and dl, 0xfb
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r11 + rax*8]
mov byte [rax + rcx + 0x38], dl
lea rbp, [r14 + r8*2]
mov rsi, r14
mov rbx, r14
cmp r14, rbp
jae 0x14016fcd6
mov ecx, reloc.WSOCK32.dll_listen
lea r13d, [rcx - 0xb]
movzx eax, word [rsi]
cmp ax, 0x1a
je 0x14016fc94
cmp ax, cx
je 0x14016fb39
mov word [rbx], ax
add rbx, r13
add rsi, r13
jmp 0x14016fc2d
lea rax, [rsi + 2]
cmp rax, rbp
jae 0x14016fb61
cmp word [rax], r10w
jne 0x14016fb53
mov word [rbx], r10w
mov eax, 4
jmp 0x14016fb59
mov word [rbx], cx
mov rax, r13
add rsi, rax
jmp 0x14016fc77
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x80]
mov r8d, r13d
lea rdx, [rsp + 0x70]
mov rcx, r12
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14016fc7c
cmp dword [rsp + 0x80], 0
je 0x14016fc7c
mov rcx, rdi
lea r11, [0x140315eb0]
and ecx, 0x3f
mov rax, rdi
sar rax, 6
mov r10d, 0xa
shl rcx, 6
mov rax, qword [r11 + rax*8]
test byte [rax + rcx + 0x38], 0x48
je 0x14016fc3b
movzx eax, word [rsp + 0x70]
cmp ax, r10w
jne 0x14016fbd3
mov word [rbx], r10w
jmp 0x14016fc25
mov r8, rdi
mov word [rsp + 0x78], ax
mov r9, rdi
and r8d, 0x3f
sar r9, 6
mov ecx, reloc.WSOCK32.dll_listen
xor edx, edx
mov word [rbx], cx
shl r8, 6
mov rcx, qword [r11 + r9*8]
mov al, byte [rsp + rdx + 0x78]
add rcx, r8
mov byte [rcx + rdx + 0x3a], al
inc rdx
cmp rdx, r13
jl 0x14016fbf4
mov rcx, rdi
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r11 + rax*8]
mov byte [rax + rcx + 0x3c], r10b
add rbx, r13
mov ecx, reloc.WSOCK32.dll_listen
cmp rsi, rbp
jb 0x14016fb19
jmp 0x14016fcd6
cmp word [rsp + 0x70], r10w
jne 0x14016fc48
cmp rbx, r14
je 0x14016fbcd
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.140170860
mov r10d, 0xa
lea r11, [0x140315eb0]
cmp word [rsp + 0x70], r10w
je 0x14016fc28
lea ecx, [r10 + 3]
mov word [rbx], cx
add rbx, r13
jmp 0x14016fc2d
mov ecx, reloc.WSOCK32.dll_listen
lea r11, [0x140315eb0]
mov word [rbx], cx
add rbx, r13
lea r10d, [rcx - 3]
jmp 0x14016fc2d
mov rcx, rdi
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r11 + rax*8]
mov dl, byte [rax + rcx + 0x38]
test dl, 0x40
jne 0x14016fccd
mov rax, rdi
or dl, r13b
sar rax, 6
and edi, 0x3f
shl rdi, 6
mov rax, qword [r11 + rax*8]
mov byte [rax + rdi + 0x38], dl
jmp 0x14016fcd6
movzx ecx, word [rsi]
mov word [rbx], cx
add rbx, r13
sub rbx, r14
sar rbx, 1
lea rax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140170a30
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140170a50
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14014b8ec
or eax, 0xffffffff
jmp 0x140170a52
xor eax, eax
add rsp, 0x28
ret
Function at 0x14017b92c
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14017b93f
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14017bfa4
lea rdx, [0x140307450]
lea rcx, [rsp + 0x20]
call fcn.1401419e8
int3

Function at 0x140186668
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1403164c8]
xor edx, edx
jmp fcn.14017b92c

Function at 0x140187044
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1403164c8]
jmp fcn.14017b92c

Function at 0x14019aaf0
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov qword [rax - 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14030bc70]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r15d, r8d
mov rdi, rdx
mov r13, rcx
mov rax, qword [rdx + 8]
sub rax, qword [rdx]
test rax, 0xfffffffffffffffc
je 0x14019ac91
cmp r8d, 0xffffffff
jne 0x14019ab59
call fcn.14019b210
mov r15d, eax
cmp eax, 0xffffffff
jne 0x14019ab59
xor al, al
jmp 0x14019ac93
xor r12d, r12d
mov ebp, r12d
mov qword [rsp + 0x30], r12
lea rdx, [r13 + 0xb0]
cmp qword [rdx + 0x18], 0x10
jb 0x14019ab75
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, qword [r13 + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rsi, qword [rsp + 0x30]
test eax, eax
je 0x14019abb8
test rsi, rsi
je 0x14019ac91
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, r12
mov qword [rsp + 0x30], r12
test rsi, rsi
je 0x14019ac91
mov rbx, qword [rdi]
mov rdi, qword [rdi + 8]
cmp rbx, rdi
je 0x14019ac79
mov edx, dword [rbx]
lea rcx, [rsp + 0x40]
call fcn.1401a3d80
nop
cmp qword [rax + 0x18], 0x10
jb 0x14019abe8
mov rax, qword [rax]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
sete r14b
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jb 0x14019ac3a
mov rcx, qword [rsp + 0x40]
inc rax
cmp rax, 0x1000
jb 0x14019ac35
test cl, 0x1f
jne 0x14019ac73
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14019ac6d
sub rcx, rax
cmp rcx, 8
jb 0x14019ac67
cmp rcx, 0x27
ja 0x14019ac61
mov rcx, rax
call fcn.1400dbae0
mov qword [rsp + 0x58], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0x50], r12
mov byte [rsp + 0x40], 0
lea eax, [rbp + 1]
test r14b, r14b
cmove eax, ebp
mov ebp, eax
add rbx, 4
jmp 0x14019abc8
call fcn.14014b4d8
int3
call fcn.14014b4d8
int3
call fcn.14014b4d8
int3
call fcn.14014b4d8
int3
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
jle 0x14019ac91
mov edx, r15d
mov rcx, r13
call fcn.14019d120
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140113910
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret