joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50d460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50d527
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x3233726d8461766a
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0x6c6a792e
movabs rdx, 0xa020a0100020901
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x905030900040a02
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x50d4c8
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0xa]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0xa]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xe
jge 0x50d4f7
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x50d51a
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xc
jb 0x50d4ab
jmp 0x50d50e
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00451880
mov eax, edi
mov ecx, 0xc
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0050d460

Function at 0x50e1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50e2b2
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x61f7e304a30d0347
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x57658f61f7e304a3
mov qword [rsp + 0x22], rdx
movabs rdx, 0x808050503050101
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x806040604020808
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x50e24c
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x62]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0xe
jge 0x50e27e
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x50e2a5
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x62]
cmp rsi, 0xb
jb 0x50e232
jmp 0x50e295
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.00451880
mov eax, edi
mov ecx, 0xb
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0050e1e0
Function at 0x50e2c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50e39d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x683a745140585244
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x544d3b4e7355424d
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd06090c0e040103
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf060d06090c0e04
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd0f0c0a01020c01
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x50e340
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x20]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x20]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x50e36d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x50e390
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x10
jb 0x50e322
jmp 0x50e384
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x10
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00451880
mov eax, edi
mov ecx, 0x10
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.0050e2c0

Function at 0x50ee00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50eecc
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xf3537997866565a9
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6c88a1f353799786
mov qword [rsp + 0x22], rdx
movabs rdx, 0x904000007080807
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2000700030a0904
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x50ee6f
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x10]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x10]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x50ee9c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x50eebf
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xb
jb 0x50ee52
jmp 0x50eeb3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451880
mov eax, edi
mov ecx, 0xb
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0050ee00
Function at 0x50eee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50efdb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x63cecffdcddadfeb
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xd1e8725d6c659463
mov qword [rsp + 0x26], rdx
movabs rdx, 0xed65ddd361e24d8e
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb11040f08011010
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1105160e04010d14
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x3001105160e0401
mov qword [rsp + 0x40], rdx
movabs rdx, 0x610160613020813
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x50ef79
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x63]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x1a
jge 0x50efab
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x50efce
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x63]
cmp rsi, 0x17
jb 0x50ef5f
jmp 0x50efc2
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x17
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00451880
mov eax, edi
mov ecx, 0x17
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.0050eee0
Function at 0x14000d620
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140016c60], rbx
je 0x14000d687
cmp rax, rbx
jne 0x14000d67a
mov ebx, 1
mov esi, ebx
jmp 0x14000d68c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000d65f
mov ebx, 1
mov eax, dword [0x140016c68]
cmp eax, ebx
jne 0x14000d6a4
mov edi, 0x1f
mov ecx, edi
call fcn.140149000
jmp 0x14000d710
mov eax, dword [0x140016c68]
test eax, eax
jne 0x14000d705
mov dword [0x140016c68], ebx
lea r15, [0x140010bb8]
lea rdi, [0x140010ba0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000d6f7
test eax, eax
jne 0x14000d6fb
cmp qword [rdi], r14
je 0x14000d6ec
mov rax, qword [rdi]
mov rcx, qword [0x140010b58]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000d6ce
test eax, eax
je 0x14000d70b
mov eax, 0xff
jmp 0x14000d866
mov dword [0x1400163e4], ebx
mov edi, 0x1f
mov eax, dword [0x140016c68]
cmp eax, ebx
jne 0x14000d737
lea rdx, [0x140010b98]
lea rcx, [0x140010b60]
call sub.msvcrt.dll__initterm
mov dword [0x140016c68], 2
test esi, esi
jne 0x14000d745
mov rax, r14
xchg qword [0x140016c60], rax
cmp qword [0x140016c80], r14
je 0x14000d778
lea rcx, [0x140016c80]
call fcn.14000dce0
test eax, eax
je 0x14000d778
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140016c80]
mov r9, qword [0x140010b58]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000d791
mov eax, 0xff
jmp 0x14000d866
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000d817
test ax, ax
je 0x14000d7ac
test edx, edx
jne 0x14000d817
sub ax, bx
cmp ax, di
ja 0x14000d7c2
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000d7ac
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400019fc
mov dword [0x1400163e0], eax
cmp dword [0x140016400], r14d
jne 0x14000d800
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400163e4], r14d
jne 0x14000d815
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400163e0]
jmp 0x14000d866
cmp ax, 0x22
jne 0x14000d82b
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000d79a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14000dd74
add rsp, 0x28
jmp 0x14000d620
Function at 0x140006f48
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], r14
mov rax, qword [0x1402aaed0]
xor rax, rbp
mov qword [rbp + 0x18], rax
mov r8, qword [rcx + 0x38]
lea r14, [0x1402af820]
and qword [rbp + 8], 0
mov rdi, rcx
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0x1000
or r9d, 0xffffffff
mov qword [rsp + 0x20], r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [0x140244b2c]
mov rdx, r14
lea rcx, [rbp + 8]
call fcn.1401bc86c
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x140007140
mov edx, 0xfffffff0
lea r8d, [rdx + 0x12]
call fcn.1401bcd10
mov r9, qword [rbp + 8]
lea rcx, [0x1402b2820]
mov esi, 1
mov edx, esi
lea r8d, [rsi + 0xf]
call fcn.1401c279c
mov rax, qword [0x1402b2820]
cmp rax, qword [0x1402aba50]
jne 0x140007137
mov rax, qword [0x1402b2828]
cmp rax, qword [0x1402aba58]
jne 0x140007137
mov rcx, qword [rbp + 8]
lea edx, [rsi - 0x15]
mov r8d, esi
call fcn.1401bcd10
mov r9, qword [rbp + 8]
lea r8d, [rsi + 3]
mov edx, esi
lea rcx, [rbp]
call fcn.1401c279c
cmp rax, 4
jne 0x140007137
mov ecx, dword [rbp]
call qword [sym.imp.WS2_32.dll_ntohl]
mov rcx, qword [rbp + 8]
lea edx, [rsi - 5]
sub edx, eax
mov dword [rbp], eax
mov r8d, esi
call fcn.1401bcd10
movsxd rdx, dword [rbp]
mov eax, 0xffffffc7
cmp rdx, rax
jae 0x140007097
lea rax, [rdx + 0x38]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140007081
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1401b9e30
sub rsp, rcx
lea rcx, [rsp + 0x30]
jmp 0x140007099
xor ecx, ecx
mov r9d, esi
mov r8d, 8
call fcn.14008ba98
mov rdx, rsi
mov rbx, rax
lea rcx, [rax + 8]
mov qword [rax], rcx
mov rcx, rax
movsxd r8, dword [rbp]
mov r9, qword [rbp + 8]
call fcn.1401c279c
movsxd rdx, dword [rbp]
cmp rax, rdx
jne 0x140007137
mov rcx, qword [rdi + 0x38]
lea rdx, str..msh
and qword [rbp + 0x10], 0
call fcn.14000301c
or r9d, 0xffffffff
mov dword [rsp + 0x28], 0x1000
mov r8, rax
mov qword [rsp + 0x20], r14
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [0x140245a90]
mov rdx, r14
lea rcx, [rbp + 0x10]
call fcn.1401bc86c
mov r9, qword [rbp + 0x10]
test r9, r9
je 0x140007137
movsxd r8, dword [rbp]
mov rdx, rsi
mov rcx, rbx
call fcn.1401c12c0
mov rcx, qword [rbp + 0x10]
call fcn.1401bc954
mov rcx, qword [rbp + 8]
call fcn.1401bc954
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1401b98c0
mov rbx, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x38]
mov rdi, qword [rbp + 0x40]
mov r14, qword [rbp + 0x48]
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x140007300
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1402aaed0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov edi, ecx
xor r9d, r9d
mov ecx, 0xba0
xor r8d, r8d
xor edx, edx
call fcn.14008bc74
xor edx, edx
lea rcx, str.Shcore.dll
mov r8d, 0x800
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rbx + 0x68], rax
test rax, rax
je 0x14000737c
lea rdx, str.SetProcessDpiAwareness
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x70], rax
test rax, rax
jne 0x14000737c
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
and qword [rbx + 0x68], 0
mov ecx, 0x18
mov dword [rbx + 0x98c], 4
call fcn.14008c084
mov rcx, rax
mov qword [rbx], rax
call fcn.1400940cc
or edi, 0x118
mov qword [rbx + 0x30], rax
xor edx, edx
mov dword [rbx + 0x88], edi
mov r8d, 0x800
lea rcx, str.Ws2_32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x1400073e8
lea rdx, str.GetHostNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000742f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
lea rcx, [rbx + 0x8c]
mov edx, 0xff
call qword [sym.imp.WS2_32.dll_gethostname]
test rdi, rdi
je 0x140007408
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
movzx edx, byte [rsp + 0x41]
mov ecx, edx
sub ecx, 0x80
je 0x140007480
cmp ecx, 0x7f
je 0x140007477
mov dword [rbx + 0x99c], edx
jmp 0x14000748a
mov edx, 0x104
lea rcx, [rsp + 0x50]
call rax
test eax, eax
jne 0x1400073fa
and qword [rsp + 0x38], 0
lea rax, [rbx + 0x8c]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x50]
mov dword [rsp + 0x28], 0xff
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x1400073fa
and dword [rbx + 0x99c], 0
jmp 0x14000748a
mov dword [rbx + 0x99c], 3
mov rax, qword [rbx]
mov edx, reloc.WS2_32.dll_recv
test rax, rax
lea rcx, [rax + 0x994]
mov rax, rbx
cmove rcx, rdx
mov qword [rcx], rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401b98c0
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x14000b5e4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rdi, qword [0x1402ae3c0]
xor eax, eax
and dword [rsp + 0x30], 0
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0x34], rax
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], eax
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000b02c
mov edx, 0x7f8a
mov dword [0x1402d39bc], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000b02c
mov edx, 0x7f03
mov dword [0x1402d39a4], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000b02c
mov edx, 0x7f89
mov dword [0x1402d39ac], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000b02c
mov edx, 0x7f8b
mov dword [0x1402d3a30], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000b02c
mov edx, 0x7f01
mov dword [0x1402d3998], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000b02c
mov edx, 0x7f88
mov dword [0x1402d39b0], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000b02c
mov edx, 0x7f86
mov dword [0x1402d39b8], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000b02c
mov edx, 0x7f83
mov dword [0x1402d39c0], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000b02c
mov edx, 0x7f85
mov dword [0x1402d39a8], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000b02c
mov edx, 0x7f82
mov dword [0x1402d39a0], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000b02c
mov edx, 0x7f84
mov dword [0x1402d3a34], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000b02c
mov edx, 0x7f04
mov dword [0x1402d399c], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000b02c
mov edx, 0x7f02
mov dword [0x1402d39b4], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call fcn.14000b02c
lea rcx, [rsp + 0x30]
mov dword [0x1402d39c4], eax
mov dword [rsp + 0x30], 0x18
call qword [sym.imp.USER32.dll_GetCursorInfo]
mov rcx, qword [rsp + 0x38]
call fcn.14000b02c
mov ecx, eax
call fcn.14000af64
mov ecx, 0x1d
mov dword [reloc.WS2_32.dll_connect], eax
call fcn.1401c2864
xor r9d, r9d
mov rcx, rax
xor r8d, r8d
lea edx, [r9 + 5]
call fcn.14008ba98
mov ecx, 0x58
mov rbx, rax
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, 5
mov word [rbx], ax
call qword [sym.imp.WS2_32.dll_htons]
mov dl, byte [reloc.WS2_32.dll_connect]
xor r8d, r8d
mov byte [rbx + 4], dl
mov rcx, rdi
mov rdx, rbx
mov word [rbx + 2], ax
call fcn.1400923cc
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenThread]
and qword [rsp + 0x28], 0
lea r8, [0x14000b4b0]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov qword [0x1402ae390], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x60]
mov qword [0x1402ae3b0], rax
add rsp, 0x50
pop rdi
ret
Function at 0x14000b850
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov ebx, edx
mov dil, cl
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x14000b8de
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, 1
movzx eax, dil
mov word [rsp + 0x28], ax
mov dword [rsp + 0x20], esi
cmp ebx, esi
jne 0x14000b898
mov dword [rsp + 0x2c], 2
jmp 0x14000b8af
cmp ebx, 3
jne 0x14000b8a3
mov dword [rsp + 0x2c], ebx
jmp 0x14000b8af
xor eax, eax
cmp ebx, 4
cmove eax, esi
mov dword [rsp + 0x2c], eax
and dword [rsp + 0x30], 0
xor edx, edx
movzx ecx, dil
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x20]
mov r8d, 0x28
mov word [rsp + 0x2a], ax
mov ecx, esi
call qword [sym.imp.USER32.dll_SendInput]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14000cbb8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [0x1402ae560], 0
mov rbp, r9
mov ebx, edx
mov rdi, rcx
je 0x14000cc35
cmp edx, 2
jl 0x14000cc1f
movzx ecx, word [rcx]
call qword [sym.imp.WS2_32.dll_ntohs]
cmp ax, 0xa
jne 0x14000cc1f
and qword [rsp + 0x28], 0
lea r8, [0x14000bcd4]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14000cc1f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1402ae560]
mov r8d, ebx
mov rdx, rdi
call fcn.140095b1c
mov eax, ebx
jmp 0x14000cc5a
xor esi, esi
jmp 0x14000cc48
add esi, eax
mov edx, ebx
sub edx, esi
movsxd rcx, esi
add rcx, rdi
mov r9, rbp
lea r8, [0x140001824]
call fcn.14000c444
test eax, eax
jne 0x14000cc39
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14000cef8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
mov eax, 0x7580
call fcn.1401b9e30
sub rsp, rax
mov rax, qword [0x1402aaed0]
xor rax, rsp
mov qword [rsp + 0x7570], rax
mov rsi, qword [rcx]
xor r15d, r15d
mov rbp, qword [rcx + 8]
mov edi, r15d
mov ebx, r15d
mov dword [rsp + 0x30], r15d
jmp 0x14000cfba
mov rcx, qword [0x1402aba70]
lea rdx, [rsp + 0x40]
mov r8d, 0x7530
movsxd rax, ebx
sub r8d, ebx
mov qword [rsp + 0x20], r15
add rdx, rax
lea r9, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000cfc9
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14000cfc9
cmp dword [0x1402aba64], r15d
jne 0x14000cfc9
add ebx, eax
mov r14d, ebx
jmp 0x14000cf8b
add edi, eax
mov edx, ebx
movsxd rax, edi
lea rcx, [rsp + 0x40]
sub edx, edi
add rcx, rax
mov r9, rbp
mov r8, rsi
call fcn.14000c444
test eax, eax
jne 0x14000cf89
cmp edi, ebx
mov eax, r15d
cmove ebx, r15d
cmp edi, r14d
cmovne eax, edi
mov edi, eax
cmp dword [0x1402aba64], r15d
je 0x14000cf42
jmp 0x14000cfd3
mov dword [0x1402aba64], 1
xor eax, eax
mov rcx, qword [rsp + 0x7570]
xor rcx, rsp
call fcn.1401b98c0
lea r11, [rsp + 0x7580]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14000db58
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r9
mov r8, rcx
test rdx, rdx
je 0x14000dbb3
cmp dword [0x1402ae3d8], 1
jne 0x14000db82
cmp dword [0x1402aba64], 0
jne 0x14000db82
xor eax, eax
jmp 0x14000dc25
mov eax, dword [rsp + 0x60]
lea r9, [0x140001824]
and dword [0x1402ae3d4], 0
mov dword [0x1402aba68], eax
mov dword [reloc.WS2_32.dll_accept], 5
mov qword [rsp + 0x60], rdi
add rsp, 0x30
pop rdi
jmp fcn.14000d950
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x14]
call fcn.14008bc74
cmp dword [0x1402ae3d8], 1
lea rcx, [0x140001824]
mov dword [0x1402ae404], 1
mov qword [rax], rcx
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
jne 0x14000dc01
cmp dword [0x1402aba64], 0
jne 0x14000dc01
mov rcx, rax
call fcn.1401c141c
jmp 0x14000db7b
and qword [rsp + 0x28], 0
lea r8, [fcn.14000d768]
and dword [rsp + 0x20], 0
mov r9, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x14000dc2c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x1402ae560]
mov dword [0x1402aba64], 1
test rbx, rbx
je 0x14000dc6b
mov rcx, rbx
call fcn.14008bbd0
test eax, eax
je 0x14000dc63
mov rcx, qword [rbx + 0x50]
mov edx, 0x42b
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
and qword [0x1402ae560], 0
add rsp, 0x20
pop rbx
ret

Function at 0x14000de14
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r15
mov r10d, dword [0x1402ae420]
mov ebp, edx
mov r11d, dword [0x1402ae410]
mov eax, r10d
cdq
xor r13d, r13d
idiv r11d
mov r15, r8
mov r12d, ecx
mov r9d, r13d
mov ebx, edx
test edx, edx
je 0x14000de5f
mov r8d, r11d
sub r8d, edx
add r8d, r10d
jmp 0x14000de62
mov r8d, r10d
sub r8d, ebp
sub r8d, dword [0x1402ae3ec]
test ebx, ebx
je 0x14000de7a
mov eax, r11d
sub eax, ebx
add eax, r10d
jmp 0x14000de7d
mov eax, r10d
sub eax, ebp
cmp r8d, eax
jge 0x14000df0b
mov eax, dword [0x1402ae3dc]
cdq
idiv r11d
test edx, edx
je 0x14000dea3
mov eax, r11d
sub eax, edx
add eax, dword [0x1402ae3dc]
jmp 0x14000dea9
mov eax, dword [0x1402ae3dc]
imul eax, r8d
mov rdi, r13
add eax, r12d
imul eax, dword [0x1402ae430]
movsxd rdx, eax
mov eax, dword [0x1402ae430]
add rdx, r15
imul eax, r11d
movsxd rcx, eax
sar rcx, 2
lea rax, [rdx + rcx*4]
lea rcx, [rcx*4 + 3]
shr rcx, 2
cmp rdx, rax
cmova rcx, r13
test rcx, rcx
je 0x14000df03
imul r9d, r9d, 0x1000193
inc rdi
xor r9d, dword [rdx]
lea rdx, [rdx + 4]
cmp rdi, rcx
jb 0x14000deed
inc r8d
jmp 0x14000de6c
mov rbx, qword [rsp + 0x18]
mov eax, r9d
mov rbp, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
pop r15
pop r13
ret