joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140028244
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rsi, rdx
mov rbx, rcx
and dword [rcx + 8], 0
lea rax, vtable.std::time_get_unsigned_short_int__class_std::istreambuf_iterator_unsigned_short_int__struct_std::char_traits_unsigned_short_int___.0
mov qword [rcx], rax
and qword [rcx + 0x10], 0
and qword [rcx + 0x18], 0
and qword [rcx + 0x20], 0
mov qword [r11 + 0x10], rcx
lea rcx, [r11 - 0x50]
call fcn.1400201a4
lea rbp, [rbx + 0x2c]
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
movsd xmm0, qword [rax + 0x20]
movsd qword [rbp + 0x20], xmm0
mov eax, dword [rax + 0x28]
mov dword [rbp + 0x28], eax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__Getdays]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x1400282e4
lea rcx, [rsi + 8]
mov rdx, rax
call fcn.14000dee4
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
nop dword [rax + rax]
lea rcx, [0x140040ad0]
cmp qword [rsi + 8], 0
cmovne rcx, qword [rsi + 8]
mov r8, rbp
call fcn.1400256ec
mov qword [rbx + 0x10], rax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__Getmonths]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x140028330
lea rcx, [rsi + 0x18]
mov rdx, rax
call fcn.14000dee4
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
nop dword [rax + rax]
lea rcx, [0x140040a40]
cmp qword [rsi + 0x18], 0
cmovne rcx, qword [rsi + 0x18]
mov r8, rbp
call fcn.1400256ec
mov qword [rbx + 0x18], rax
mov r8, rbp
lea rcx, [0x140040d38]
call fcn.1400256ec
mov qword [rbx + 0x20], rax
and dword [rsp + 0x90], 0
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o____lc_locale_name_func]
nop dword [rax + rax]
mov edi, 2
mov r9d, edi
lea r8, [rsp + 0x90]
lea edx, [rdi + 0x20]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoEx]
nop dword [rax + rax]
mov eax, dword [rsp + 0x90]
cmp ax, 0x30
je 0x1400283bd
cmp ax, 0x31
jne 0x1400283b1
mov edi, 1
jmp 0x1400283bd
xor edi, edi
lea ecx, [rdi + 3]
cmp ax, 0x32
cmove edi, ecx
mov dword [rbx + 0x28], edi
mov rax, rbx
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002b954
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x60
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov rsi, rdx
mov rbx, rcx
and dword [rcx + 8], 0
lea rax, vtable.std::time_get_wchar_t__class_std::istreambuf_iterator_wchar_t__struct_std::char_traits_wchar_t___.0
mov qword [rcx], rax
and qword [rcx + 0x10], 0
and qword [rcx + 0x18], 0
and qword [rcx + 0x20], 0
mov qword [r11 + 0x10], rcx
lea rcx, [r11 - 0x50]
call fcn.1400201a4
movups xmm0, xmmword [rax]
movups xmmword [rbx + 0x2c], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x3c], xmm1
movsd xmm0, qword [rax + 0x20]
movsd qword [rbx + 0x4c], xmm0
mov eax, dword [rax + 0x28]
mov dword [rbx + 0x54], eax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__W_Getdays]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x14002b9ec
lea rcx, [rsi + 0x28]
mov rdx, rax
call fcn.140022d24
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
nop dword [rax + rax]
lea rcx, str.:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
cmp qword [rsi + 0x28], 0
cmovne rcx, qword [rsi + 0x28]
call fcn.140020668
mov qword [rbx + 0x10], rax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__W_Getmonths]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x14002ba35
lea rcx, [rsi + 0x38]
mov rdx, rax
call fcn.140022d24
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
nop dword [rax + rax]
lea rcx, str.:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December
cmp qword [rsi + 0x38], 0
cmovne rcx, qword [rsi + 0x38]
call fcn.140020668
mov qword [rbx + 0x18], rax
lea rcx, str.:AM:am:PM:pm
call fcn.140020668
mov qword [rbx + 0x20], rax
and dword [rsp + 0x90], 0
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o____lc_locale_name_func]
nop dword [rax + rax]
mov edi, 2
mov r9d, edi
lea r8, [rsp + 0x90]
lea edx, [rdi + 0x20]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoEx]
nop dword [rax + rax]
mov eax, dword [rsp + 0x90]
cmp ax, 0x30
je 0x14002babc
cmp ax, 0x31
jne 0x14002bab0
mov edi, 1
jmp 0x14002babc
xor edi, edi
lea ecx, [rdi + 3]
cmp ax, 0x32
cmove edi, ecx
mov dword [rbx + 0x28], edi
mov rax, rbx
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x140037e8c
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r15
mov rbp, rsp
sub rsp, 0x20
xor esi, esi
lea r8, [rbp + 0x30]
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], rsi
lea edx, [rsi + 1]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathAllocCanonicalize]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x140037f98
mov rcx, qword [rbp + 0x30]
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rcx + rdx*2], si
jne 0x140037ed0
inc rdx
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchRemoveBackslash]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x140037f98
mov rcx, qword [rbp + 0x30]
lea rdx, [rbp + 0x28]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchSkipRoot]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x140037f98
mov rax, qword [rbp + 0x28]
mov edi, esi
cmp si, word [rax]
sete dil
je 0x140037f98
mov r15d, 0x5c
cmp si, word [rax]
jne 0x140037f31
mov edi, 1
jmp 0x140037f3e
cmp r15w, word [rax]
jne 0x140037f3e
mov word [rax], si
mov rax, qword [rbp + 0x28]
cmp si, word [rax]
jne 0x140037ff2
mov rcx, qword [rbp + 0x30]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x140037fe2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, 0x800700b7
je 0x140037fc3
cmp ebx, 0x80070005
je 0x140037fc3
cmp ebx, 0x80070003
jne 0x140037fde
mov ebx, 0x800700b7
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140037fad
call qword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rdi
pop rbp
ret
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140037fdc
test al, 0x10
je 0x140037fde
mov ebx, esi
test ebx, ebx
js 0x140037f98
mov rax, qword [rbp + 0x28]
test edi, edi
jne 0x140037ff2
mov word [rax], r15w
mov rax, qword [rbp + 0x28]
add rax, 2
mov qword [rbp + 0x28], rax
test edi, edi
jne 0x140037f98
jmp 0x140037f25
Function at 0x140038378
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x14004f690], eax
call fcn.140038b90
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x14004f690], 0
jne case.default.0x1400383ce
mov ecx, 1
call fcn.140038b90
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
movsd dword [rdi], dword [rsi]
movabs eax, dword [0x5b08bd5aba81560b]
in al, dx
pop rsp
cmp eax, 0x1240c9d8
mov bh, byte [rcx*8 - 0x7b3716c6]
push rdi
push rbx
invalid
Function at 0x180017da0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x23
syscall
ret
Function at 0x1400025a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x1400025d7
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x1400025f8
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400025fa
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140002653
test ecx, ecx
jle 0x140002633
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140002653
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140002653
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140002680
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400026a2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x1400026b8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400026d4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400026d6
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x140002710
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400027b7
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x14000274b
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x140002791
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x1400027d0
cmp rbx, rax
ja 0x140002760
mov r8, rdi
test rdi, rdi
je 0x1400027b7
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x1400027ba
Function at 0x140002bd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140011010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140002bfd
xor eax, eax
jmp 0x140002d52
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140002c28
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140002c28
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140002d52
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140002d45
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140002c6b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002c96
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002d4a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002d05
sub eax, 1
je 0x140002d05
cmp eax, 2
jne 0x140002d45
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002d4a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002d33
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140002d45
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x140002d4a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000a850
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x140002e20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140002e54
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140002e40
ret
Function at 0x140003200
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140011010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400032d3
cmp byte [rcx + 0x71], 0
je 0x1400032d3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400032cf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003294
sub eax, 1
je 0x140003298
cmp eax, 2
jne 0x1400032cf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000a850
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400032c6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400032cf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000327c
xor al, al
jmp 0x14000327c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000a850
add rsp, 0x60
pop rbx
ret
Function at 0x1400099f0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x20
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
cmp eax, 0xc0000000
jb 0x140009a89
mov ebx, eax
xor ebx, 0x80000000
je 0x140009a89
mov rcx, qword [0x140443578]
test rcx, rcx
jne 0x140009a5b
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140009b42
mov rcx, rax
mov qword [0x140443578], rax
mov r8d, 4
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140009b42
mov dword [rax], ebx
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rax
call sub.kernel32.dll_HeapFree
jmp 0x140009b14
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [0x1404435e8]
test rax, rax
je 0x140009ad9
lea rbx, [rsp + 0x70]
test eax, 0x4000
jne 0x140009aea
movaps xmm0, xmmword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
jmp 0x140009afe
call fcn.140096f98
lea rbx, [rsp + 0x70]
test eax, 0x4000
je 0x140009ab5
lea r8, [0x1403eb028]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140048983
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
call fcn.1400465af
nop
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 4
mov edx, 4
call fcn.1400949bf
ud2
Function at 0x14000a930
Capabilities:
Delete file

Disassembly:
mov rax, qword [rcx]
mov rdx, qword [rcx + 0x10]
mov rcx, rax
jmp fcn.140090215

Function at 0x14000a940
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov al, 4
test r8, r8
je 0x14000a9f0
mov rdi, r8
mov rbx, rdx
mov rsi, qword [rcx]
mov r13d, 0xffffffff
lea r15, [rsp + 0x2c]
mov r14, qword [sym.imp.kernel32.dll_WriteFile]
lea r12, str.failed_to_write_whole_buffer
mov rax, r12
shr rax, 8
mov qword [rsp + 0x30], rax
jmp 0x14000a9a8
call qword [sym.imp.kernel32.dll_GetLastError]
mov ebp, eax
mov ecx, eax
call fcn.140084604
cmp al, 0x23
jne 0x14000aa03
test rdi, rdi
je 0x14000a9ec
mov dword [rsp + 0x2c], 0
cmp rdi, r13
mov r8d, 0xffffffff
cmovb r8d, edi
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, rbx
mov r9, r15
call r14
test eax, eax
je 0x14000a990
mov eax, dword [rsp + 0x2c]
test rax, rax
je 0x14000a9f2
sub rdi, rax
jb 0x14000aa2e
add rbx, rax
test rdi, rdi
jne 0x14000a9a8
mov al, 4
jmp 0x14000aa0e
jmp 0x14000aa0e
shl r12, 0x38
or r12, 0x17
mov al, 2
mov rdx, qword [rsp + 0x30]
jmp 0x14000aa0e
mov r12d, ebp
shl r12, 0x18
xor edx, edx
xor eax, eax
shld rdx, r12, 8
shl r12, 8
movzx eax, al
or rax, r12
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x14001b6a9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
mov r10, qword [rsp + 0x68]
mov r11, qword [rsp + 0x60]
mov r14, qword [rsp + 0x58]
mov r15d, ecx
shr r15d, 8
lea r8, [rdx + r8*2]
xor edi, edi
mov rsi, rdx
movzx eax, byte [rdx + 1]
add rdx, 2
lea rbx, [rdi + rax]
cmp byte [rsi], r15b
jne 0x14001b703
cmp rbx, rdi
jb 0x14001b756
cmp rbx, r14
ja 0x14001b756
add rdi, r9
xor esi, esi
cmp rax, rsi
je 0x14001b705
lea rbp, [rsi + 1]
cmp byte [rdi + rsi], cl
mov rsi, rbp
jne 0x14001b6f0
jmp 0x14001b749
ja 0x14001b70d
mov rdi, rbx
cmp rdx, r8
jne 0x14001b6cd
add r10, r11
movzx ecx, cx
mov al, 1
lea rbp, [r11 + 1]
movzx edx, byte [r11]
test dl, dl
js 0x14001b726
mov r11, rbp
jmp 0x14001b73c
cmp rbp, r10
je 0x14001b756
and edx, 0x7f
shl edx, 8
movzx ebp, byte [r11 + 1]
add r11, 2
or edx, ebp
sub ecx, edx
js 0x14001b74b
xor al, 1
cmp r11, r10
jne 0x14001b715
jmp 0x14001b74b
xor eax, eax
and al, 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
ud2

Function at 0x14001cd47
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x14001ec0e
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov r12, r9
mov r14, r8
mov rbx, rdx
mov r15, rcx
cmp dword [rdx], 1
jne 0x14001ecf4
lea rsi, [rbx + 8]
lea rdi, [rsp + 0x28]
mov rax, qword [rbx + 0x80]
cmp qword [rbx + 0x78], rax
jb 0x14001ed3b
jne 0x14001ecb1
mov rcx, rdi
mov rdx, rsi
call fcn.14001ed3f
cmp dword [rsp + 0x28], 1
je 0x14001ed13
cmp dword [rsp + 0x2c], 0
je 0x14001ecb1
cmp qword [rbx + 0x60], 0
je 0x14001ec98
mov rcx, rdi
mov rdx, rsi
call fcn.14001fd5d
cmp dword [rsp + 0x28], 1
mov rax, qword [rsp + 0x30]
je 0x14001ed18
test rax, rax
je 0x14001ecb1
mov qword [rbx + 0x60], 0
mov rcx, rdi
mov rdx, rsi
call fcn.14001fbbb
cmp byte [rsp + 0x28], 1
je 0x14001ed13
cmp byte [rsp + 0x29], 0
je 0x14001ec39
mov rdi, qword [rbx + 0x78]
mov rsi, qword [rbx + 0x80]
mov rax, rdi
sub rax, rsi
jb 0x14001ed3b
mov rdx, qword [rbx + 0x68]
add rdx, rsi
cmp rax, r12
cmovb r12, rax
mov rcx, r14
mov r8, r12
call fcn.1400931b0
add rsi, r12
cmp rsi, rdi
ja 0x14001ed3b
mov qword [rbx + 0x80], rsi
mov qword [r15 + 8], r12
xor eax, eax
jmp 0x14001ed2a
mov rdx, qword [rbx + 8]
mov rcx, r15
mov r8, r14
mov r9, r12
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.14008c6be
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov qword [r15 + 0x10], rcx
mov qword [r15 + 8], rax
mov eax, 1
mov qword [r15], rax
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
ud2
Function at 0x14001fbbb
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rax, qword [rdx + 0x98]
cmp qword [rdx + 0x90], rax
jb 0x14001fd59
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x80]
mov eax, eax
bts rax, 0x20
lea rbx, [rsp + 0x20]
mov qword [rbx + 8], rcx
mov qword [rbx], rax
xorps xmm0, xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
lea rdx, [rsp + 0x60]
mov qword [rdx + 8], rbx
movabs rax, 0x400000000
mov qword [rdx], rax
lea rcx, [rdi + 8]
xor r8d, r8d
xor r9d, r9d
call sub.secur32.dll_DecryptMessage
cmp eax, 0x90316
jg 0x14001fcce
cmp eax, 0x80090318
je 0x14001fd1c
test eax, eax
jne 0x14001fd3d
mov rax, qword [rsp + 0x38]
mov rdx, qword [rdi + 0x80]
sub rax, rdx
mov r8d, dword [rsp + 0x30]
mov rcx, rax
mov qword [rdi + 0x70], 0
add rcx, r8
jb 0x14001fd59
cmp qword [rdi + 0x90], rcx
jb 0x14001fd59
lea rcx, [rdi + 0x60]
add rdx, rax
add r8, rdx
call fcn.140016677
mov qword [rdi + 0x78], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x98]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14001fe6a
xor eax, eax
cmp qword [rdi + 0x98], 0
sete al
mov qword [rdi + 0x58], rax
mov byte [rsi + 1], 0
jmp 0x14001fd4f
cmp eax, 0x90317
je 0x14001fd35
cmp eax, 0x90321
jne 0x14001fd3d
mov dword [rdi + 0xe0], 0x10000
xor ebx, ebx
mov byte [rdi + 0xe4], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x98]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.14001fe6a
mov qword [rdi + 0x58], 0
mov byte [rsi + 1], bl
jmp 0x14001fd4f
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x58], rax
mov byte [rsi + 1], 0
jmp 0x14001fd39
mov byte [rsi + 1], 1
xor ebx, ebx
jmp 0x14001fd4f
shl rax, 0x20
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
ud2