joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e70e0
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
movabs al, byte [0x8948d68948000000]
iretd
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x20
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
cmp eax, 0xc0000000
add al, al
jb 0x1400e7137
mov ebx, eax
lea rcx, [rsp + 0x20]
mov edx, 0x20
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x1400e71e8
add byte [rax], al
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [0x14019f2d0]
add byte [rax - 0x7b], cl
ror byte [rdi], 0x84
test cl, al
add byte [rax], al
invalid
and eax, 0x4000
xor ecx, ecx
lea rbx, [rsp + 0x70]
or rax, rcx
je 0x1400e7182
lea r8, [0x140169860]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140046250
jmp 0x1400e71a4
movaps xmm0, xmmword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x70], xmm0
and al, 0x70
movaps xmmword [rsp + 0x80], xmm1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
and byte [rdi], cl
sub dword [rdi + 0x20], edx
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
invalid
invalid
dec dword [rax + 3]
add eax, dword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
call fcn.140043fc0
nop
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
movzx eax, byte [0x14019f308]
mov edx, 4
xor ecx, ecx
call fcn.1400f8ae0
sbb byte [rcx], al
add byte [rax - 0x7b], cl
invalid
je 0x1400e7226
and ebx, 0x7fffffff
mov dword [rax], ebx
mov rcx, qword [0x14019f258]
xor edx, edx
mov r8, rax
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1400e71ba
call fcn.14012c8e0
jmp 0x1400e715b
mov ecx, 4
mov edx, 4
call fcn.140122190
int3

Function at 0x1400e74b0
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm6
mov ah, 0x24
mov al, 0
add byte [rax], al
Function at 0x1400f1b70
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x498
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x410], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.1400f2190
mov rcx, qword [rbp - 0x60]
mov rax, rcx
neg rax
jno 0x1400f1c49
mov rax, qword [rbp - 0x58]
mov ecx, eax
and ecx, 3
cmp ecx, 1
stc
add dword [rbp + 0x77], esi
lea rcx, [rax - 1]
mov qword [rbp + 0x3f0], rcx
mov rcx, qword [rax - 1]
mov qword [rbp + 0x400], rcx
mov rax, qword [rax + 7]
mov qword [rbp + 0x408], rax
mov rax, qword [rax]
test rax, rax
je 0x1400f1bf2
mov rcx, qword [rbp + 0x400]
call rax
mov r8, qword [rbp + 0x400]
mov rax, qword [rbp + 0x408]
or byte [rax + rax], al
add byte [rax - 0x7d], cl
js 0x1400f1c0c
invalid
je 0x1400f1c21
cmp qword [rax + 0x10], 0x11
jb 0x1400f1c12
mov r8, qword [r8 - 8]
mov rcx, qword [0x14019f258]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x14019f258]
xor edx, edx
mov r8, qword [rbp + 0x3f0]
call qword [sym.imp.kernel32.dll_HeapFree]
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400f1ef5
mov qword [rbp + 0x3f8], rsi
mov qword [rbp + 0x3f0], rcx
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x400], rax
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x408], rax
xor edi, edi
xor ebx, ebx
xor r14d, r14d
cmp r8, 0x201
jae 0x1400f1cd0
jmp 0x1400f1cbf

Function at 0x1400f4c00
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov r8, rdx

Function at 0x1400f7b00
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x1e8
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov rdi, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov word [rbp + 0x166], ax
mov eax, dword [0x14019f268]
cmp eax, 3
jne 0x1400f7cee
lea rax, [rbp + 0x166]
mov qword [rbp + 0x150], rax
cmp rdi, 0x17f
ja 0x1400f7d14
lea rbx, [rbp - 0x60]
mov rcx, rbx
mov r8, rdi
call fcn.140121660
mov byte [rbp + rdi - 0x60], 0
lea rax, [rdi + 1]
cmp rdi, 0xe
ja 0x1400f7b98
xor edx, edx
nop word cs:[rax + rax]
cmp byte [rbp + rdx - 0x60], 0
je 0x1400f7c54
inc rdx
cmp rax, rdx
jne 0x1400f7b80
jmp 0x1400f7cb9
lea rcx, [rbp - 0x59]
and rcx, 0xfffffffffffffff8
sub rcx, rbx
je 0x1400f7bce
xor edx, edx
nop word [rax + rax]
cmp byte [rbp + rdx - 0x60], 0
je 0x1400f7c54
inc rdx
cmp rcx, rdx
jne 0x1400f7bb0
lea rdx, [rdi - 0xf]
cmp rcx, rdx
jbe 0x1400f7bd2
jmp 0x1400f7c20
lea rdx, [rdi - 0xf]
movabs r8, 0x101010101010100
mov rbx, rdx
call fcn.14012c290
mov rdx, rbx
lea rax, [rbp + 0x166]
mov qword [rbp + 0x150], rax
cmp rdi, 0x17f
jbe 0x1400f7b55
lea r9, [rbp + 0x150]
mov rcx, rsi
mov r8, rdi
call fcn.14012c300
Function at 0x1400f8510
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x14019f308]
mov edx, 0x10
xor ecx, ecx
call fcn.1400f8ae0
test rax, rax
je 0x1400f8609
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400f86c0]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400f85fb
mov rax, qword [rbx]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rax
mov rax, qword [rax]
test rax, rax
je 0x1400f85a7
mov rcx, qword [rbp - 0x18]
call rax
mov r8, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
cmp qword [rax + 8], 0
mov rsi, qword [rbp - 0x20]
je 0x1400f85d4
cmp qword [rax + 0x10], 0x11
jb 0x1400f85c5
mov r8, qword [r8 - 8]
mov rcx, qword [0x14019f258]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x14019f258]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.140122190
ud2

Function at 0x1400fc650
Capabilities:
Set environment variable

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rdx
mov rdx, rcx
lea rcx, [rbp - 0x30]
mov r8d, 0xb
call fcn.1400f2190
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
mov rax, rdx
neg rax
jno 0x1400fc694
mov rsi, rcx
jmp 0x1400fc714
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
lea rcx, [rbp - 0x30]
mov r8d, 0x45
mov rdx, rsi
call fcn.1400f2190
mov rbx, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x28]
mov rax, rbx
neg rax
jno 0x1400fc6ce
mov rsi, rdi
cmp qword [rbp - 0x18], 0
mov r14, qword [rbp - 0x10]
jne 0x1400fc702
jmp 0x1400fc714
mov r14, qword [rbp - 0x10]
mov rcx, r14
mov rdx, rdi
call qword [sym.imp.kernel32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x1400fc722
xor esi, esi
test rbx, rbx
je 0x1400fc6fb
mov rcx, qword [0x14019f258]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rbp - 0x18], 0
je 0x1400fc714
mov rcx, qword [0x14019f258]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
shl rsi, 0x20
or rsi, 2
test rbx, rbx
jne 0x1400fc6e9
jmp 0x1400fc6fb
Function at 0x14010cce0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, r8
mov r14, rdx
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x20], rax
cmp rax, 0xffffffffffffffff
je 0x14010ceb1
mov r15, qword [rcx + 0x10]
mov rdi, qword [rcx + 0x20]
jmp 0x14010cd47
mov rdx, qword [rcx + 0x10]
lea rcx, [rsp + 0x28]
mov r8, r14
xor r9d, r9d
call fcn.1400ff6a0
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x14010ced8
cmp al, 2
jne 0x14010cf8e
mov r12, qword [rsp + 0x28]
jmp 0x14010cf16

Function at 0x14010cfc0
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x40], r8
mov rbx, rdx
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x14010d16f
mov r14, qword [rcx + 0x10]
mov r12, qword [rcx + 0x20]
cmp r9, 0x7fffffff
mov r15d, 0x7fffffff
cmovb r15, r9
jmp 0x14010d037
mov rcx, qword [0x14019f258]
xor edx, edx
mov r8, rbp
call qword [sym.imp.kernel32.dll_HeapFree]
dec r13
mov rcx, qword [0x14019f258]
xor edx, edx
mov r8, r13
call qword [sym.imp.kernel32.dll_HeapFree]
lea rcx, [rsp + 0x28]
mov rdx, r14
mov r8, rbx
mov r9b, 1
call fcn.1400ff6a0
movzx eax, byte [rsp + 0x31]
cmp al, 3
je 0x14010d18c
mov rbp, qword [rsp + 0x28]
cmp al, 2
je 0x14010d1a6
movzx edi, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov r8d, r15d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x14010d1b0
test r12, r12
sete sil
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov r13d, eax
shl r13, 0x20
or r13, 2
mov rcx, r13
call fcn.140040bb0
cmp al, 0xd
setne al
or al, sil
jne 0x14010d0e5
mov rcx, qword [r12]
mov rax, qword [r12 + 8]
lock inc qword [rax]
jle 0x14010d1c9
add rcx, 0x10
mov rdx, qword [r12 + 8]
mov r8, qword [r12 + 0x10]
movzx r9d, byte [r12 + 0x18]
call fcn.140040940
test rax, rax
cmovne r13, rax
mov rcx, r13
call fcn.140097f30
cmp al, 0xd
jne 0x14010d19f
movzx ecx, dil
and ebp, 0x23
mov rax, qword [r14 + 0x90]
xor rbp, 0x2f
shl ecx, 0x10
nop word [rax + rax]
mov edx, eax
shr edx, 0x10
cmp dil, dl
jne 0x14010d12c
mov edx, ebp
and edx, eax
or rdx, rcx
lock cmpxchg qword [r14 + 0x90], rdx
jne 0x14010d110
mov eax, r13d
and eax, 3
cmp eax, 1
jne 0x14010d037
mov rbp, qword [r13 - 1]
mov rdi, qword [r13 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x14010d150
mov rcx, rbp
call rax
cmp qword [rdi + 8], 0
je 0x14010d022
cmp qword [rdi + 0x10], 0x11
jb 0x14010d010
mov rbp, qword [rbp - 8]
jmp 0x14010d010
mov rdx, qword [rcx + 0x10]
lea rcx, [rsp + 0x28]
mov r8, rbx
mov r9b, 1
call fcn.1400ff6a0
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x14010d196
mov eax, 2
mov r13, rbp
jmp 0x14010d1b5
cmp al, 2
jne 0x14010d1cb
mov r13, qword [rsp + 0x28]
mov eax, 1
jmp 0x14010d1b5
mov eax, 1
mov r13, rbp
jmp 0x14010d1b5
movsxd r13, eax
xor eax, eax
mov rdx, r13
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
lea rcx, str.C:Usersmilus.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_srciopoll_evented.rs
call fcn.140122a00
int3
Function at 0x14011e6a4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14011e6ee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14011e6ee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14011e6ee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14011e6ee
cmp dword [rcx + 0x84], 0xe
jbe 0x14011e6ee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14011e6f0
xor al, al
add rsp, 0x28
ret

Function at 0x140121440
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140121468
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140121468
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1401270b0
Capabilities:
Link many functions at runtime

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rcx, [0x14015809d]
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x140127102
mov rdi, rax
lea rdx, [0x1401580be]
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140127102
mov rsi, rax
lea rdx, [0x1401580cc]
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140127102
mov r14, rax
xor edi, edi
jmp 0x140127186
lea rcx, [0x140158058]
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x1401271ee
mov rsi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x1401271ee
mov rbx, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rsi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x1401271ee
mov rdi, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rsi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x1401271ee
mov rsi, rax
lea rcx, [rsp + 0x20]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
jne 0x1401271ee
mov r14, qword [rsp + 0x20]
movzx eax, byte [0x14019f308]
mov edx, 0x18
xor ecx, ecx
call fcn.1400f8ae0
sbb r13d, r15d
dec dword [rax - 0x7b]
invalid
je 0x1401271f3
mov rbx, rax
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], r14
xor eax, eax
lock cmpxchg qword [0x14019f1c0], rbx
je 0x1401271e1
mov rsi, rax
cmp qword [rbx], 0
je 0x1401271cc
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [0x14019f258]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140127210
mov ecx, 8
mov edx, 0x18
call fcn.140122190
int3
Function at 0x140129cd0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
movdqa xmmword [rsp + 0x80], xmm6
and al, 0x80
add byte [rax], al
add byte [rcx - 0x77], cl
enter 0xffffffffffff8b48, 0x49
sbb byte [rax - 0x7d], cl
stc
dec dword [rdi]
test byte [rcx + rcx], al
invalid
mov rbp, qword [r8 + 8]
lea r14, [rbp + 1]
mov rax, r14

Function at 0x14012c300
Capabilities:
Resolve dns

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
cmp r8, 0xffffffffffffffff
je 0x14012c51c
mov rbx, r8
mov r15, r8
inc r15
js 0x14012c528
mov rdi, r9
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x14019f308]
xor ecx, ecx
mov rdx, r15
call fcn.1400f8ae0
test rax, rax
je 0x14012c52d
mov r12, rax
mov rcx, rax
mov rdx, r14
mov r8, rbx
call fcn.140121660
cmp rbx, 0xf
ja 0x14012c398
test rbx, rbx
je 0x14012c43f
xor eax, eax
nop word cs:[rax + rax]
cmp byte [r14 + rax], 0
je 0x14012c4a4
inc rax
cmp rbx, rax
jne 0x14012c380
jmp 0x14012c43f
lea rax, [r14 + 7]
and rax, 0xfffffffffffffff8
sub rax, r14
jne 0x14012c3f1
lea rcx, [rbx - 0x10]
xor eax, eax
movabs rdx, 0x101010101010100
movabs r8, 0x8080808080808080
nop
mov r9, qword [r14 + rax]
mov r10, qword [r14 + rax + 8]
mov r11, rdx
sub r11, r10
or r11, r10
mov r10, rdx
sub r10, r9
or r10, r9
and r10, r11
not r10
test r10, r8
jne 0x14012c41c
add rax, 0x10
cmp rax, rcx
jbe 0x14012c3c0
jmp 0x14012c41c
xor ecx, ecx
nop word cs:[rax + rax]
cmp byte [r14 + rcx], 0
je 0x14012c4a4
inc rcx
cmp rax, rcx
jne 0x14012c400
lea rcx, [rbx - 0x10]
cmp rax, rcx
jbe 0x14012c3ab
cmp rax, rbx
je 0x14012c43f
nop word cs:[rax + rax]
cmp byte [r14 + rax], 0
je 0x14012c4a4
inc rax
cmp rbx, rax
jne 0x14012c430
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], rbx
lea rcx, [rbp - 0x40]
call fcn.140006900
mov rbx, rax
mov r14, rdx
xorps xmm0, xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x38], 1
mov qword [rbp - 8], 0
lea r8, [rbp - 0x40]
lea r9, [rbp - 8]
mov rcx, rax
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x14012c4d7
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x14012c4eb
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, qword [0x14019f258]
xor edx, edx
mov r8, r12
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [rdi]
mov rax, qword [rbp - 8]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rbx], 0
test r14, r14
je 0x14012c50c
mov rcx, qword [0x14019f258]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea rcx, str.alloc_src_ffic_str.rs
call fcn.140122a00
call fcn.1400067e0
mov ecx, 1
mov rdx, r15
call fcn.140122170
int3
Function at 0x140002540
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rbx, rcx
xor r9d, r9d
mov dword [rsp + 0x20], ebp
xor r8d, r8d
lea rcx, str.HTTP_POST_Example
lea edx, [rbp + 1]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rdi, rax
test rax, rax
jne 0x1400025bf
lea rdx, str.InternetOpen_failed
lea rcx, [0x140038530]
call fcn.140004240
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.1400040f0
movzx edx, al
mov rcx, rbx
call fcn.1400047c0
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
jmp fcn.140004720
mov qword [rsp + 0x38], rbp
lea rdx, str.116.198.227.48
mov dword [rsp + 0x30], ebp
mov r8d, 0x22b8
mov dword [rsp + 0x28], 3
xor r9d, r9d
mov rcx, rdi
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x50], rsi
call qword [sym.imp.WININET.dll_InternetConnectW]
mov rsi, rax
test rax, rax
jne 0x14000263a
lea rdx, str.InternetConnect_failed
lea rcx, [0x140038530]
call fcn.140004240
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.1400040f0
movzx edx, al
mov rcx, rbx
call fcn.1400047c0
mov rcx, rbx
call fcn.140004720
jmp 0x14000272d
mov qword [rsp + 0x38], rbp
lea r8, [0x140032560]
mov dword [rsp + 0x30], ebp
lea rdx, str.POST
mov qword [rsp + 0x28], rbp
xor r9d, r9d
mov rcx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.WININET.dll_HttpOpenRequestW]
mov rbp, rax
test rax, rax
jne 0x1400026ab
lea rdx, str.HttpOpenRequest_failed
lea rcx, [0x140038530]
call fcn.140004240
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.1400040f0
movzx edx, al
mov rcx, rbx
call fcn.1400047c0
mov rcx, rbx
call fcn.140004720
jmp 0x140002724
cmp qword [rbx + 0x18], 0x10
mov r9, rbx
jb 0x1400026b8
mov r9, qword [rbx]
mov eax, dword [rbx + 0x10]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
mov rcx, rbp
call qword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
jne 0x1400026e1
lea rdx, str.HttpSendRequest_failed
lea rcx, [0x140038530]
jmp 0x1400026ef
lea rdx, str.Data_sent_successfully
lea rcx, [0x140038390]
call fcn.140004240
mov rbx, rax
mov dl, 0xa
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbx
call fcn.1400040f0
movzx edx, al
mov rcx, rbx
call fcn.1400047c0
mov rcx, rbx
call fcn.140004720
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
jmp qword [sym.imp.WININET.dll_InternetCloseHandle]

Function at 0x140013364
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013154
Function at 0x140018130
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x140018162
call fcn.14000fa98
mov dword [rax], 0x16
call fcn.14000d29c
jmp 0x140018281
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140018281
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140018281
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140018191
lock or dword [rcx + 0x14], 0x10
jmp 0x140018281
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1400181a5
call fcn.1400198e0
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.14001716c
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.140018f10
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x14001826f
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x14001823a
mov rcx, rsi
call fcn.14001716c
cmp eax, edi
je 0x140018225
mov rcx, rsi
call fcn.14001716c
cmp eax, 0xfffffffe
je 0x140018225
mov rcx, rsi
call fcn.14001716c
movsxd rbx, eax
lea r14, [0x140039590]
mov rcx, rsi
sar rbx, 6
call fcn.14001716c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x14001822c
lea rdx, [0x1400373e0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14001823a
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x14001825e
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x14001825e
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x14001825e
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x140018284
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x1400185ac
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140007370
sub rsp, rax
mov rax, qword [0x140037028]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14001716c
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1400185fb
mov rax, rbp
jmp 0x140018703
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x39590]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.1400196e8
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x39590]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x1400186ff
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400186ff
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.1400196e8
test rax, rax
js 0x1400186ff
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x1400186ff
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x1400186f1
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x1400186f1
cmp byte [rcx], 0xd
jne 0x1400186d7
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1400186e6
cmp byte [rcx + 1], 0xa
jne 0x1400186e6
inc rcx
jmp 0x1400186e6
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x37430]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x1400186b9
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x140018703
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140007340
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret