joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a1620
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1400dd240]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400dd220]
test rbx, rbx
je 0x1400a1674
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400a166b
test rsi, rsi
je 0x1400a166b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400a1650
lea rcx, [0x1400dd240]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400a18c0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x1400a18d0
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x1400a18e0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x1400a1921
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x1400a1918
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x1400a1923
add rax, 0x28
cmp rax, r9
jne 0x1400a1904
xor eax, eax
ret

Function at 0x1400a19d0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1400ca240]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x1400a1a3f
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x1400a1a3f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x1400a1a3d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x1400a1a34
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400a1a3f
add rdx, 0x28
cmp rdx, r9
jne 0x1400a1a20
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x1400a1b40
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x1400ca240]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x1400a1baf
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x1400a1baf
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x1400a1bad
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x1400a1ba4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400a1bb4
add rax, 0x28
cmp rax, r9
jne 0x1400a1b90
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x1400a1bd0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x1400ca240]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x1400a1c43
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x1400a1c43
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x1400a1c43
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x1400a1c43
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
mov r9d, dword [rdx + 0xc]
cmp rax, r9
mov rcx, r9
jb 0x1400a1c37
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x1400a1c50
add rdx, 0x28
cmp rdx, r10
jne 0x1400a1c23
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jne 0x1400a1c68
jmp 0x1400a1c40
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x1400a1c76
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400a1c40
test r8d, r8d
jg 0x1400a1c60
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x140011177
Capabilities:
Encrypt data using rc4 via systemfunction032

Disassembly:
jmp 0x140015ea0
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1a8]
mov rax, qword [0x14001e180]
xor rax, rbp
mov qword [rbp + 0x158], rax
lea rcx, [0x1400230a3]
call fcn.140011398
nop
mov dword [rbp + 4], 0
mov eax, dword [rbp + 0x190]
mov dword [rbp + 0x28], eax
mov eax, dword [rbp + 0x190]
mov dword [rbp + 0x2c], eax
mov rax, qword [rbp + 0x180]
mov qword [rbp + 0x30], rax
mov eax, dword [rbp + 0x198]
mov dword [rbp + 0x58], eax
mov eax, dword [rbp + 0x198]
mov dword [rbp + 0x5c], eax
mov rax, qword [rbp + 0x188]
mov qword [rbp + 0x60], rax
lea rcx, str.Advapi32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.SystemFunction032
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x88], rax
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x58]
call qword [rbp + 0x88]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x140015f89
mov edx, dword [rbp + 4]
lea rcx, str.____SystemFunction032_FAILED_With_Error_:_0x_0.8X_n
call fcn.1400111ae
nop
xor eax, eax
jmp 0x140015f8e
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001acc0]
call fcn.140011334
mov rax, rdi
mov rcx, qword [rbp + 0x158]
xor rcx, rbp
call fcn.1400111c7
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret

Function at 0x14001120d
Capabilities:
Terminate process

Disassembly:
jmp 0x140013390
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x140011294
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400146e0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014700
xor al, al
jmp 0x140014781
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014713
xor al, al
jmp 0x140014781
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001473d
xor al, al
jmp 0x140014781
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014751
xor al, al
jmp 0x140014781
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014763
xor al, al
jmp 0x140014781
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001477f
xor al, al
jmp 0x140014781
mov al, 1
add rsp, 0x38
ret
Function at 0x140011406
Capabilities:
Parse pe header

Disassembly:
jmp 0x140016220
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x3f0
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x94
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x418]
mov rax, qword [0x14001e180]
xor rax, rbp
mov qword [rbp + 0x3c8], rax
lea rcx, [0x1400230a3]
call fcn.140011398
nop
mov rax, qword [rbp + 0x3f0]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140016298
xor eax, eax
jmp 0x1400163e9
mov rax, qword [rbp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
cmp dword [rax], 0x4550
je 0x1400162c1
xor eax, eax
jmp 0x1400163e9
lea rax, [rbp + 0x70]
mov rcx, qword [rbp + 0x48]
mov rdi, rax
lea rsi, [rcx + 0x18]
mov ecx, pe_nt_image_headers64
rep movsb byte [rdi], byte [rsi]
mov eax, 8
imul rax, rax, 0
mov eax, dword [rbp + rax + 0xe0]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x178], rax
mov rax, qword [rbp + 0x178]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x198], rax
mov rax, qword [rbp + 0x178]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x1b8], rax
mov rax, qword [rbp + 0x178]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x1d8], rax
mov dword [rbp + 0x1f4], 0
jmp 0x140016363
mov eax, dword [rbp + 0x1f4]
inc eax
mov dword [rbp + 0x1f4], eax
mov rax, qword [rbp + 0x178]
mov eax, dword [rax + 0x14]
cmp dword [rbp + 0x1f4], eax
jae 0x1400163e7
mov eax, dword [rbp + 0x1f4]
mov rcx, qword [rbp + 0x198]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x218], rax
mov rdx, qword [rbp + 0x218]
mov rcx, qword [rbp + 0x3f8]
call fcn.14001140b
test eax, eax
jne 0x1400163e2
mov eax, dword [rbp + 0x1f4]
mov rcx, qword [rbp + 0x1d8]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rbp + 0x1b8]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x238], rax
mov rax, qword [rbp + 0x238]
jmp 0x1400163e9
jmp 0x140016355
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ad40]
call fcn.140011334
mov rax, rdi
mov rcx, qword [rbp + 0x3c8]
xor rcx, rbp
call fcn.1400111c7
lea rsp, [rbp + 0x3d0]
pop rdi
pop rsi
pop rbp
ret
Function at 0x140006682
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
jne 0x14000669f
xor r10d, r10d
jmp 0x1400067ad
movabs rcx, 0x5c50448bc98c8905
lea r10, [rcx + 8]
xor r10, rcx
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
movabs rcx, 0x3061e68c8ea82c8
lea r9, [rcx + 3]
xor r9, rcx
cmp rdi, r9
jbe 0x1400066dd
mov esi, dword [rdx]
mov r9d, 4
jmp 0x1400066e2
xor esi, esi
xor r9d, r9d
movabs rcx, 0x4ce5ce9f40037c50
lea rbx, [rcx + 1]
xor rbx, rcx
or rbx, r9
cmp rbx, rdi
jae 0x140006722
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
movabs rcx, 0xe4fc376202addb4d
lea rbx, [rcx + 2]
xor rbx, rcx
or r9, rbx
cmp r9, rdi
jae 0x140006739
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140006759
add r11, r8
jmp 0x1400068ba
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov r11, qword [rax + 0x10]
mov r9, qword [rax]
add r9, r11
mov rdi, qword [rax + 8]
add rdi, rcx
rol r11, 0xd
xor r11, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, rdi
add rdi, r11
rol r11, 0x11
add r9, rcx
xor r11, rdi
rol rcx, 0x15
mov qword [rax + 0x10], r11
xor rcx, r9
rol rdi, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], rdi
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140006831
movabs r14, 0xbe9710cf120b4a87
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
lea rbx, [r14 + 8]
xor rbx, r14
mov r14, qword [rdx + r10]
xor rdi, r14
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, r14
add r10, rbx
cmp r10, r8
jb 0x1400067e0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
movabs rcx, 0x838b80f7e682ed18
lea r8, [rcx + 3]
xor r8, rcx
cmp r11, r8
jbe 0x140006853
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x140006859
xor r9d, r9d
xor r8d, r8d
movabs rcx, 0x7a51b5430c3147d2
lea rsi, [rcx + 1]
xor rsi, rcx
or rsi, r8
cmp rsi, r11
jae 0x14000689c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
movabs rcx, 0xb6985d9cf7c0a5c5
lea rsi, [rcx + 2]
xor rsi, rcx
or r8, rsi
cmp r8, r11
jae 0x1400068b6
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14004630c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
test r8, r8
jne 0x140046370
mov rdx, qword [rsp + 0x58]
mov al, 1
test rdx, rdx
je 0x1400463e0
mov r8, qword [rsp + 0x50]
add rdx, r8
movzx ecx, cx
mov al, 1
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140046345
mov r8, r10
jmp 0x140046362
cmp r10, rdx
je 0x1400463e8
and r9d, 0x7f
shl r9d, 8
movzx r10d, byte [r8 + 1]
add r8, 2
or r9d, r10d
sub ecx, r9d
js 0x1400463e0
xor al, 1
cmp r8, rdx
jne 0x140046333
jmp 0x1400463e0
mov rax, qword [rsp + 0x48]
mov r10d, ecx
shr r10d, 8
lea r8, [rdx + r8*2]
xor r11d, r11d
mov rbx, rdx
movzx edi, byte [rdx + 1]
add rdx, 2
lea rsi, [r11 + rdi]
cmp byte [rbx], r10b
jne 0x1400463ba
cmp rsi, r11
jb 0x1400463e8
cmp rsi, rax
ja 0x1400463e8
add r11, r9
xor ebx, ebx
cmp rdi, rbx
je 0x1400463d1
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x1400463a6
jmp 0x1400463de
seta r11b
cmp rdx, r8
sete bl
or bl, r11b
mov r11, rsi
je 0x140046383
jmp 0x140046316
mov r11, rsi
cmp rdx, r8
jne 0x140046383
jmp 0x140046316
xor eax, eax
and al, 1
pop rbx
pop rdi
pop rsi
pop r14
ret
ud2

Function at 0x1400481fc
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rbx, rcx
mov eax, 0x40
call fcn.140074a70
sub rsp, rax
mov r10, rsp
xorps xmm0, xmm0
movups xmmword [r10 + 0x30], xmm0
mov eax, dword [rcx + 0x50]
lea ecx, [r8*8]
mov r9d, r8d
shr r9d, 0x1d
add ecx, eax
mov dword [rbx + 0x50], ecx
adc dword [rbx + 0x54], r9d
movups xmmword [r10 + 0x20], xmm0
movups xmmword [r10 + 0x10], xmm0
movups xmmword [r10], xmm0
test r8, r8
je 0x14004839e
lea rcx, [rbx + 0x40]
mov qword [rbp], rcx
add r8, rdx
movabs r12, 0xe433245cb108bad8
movabs r13, 0xb92bd3ac501c7b2a
movabs r9, 0x965963f79814378b
movabs r15, 0x752f27103c5bbb89
movabs rsi, 0x46824b6a76f0eaec
movabs r11, 0x44b2670f07f80112
movabs rdi, 0x41fd4c421786b552
movabs r14, 0x2e4f9cf3586c6604
shr eax, 3
and eax, 0x3f
mov qword [rbp - 0x10], r8
mov qword [rbp - 8], r10
mov cl, byte [rdx]
mov byte [rbx + rax], cl
lea rcx, [r11 + 1]
xor rcx, r11
add rcx, rax
lea rax, [r9 + 0x40]
xor rax, r9
cmp rcx, rax
jne 0x14004838f
mov qword [rbp - 0x18], rdx
xor eax, eax
xor ecx, ecx
lea rdx, [r12 + 3]
xor rdx, r12
or rdx, rax
movzx edx, byte [rbx + rdx]
shl edx, 0x18
lea r8, [rsi + 2]
xor r8, rsi
or r8, rax
movzx r8d, byte [rbx + r8]
shl r8d, 0x10
or r8d, edx
lea rdx, [rdi + 1]
xor rdx, rdi
or rdx, rax
movzx edx, byte [rbx + rdx]
shl edx, 8
or edx, r8d
movzx r8d, byte [rbx + rax]
or r8d, edx
lea rdx, [r14 + 1]
xor rdx, r14
add rdx, rcx
mov dword [r10 + rcx*4], r8d
lea rcx, [r15 + 4]
xor rcx, r15
add rax, rcx
lea r8, [r13 + 0x10]
xor r8, r13
mov rcx, rdx
cmp rdx, r8
jne 0x1400482ee
sub rsp, 0x20
mov rcx, qword [rbp]
mov rdx, r10
call fcn.1400483af
mov r10, qword [rbp - 8]
add rsp, 0x20
xor ecx, ecx
mov r8, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
movabs r9, 0x965963f79814378b
movabs r11, 0x44b2670f07f80112
inc rdx
mov rax, rcx
cmp rdx, r8
jne 0x1400482c7
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14004e6d7
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov eax, 0x7fffffff
cmp r8, rax
cmovae r8, rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x14004e71a
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
movabs rcx, 0x18aa1fa4c4e3a22d
lea rdx, [rcx + 2]
xor rdx, rcx
or rdx, rax
mov eax, 1
jmp 0x14004e71f
movsxd rdx, eax
xor eax, eax
add rsp, 0x28
ret
Function at 0x140053ba2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rsi, rcx
mov eax, 0x20
call fcn.140074a70
sub rsp, rax
mov rbx, rsp
sub rsp, 0x20
mov rcx, rbx
call fcn.140053c55
add rsp, 0x20
mov r15, qword [rbx]
mov rdi, qword [rbx + 8]
movabs r14, 0x8000000000000000
cmp r15, r14
jne 0x140053bfc
sub rsp, 0x20
mov rcx, rdi
call fcn.14004df29
add rsp, 0x20
mov qword [rsi], r14
jmp 0x140053c48
mov rbx, qword [rbx + 0x10]
sub rsp, 0x20
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
add rsp, 0x20
cmp eax, 0xffffffff
jne 0x140053c3d
mov qword [rsi], r14
test r15, r15
je 0x140053c48
mov rcx, qword [0x1400a5b60]
xor edx, edx
mov r8, rdi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
jmp qword [sym.imp.kernel32.dll_HeapFree]
mov qword [rsi], r15
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rbx
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x1400547bd
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov r14, r9
mov r12, r8
mov r15, rdx
mov rbx, rcx
mov eax, 0x10
call fcn.140074a70
sub rsp, rax
mov r13, rsp
mov eax, 0x20
call fcn.140074a70
sub rsp, rax
mov rdx, rsp
mov eax, 0x20
call fcn.140074a70
sub rsp, rax
mov rsi, rsp
lea rax, [0x1400943ec]
mov qword [rdx], rax
lea rax, [0x140094408]
mov qword [rdx + 8], rax
mov word [rdx + 0x10], 0
sub rsp, 0x20
mov rcx, rsi
call fcn.14005b8d5
mov r11, rsi
add rsp, 0x20
mov rdi, qword [rsi + 0x10]
cmp rdi, qword [rsi]
mov qword [rbp], rsi
jne 0x14005485d
sub rsp, 0x20
mov rcx, r11
call fcn.140058967
mov r11, qword [rbp]
add rsp, 0x20
mov rsi, qword [rbp + 0x70]
mov rax, qword [r11 + 8]
mov word [rax + rdi*2], 0x22
movabs rax, 0xad0dd7ff1ec24054
lea rcx, [rax + 1]
xor rcx, rax
add rcx, rdi
mov qword [r11 + 0x10], rcx
lea rcx, [r12 + r12]
xor edx, edx
lea rax, str._D_t_
mov qword [rbp - 0x28], rbx
cmp rcx, rdx
je 0x1400548aa
cmp word [r15 + rdx], 0x22
lea rdx, [rdx + 2]
jne 0x140054894
jmp 0x1400550a3
mov qword [rbp - 0x40], r13
movzx ecx, word [r15 + r12*2 - 2]
cmp cx, 0x5c
je 0x1400550a3
lea r8, [r12 - 1]
test cx, cx
cmovne r8, r12
sub rsp, 0x20
mov rcx, r11
mov rdx, r15
call fcn.14005b01b
mov r11, qword [rbp]
add rsp, 0x20
mov rbx, qword [r11 + 0x10]
cmp rbx, qword [r11]
jne 0x1400548fe
sub rsp, 0x20
mov rcx, r11
call fcn.140058967
mov r11, qword [rbp]
add rsp, 0x20
mov rax, qword [r11 + 8]
mov word [rax + rbx*2], 0x22
movabs rax, 0xc721c5f85650a92a
lea rdi, [rax + 1]
xor rdi, rax
add rdi, rbx
mov qword [r11 + 0x10], rdi
test rsi, rsi
jne 0x140054974
mov r15, r14
lea rax, [rsi + rsi*4]
lea rax, [r14 + rax*8]
mov qword [rbp - 0x30], rax
movabs r14, 0xeb5a25a8ba25d33e
movabs rax, 0xc0d4c339529a79b8
movabs rsi, 0x99d453e9a5463398
lea rcx, [rax + 1]
xor rcx, rax
mov qword [rbp - 0x38], rcx
lea rbx, [0x140094490]
Function at 0x14005a591
Capabilities:
Create udp socket

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov edi, edx
test cx, cx
mov eax, 2
mov ebx, 0x17
cmove ebx, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
xor r14d, r14d
mov ecx, ebx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14005a693
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2739
je 0x14005a5f2
cmp eax, 0x2726
jne 0x14005a675
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
jne 0x14005a62e
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
movabs rcx, 0x268808cb231f6e94
jmp 0x14005a683
mov rsi, rax
xor r14d, r14d
mov rcx, rax
mov edx, 1
xor r8d, r8d
call qword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
jne 0x14005a693
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
movabs rcx, 0x971480ff4a703ed
lea rdi, [rcx + 2]
xor rdi, rcx
or rdi, rax
mov rcx, rsi
call qword [sym.imp.ws2_32.dll_closesocket]
mov rsi, rdi
jmp 0x14005a68d
shl rax, 0x20
movabs rcx, 0x28a0d98ebec7ba35
lea rsi, [rcx + 2]
xor rsi, rcx
or rsi, rax
mov r14d, 1
mov rax, r14
mov rdx, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14005c061
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rbx, r8
mov r14, rdx
mov rdi, rcx
mov al, byte [0x1400a5058]
movabs rax, 0x4f6f74d315e80262
lea rdx, [rax + 0x10]
xor rdx, rax
xor ecx, ecx
call fcn.14004fc65
test rax, rax
je 0x14005c15f
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x14005c161]
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdi, rax
mov rdx, rax
test rax, rax
jne 0x14005c14d
mov rbx, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, qword [r14]
test rax, rax
je 0x14005c0e9
mov rcx, rbx
call rax
cmp qword [r14 + 8], 0
je 0x14005c11d
movabs rax, 0x7a5a33787f57f8ae
lea rcx, [rax + 0x11]
xor rcx, rax
cmp qword [r14 + 0x10], rcx
jb 0x14005c10b
mov rbx, qword [rbx - 8]
mov rcx, qword [0x1400a5b60]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x1400a5b60]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
movabs rcx, 0x47193ca5c09b5020
lea rdx, [rcx + 2]
xor rdx, rcx
or rdx, rax
xor eax, eax
test rdi, rdi
sete al
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
ud2
Function at 0x14005d90d
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rbx, rcx
xor eax, eax
call fcn.140074a70
sub rsp, rax
mov r14, rsp
mov eax, 0x30
call fcn.140074a70
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.140074a70
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
call fcn.140074a70
sub rsp, rax
mov r15, rsp
movups xmm0, xmmword [0x1400951a0]
movups xmmword [r15], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
sub rsp, 0x50
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0