joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140018a94
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400258e0], eax
call fcn.140019344
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x1400258e0], 0
jne case.default.0x140018aea
mov ecx, 1
call fcn.140019344
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
mov dl, 0xfb
invalid
Function at 0x1401ceee0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x10090
call fcn.1401d3340
sub rsp, rax
mov rax, qword [0x140216580]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx edx, byte [rcx]
lea rbx, [rsp + 0x30]
xor eax, eax
mov rsi, rcx
mov word [rsp + 0x80], ax
mov word [rsp + 0x30], ax
lea edi, [rax + 0x28]
test dl, dl
je 0x1401cefa2
nop dword [rax + rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x1401cef4d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x1401cef40
cmp rcx, 1
jb 0x1401ceffa
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1401cef70
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.1401e27f4
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x1401cef30
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x1401cefd3
lea rcx, [rsp + 0x80]
call fcn.1401e5500
jmp 0x1401cefd5
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.1401d3310
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.1401d79a0
int3
Function at 0x1401d2ef0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140216580]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
lea rbx, [rsp + 0x30]
mov rbp, rdx
mov word [rsp + 0x30], ax
movzx edx, byte [rcx]
mov rsi, rcx
lea edi, [rax + 0x28]
test dl, dl
je 0x1401d2f95
nop dword [rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x1401d2f4d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x1401d2f40
cmp rcx, 1
jb 0x1401d2fc6
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1401d2f63
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.1401e27f4
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x1401d2f30
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401d3310
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
call fcn.1401d79a0
int3
Function at 0x1401d3070
Capabilities:
Set environment variable

Disassembly:
push rbx
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x140216580]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rax, qword [0x140236ca0]
mov rbx, r8
mov r14, rdx
mov r15, rcx
test rax, rax
jne 0x1401d30c1
lea rcx, [0x1401f42f4]
call qword [sym.imp.python38.dll_PyImport_ImportModule]
mov qword [0x140236ca0], rax
test rax, rax
je 0x1401d3274
mov qword [rsp + 0xd8], rbp
lea rdx, str.environ
mov qword [rsp + 0x98], rsi
mov rcx, rax
mov qword [rsp + 0x90], rdi
call qword [sym.imp.python38.dll_PyObject_GetAttrString]
mov rcx, r14
mov rdi, rax
call qword [sym.imp.python38.dll_PyUnicode_FromString]
mov rbp, rax
test rbx, rbx
je 0x1401d315e
mov rdx, rbx
mov rcx, r14
call fcn.1401d2ef0
mov rdx, 0xffffffffffffffff
mov rcx, rbx
call qword [sym.imp.python38.dll_PyUnicode_FromWideChar]
mov rdx, rbp
mov rcx, rdi
mov r8, rax
mov rbx, rax
call qword [sym.imp.python38.dll_PyObject_SetItem]
test eax, eax
je 0x1401d3145
mov ecx, 1
call qword [sym.imp.python38.dll_PyErr_PrintEx]
mov ecx, 1
call qword [sym.imp.python38.dll_Py_Exit]
int3
sub qword [rbx], 1
jne 0x1401d3218
mov rax, qword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x1401d3218
movzx edx, byte [r14]
lea rbx, [rsp + 0x30]
xor eax, eax
mov word [rsp + 0x30], ax
lea esi, [rax + 0x28]
test dl, dl
je 0x1401d31f3
nop word [rax + rax]
cmp word [rbx], 0
mov rcx, rsi
mov rax, rbx
je 0x1401d319d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x1401d3190
cmp rcx, 1
jb 0x1401d326e
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1401d31c0
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.1401e27f4
movzx edx, byte [r14 + 1]
inc r14
add rbx, 2
dec rsi
test dl, dl
jne 0x1401d3180
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.python38.dll_PyObject_DelItem]
test eax, eax
je 0x1401d3218
mov rcx, r15
call fcn.1400014a0
sub qword [rbp], 1
jne 0x1401d3229
mov rax, qword [rbp + 8]
mov rcx, rbp
call qword [rax + 0x30]
sub qword [rdi], 1
jne 0x1401d3239
mov rax, qword [rdi + 8]
mov rcx, rdi
call qword [rax + 0x30]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0xd8]
mov rdi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401d3310
add rsp, 0xa0
pop r15
pop r14
pop rbx
ret
call fcn.1401d79a0
int3
call fcn.1401d79a0
int3

Function at 0x1401d3d74
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401d3dbe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401d3dbe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401d3dbe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401d3dbe
cmp dword [rcx + 0x84], 0xe
jbe 0x1401d3dbe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401d3dc0
xor al, al
add rsp, 0x28
ret
Function at 0x1401d8e00
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1401d8c6b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401d8c6b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401d8c6b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401d8c6b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401d8c6b
cmp dword [rcx + 0x84], 0xe
jbe 0x1401d8c6b
cmp dword [rcx + 0xf8], 0
je 0x1401d8c6b
mov ecx, ebx
call fcn.1401d8d1c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1401d8af8
nop
cmp dword [rbp + 0x20], 0
je 0x1401d8cb9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1401d8cc4
int3
xor r8d, r8d
xor edx, edx
jmp 0x1401d8bfc
Function at 0x1401ea550
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1401ea5d7
mov rsi, rbx
cmp word [rax], bp
je 0x1401ea596
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1401ea580
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1401ea57c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1401e5cec
mov rdi, rax
test rax, rax
je 0x1401ea5c4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1401f0210
mov rbp, rdi
xor ecx, ecx
call fcn.1401e66fc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1401edcf0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1401edd06
mov al, 1
jmp 0x1401edd66
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1401edd17
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1401edd64
mov ecx, dword [rcx + 0x18]
nop
call fcn.1401ea898
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1401edd64
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1401edd64
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1401edd64
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1401edd66
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1401f0060
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401f0088
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1401f0088
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140eba738
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140eba742
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140eba76b
pop rbp
sub rbp, 0x33
sub rbp, 0xeba738
sub rsp, 0x20
jmp 0x140eba78a
mov rax, 0xeba738
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x44f233ff
xor byte [rax], dl
inc rax
dec rcx
jne 0x140eba7a9
jmp 0x140eba7c0
mov bh, 0x76
invalid
Function at 0x140008a60
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140008a82
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x140008afc
mov rdi, r14
mov rcx, rbx
call fcn.14000ba60
test rax, rax
jle 0x140008ad4
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.14009e160
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140008aec
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x140008af4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140008a96
sub r14, rdi
jmp 0x140008bdf
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140008b13
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140008b15
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140008b47
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14009e160
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140008bdc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140008b82
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x140008bbd
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400acbc0
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x140008bdc
cmp rbp, rax
ja 0x140008b90
test rbp, rbp
je 0x140008bdc
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400acbc0
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret

Function at 0x14000f960
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14011b8b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x38], eax
lea rcx, [0x140104a5c]
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], eax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [rsp + 0x40]
shr eax, 6
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14009bc50
add rsp, 0x58
ret
Function at 0x14000fa20
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14011b8b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rbx, [0x140124130]
mov dword [rsp + 0x20], 0x400
mov rcx, rbx
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x28], xmm0
mov r8, 0xffffffffffffffff
movdqu xmmword [rsp + 0x38], xmm1
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x14000fa70
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14000d650
mov r9, qword [rsp + 0x28]
lea r8, [rsp + 0x28]
mov r10, qword [rsp + 0x40]
lea rax, [rsp + 0x28]
xor ebx, ebx
cmp r10, 0x10
cmovae r8, r9
cmovae rax, r9
add r8, qword [rsp + 0x38]
mov rcx, r8
sub rcx, rax
cmp rax, r8
cmova rcx, rbx
test rcx, rcx
je 0x14000fb33
cmp rcx, 0x10
jb 0x14000fb33
and rcx, 0xfffffffffffffff0
xorps xmm1, xmm1
xorps xmm2, xmm2
movq xmm0, qword [rax]
add rbx, 0x10
punpcklbw xmm0, xmm0
psraw xmm0, 8
paddw xmm1, xmm0
movq xmm0, qword [rax + 8]
punpcklbw xmm0, xmm0
add rax, 0x10
psraw xmm0, 8
paddw xmm0, xmm2
movdqa xmm2, xmm0
cmp rbx, rcx
jne 0x14000fad0
paddw xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
paddw xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 4
paddw xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 2
paddw xmm1, xmm0
movd ebx, xmm1
cmp rax, r8
je 0x14000fb4e
nop dword [rax + rax]
movsx ecx, byte [rax]
inc rax
add bx, cx
cmp rax, r8
jne 0x14000fb40
cmp r10, 0x10
jb 0x14000fb81
lea rdx, [r10 + 1]
mov rax, r9
cmp rdx, 0x1000
jb 0x14000fb79
mov r9, qword [r9 - 8]
add rdx, 0x27
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fb97
mov rcx, r9
call fcn.14009bc70
movzx eax, bx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14009bc50
add rsp, 0x50
pop rbx
ret
call fcn.1400abd94
int3
Function at 0x140016270
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x50
mov rax, qword [0x14011b8b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor esi, esi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x40], esi
mov r8d, edx
mov word [rsp + 0x38], si
lea r9d, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x140016383
mov qword [rsp + 0x60], rdi
lea r9, [rsp + 0x40]
mov al, 0xcc
mov rdi, rbx
mov ecx, 0x1000
mov edx, 0x1000
rep stosb byte [rdi], al
mov rcx, rbx
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400162fa
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
jmp 0x14001637e
mov byte [rsp + 0x39], 1
mov edi, 3
mov qword [rsp + 0x28], rsi
lea r9, [rsp + 0x38]
lea r8, [0x1400161f0]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
sub rdi, 1
jne 0x140016304
mov byte [rsp + 0x3c], sil
mov edi, esi
cmp byte [rsp + 0x38], sil
jne 0x140016363
mov r9d, 1
mov qword [rsp + 0x20], rsi
lea r8, [rsp + 0x3c]
mov rdx, rbx
lea rcx, [r9 - 2]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, rbx
call fcn.1400161e0
inc edi
cmp edi, 0x19
jl 0x140016330
xor edx, edx
mov byte [rsp + 0x39], sil
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
movzx eax, byte [rsp + 0x38]
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14009bc50
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
Function at 0x1400267c0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400268a2
call fcn.14003db20
test al, al
jne 0x1400268a2
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x1400267f2
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.140048d60
test rax, rax
je 0x140026837
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.140048d60
mov rsi, rax
test rax, rax
je 0x140026837
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x14002686b
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.1400386e0
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x140026850
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14002ce70
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x14011b8b0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, qword [rdx + 0x10]
mov rbx, rcx
mov rax, qword [rdx + 0x18]
lea rcx, str.SSL_PROXY
cmp qword [rdx], rcx
jne 0x14002ceb7
mov rdi, qword [rax + 0x128]
mov rsi, qword [rax + 0x130]
mov ebp, dword [rax + 0x138]
jmp 0x14002cecb
mov rdi, qword [rax + 0xa0]
mov rsi, qword [rax + 0xa8]
mov ebp, dword [rax + 0x728]
mov qword [rsp + 0x80], r15
test rdi, rdi
je 0x14002d08b
mov r9, qword [rbx]
test r9, r9
je 0x14002cf0b
mov r8, r9
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14002cf03
inc rax
test ecx, ecx
jne 0x14002cef0
test edx, edx
je 0x14002d08b
mov rcx, qword [rbx + 8]
cmp rcx, r9
je 0x14002cf1a
call qword [fcn.1400ac79c]
mov rcx, qword [rbx + 0x10]
call qword [fcn.1400ac79c]
mov rcx, qword [rbx]
call qword [fcn.1400ac79c]
xor r15d, r15d
mov rcx, rdi
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov qword [rbx], r15
mov byte [rbx + 0x18], r15b
call qword [case.0x14002f61f.1]
mov qword [rbx], rax
mov r9, rax
test rax, rax
jne 0x14002cf8e
mov rcx, qword [rbx + 8]
cmp rcx, rax
je 0x14002cf62
call qword [fcn.1400ac79c]
mov rcx, qword [rbx + 0x10]
call qword [fcn.1400ac79c]
mov rcx, qword [rbx]
call qword [fcn.1400ac79c]
mov eax, 0x1b
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov qword [rbx], r15
mov byte [rbx + 0x18], r15b
jmp 0x14002d091
test rsi, rsi
je 0x14002cfd3
mov r8, rsi
sub r8, rdi
nop dword [rax]
movzx edx, byte [rdi]
movzx eax, byte [rdi + r8]
sub edx, eax
jne 0x14002cfb3
inc rdi
test eax, eax
jne 0x14002cfa0
test edx, edx
je 0x14002cfd3
mov rcx, rsi
call qword [case.0x14002f61f.1]
mov qword [rbx + 8], rax
test rax, rax
jne 0x14002cfd7
cmp rax, qword [rbx]
je 0x14002cf62
mov rcx, rax
jmp 0x14002cf5c
mov qword [rbx + 8], r9
mov rdi, qword [rbx]
mov qword [rbx + 0x10], r15
test rdi, rdi
je 0x14002d018
cmp byte [rdi], r15b
je 0x14002d018
lea r8, [rsp + 0x20]
mov rdx, rdi
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jne 0x14002d014
lea r8, [rsp + 0x20]
mov rdx, rdi
lea ecx, [rax + 0x17]
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x14002d018
mov cl, 1
jmp 0x14002d01a
xor cl, cl
mov rax, qword [rbx]
mov byte [rbx + 0x18], cl
cmp byte [rax], r15b
je 0x14002d08b
test cl, cl
jne 0x14002d08b
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], r15b
jne 0x14002d030
test rdi, rdi
je 0x14002d048
cmp byte [rax + rdi - 1], 0x2e
jne 0x14002d048
dec rdi
cmp rdi, 0xffff
jae 0x14002d08b
lea rdx, [rdi + 1]
mov ecx, 1
call qword [fcn.1400ad32c]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x14002d075
mov rcx, qword [rbx + 8]
cmp rcx, qword [rbx]
jmp 0x14002cf5a
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, rax
call fcn.140038730
mov rax, qword [rbx + 0x10]
mov byte [rdi + rax], r15b
mov dword [r14 + 0x50], ebp
xor eax, eax
mov r15, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14009bc50
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140035fd0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call fcn.1400c43a4
cdqe
add rsp, 0x28
ret
Function at 0x1400364a0
Capabilities:
Get common file path
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x14011b8b0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
test cl, 2
je 0x140036506
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400364e9
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x1400364e3
shr ax, 8
cmp al, 2
je 0x140036506
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.14009bc50
add rsp, 0x1e8
ret
call fcn.14006b860
test eax, eax
jne 0x140036720
mov qword [rsp + 0x200], rsi
lea rcx, str.kernel32
mov qword [rsp + 0x208], rdi
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x140036546
mov qword [0x140121028], rsi
jmp 0x1400366dd
mov qword [rsp + 0x1f0], rbx
lea rdx, [0x1400dd988]
mov rcx, rdi
mov qword [rsp + 0x1f8], rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rbx, str.iphlpapi.dll
mov rbp, rax
mov rcx, rbx
lea rdx, [0x1400dd998]
call fcn.1400b307c
test rax, rax
je 0x1400365aa
mov rcx, rbx
test rbp, rbp
je 0x14003659c
xor edx, edx
lea r8d, [rdx + 8]
call rbp
mov rsi, rax
jmp 0x14003669c
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
jmp 0x14003669c
test rbp, rbp
je 0x1400365d9
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400365d9
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call rbp
mov rsi, rax
jmp 0x14003669c
xor edx, edx
mov qword [rsp + 0x1e0], r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r14d, eax
test eax, eax
je 0x140036694
lea ecx, [rax + 1]
lea rcx, [rcx*2 + 0x18]
call qword [section..data]
mov rdi, rax
test rax, rax
je 0x14003668b
mov edx, r14d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14003668b
mov rcx, 0xffffffffffffffff
mov rax, rcx
nop dword [rax]
cmp word [rdi + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x140036630
mov dword [rdi + rax*2], 0x5c
cmp word [rdi + rcx*2 + 2], si
lea rcx, [rcx + 1]
jne 0x140036642
lea rdx, [rcx + rcx]
sub rdx, rbx
add rdx, rdi
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rdx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x140036660
mov rcx, rdi
test rbp, rbp
je 0x140036682
xor edx, edx
lea r8d, [rdx + 8]
call rbp
jmp 0x140036688
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
mov rcx, rdi
call qword [fcn.1400ac79c]
mov r14, qword [rsp + 0x1e0]
mov rbp, qword [rsp + 0x1f8]
mov rbx, qword [rsp + 0x1f0]
mov qword [0x140121028], rsi
test rsi, rsi
je 0x1400366dd
lea rdx, str.if_nametoindex
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140121020]
test rax, rax
cmovne rcx, rax
mov qword [0x140121020], rcx
xor edx, edx
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.14006b410
test al, al
lea rcx, [0x140124550]
setne byte [0x140124548]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rdi, qword [rsp + 0x208]
xor eax, eax
mov rsi, qword [rsp + 0x200]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.14009bc50
add rsp, 0x1e8
ret