joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3a308
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x60
mov rsi, rdx
lea rdx, [rax - 0x28]
mov rdi, r8
mov rbp, rcx
call fcn.0003a078
lea rdx, [rbp + 0x10]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.00039f0c
xor ebx, ebx
movzx r9d, bx
movsx rcx, r9w
inc r9w
mov eax, dword [rbp + rcx*4]
xor eax, dword [rsp + rcx*4 + 0x20]
mov dword [rsp + rcx*4 + 0x30], eax
cmp r9w, 4
jb 0x3a347
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsp + rcx*4 + 0x50], eax
cmp dx, 4
jb 0x3a365
lea rcx, [rsp + 0x50]
call fcn.00039e88
movzx edx, bx
cmp word [rdi], bx
je 0x3a3aa
movsx rcx, dx
inc dx
mov eax, dword [rdi + rcx*4 + 4]
xor eax, dword [rsp + rcx*4 + 0x50]
xor eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsi + rcx*4], eax
cmp dx, 4
jb 0x3a38c
jmp 0x3a3c2
movsx rcx, dx
inc dx
mov eax, dword [rsp + rcx*4 + 0x50]
xor eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsi + rcx*4], eax
cmp dx, 4
jb 0x3a3aa
movzx ecx, bx
movsx rax, cx
inc cx
or dword [rsp + rax*4 + 0x20], 0xffffffff
cmp cx, 4
jb 0x3a3c5
and dword [rsp + 0x20], 0x1ffff
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rsp + rcx*4 + 0x30]
xor dword [rsp + rcx*4 + 0x20], eax
cmp dx, 4
jb 0x3a3e2
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.00039f0c
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rbp + rcx*4]
mov dword [rsp + rcx*4 + 0x40], eax
cmp dx, 4
jb 0x3a40c
lea rcx, [rsp + 0x40]
call fcn.00039e88
movsx rcx, bx
inc bx
mov eax, dword [rsp + rcx*4 + 0x50]
xor eax, dword [rsp + rcx*4 + 0x40]
mov dword [rsi + rcx*4 + 0x10], eax
cmp bx, 4
jb 0x3a42b
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x3a460
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xf0
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor r13d, r13d
mov r12, r9
mov rsi, r8
lea r14d, [r13 + 1]
mov rbp, rdx
movzx r10d, r13w
movsx r8, r10w
add r10w, r14w
mov eax, dword [rcx + r8*4]
mov dword [rsp + r8*4 + 0x20], eax
cmp r10w, 4
jb 0x3a49f
mov edx, r13d
movzx ecx, r13w
movsx rax, cx
add cx, r14w
or edx, dword [rsp + rax*4 + 0x20]
cmp cx, 4
jb 0x3a4be
cmp edx, r13d
jne 0x3a507
movzx ecx, r13w
movsx rax, cx
add cx, r14w
mov dword [rsi + rax*4], r13d
cmp cx, 4
jb 0x3a4d9
movzx ecx, r13w
movsx rax, cx
add cx, r14w
mov dword [rsi + rax*4 + 0x10], r13d
cmp cx, 4
jb 0x3a4ef
jmp 0x3a6a3
movzx ebx, r13w
mov r11d, 3
test byte [rsp + 0x2c], r14b
je 0x3a547
mov al, byte [rsp + 0x2c]
mov ecx, 2
and al, r11b
sub cl, al
movsx rax, bx
mov byte [rsp + rax + 0x60], cl
jns 0x3a550
movzx ecx, r11w
movsx rax, cx
add dword [rsp + rax*4 + 0x20], r14d
jne 0x3a550
add cx, 0xffff
jns 0x3a534
jmp 0x3a550
movsx rax, bx
mov byte [rsp + rax + 0x60], r13b
and dword [rsp + 0x2c], 0xfffffffe
lea rcx, [rsp + 0x20]
call fcn.00039ec8
add bx, r14w
mov edx, r13d
movzx ecx, r13w
movsx rax, cx
add cx, r14w
or edx, dword [rsp + rax*4 + 0x20]
cmp cx, 4
jb 0x3a56a
cmp edx, r13d
jne 0x3a511
dec bx
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rbp + rcx*4]
mov dword [rsi + rcx*4], eax
cmp dx, 4
jb 0x3a588
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rbp + rcx*4 + 0x10]
mov dword [rsi + rcx*4 + 0x10], eax
cmp dx, 4
jb 0x3a5a1
cmp bx, r13w
jle 0x3a6a3
movsx rax, bx
lea rdi, [rsp + rax + 0x60]
lea rdx, [rsp + 0x20]
mov r8, r12
mov rcx, rsi
call fcn.0003a308
sub rdi, r14
dec bx
cmp byte [rdi], 0xff
je 0x3a635
cmp byte [rdi], r13b
je 0x3a600
cmp byte [rdi], r14b
jne 0x3a699
lea rdx, [rsp + 0x20]
mov rcx, rbp
jmp 0x3a68e
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rsp + rcx*4 + 0x20]
mov dword [rsi + rcx*4], eax
cmp dx, 4
jb 0x3a604
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsi + rcx*4 + 0x10], eax
cmp dx, 4
jb 0x3a61d
jmp 0x3a699
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rbp + rcx*4]
mov dword [rsp + rcx*4 + 0x40], eax
cmp dx, 4
jb 0x3a639
movzx ecx, r13w
movsx rax, cx
add cx, r14w
mov dword [rsp + rax*4 + 0x50], r13d
cmp cx, 4
jb 0x3a653
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rbp + rcx*4 + 0x10]
xor eax, dword [rbp + rcx*4]
mov dword [rsp + rcx*4 + 0x50], eax
cmp dx, 4
jb 0x3a66a
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
mov r9, r12
mov r8, rsi
call fcn.0003a190
cmp bx, r13w
jg 0x3a5ca
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.0003acb0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x3a7b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x1f0
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov esi, 1
xor ebp, ebp
lea r12d, [rsi + 0x70]
mov cx, si
movzx r8d, bp
movsx rax, cx
movsx ecx, cx
mov word [rsp + rax*2 + 0x10], r8w
add ecx, ecx
mov eax, 0x24168e19
add r8w, si
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe3
sub ecx, edx
cmp r8w, r12w
jl 0x3a7f4
mov r8d, 0xe2
cmp cx, si
jne 0x3a86e
movzx r9d, bp
movsx rax, r8w
movsx ecx, r8w
mov word [rsp + rax*2 + 0x10], r9w
add ecx, ecx
mov eax, 0x24168e19
add r9w, si
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe3
sub ecx, edx
cmp r9w, r12w
mov r8w, cx
jl 0x3a835
jmp 0x3a8a4
movzx r9d, r12w
movsx rax, cx
movsx ecx, cx
mov word [rsp + rax*2 + 0x10], r9w
add ecx, ecx
mov eax, 0x24168e19
add r9w, si
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe3
sub ecx, edx
cmp r9w, r8w
jl 0x3a872
or eax, 0xffffffff
mov word [0x0004df80], si
mov bx, si
lea r11d, [rax + 0x71]
mov word [0x0004e146], ax
mov r8, rsi
mov r10, r11
movsx ebx, bx
mov eax, 0x24168e19
add ebx, ebx
imul ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe3
sub ebx, edx
movsx rdx, bx
mov rcx, rdx
neg rcx
movzx eax, word [rsp + rcx*2 + 0x1d8]
mov word [rsp], ax
movzx eax, word [rsp + rcx*2 + 0x1d4]
movzx ecx, bp
mov word [rsp + 2], ax
movzx eax, word [rsp + rdx*2 + 0xe]
mov word [rsp + 4], ax
movzx eax, word [rsp + rdx*2 + 0x12]
movzx edx, bp
mov word [rsp + 6], ax
movsx rax, dx
movzx r9d, word [rsp + rax*2]
cmp r9w, r12w
jge 0x3a949
movsx rax, cx
lea rdi, [0x0004df80]
imul rax, rax, 0xe3
add rax, r8
add cx, si
mov word [rdi + rax*2], r9w
add dx, si
cmp cx, 2
jl 0x3a91d
add r8, rsi
sub r10, rsi
jne 0x3a8c2
lea edx, [r10 + 0x10]
movzx r8d, bp
mov word [0x0004df64], bp
mov r10d, edx
mov r9d, 0xffff0000
mov ecx, r9d
and ecx, r11d
je 0x3a985
add r8w, dx
mov r11d, ecx
mov eax, r10d
cdq
sub eax, edx
sar eax, 1
movsx edx, ax
mov eax, r9d
mov ecx, edx
mov r10d, edx
shr eax, cl
xor r9d, eax
cmp dx, bp
jne 0x3a976
mov word [0x0004df64], r8w
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.0003acb0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x3a9e0
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x230
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov r12, rcx
movsxd r13, edx
xor ebx, ebx
lea rcx, [rsp + 0x20]
jmp 0x3aa41
mov al, byte [r8]
cmp al, 0x20
je 0x3aa3e
cmp al, 9
je 0x3aa3e
cmp al, 0xd
je 0x3aa3e
cmp al, 0xa
je 0x3aa3e
cmp al, 0x61
jl 0x3aa39
cmp al, 0x7a
jg 0x3aa39
sub al, 0x20
mov byte [rcx], al
inc rcx
inc r8
cmp byte [r8], bl
jne 0x3aa1c
mov r10, qword [0x0004ef10]
mov byte [rcx], bl
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
or esi, 0xffffffff
repne scasb al, byte [rdi]
not rcx
lea rbp, [rcx - 1]
cmp r10, rbx
jne 0x3aaf2
mov edx, 0x400
xor ecx, ecx
mov r8d, 0xcc4d5053
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r9d, ebx
mov r8, rbx
mov r10, rax
mov qword [0x0004ef10], rax
mov eax, 1
mov ecx, ebx
lea edx, [rax + 0x7f]
test r9d, eax
je 0x3aaa3
or ecx, edx
add eax, eax
shr edx, 1
jne 0x3aa9c
shl ecx, 0x18
mov eax, 8
bt ecx, 0x1f
jae 0x3aac1
add ecx, ecx
xor ecx, 0x4c11db7
jmp 0x3aac3
add ecx, ecx
sub rax, 1
jne 0x3aab1
lea edi, [rax + 1]
mov edx, ebx
mov eax, 0x80000000
test ecx, edi
je 0x3aad9
or edx, eax
add edi, edi
shr eax, 1
jne 0x3aad3
mov dword [r10 + r8*4], edx
inc r8
inc r9d
cmp r8, 0x100
jl 0x3aa92
mov eax, ebp
lea rdi, [rsp + 0x20]
lea rdx, [rsp + rax + 0x20]
lea rax, [rsp + 0x20]
cmp rax, rdx
jae 0x3ab26
movsx ecx, byte [rdi]
mov eax, esi
inc rdi
xor rcx, rax
movzx eax, cl
mov ecx, esi
mov esi, dword [r10 + rax*4]
shr ecx, 8
xor esi, ecx
cmp rdi, rdx
jb 0x3ab08
cmp r13, rbx
mov dword [0x0004df78], esi
jle 0x3ab47
mov ecx, 0x100
call fcn.00038bd8
xor byte [rbx + r12], al
inc rbx
cmp rbx, r13
jl 0x3ab31
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.0003acb0
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x2a8270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
sub edi, edi
movzx ebx, r8b
bswap r10w
movzx r11w, r11b
mov r11, rcx
mov r8, rdi
nop
movzx r9d, byte [r11]
movzx r10d, byte [rdx]
jmp 0x2a829d
inc r11
inc rdx
test edi, 0x47a27f3
clc
stc
test bl, bl
jmp 0x2a82b2
je 0x2a82e1
mov ecx, r8d
bt rax, 0x5f
mov eax, 0xeff1c2a
stc
clc
rol eax, cl
clc
test r9b, 0x70
add al, r8b
cmp r10b, bpl
xor r9b, al
jmp 0x2a82dc
inc r8
cmc
clc
test r9b, r9b
jmp 0x2a82e9
je 0x2a82f8
cmp r9b, r10b
je 0x2a8290
cmp r9b, r10b
jmp 0x2a8300
jae 0x2a8334
or eax, 0xffffffff
movsx bx, ah
cmovl bx, r13w
mov bx, 0x268c
mov rbx, qword [rsp + 8]
mov rdi, 0x66162a21
movsx rdi, r8w
movsx edi, ax
mov rdi, qword [rsp + 0x10]
jmp 0x2a8333
ret
mov rbx, qword [rsp + 8]
lahf
setle dil
seta dil
movzx ax, dl
cwde
mov eax, edi
mov rdi, qword [rsp + 0x10]
jmp 0x2a8353
ret
Function at 0x10000bae0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x100011df8], rdi
je 0x10000bb40
cmp rax, rdi
jne 0x10000bb33
mov r12d, 1
jmp 0x10000bb40
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10000bb19
mov eax, dword [0x100011df0]
cmp eax, 1
jne 0x10000bb55
lea ecx, [rax + 0x1e]
call fcn.100180000
jmp 0x10000bbbc
mov eax, dword [0x100011df0]
cmp eax, ebx
jne 0x10000bbb2
mov dword [0x100011df0], 1
lea r13, [0x100001448]
lea rdi, [0x100001430]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x10000bba4
cmp eax, ebx
jne 0x10000bba4
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x10000bb99
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x10000bb82
cmp eax, ebx
je 0x10000bbbc
mov eax, 0xff
jmp 0x10000bd04
mov dword [0x1000115d4], 1
mov eax, dword [0x100011df0]
cmp eax, 1
jne 0x10000bbe4
lea rdx, [0x100001428]
lea rcx, [0x1000013f0]
call sub.msvcrt.dll__initterm
mov dword [0x100011df0], 2
cmp r12d, ebx
jne 0x10000bbf3
mov rax, rbx
xchg qword [0x100011df8], rax
cmp qword [0x100011e10], rbx
je 0x10000bc1b
lea rcx, [0x100011e10]
call fcn.10000c0cc
cmp eax, ebx
je 0x10000bc1b
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100011e10]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x10000bc31
mov eax, 0xff
jmp 0x10000bd04
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x10000bcb6
cmp word [rcx], bx
je 0x10000bc4c
cmp edx, ebx
jne 0x10000bcb6
cmp word [rcx], bx
je 0x10000bc62
cmp word [rcx], 0x20
ja 0x10000bc62
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x10000bc4c
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x100000000]
call fcn.100002d14
mov dword [0x1000115d0], eax
cmp dword [0x1000115b4], ebx
jne 0x10000bca0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1000115d4], ebx
jne 0x10000bcb4
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1000115d0]
jmp 0x10000bd04
cmp word [rcx], 0x22
jne 0x10000bcc9
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x10000bc3d
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.10000c1e0
add rsp, 0x28
jmp 0x10000bae0
Function at 0x500c30
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x500c3d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x500c4d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x500c35
lea eax, [rcx + 1]
jmp 0x500c5b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x500c6e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x500c54
sub eax, 3
jb 0x500c8e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x500cdd
sar eax, 1
movsxd rbp, eax
jb 0x500cc4
jmp 0x500c9c
add ebx, ebx
jne 0x500c9a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x500cc4
inc ecx
add ebx, ebx
jne 0x500caa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x500cc4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x500cbd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x500cac
add ecx, 2
jmp 0x500cc9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00500bf2
jmp 0x500c3d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x70c00
mov dl, 0xe
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x500d29
cmp rsi, rcx
jae 0x500d31
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x500d10
cmp al, 0x8f
ja 0x500d10
cmp byte [rsi - 2], 0xf
je 0x500d16
sub al, 0xe8
cmp al, 1
ja 0x500cfa
cmp rsi, rcx
jae 0x500d31
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x500d00
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x500d31
lodsb al, byte [rsi]
jmp 0x500d10
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xfe000]
mov eax, dword [rdi]
or eax, eax
je 0x500d8e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x100000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x500d3e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x500d88
mov qword [rbx], rax
add rbx, 8
jmp 0x500d5e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.00500e11], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.00500e11
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x500e01
sub rsp, 0xffffffffffffff80
jmp 0x401500
Function at 0x18000fac9
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1b8
lea rdx, [rsp + 0x20]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor ecx, ecx
cmp eax, 0x2753
setl cl
lea rdx, [0x1800191a8]
mov r8d, 0xeb605178
xor r8d, dword [0x1800191b8]
inc r8d
movsxd r8, r8d
add r8, qword [rdx + rcx*8]
jmp r8

Function at 0x18000fdc4
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rbx, rdx
mov dword [rsp + 0x2c], 1
mov ecx, 2
mov edx, 2
mov r8d, 0x11
call qword [sym.imp.WS2_32.dll_socket]
mov rsi, rax
movsxd rdi, esi
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x2c]
mov rcx, rdi
mov edx, 0xffff
mov r8d, 0x20
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rsp + 0x34], eax
mov word [rsp + 0x30], 2
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x32], ax
lea rdx, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x10
call qword [sym.imp.WS2_32.dll_bind]
mov eax, esi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x180012792
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x60
mov rsi, r8
mov r8, qword [rsp + 0x90]
lea rax, [rsp + 0x38]
mov qword [rax], rcx
mov dword [rax + 8], edx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r9
mov qword [rax + 0x20], r8
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x1800123d8]
xor ecx, ecx
xor edx, edx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
test rax, rax
setne cl
lea rdx, [0x180019f98]
mov r8d, 0x3ebc6826
xor r8d, dword [0x180019fa8]
inc r8d
movsxd r8, r8d
add r8, qword [rdx + rcx*8]
jmp r8
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
xor dword [rax + 0x47f4e5eb], ebp
dec byte [rbx - 0x39d9093d]
invalid
Function at 0x1400d6fe0
Capabilities:
Check mutex on windows
Get hostname

Disassembly:
push rsi
sub rsp, 0x240
mov esi, ecx
mov dword [rsp + 0x24], 0x104
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x208
call fcn.1401a20d0
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r8, [rsp + 0x30]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je fcn.1400da0c8
jmp 0x1400da0d9
cmp esi, 0x60412da5
jae 0x1400d7b10
sub dword [rbx], 0xffffffda
invalid
invalid
jmp 0x1400d8093

Function at 0x14011fc20
Capabilities:
Set current directory

Disassembly:
push rsi
sub rsp, 0x170
mov rsi, rcx
mov qword [rsp + 0x58], rsi
xor ecx, ecx
call fcn.1400d6810
mov ecx, eax
call fcn.1401a4cd0
mov rax, qword [str.P:HfrefChoyvpQbjaybnqf_]
mov qword [rsp + 0x30], rax
mov rax, qword [0x1401b64a8]
mov qword [rsp + 0x38], rax
mov rax, qword [0x1401b64b0]
mov qword [rsp + 0x40], rax
mov ax, word [0x1401b64b8]
mov word [rsp + 0x48], ax
mov al, byte [0x1401b64ba]
mov byte [rsp + 0x4a], al
lea rcx, [rsp + 0x30]
call fcn.1401a5790
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.14011fb60
mov rcx, rsi
mov edx, 0x104
mov r8, rax
call fcn.1401a0dd0
mov rcx, rsi
add rcx, 0x104
mov edx, 8
call fcn.14011fac0
mov rcx, rsi
add rcx, 0x10d
mov edx, 8
call fcn.14011fac0
mov rax, rsi
add rax, 0x10d
mov rdx, rsi
add rdx, 0x104
mov rcx, rsi
add rcx, 0x116
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r8, str._s_s_s.exe
mov edx, 0x104
mov r9, rsi
call fcn.1401a0dd0
mov rax, rsi
add rax, 0x10d
mov rdx, rsi
add rdx, 0x104
mov rcx, rsi
add rcx, 0x116
add rcx, 0x104
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r8, str._s_s_s.dat
mov edx, 0x104
mov r9, rsi
call fcn.1401a0dd0
mov rax, rsi
add rax, 0x104
mov rcx, rsi
add rcx, 0x116
add rcx, 0x208
mov qword [rsp + 0x20], rax
lea r8, str._s_sedge.xml
mov edx, 0x104
mov r9, rsi
call fcn.1401a0dd0
mov rax, rsi
add rax, 0x104
mov rcx, rsi
add rcx, 0x116
add rcx, 0x30c
mov qword [rsp + 0x20], rax
lea r8, str._s_sedge.jpg
mov edx, 0x104
mov r9, rsi
call fcn.1401a0dd0
mov rax, rsi
add rax, 0x104
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r8, str._s_s_
mov edx, 0x104
mov r9, rsi
call fcn.1401a0dd0
lea rcx, [rsp + 0x60]
call fcn.1401a5a50
cmp eax, 0
je 0x14011fdeb
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x14011fdf6
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov rax, rsi
add rsp, 0x170
pop rsi
ret
Function at 0x14011fe10
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x88
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x48], 4
lea rcx, [rsp + 0x50]
lea rdx, [0x1401b64c0]
mov r8d, 0x2a
call fcn.1401a1a30
lea rcx, [rsp + 0x50]
call fcn.1401a5790
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.14011fb60
lea r10, [rsp + 0x40]
mov rcx, 0xffffffff80000001
mov rdx, rax
xor r8d, r8d
mov r9d, 1
mov qword [rsp + 0x20], r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 0
jne 0x14011fed6
lea r10, [rsp + 0x4c]
mov rcx, qword [rsp + 0x40]
lea rdx, str.IsStatus
lea r9, [rsp + 0x3c]
lea rax, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0
jne 0x14011fecb
cmp dword [rsp + 0x3c], 4
jne 0x14011fec9
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
call fcn.1401a5608
jmp 0x14011fecb
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x88
ret

Function at 0x14011fee0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0xa8
lea rax, str.IsStatus
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x5c], 1
lea rcx, [rsp + 0x70]
lea rdx, str.FbsgjnerZvpebfbsgVagrearg_RkcybereZnva
mov r8d, 0x2a
call fcn.1401a1a30
lea rcx, [rsp + 0x70]
call fcn.1401a5790
lea rcx, [rsp + 0x70]
mov rdx, rax
call fcn.14011fb60
lea r10, [rsp + 0x50]
mov rcx, 0xffffffff80000001
mov rdx, rax
xor r8d, r8d
mov r9d, 0x20006
mov qword [rsp + 0x20], r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 0
jne 0x14011ffa9
lea rax, [rsp + 0x5c]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov r9d, 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, 0
jne 0x14011ff99
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x58], 1
jmp 0x140120062
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14012005a
lea rcx, [rsp + 0x70]
call fcn.1401a5790
lea rcx, [rsp + 0x70]
mov rdx, rax
call fcn.14011fb60
lea r10, [rsp + 0x50]
lea r11, [rsp + 0x6c]
mov rcx, 0xffffffff80000001
mov rdx, rax
xor r8d, r8d
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0x20006
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, 0
jne 0x140120058
lea rax, [rsp + 0x5c]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov r9d, 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, 0
jne 0x14012004d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x58], 1
jmp 0x140120062
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14012005a
mov dword [rsp + 0x58], 0
mov eax, dword [rsp + 0x58]
add rsp, 0xa8
ret