joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140056b30
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2c8
mov rax, qword [0x1400cc400]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rdx, [rsp + 0xb0]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x140056cc3
mov dword [rsp + 0x20], 0
jmp 0x140056b83
mov eax, dword [rsp + 0x20]
add eax, 4
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
movsx eax, byte [rsp + rax + 0xb0]
test eax, eax
je 0x140056cc3
movsxd rax, dword [rsp + 0x20]
lea rax, [rsp + rax + 0xb0]
lea rdx, [0x1400af544]
mov rcx, rax
call fcn.1400a39cc
test eax, eax
je 0x140056bd8
movsxd rax, dword [rsp + 0x20]
lea rax, [rsp + rax + 0xb0]
lea rdx, [0x1400af558]
mov rcx, rax
call fcn.1400a39cc
test eax, eax
jne 0x140056bda
jmp 0x140056b78
movsxd rax, dword [rsp + 0x20]
mov ecx, 1
imul rcx, rcx, 0
movzx eax, byte [rsp + rax + 0xb0]
mov byte [rsp + rcx + 0x24], al
mov eax, dword [rsp + 0x20]
inc eax
cdqe
mov ecx, 1
imul rcx, rcx, 1
movzx eax, byte [rsp + rax + 0xb0]
mov byte [rsp + rcx + 0x24], al
mov eax, 1
imul rax, rax, 2
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 3
jae 0x140056c29
jmp 0x140056c2e
call fcn.14004cd04
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x24], 0
mov r8d, 0x64
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x140056c56
xor eax, eax
jmp 0x140056cc5
lea rcx, [rsp + 0x40]
call fcn.14008e8c0
mov dword [rsp + 0x28], eax
movsxd rax, dword [rsp + 0x28]
mov r8, rax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x2d0]
call fcn.14007d550
test eax, eax
jne 0x140056cbe
lea rdx, [rsp + 0x24]
mov rcx, qword [rsp + 0x2d8]
call fcn.14008e7f0
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x2d0]
add rcx, rax
mov rax, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x2d8]
call fcn.14008e750
mov eax, 1
jmp 0x140056cc5
jmp 0x140056b78
xor eax, eax
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14004c260
add rsp, 0x2c8
ret

Function at 0x140056cf0
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x150
mov rax, qword [0x1400cc400]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140056d4c
xor eax, eax
jmp 0x140056da9
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.PSAPI.DLL_GetProcessImageFileNameA
test eax, eax
jne 0x140056d74
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140056da9
mov rdx, qword [rsp + 0x160]
lea rcx, [rsp + 0x30]
call fcn.140056b30
test eax, eax
jne 0x140056d99
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140056da9
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14004c260
add rsp, 0x150
pop rdi
ret
Function at 0x140056e70
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x328
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1400cc400]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov dword [rsp + 0x300], 0x19db
mov dword [rsp + 0x304], 0x4eb
mov dword [rsp + 0x308], 0x23dd
mov dword [rsp + 0x30c], 0xb47
lea rdx, [rsp + 0x300]
lea rcx, [rsp + 0x40]
call fcn.14004fbe0
nop
lea rax, [rsp + 0x30]
lea rcx, [0x1400af4e0]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140050d60
mov rcx, qword [rsp + 0x340]
call fcn.140056e10
mov rcx, qword [rsp + 0x340]
call fcn.14008e8c0
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x340]
add rcx, rax
mov rax, rcx
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1400a4120
mov rcx, qword [rsp + 0x340]
call fcn.140056dd0
test eax, eax
jne 0x140056ffa
mov r8d, 0x100
xor edx, edx
mov rcx, qword [rsp + 0x340]
call fcn.1400a3cc0
mov rdx, qword [rsp + 0x340]
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rcx, qword [rsp + 0x340]
call fcn.14008e8c0
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x340]
mov byte [rcx + rax], 0x5c
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x340]
add rcx, rax
mov rax, rcx
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1400a4120
mov rcx, qword [rsp + 0x340]
call fcn.140056dd0
test eax, eax
jne 0x140056ffa
mov r8d, 0x100
xor edx, edx
mov rcx, qword [rsp + 0x340]
call fcn.1400a3cc0
nop
lea rcx, [rsp + 0x40]
call fcn.140050b90
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.14004c260
add rsp, 0x328
pop rdi
pop rsi
ret
Function at 0x140059270
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2c8
mov rax, qword [0x1400cc400]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rdx, [rsp + 0xb0]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x140059403
mov dword [rsp + 0x20], 0
jmp 0x1400592c3
mov eax, dword [rsp + 0x20]
add eax, 4
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
movsx eax, byte [rsp + rax + 0xb0]
test eax, eax
je 0x140059403
movsxd rax, dword [rsp + 0x20]
lea rax, [rsp + rax + 0xb0]
lea rdx, [0x1400af7d4]
mov rcx, rax
call fcn.1400a39cc
test eax, eax
je 0x140059318
movsxd rax, dword [rsp + 0x20]
lea rax, [rsp + rax + 0xb0]
lea rdx, [0x1400af7e4]
mov rcx, rax
call fcn.1400a39cc
test eax, eax
jne 0x14005931a
jmp 0x1400592b8
movsxd rax, dword [rsp + 0x20]
mov ecx, 1
imul rcx, rcx, 0
movzx eax, byte [rsp + rax + 0xb0]
mov byte [rsp + rcx + 0x24], al
mov eax, dword [rsp + 0x20]
inc eax
cdqe
mov ecx, 1
imul rcx, rcx, 1
movzx eax, byte [rsp + rax + 0xb0]
mov byte [rsp + rcx + 0x24], al
mov eax, 1
imul rax, rax, 2
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 3
jae 0x140059369
jmp 0x14005936e
call fcn.14004cd04
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x24], 0
mov r8d, 0x64
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x140059396
xor eax, eax
jmp 0x140059405
lea rcx, [rsp + 0x40]
call fcn.14008e8c0
mov dword [rsp + 0x28], eax
movsxd rax, dword [rsp + 0x28]
mov r8, rax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x2d0]
call fcn.14007d550
test eax, eax
jne 0x1400593fe
lea rdx, [rsp + 0x24]
mov rcx, qword [rsp + 0x2d8]
call fcn.14008e7f0
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x2d0]
add rcx, rax
mov rax, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x2d8]
call fcn.14008e750
mov eax, 1
jmp 0x140059405
jmp 0x1400592b8
xor eax, eax
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14004c260
add rsp, 0x2c8
ret

Function at 0x140059430
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x150
mov rax, qword [0x1400cc400]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14005948c
xor eax, eax
jmp 0x1400594e9
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.PSAPI.DLL_GetProcessImageFileNameA
test eax, eax
jne 0x1400594b4
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400594e9
mov rdx, qword [rsp + 0x160]
lea rcx, [rsp + 0x30]
call fcn.140059270
test eax, eax
jne 0x1400594d9
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400594e9
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14004c260
add rsp, 0x150
pop rdi
ret
Function at 0x14005a090
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 0x58]
and ax, 1
movzx eax, ax
test eax, eax
je 0x14005a0e0
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax + 0x30c]
mov rcx, qword [rsp + 0x40]
movzx ecx, byte [rcx + 0x30e]
imul eax, ecx
mov rcx, qword [rsp + 0x40]
movzx ecx, byte [rcx + 0x30d]
add eax, ecx
jmp 0x14005a27a
mov cl, 4
call fcn.140056180
test eax, eax
jne 0x14005a0f5
mov eax, 0xfffffff6
jmp 0x14005a27a
lea rdx, [0x1400d0ff0]
mov rcx, qword [rsp + 0x48]
call fcn.140059110
test eax, eax
jne 0x14005a114
mov eax, 0xfffffff5
jmp 0x14005a27a
mov eax, dword [0x1400d0ff0]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
movzx ecx, word [rsp + 0x20]
mov word [rax + 0x31c], cx
mov rax, qword [rsp + 0x40]
movzx ecx, word [rsp + 0x22]
mov word [rax + 0x31e], cx
mov rax, qword [rsp + 0x40]
add rax, 0x28c
mov rcx, rax
call fcn.14005c350
mov rax, qword [rsp + 0x40]
add rax, 0x28c
mov rcx, rax
call fcn.14005e070
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax + 0x30e]
test eax, eax
je 0x14005a186
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax + 0x30f]
test eax, eax
jne 0x14005a1a3
mov rax, qword [rsp + 0x40]
add rax, 0x28c
mov rcx, rax
call fcn.14005c3c0
mov eax, 0xfffffff4
jmp 0x14005a27a
mov rax, qword [rsp + 0x40]
add rax, 0x28c
mov rdx, qword [rsp + 0x40]
mov rcx, rax
call fcn.14005c440
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [rax + reloc.WS2_32.dll_htonl]
mov edx, 0x1388
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0xf0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14005a262
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 0x58]
or ax, 1
mov rcx, qword [rsp + 0x40]
mov word [rcx + 0x58], ax
cmp qword [0x1400cc488], 0xffffffffffffffff
jne 0x14005a237
mov r8, qword [rsp + 0x40]
xor edx, edx
lea rcx, [0x14005a670]
call fcn.14008f968
mov qword [0x1400cc488], rax
mov edx, 0xffffffff
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0xf0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax + 0x30c]
mov rcx, qword [rsp + 0x40]
movzx ecx, byte [rcx + 0x30e]
imul eax, ecx
mov rcx, qword [rsp + 0x40]
movzx ecx, byte [rcx + 0x30d]
add eax, ecx
jmp 0x14005a27a
mov rax, qword [rsp + 0x40]
add rax, 0x28c
mov rcx, rax
call fcn.14005c3c0
mov eax, 0xffffff9c
add rsp, 0x38
ret
Function at 0x14005b760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [rsp + 0x18], r8w
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x90], 0
je 0x14005b7e4
movzx eax, byte [0x1400cc488]
mov byte [rsp], al
mov dword [rsp + 4], 0
jmp 0x14005b7a1
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
movzx eax, word [rsp + 0x30]
cmp dword [rsp + 4], eax
jge 0x14005b7d6
movsxd rax, dword [rsp + 4]
mov rcx, qword [rsp + 0x28]
movzx eax, byte [rcx + rax]
movzx ecx, byte [rsp]
xor eax, ecx
movsxd rcx, dword [rsp + 4]
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx + 0x90]
mov byte [rdx + rcx], al
jmp 0x14005b797
mov rax, qword [rsp + 0x20]
movzx ecx, word [rsp + 0x30]
mov word [rax + 0x2a], cx
add rsp, 0x18
ret

Function at 0x14005c350
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
cmp qword [rax + 8], 0xffffffffffffffff
je 0x14005c367
jmp 0x14005c3b2
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x10], rax
mov r8, qword [rsp + 0x30]
xor edx, edx
lea rcx, [0x14005c510]
call fcn.14008f968
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x18], 0
jne 0x14005c3b2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14005c39c
add rsp, 0x28
ret
Function at 0x14005d240
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2c8
mov rax, qword [0x1400cc400]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rdx, [rsp + 0xb0]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x14005d3d3
mov dword [rsp + 0x20], 0
jmp 0x14005d293
mov eax, dword [rsp + 0x20]
add eax, 4
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
movsx eax, byte [rsp + rax + 0xb0]
test eax, eax
je 0x14005d3d3
movsxd rax, dword [rsp + 0x20]
lea rax, [rsp + rax + 0xb0]
lea rdx, [0x1400b00a0]
mov rcx, rax
call fcn.1400a39cc
test eax, eax
je 0x14005d2e8
movsxd rax, dword [rsp + 0x20]
lea rax, [rsp + rax + 0xb0]
lea rdx, [0x1400b00a4]
mov rcx, rax
call fcn.1400a39cc
test eax, eax
jne 0x14005d2ea
jmp 0x14005d288
movsxd rax, dword [rsp + 0x20]
mov ecx, 1
imul rcx, rcx, 0
movzx eax, byte [rsp + rax + 0xb0]
mov byte [rsp + rcx + 0x24], al
mov eax, dword [rsp + 0x20]
inc eax
cdqe
mov ecx, 1
imul rcx, rcx, 1
movzx eax, byte [rsp + rax + 0xb0]
mov byte [rsp + rcx + 0x24], al
mov eax, 1
imul rax, rax, 2
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 3
jae 0x14005d339
jmp 0x14005d33e
call fcn.14004cd04
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x24], 0
mov r8d, 0x64
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x14005d366
xor eax, eax
jmp 0x14005d3d5
lea rcx, [rsp + 0x40]
call fcn.14008e8c0
mov dword [rsp + 0x28], eax
movsxd rax, dword [rsp + 0x28]
mov r8, rax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x2d0]
call fcn.14007d550
test eax, eax
jne 0x14005d3ce
lea rdx, [rsp + 0x24]
mov rcx, qword [rsp + 0x2d8]
call fcn.14008e7f0
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x2d0]
add rcx, rax
mov rax, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x2d8]
call fcn.14008e750
mov eax, 1
jmp 0x14005d3d5
jmp 0x14005d288
xor eax, eax
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14004c260
add rsp, 0x2c8
ret

Function at 0x14005d400
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x150
mov rax, qword [0x1400cc400]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14005d45c
xor eax, eax
jmp 0x14005d4b9
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.PSAPI.DLL_GetProcessImageFileNameA
test eax, eax
jne 0x14005d484
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14005d4b9
mov rdx, qword [rsp + 0x160]
lea rcx, [rsp + 0x30]
call fcn.14005d240
test eax, eax
jne 0x14005d4a9
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14005d4b9
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14004c260
add rsp, 0x150
pop rdi
ret
Function at 0x14005d580
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x328
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1400cc400]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov dword [rsp + 0x300], 0x19db
mov dword [rsp + 0x304], 0x4eb
mov dword [rsp + 0x308], 0x23dd
mov dword [rsp + 0x30c], 0xb47
lea rdx, [rsp + 0x300]
lea rcx, [rsp + 0x40]
call fcn.14004fbe0
nop
lea rax, [rsp + 0x30]
lea rcx, [0x1400b0070]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140050d60
mov rcx, qword [rsp + 0x340]
call fcn.14005d520
mov rcx, qword [rsp + 0x340]
call fcn.14008e8c0
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x340]
add rcx, rax
mov rax, rcx
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1400a4120
mov rcx, qword [rsp + 0x340]
call fcn.14005d4e0
test eax, eax
jne 0x14005d70a
mov r8d, 0x100
xor edx, edx
mov rcx, qword [rsp + 0x340]
call fcn.1400a3cc0
mov rdx, qword [rsp + 0x340]
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rcx, qword [rsp + 0x340]
call fcn.14008e8c0
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x340]
mov byte [rcx + rax], 0x5c
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x340]
add rcx, rax
mov rax, rcx
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1400a4120
mov rcx, qword [rsp + 0x340]
call fcn.14005d4e0
test eax, eax
jne 0x14005d70a
mov r8d, 0x100
xor edx, edx
mov rcx, qword [rsp + 0x340]
call fcn.1400a3cc0
nop
lea rcx, [rsp + 0x40]
call fcn.140050b90
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.14004c260
add rsp, 0x328
pop rdi
pop rsi
ret
Function at 0x14005e070
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x140
mov rax, qword [0x1400cc400]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 0xff
rep stosb byte [rdi], al
lea rcx, [rsp + 0x30]
call fcn.14005d580
lea rax, [rsp + 0x30]
test rax, rax
je 0x14005e173
lea rdx, [0x1400b0068]
lea rcx, [rsp + 0x30]
call fcn.14007dad0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14005e173
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x20]
call fcn.14007e6b8
mov rcx, qword [rsp + 0x20]
call fcn.14007ed7c
mov rcx, qword [rsp + 0x150]
mov dword [rcx + 0x8c], eax
mov rax, qword [rsp + 0x150]
mov rax, qword [rax + 0x18]
add rax, 0x100
mov rcx, qword [rsp + 0x150]
mov qword [rcx + 0x84], rax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x20]
call fcn.14007e6b8
mov rax, qword [rsp + 0x150]
movsxd rax, dword [rax + 0x8c]
mov r9, qword [rsp + 0x20]
mov r8, rax
mov edx, 1
mov rax, qword [rsp + 0x150]
mov rcx, qword [rax + 0x84]
call fcn.14007e2e8
mov rcx, qword [rsp + 0x20]
call fcn.14007dc00
mov rax, qword [rsp + 0x150]
cmp qword [rax + 0x84], 0
je 0x14005e192
mov rcx, qword [rsp + 0x150]
call fcn.14005de20
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14004c260
add rsp, 0x140
pop rdi
ret
Function at 0x1400606c0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2c8
mov rax, qword [0x1400cc400]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rdx, [rsp + 0xb0]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x140060853
mov dword [rsp + 0x20], 0
jmp 0x140060713
mov eax, dword [rsp + 0x20]
add eax, 4
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
movsx eax, byte [rsp + rax + 0xb0]
test eax, eax
je 0x140060853
movsxd rax, dword [rsp + 0x20]
lea rax, [rsp + rax + 0xb0]
lea rdx, [0x1400b033c]
mov rcx, rax
call fcn.1400a39cc
test eax, eax
je 0x140060768
movsxd rax, dword [rsp + 0x20]
lea rax, [rsp + rax + 0xb0]
lea rdx, [0x1400b0340]
mov rcx, rax
call fcn.1400a39cc
test eax, eax
jne 0x14006076a
jmp 0x140060708
movsxd rax, dword [rsp + 0x20]
mov ecx, 1
imul rcx, rcx, 0
movzx eax, byte [rsp + rax + 0xb0]
mov byte [rsp + rcx + 0x24], al
mov eax, dword [rsp + 0x20]
inc eax
cdqe
mov ecx, 1
imul rcx, rcx, 1
movzx eax, byte [rsp + rax + 0xb0]
mov byte [rsp + rcx + 0x24], al
mov eax, 1
imul rax, rax, 2
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 3
jae 0x1400607b9
jmp 0x1400607be
call fcn.14004cd04
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x24], 0
mov r8d, 0x64
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x1400607e6
xor eax, eax
jmp 0x140060855
lea rcx, [rsp + 0x40]
call fcn.14008e8c0
mov dword [rsp + 0x28], eax
movsxd rax, dword [rsp + 0x28]
mov r8, rax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x2d0]
call fcn.14007d550
test eax, eax
jne 0x14006084e
lea rdx, [rsp + 0x24]
mov rcx, qword [rsp + 0x2d8]
call fcn.14008e7f0
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x2d0]
add rcx, rax
mov rax, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x2d8]
call fcn.14008e750
mov eax, 1
jmp 0x140060855
jmp 0x140060708
xor eax, eax
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14004c260
add rsp, 0x2c8
ret

Function at 0x140060880
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x150
mov rax, qword [0x1400cc400]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400608dc
xor eax, eax
jmp 0x140060939
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.PSAPI.DLL_GetProcessImageFileNameA
test eax, eax
jne 0x140060904
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140060939
mov rdx, qword [rsp + 0x160]
lea rcx, [rsp + 0x30]
call fcn.1400606c0
test eax, eax
jne 0x140060929
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140060939
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14004c260
add rsp, 0x150
pop rdi
ret
Function at 0x14006a200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov dword [rsp], 0
mov eax, dword [rsp + 0x28]
bts eax, 8
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
and eax, 1
mov dword [rsp + 4], eax
mov eax, dword [rsp + 0x28]
shr eax, 1
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
movzx eax, word [rcx + rax*2]
mov ecx, dword [rsp + 4]
neg ecx
and ecx, 0x7ff
xor eax, ecx
shr eax, 4
mov eax, eax
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax*4]
mov ecx, dword [rsp]
add ecx, eax
mov eax, ecx
mov dword [rsp], eax
cmp dword [rsp + 0x28], 2
jae 0x14006a225
mov eax, dword [rsp]
add rsp, 0x18
ret

Function at 0x14006a290
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov dword [rsp + 4], 0
mov dword [rsp], 0x100
mov eax, dword [rsp + 0x28]
bts eax, 8
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x30]
shl eax, 1
mov dword [rsp + 0x30], eax
mov eax, dword [rsp]
mov ecx, dword [rsp + 0x30]
and ecx, eax
mov eax, ecx
mov ecx, dword [rsp]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x28]
shr ecx, 8
add eax, ecx
mov eax, eax
mov rcx, qword [rsp + 0x20]
movzx eax, word [rcx + rax*2]
mov ecx, dword [rsp + 0x28]
shr ecx, 7
and ecx, 1
neg ecx
and ecx, 0x7ff
xor eax, ecx
shr eax, 4
mov eax, eax
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax*4]
mov ecx, dword [rsp + 4]
add ecx, eax
mov eax, ecx
mov dword [rsp + 4], eax
mov eax, dword [rsp + 0x28]
shl eax, 1
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
not eax
mov ecx, dword [rsp]
and ecx, eax
mov eax, ecx
mov dword [rsp], eax
cmp dword [rsp + 0x28], 0x10000
jb 0x14006a2c2
mov eax, dword [rsp + 4]
add rsp, 0x18
ret