joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180061cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x180061e61
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x180061d40
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.1800616f0
mov r8d, dword [rbx + 0x80]
mov r9d, edi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.180060d00
mov dword [rbx + 0x80], 0
jmp 0x180061e4d
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.18005fae0
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rsi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rsi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], edi
movsd xmm0, qword [rsi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], edi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x18007b350
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x18007b3d4
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x18007f840]
cmp byte [rcx + rax], 0
je 0x18007b3d4
dec r8
sub rdx, 1
jne 0x18007b3ba
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14140a2e4
Capabilities:
Encode data using xor

Disassembly:
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x14140a30d
pop rbp
sub rbp, 0x29
sub rbp, 0x140a2e4
jmp 0x14140a36d
sub rsp, 0x20
jmp 0x14140a37d
mov rax, 0x140a2e4
add rax, rbp
add rax, 0xcb
mov rcx, 0x64a
mov rdx, 0x6670b3a5
xor byte [rax], dl
inc rax
dec rcx
jne 0x14140a39c
jmp 0x14140a3b3
in eax, dx
sub al, 0x4c
sub al, 0x99
movsd dword [rdi], dword [rsi]
movsd dword [rdi], dword [rsi]
movsd dword [rdi], dword [rsi]
in eax, dx
and al, 0x64
lodsd eax, dword [rsi]
movsb byte [rdi], byte [rsi]
movsd dword [rdi], dword [rsi]
movsd dword [rdi], dword [rsi]
in eax, dx
movsb byte [rdi], byte [rsi]
in eax, dx
invalid
Function at 0x14000d9c4
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov edx, ecx
mov ebx, 0x104
mov ecx, ebx
call fcn.1400126d0
mov ecx, ebx
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, str.Kernel32.DLL
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r14d, r14d
mov rbp, rax
test rax, rax
je 0x14000da3e
lea rdx, str.GetLongPathNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000da35
mov r8d, ebx
mov rdx, rdi
mov rcx, rdi
call rax
mov esi, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
sub ebx, esi
mov ecx, ebx
call fcn.140012900
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
movsxd rax, esi
mov rsi, qword [rsp + 0x40]
mov word [rdi + rax*2], r14w
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14000da6c
Capabilities:
Delete file

Disassembly:
xor edx, edx
jmp 0x14000da74
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14000da9f
test dl, 2
je 0x14000da92
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cdqe
jmp 0x14000daa1
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14000da74
Capabilities:
Delete file
Set file attributes

Disassembly:
xor edx, edx
jmp 0x14000da74
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14000da9f
test dl, 2
je 0x14000da92
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cdqe
jmp 0x14000daa1
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14000daa8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edx, ecx
mov esi, 0x104
mov ecx, esi
call fcn.1400126d0
mov ecx, esi
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ebp, ebp
movsxd rbx, eax
test eax, eax
je 0x14000daf1
lea ecx, [rbp + 0x5c]
cmp word [rdi + rbx*2 - 2], cx
je 0x14000daf1
mov word [rdi + rbx*2], cx
inc ebx
sub esi, ebx
mov ecx, esi
call fcn.140012900
mov rsi, qword [rsp + 0x40]
movsxd rax, ebx
mov rbx, qword [rsp + 0x30]
mov word [rdi + rax*2], bp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000dc88
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x14000dc9b
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cdqe
jmp 0x14000dc9d
xor eax, eax
add rsp, 0x28
ret
Function at 0x14046c108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14046c28f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14046c139
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14046c11f
add dl, dl
jne 0x14046c146
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14046c1a6
xor eax, eax
add dl, dl
jne 0x14046c155
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14046c25d
add dl, dl
jne 0x14046c166
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14046c173
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14046c180
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14046c18d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14046c19a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14046c12e
mov eax, 1
add dl, dl
jne 0x14046c1b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14046c1c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14046c1ab
sub eax, ebx
mov ebx, 1
jne 0x14046c1fc
mov ecx, 1
add dl, dl
jne 0x14046c1de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14046c1eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14046c1d3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14046c12e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14046c218
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14046c225
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14046c20d
cmp eax, 0x7d00
jae 0x14046c24b
cmp eax, 0x500
jb 0x14046c246
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14046c12e
cmp eax, 0x7f
ja 0x14046c24e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14046c12e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14046c282
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14046c12e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x10000124c
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.100001180
add rsp, 0x28
jmp 0x100001270
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [section..data], rdi
jne 0x10000169f
mov eax, dword [0x100003014]
cmp eax, 1
je 0x1000016bf
mov eax, dword [0x100003014]
cmp eax, ebx
jne 0x1000016d6
mov dword [0x100003014], 1
lea r13, [0x100002168]
lea rdi, [0x100002150]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x10000131c
cmp eax, ebx
jne 0x10000131c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x100001311
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1000012fa
cmp eax, ebx
jne 0x1000016cc
mov eax, dword [0x100003014]
cmp eax, 1
jne 0x10000134c
lea rdx, [0x100002148]
lea rcx, [0x100002138]
call fcn.10014f000
mov dword [0x100003014], 2
cmp r12d, ebx
jne 0x10000135b
mov rax, rbx
xchg qword [section..data], rax
cmp qword [0x1000035d8], rbx
jne 0x1000016e5
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
je 0x10000170e
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [rcx], 0x20
jbe 0x1000013ab
cmp word [rcx], 0x22
je 0x100001741
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x100001390
cmp word [rcx], bx
je 0x1000013b4
cmp edx, ebx
jne 0x100001396
cmp word [rcx], bx
je 0x1000013ca
cmp word [rcx], 0x20
ja 0x1000013ca
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1000013b4
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x100000000]
call fcn.100001400
nop
jmp 0x100001715
cmp rax, rdi
jne 0x1000016af
mov r12d, 1
jmp 0x1000012ba
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000012a9
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x100001324
mov eax, 0xff
jmp 0x100001780
mov dword [0x1000036e4], 1
jmp 0x100001324
lea rcx, [0x1000035d8]
call fcn.1000018fc
cmp eax, ebx
je 0x100001368
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x1000035d8]
nop
jmp 0x100001368
mov eax, 0xff
jmp 0x100001780
mov dword [0x1000036e0], eax
cmp dword [0x100003008], ebx
jne 0x10000172b
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1000036e4], ebx
jne 0x10000173f
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1000036e0]
jmp 0x100001780
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
jmp 0x1000013a0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
Function at 0x140003120
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x140013358]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rdx
xorps xmm0, xmm0
movups xmmword [rbp - 0x69], xmm0
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
lea rdx, [rbp + 0x27]
call qword [sym.imp.Qt5Core.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_QString::toStdWString_void____ptr64]
nop
mov edx, 0x20
lea rcx, [rsp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QChar::constructor_int____ptr64]
movzx ecx, word [rax]
mov word [rsp + 0x20], cx
mov r9d, 1
lea r8, [rsp + 0x20]
mov rdx, rbx
lea rcx, [rbp - 0x79]
call qword [sym.imp.Qt5Core.dll_class_QString___cdecl_QtPrivate::QStringList_join_class_QStringList_const____ptr64__class_QChar_const____ptr64__int_]
nop
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x79]
call qword [sym.imp.Qt5Core.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_QString::toStdWString_void____ptr64]
nop
lea rcx, [rbp - 0x79]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov dword [rbp - 0x69], 0x70
xor edi, edi
mov qword [rbp - 0x61], rdi
mov dword [rbp - 0x65], 0x500
lea rax, str.runas
mov qword [rbp - 0x59], rax
lea rax, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rax, qword [rbp + 0x27]
mov qword [rbp - 0x51], rax
lea rax, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rax, qword [rbp + 7]
mov qword [rbp - 0x49], rax
mov dword [rbp - 0x39], edi
lea rcx, [rbp - 0x69]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, 1
sete bl
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x140003255
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003250
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003250
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400086c4
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x1f], 7
mov word [rbp + 7], di
mov rdx, qword [rbp + 0x3f]
cmp rdx, 8
jb 0x1400032a8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400032a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400032a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400086c4
movzx eax, bl
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140008d50
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140006270
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14008c070]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140006343
cmp byte [rcx + 0x71], 0
je 0x140006343
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14000633f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140006304
sub eax, 1
je 0x140006308
cmp eax, 2
jne 0x14000633f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006cd00
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140006336
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000633f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400062ec
xor al, al
jmp 0x1400062ec
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006cd00
add rsp, 0x60
pop rbx
ret

Function at 0x140009770
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x14008c070]
xor rax, rsp
mov qword [rsp + 0xc0], rax
movzx edi, cl
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rdx, [0x14008c1b8]
lea rcx, [rsp + 0x60]
call fcn.1400065f0
mov rbx, rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
mov r8d, 0xa
lea rdx, [0x140080a58]
lea rcx, [rsp + 0x38]
call fcn.1400067c0
nop
mov r9, rbx
mov r8d, 0xa
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x80]
call fcn.140010cb0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.140014ae0
nop
mov byte [0x14008d1cc], 0
xor r8d, r8d
lea rdx, [0x140080558]
lea rcx, [0x14008c0f8]
call fcn.1400067c0
xor r8d, r8d
lea rdx, [0x140080558]
lea rcx, [0x14008c1f8]
call fcn.1400067c0
xor r8d, r8d
lea rdx, [0x140080558]
lea rcx, [0x14008c178]
call fcn.1400067c0
xor r8d, r8d
lea rdx, [0x140080558]
lea rcx, [0x14008c158]
call fcn.1400067c0
mov ecx, 0xffffffff
call fcn.140001990
call fcn.140001aa0
mov rcx, qword [0x14008d1c0]
test rcx, rcx
je 0x1400098a7
test dil, dil
je 0x1400098a7
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov qword [0x14008d1c0], 0
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x1400098ed
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400098e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400098e8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov eax, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14006cd00
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rdi
ret
Function at 0x140004a00
Capabilities:
Create process on windows
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
cmp qword [rdx + 0x18], 8
mov rbx, rdx
mov rdi, rcx
mov r9, rdx
jb 0x140004a22
mov r9, qword [rdx]
cmp qword [rcx + 0x18], 8
mov r8, rdi
jb 0x140004a2f
mov r8, qword [rcx]
mov ecx, WSAStartup
xor edx, edx
call fcn.1400015a0
lea ecx, [rdx + 0x75]
mov word [rsp + 0x30], ax
lea edx, [rcx - 0x74]
call fcn.1400015a0
lea ecx, [rdx + 0x6d]
mov word [rsp + 0x32], ax
lea edx, [rcx - 0x6c]
call fcn.1400015a0
lea ecx, [rdx + 0x5f]
mov word [rsp + 0x34], ax
lea edx, [rcx - 0x5e]
call fcn.1400015a0
lea ecx, [rdx + 0x70]
mov word [rsp + 0x36], ax
lea edx, [rcx - 0x6f]
call fcn.1400015a0
xor ecx, ecx
mov word [rsp + 0x38], ax
lea edx, [rcx + 5]
call fcn.1400015a0
lea edx, [rcx + 6]
mov word [rsp + 0x3a], ax
movzx ecx, word [0x1400a428c]
call fcn.1400015a0
movzx ecx, word [0x1400a428e]
mov edx, 7
mov word [rsp + 0x3c], ax
call fcn.1400015a0
movzx ecx, word [reloc.WLDAP32.dll_Ordinal_46]
mov edx, 8
mov word [rsp + 0x3e], ax
call fcn.1400015a0
movzx ecx, word [reloc.WS2_32.dll_WSAStartup]
mov edx, 9
mov word [rsp + 0x40], ax
call fcn.1400015a0
movzx ecx, word [0x1400a4294]
mov edx, 0xa
mov word [rsp + 0x42], ax
call fcn.1400015a0
mov word [rsp + 0x44], ax
mov r10d, 0x133
xor eax, eax
mov word [rsp + 0x46], ax
xor esi, esi
nop word [rax + rax]
movsxd rcx, eax
lea rdx, [rsp + 0x30]
lea rdx, [rdx + rcx*2]
lea ecx, [r10 + rax]
inc eax
xor word [rdx], cx
cmp eax, 0xb
jb 0x140004b10
mov dword [rsp + 0x28], esi
lea rdx, [rsp + 0x30]
xor ecx, ecx
mov qword [rsp + 0x20], rsi
mov word [rsp + 0x46], si
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140004b80
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140004b7b
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004be9
mov rcx, r8
call fcn.14007374c
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140004bca
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140004bc5
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004be9
mov rcx, r8
call fcn.14007374c
mov qword [rbx + 0x10], rsi
mov word [rbx], si
mov rsi, qword [rsp + 0x78]
mov qword [rbx + 0x18], 7
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140004bf0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400b3098]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 8
mov dword [rsp + 0x40], ebp
jb 0x140004c21
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x140004cc2
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140004c94
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140004c8f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004d6b
mov rcx, r8
call fcn.14007374c
mov al, 1
mov word [rdi], bp
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbp
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140073230
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x140004d07
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140004d03
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140004cfe
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004d6b
mov rcx, r8
call fcn.14007374c
xor al, al
jmp 0x140004c96
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x41200
mov qword [rsp + 0x20], rbp
lea rdx, [0x1400b54f0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x140004d54
cmp rax, 8
jb 0x140004d03
lea rdx, [rax*2 + 2]
jmp 0x140004cda
cmp rax, 8
jb 0x140004c94
lea rdx, [rax*2 + 2]
jmp 0x140004c67
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140004d80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400b3098]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 8
mov dword [rsp + 0x40], ebp
jb 0x140004db1
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x140004e52
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140004e24
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140004e1f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004efb
mov rcx, r8
call fcn.14007374c
mov al, 1
mov word [rdi], bp
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbp
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140073230
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x140004e97
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140004e93
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140004e8e
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004efb
mov rcx, r8
call fcn.14007374c
xor al, al
jmp 0x140004e26
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x2400
mov qword [rsp + 0x20], rbp
lea rdx, [0x1400b30f0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x140004ee4
cmp rax, 8
jb 0x140004e93
lea rdx, [rax*2 + 2]
jmp 0x140004e6a
cmp rax, 8
jb 0x140004e24
lea rdx, [rax*2 + 2]
jmp 0x140004df7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3