joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140082432
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov eax, edx
lea r9, [rsp + 0x34]
mov dword [r9], r8d
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, eax
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14008245f
xor eax, eax
jmp 0x140082464
call fcn.140033bce
nop
add rsp, 0x38
ret

Function at 0x140083160
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x140112c88]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1400831d1
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x1400831fe
test eax, eax
js 0x1400831dd
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x1400831f4
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x140112cf0]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.1400829c0
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call case.0x14006e562.201
mov ecx, 7
int 0x29
ud2

Function at 0x1400856c0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140085760
jmp 0x14008574f

Function at 0x140087970
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.140087da0
mov rax, qword [rbp - 0x60]
movabs rdi, 0x8000000000000000
cmp rax, rdi
jne 0x1400879c6
lea rcx, [rbp - 0x58]
call fcn.140082aa0
mov qword [rsi], rdi
jmp 0x140087c08
mov qword [rbp + 0x3f8], rsi
mov qword [rbp + 0x3f0], rax
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x400], rax
mov qword [rbp + 0x408], 0
mov qword [rbp + 0x410], 2
mov dword [rbp + 0x410], 2

Function at 0x140088ad0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi

Function at 0x14008ab90
Capabilities:
Create directory

Disassembly:
push rbp
mov rbp, rsp
test cl, cl
je 0x14008aba4
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.14008ac70
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.14008abb0
Function at 0x14008abb0
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x10]
call fcn.140087da0
mov rax, qword [rbp - 0x10]
mov rsi, qword [rbp - 8]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x14008ac10
mov rcx, qword [rbp]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x28]
lea edx, [rbp - 0x28]
mov r8b, 1
call fcn.140089890
invalid
in al, dx
invalid
dec dword [rax - 0x75]
jge 0x14008abc7
ror byte [rax - 0x75], 0x75
enter 0x3948, 0xffffffffffffffdf
cmp edi, ebx
jne 0x14008ac1c
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
xor edx, edx
invalid
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
je 0x14008ac41
invalid
test rdi, rdi
je 0x14008ac66
invalid
mov edx, 2
mov rcx, rsi
call fcn.140007ce0
xor eax, eax
jmp case.0x140089fd3.69
call qword [sym.imp.KERNEL32.DLL_GetLastError]
shl rax, 0x20
or rax, 2
test rdi, rdi
je case.0x140089fd3.69
mov edx, 2
mov rcx, rsi
mov rsi, rax
call fcn.140007ce0
jmp 0x14008ac10
xor eax, eax
jmp case.0x140089fd3.69
Function at 0x14008c510
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x1e8
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov rdi, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov word [rbp + 0x166], ax
mov rax, qword [0x14014bfb0]
cmp rax, 3
jne 0x14008c702
lea rax, [rbp + 0x166]
mov qword [rbp + 0x150], rax
cmp rdi, 0x17f
ja 0x14008c712
lea rbx, [rbp - 0x60]
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi - 0x60], 0
lea rax, [rdi + 1]
cmp rdi, 0xe
ja 0x14008c5a8
xor edx, edx
nop word [rax + rax]
cmp byte [rbp + rdx - 0x60], 0
je 0x14008c664
inc rdx
cmp rax, rdx
jne 0x14008c590
jmp 0x14008c6cd
lea rcx, [rbp - 0x59]
and rcx, 0xfffffffffffffff8
sub rcx, rbx
je 0x14008c5de
xor edx, edx
nop word [rax + rax]
cmp byte [rbp + rdx - 0x60], 0
je 0x14008c664
inc rdx
cmp rcx, rdx
jne 0x14008c5c0
lea rdx, [rdi - 0xf]
cmp rcx, rdx
jbe 0x14008c5e2
jmp 0x14008c62e
lea rdx, [rdi - 0xf]
movdqa xmm0, xmmword [0x1400da6e0]
movabs r8, 0x8080808080808080
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rbp + rcx - 0x60]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r9, xmm2
test r9, r8
jne 0x14008c62e
add rcx, 0x10
cmp rcx, rdx
jbe 0x14008c600
sub rax, rcx
je 0x14008c6cd
lea r8, [rcx + rbp]
add r8, 0xffffffffffffffa0
xor edx, edx
nop word cs:[rax + rax]
cmp byte [r8 + rdx], 0
je 0x14008c661
inc rdx
cmp rax, rdx
jne 0x14008c650
jmp 0x14008c6cd
add rdx, rcx
cmp rdx, rdi
jne 0x14008c6cd
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x120], xmm0
movdqa xmmword [rbp + 0x140], xmm0
movdqa xmmword [rbp + 0x130], xmm0
mov dword [rbp + 0x128], 1
mov qword [rbp + 0x158], 0
lea rcx, [rbp - 0x60]
lea r8, [rbp + 0x120]
lea r9, [rbp + 0x158]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x14008c6e1
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x14008c6f9
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x14008c724
mov rax, qword [rbp + 0x158]
movzx ecx, word [rbp + 0x166]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
jmp 0x14008c724
mov rbx, rdx
call fcn.1400d80c0
mov rdx, rbx
jmp 0x14008c54c
lea r9, [rbp + 0x150]
mov rcx, rsi
mov r8, rdi
call fcn.1400d8120
nop
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008d540
Capabilities:
Create process on windows
Encode data using base64
Encrypt data using speck
Get common file path
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x668
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x5d0], xmm6
mov qword [rbp + 0x5c8], 0xfffffffffffffffe
mov qword [rbp + 0x560], r8
mov rsi, rdx
mov qword [rbp + 0x540], rcx
movzx eax, byte [rdx + 0xa0]
mov r14, qword [rdx + 0x98]
test al, al
mov qword [rbp + 0x548], rdx
jne 0x14008d5b0
test r14, r14
jne 0x14008d5b0
mov qword [rbp + 0x3e0], 0
xor r12d, r12d
jmp 0x14008e1bb
mov qword [rbp + 0x4b0], 0
mov qword [rbp + 0x4c0], 0
test al, al
jne 0x14008d7ec
mov qword [rbp + 0x568], r14
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW]
test rax, rax
je 0x1400903de
lea r14, [rbp - 0x10]
lea rsi, [rbp + 0x4d0]
lea rdi, [rbp - 0x30]
mov qword [rbp + 0x590], rax
mov rbx, rax
nop dword [rax]
call qword [sym.imp.KERNEL32.DLL_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x430], rax
lea rax, [rbp + 0x430]
mov qword [rbp + 0x4d0], rax
lea rax, [fcn.1400886b0]
mov qword [rbp + 0x4d8], rax
lea rax, str.failure_getting_env_string_from_OS:
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x10], 0
lea rax, [rbp + 0x4d0]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 1
lea rdx, str.library_std_src_syspalwindowsos.rs
lea rcx, [rbp - 0x30]
call fcn.1400d5c10
jmp 0x140090499

Function at 0x140093780
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
lea rcx, [rbp - 0x28]
call fcn.140087da0
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
movabs rbx, 0x8000000000000000
cmp rcx, rbx
jne 0x1400937be
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], rbx
jmp 0x1400937e4
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rdx
lea rcx, [rbp - 0x10]
lea rdx, [rbp - 0x40]
call fcn.1400936a0
mov r14, qword [rbp - 0x10]
cmp r14, rbx
jne 0x1400937fd
lea rcx, [rbp - 8]
call fcn.140082aa0
mov qword [rsi], rbx
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov rdi, qword [rbp - 8]
mov r15, qword [rbp]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140093820
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r15
jmp 0x1400937f0
mov qword [rsi], rbx
test r14, r14
je 0x1400937f0
mov edx, 2
mov rcx, rdi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
jmp fcn.140007ce0
Function at 0x140095b30
Capabilities:
Create pipe

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x148
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xb0], xmm6
mov qword [rbp + 0xa8], 0xfffffffffffffffe
mov qword [rbp + 0x68], rcx
mov byte [rbp + 0xa5], dl
movzx eax, dl
mov ecx, 0x40080002
sub ecx, eax
mov dword [rbp + 0x64], ecx
xor eax, eax
mov qword [rbp - 8], rax
mov r12d, 8
mov sil, 1
xorps xmm6, xmm6
lea r13, [rbp + 0x20]
mov rbx, qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
xor edi, edi
xor eax, eax
mov qword [rbp - 0x10], rax
nop dword [rax]

Function at 0x140096790
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x14014c048]
mov edx, 0x10
xor ecx, ecx
call fcn.140099360
test rax, rax
je 0x140096870
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140096960]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140096862
mov rax, qword [rbx]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rax
mov rax, qword [rax]
test rax, rax
je 0x140096827
mov rcx, qword [rbp - 0x18]
call rax
mov rcx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
cmp qword [rax + 8], 0
je 0x14009683f
mov rdx, qword [rax + 0x10]
call fcn.140007ce0
mov edx, 8
mov rcx, qword [rbp - 0x20]
call fcn.140007ce0
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.1400d58a0
ud2

Function at 0x1400a0450
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x1400a0457
test al, 1
je 0x1400a0476
test al, 2
jne 0x1400a048e
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x140115ab8]
mov edx, 0x23
call fcn.1400d5da0
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140115af8]
mov edx, 0x25
call fcn.1400d5da0
int3

Function at 0x1400a0d7e
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
call fcn.1400a02c3
mov rcx, qword [rax]
movzx eax, bl
lea r9, [rsp + 0x2c]
mov dword [r9], eax
mov dword [rsp + 0x20], 4
mov edx, 6
mov r8d, 1
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1400a0dba
xor eax, eax
jmp 0x1400a0dc8
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x30
pop rbx
ret
Function at 0x1400a1032
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
lea r14, [rsp + 0x2a]
lea r12, [rsp + 0x42]
mov r13, qword [rcx + 8]
mov r15, qword [rcx + 0x10]
mov eax, 0x7fffffff
cmp r9, rax
cmovb rax, r9
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x48], rax
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], r13
mov rcx, rbp
mov rdx, r13
mov r8, rdi
call fcn.1400a0d76
mov al, byte [rsp + 0x29]
cmp al, 3
je 0x1400a11a7
mov rbp, qword [rsp + 0x20]
cmp al, 2
je 0x1400a11a0
mov cl, byte [rsp + 0x28]
movzx edx, word [r14 + 4]
mov word [r12 + 4], dx
mov edx, dword [r14]
mov dword [r12], edx
mov qword [rsp + 0x38], rbp
mov byte [rsp + 0x40], cl
mov byte [rsp + 0x41], al
cmp r15, 0xffffffffffffffff
je 0x1400a11c7
mov rcx, r15
mov rdx, rsi
mov r8, qword [rsp + 0x50]
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x1400a11ae
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ebp, eax
shl rbp, 0x20
or rbp, 2
mov rcx, rbp
call fcn.140014898
cmp al, 0xd
jne 0x1400a1170
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x1400a1170
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
lock inc qword [rdx]
jle 0x1400a11d3
mov r13, r15
mov r15, rbx
mov rbx, r14
add rcx, 0x10
mov r8, qword [rax + 0x10]
mov r9b, byte [rax + 0x18]
call fcn.1400343ec
mov r14, rax
xor ecx, ecx
call fcn.140081c88
test r14, r14
je 0x1400a1162
mov ecx, 1
mov rdx, rbp
call fcn.1400345ae
mov rbp, r14
mov r14, rbx
mov rbx, r15
mov r15, r13
mov r13, qword [rsp + 0x30]
mov rcx, rbp
call fcn.14009d7ed
cmp al, 0xd
jne 0x1400a11a0
mov qword [rsp + 0x20], rbp
mov rcx, rbx
lea rdx, [rsp + 0x38]
call fcn.1400a0aec
lea rbp, [rsp + 0x20]
mov rcx, rbp
call fcn.14009da80
jmp 0x1400a1081
mov eax, 1
jmp 0x1400a11b3
mov eax, 2
jmp 0x1400a11b3
movsxd rbp, eax
xor eax, eax
mov rdx, rbp
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.C:UsersG.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.39.2_srciopoll_evented.rs
call fcn.1400d6180
ud2
Function at 0x1400a9a4b
Capabilities:
Create directory

Disassembly:
mov r8, rdx
mov rdx, rcx
mov cl, 1
jmp fcn.14008ab90

Function at 0x1400a9e82
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
Function at 0x1400abbc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0x20
mov rsi, rcx
jb 0x1400abc4c
mov rcx, qword [rcx + 0x20]
mov edx, 0x12
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotl64
mov rcx, qword [rsi + 0x18]
mov edx, 0xc
mov rbx, rax
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotl64
mov rcx, qword [rsi + 0x10]
mov edx, 7
add rbx, rax
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotl64
mov rcx, qword [rsi + 8]
mov edx, 1
add rbx, rax
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotl64
mov rdx, qword [rsi + 8]
lea rcx, [rbx + rax]
call fcn.1400abb54
mov rdx, qword [rsi + 0x10]
mov rcx, rax
call fcn.1400abb54
mov rdx, qword [rsi + 0x18]
mov rcx, rax
call fcn.1400abb54
mov rdx, qword [rsi + 0x20]
mov rcx, rax
call fcn.1400abb54
jmp 0x1400abc5d
mov rax, qword [rcx + 0x18]
movabs rcx, 0x27d4eb2f165667c5
add rax, rcx
mov r8, qword [rsi]
lea rdx, [rsi + 0x28]
xor r9d, r9d
lea rcx, [r8 + rax]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400ab9e0
Function at 0x1400d4f9c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test rax, rax
je 0x1400d4fe6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400d4fe6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400d4fe6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400d4fe6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400d4fe6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400d4fe8
xor al, al
add rsp, 0x28
ret

Function at 0x1400d8120
Capabilities:
Resolve dns

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov r14, r8
inc r14
sete r13b
je 0x1400d8291
js 0x1400d829d
mov rdi, r9
mov rbx, r8
mov r12, rdx
mov rsi, rcx
movzx eax, byte [0x14014c048]
xor ecx, ecx
mov rdx, r14
call fcn.140099360
test rax, rax
je 0x1400d82a2
mov r15, rax
mov rcx, rax
mov rdx, r12
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
cmp rbx, 0xf
ja 0x1400d81a1
test rbx, rbx
je 0x1400d81eb
xor eax, eax
nop
cmp byte [r12 + rax], 0
je 0x1400d81b3
inc rax
cmp rbx, rax
jne 0x1400d8190
jmp 0x1400d81eb
xor ecx, ecx
mov rdx, r12
mov r8, rbx
call fcn.14000fad0
test rax, rax
je 0x1400d81eb
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
test r13b, r13b
jne 0x1400d827f
mov edx, 1
mov rcx, r15
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp fcn.140007ce0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], rbx
lea rcx, [rbp - 0x30]
call fcn.140007f30
mov rbx, rax
mov r14, rdx
xorps xmm0, xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x28], 1
mov qword [rbp], 0
lea r8, [rbp - 0x30]
mov r9, rbp
mov rcx, rax
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1400d824f
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1400d8263
mov rcx, qword [rdi]
mov rax, qword [rbp]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rbx], 0
test r14, r14
je 0x1400d827f
mov edx, 1
mov rcx, rbx
call fcn.140007ce0
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.library_alloc_src_ffic_str.rs
call fcn.1400d6180
call fcn.140007e00
mov ecx, 1
mov rdx, r14
call fcn.1400d5880
int3
Function at 0x140017c30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140017cb0
cmp r11, r10
ja 0x140017d27
cmp r10, rdx
ja 0x140017d39
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x140017cb2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140017c90
jmp 0x140017d14
ja 0x140017cba
mov r11, r10
cmp rax, r8
jne 0x140017c5e
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140017cf0
mov rdi, r8
sub ecx, edx
jns 0x140017d0b
jmp 0x140017d16
cmp r8, rsi
je 0x140017d48
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140017d16
xor al, 1
cmp rdi, rsi
jne 0x140017cd0
jmp 0x140017d16
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, [0x1413b17d0]
mov rcx, r11
mov rdx, r10
call fcn.14004d2e0
lea r8, [0x1413b17d0]
mov rcx, r10
call fcn.14004d140
lea rcx, [0x1413b17b8]
call fcn.14004d3e0
int3

Function at 0x14001d280
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x14001d2a5
cmp rax, rcx
je 0x14001d2ab
cmp rdx, 4
jae 0x14001d2af
xor eax, eax
xor r8d, r8d
jmp 0x14001d340
pop rbp
jmp fcn.140015340
xor eax, eax
pop rbp
ret
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x14004f700]
movdqa xmm3, xmmword [0x14004f510]
pxor xmm1, xmm1
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x14001d2d0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x14001d357
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x14001d340
pop rbp
ret
Function at 0x1400211e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x1413b8388]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140021251
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x14002127e
test eax, eax
js 0x14002125d
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140021274
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x1413b83e8]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.140020a20
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.140020ac0
mov ecx, 7
int 0x29
ud2
Function at 0x14002a040
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
in al, dx
push 0x246c8d48
lea ebp, [rsp + 0x60]
Function at 0x140033330
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
lea rcx, [rbp - 0x28]
call fcn.140026330
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
movabs rbx, 0x8000000000000000
cmp rcx, rbx
jne 0x14003336e
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], rbx
jmp 0x140033394
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rdx
lea rcx, [rbp - 0x10]
lea rdx, [rbp - 0x40]
call fcn.140033250
mov r14, qword [rbp - 0x10]
cmp r14, rbx
jne 0x1400333ad
lea rcx, [rbp - 8]
call fcn.140020ae0
mov qword [rsi], rbx
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov rdi, qword [rbp - 8]
mov r15, qword [rbp]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400333d0
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r15
jmp 0x1400333a0
mov qword [rsi], rbx
test r14, r14
je 0x1400333a0
mov rcx, qword [0x1413cab78]
xor edx, edx
mov r8, rdi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
jmp qword [sym.imp.KERNEL32.dll_HeapFree]