joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d7d3e60
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d7f55e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d7d3fe8
mov rax, qword [0x6d7f55e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d7d3eac
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d7d3f35
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d7d3e90
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d7d401d
mov rax, qword [0x6d7f55e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d7f55e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d7d4000
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d7d3f2e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d7d3f90
add dword [0x6d7f55e4], 1
cmp edi, 8
jae 0x6d7d3f63
test dil, 4
jne 0x6d7d3fd4
test edi, edi
je 0x6d7d3f58
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d7d3fef
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d7d3f58
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d7d3f7c
jmp 0x6d7d3f58
add rsi, qword [0x6d7f55e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d7d3f2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d7d3f58
xor esi, esi
jmp 0x6d7d3eb7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d7d3f58
mov rax, qword [0x6d7f55e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d7d4770
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d7f58c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d7f58a0]
test rbx, rbx
je 0x6d7d47c4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d7d47bb
test rsi, rsi
je 0x6d7d47bb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d7d47a0
lea rcx, [0x6d7f58c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d7d4a00
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d7d4a10
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d7d4a20
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d7d4a61
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d7d4a58
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d7d4a63
add rax, 0x28
cmp rax, r9
jne 0x6d7d4a44
xor eax, eax
ret

Function at 0x6d7d4b00
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d7f21f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d7d4b6d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d7d4b6d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d7d4b6d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d7d4b64
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d7d4b6f
add rax, 0x28
cmp rax, r9
jne 0x6d7d4b50
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d7d4c70
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d7f21f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d7d4c90
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d7d4c88
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d7d4ced
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d7d4ce4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d7d4cf4
add rax, 0x28
cmp rax, r9
jne 0x6d7d4cd0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d7d4d10
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d7f21f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d7d4d7e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d7d4d7e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d7d4d7e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d7d4d7e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d7d4d75
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d7d4d85
add rcx, 0x28
cmp rcx, rax
jne 0x6d7d4d60
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d7d4d98
jmp 0x6d7d4d7e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d7d4da6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d7d4d7e
test r9d, r9d
jg 0x6d7d4d90
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d7d50e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x10000129c
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x1000036f8]
lea rdx, [0x100003700]
call qword [sym.imp.API_MS_WIN_Service_Core_L1_1_0.dll_SetServiceStatus]
test eax, eax
jne 0x1000012e6
mov dword [0x100003704], 1
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp qword [0x1000036f8], 0
mov dword [0x10000370c], eax
je 0x1000012dd
call fcn.10000129c
xor ecx, ecx
call qword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_ExitProcess]
inc dword [0x100003714]
add rsp, 0x28
ret

Function at 0x1000014b0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor r12d, r12d
xor eax, eax
lock cmpxchg qword [0x100003740], rdi
je 0x1000014fe
cmp rax, rdi
jne 0x1000014f1
mov edi, 1
mov r12d, edi
jmp 0x100001503
mov ecx, 0x3e8
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_Sleep]
jmp 0x1000014d5
mov edi, 1
mov eax, dword [0x100003738]
cmp eax, edi
jne 0x100001519
mov ecx, 0x1f
call fcn.10011c000
jmp 0x100001576
mov eax, dword [0x100003738]
test eax, eax
jne 0x100001570
mov dword [0x100003738], edi
lea r13, [0x1000011a0]
lea rsi, [0x100001188]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
cmp rsi, r13
jae 0x100001562
test eax, eax
jne 0x100001562
mov rcx, qword [rsi]
test rcx, rcx
je 0x100001557
call rcx
mov dword [rsp + 0x20], eax
add rsi, 8
mov qword [rsp + 0x28], rsi
jmp 0x100001540
test eax, eax
je 0x100001576
mov eax, 0xff
jmp 0x100001648
mov dword [0x100003164], edi
mov eax, dword [0x100003738]
cmp eax, edi
jne 0x10000159d
lea rdx, [0x100001180]
lea rcx, [0x100001170]
call sub.msvcrt.dll__initterm
mov dword [0x100003738], 2
test r12d, r12d
jne 0x1000015ab
xor eax, eax
xchg qword [0x100003740], rax
cmp qword [0x100003748], 0
je 0x1000015d4
lea rcx, [0x100003748]
call fcn.10000189c
test eax, eax
je 0x1000015d4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100003748]
mov r8, qword [0x100003148]
mov rdx, qword [0x100003150]
mov ecx, dword [0x100003140]
call fcn.100001440
mov dword [0x100003160], eax
cmp dword [0x100003144], 0
jne 0x100001604
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100003164], 0
jne 0x100001619
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100003160]
jmp 0x100001648
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret
sub rsp, 0x28
call fcn.1000019b0
add rsp, 0x28
jmp 0x1000014b0

Function at 0x100001908
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100001955
cmp rcx, 0xffffffffffffffff
je 0x100001955
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10000194d
cmp dword [rcx + 0x3c], edx
jl 0x10000194d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10000194d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100001955
mov rax, rdx
add rsp, 0x18
ret
Function at 0x1400111f9
Capabilities:
Terminate process

Disassembly:
jmp 0x140013040
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001127b
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014390
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400143b0
xor al, al
jmp 0x140014431
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400143c3
xor al, al
jmp 0x140014431
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400143ed
xor al, al
jmp 0x140014431
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014401
xor al, al
jmp 0x140014431
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014413
xor al, al
jmp 0x140014431
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001442f
xor al, al
jmp 0x140014431
mov al, 1
add rsp, 0x38
ret
Function at 0x1400113b6
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
jmp 0x140011800
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x178]
mov rax, qword [0x14001d180]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x1400230a2]
call fcn.14001138e
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140011882
mov eax, 0xffffffff
jmp 0x140011958
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1400118ae
mov eax, 0xffffffff
jmp 0x140011958
xor r9d, r9d
mov r8d, dword [rbp + 0x158]
mov rdx, qword [rbp + 0x150]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1400118d7
mov eax, 0xffffffff
jmp 0x140011958
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rbp + 0x28]
mov edx, 0x6610
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x140011901
mov eax, 0xffffffff
jmp 0x140011958
lea rax, [rbp + 0x148]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x140]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x140011936
mov eax, 0xffffffff
jmp 0x140011958
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001ac90]
call fcn.14001130c
mov rax, rdi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.1400111b8
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x1400113c5
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x1400119f0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x128]
mov rax, qword [0x14001d180]
xor rax, rbp
mov qword [rbp + 0xd8], rax
lea rcx, [0x1400230a2]
call fcn.14001138e
mov dword [rbp + 4], 0
lea r9, [rbp + 4]
mov r8d, 4
mov rdx, qword [rbp + 0x110]
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x108]
mov rcx, qword [rbp + 0x100]
call fcn.1400111bd
mov r9d, 0x10
lea r8, section..data
mov edx, dword [rbp + 0x110]
mov rcx, qword [rbp + 0x100]
call fcn.1400113b6
lea r9, [rbp + 4]
mov r8d, 0x40
mov rdx, qword [rbp + 0x110]
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ad20]
call fcn.14001130c
mov rcx, qword [rbp + 0xd8]
xor rcx, rbp
call fcn.1400111b8
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x40bed0
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x148
mov qword [rsp + 0x40], 0
mov rbx, rcx
mov r13, rdx
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call qword [sym.imp.libcurl_4.dll_curl_easy_init]
mov r12, rax
test rax, rax
je 0x40c210
lea rsi, [rsp + 0x40]
mov r8, rbx
mov edx, 0x2712
mov rcx, rax
mov rbx, qword [sym.imp.libcurl_4.dll_curl_easy_setopt]
call rbx
mov r8d, 1
mov edx, 0x4a
mov rcx, r12
call rbx
mov r8d, 0xf
mov edx, 0x4e
mov rcx, r12
call rbx
mov r8, rsi
mov edx, 0x271a
mov rcx, r12
call rbx
mov r8d, 1
mov edx, 0x63
mov rcx, r12
call rbx
mov r8d, 1
mov edx, 0x79
mov rcx, r12
call rbx
lea r8, [0x0040a4d0]
mov edx, 0x4e2b
mov rcx, r12
call rbx
lea r8, [rsp + 0x20]
mov edx, 0x2711
mov rcx, r12
call rbx
mov rax, qword [0x00630b10]
mov r8, qword [rax]
test r8, r8
je 0x40c1a0
mov edx, 0x2714
mov rcx, r12
call rbx
mov rax, qword [0x00630b20]
mov edx, 0x65
mov rcx, r12
mov r8d, dword [rax]
call rbx
mov rcx, r12
call qword [sym.imp.libcurl_4.dll_curl_easy_perform]
test eax, eax
jne 0x40c1f0
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x40c15b
cmp qword [rsp + 0x28], 0
jne 0x40c190
lea rdx, str.Empty_data_received_for_config
mov ecx, 1
xor r13d, r13d
call fcn.0040a6c0
mov rcx, r12
call qword [sym.imp.libcurl_4.dll_curl_easy_cleanup]
mov rax, r13
add rsp, 0x148
pop rbx
pop rsi
pop r12
pop r13
ret
mov r8, r13
xor edx, edx
call fcn.00599810
mov r13, rax
jmp 0x40c16f
lea rcx, str.http_proxy
call sub.msvcrt.dll_getenv
test rax, rax
je 0x40c138
lea rcx, str.all_proxy
call sub.msvcrt.dll_getenv
lea rcx, str.all_proxy
test rax, rax
je 0x40c230
call sub.msvcrt.dll_getenv
mov rcx, r12
mov edx, 0x2714
mov r8, rax
call rbx
mov rcx, r12
call qword [sym.imp.libcurl_4.dll_curl_easy_perform]
test eax, eax
je 0x40c149
nop dword [rax]
mov r8, rsi
lea rdx, str.Remote_config_read_failed:__s
mov ecx, 1
xor r13d, r13d
call fcn.0040a6c0
jmp 0x40c16f
lea rdx, str.Remote_config_init_failed_
mov ecx, 1
xor r13d, r13d
call fcn.0040a6c0
jmp 0x40c178
lea rcx, str.ALL_PROXY
call sub.msvcrt.dll_getenv
test rax, rax
je 0x40c250
lea rcx, str.ALL_PROXY
jmp 0x40c1c9
lea r8, [0x005d8ba3]
mov edx, 0x2714
mov rcx, r12
call rbx
jmp 0x40c138
Function at 0x415350
Capabilities:
Hash data using sha512

Disassembly:
push rdi
push rbx
sub rsp, 0x68
mov rbx, rcx
test rcx, rcx
je 0x41547a
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x415450
xor eax, eax
lea rdi, [rcx + 0x48]
mov byte [rsp + 0x20], dl
movdqu xmm0, xmmword [0x005db420]
mov word [rsp + 0x3e], ax
and rdi, 0xfffffffffffffff8
mov eax, ecx
sub eax, edi
mov byte [rsp + 0x31], 0
mov qword [rsp + 0x29], 0
mov qword [rsp + 0x21], 0x10100
mov qword [rsp + 0x32], 0
mov dword [rsp + 0x3a], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rcx + 0x40], 0
mov qword [rcx + 0xe8], 0
lea ecx, [rax + 0xf0]
xor eax, eax
shr ecx, 3
rep stosq qword [rdi], rax
mov dword [rbx + 0xe4], edx
pxor xmm0, xmmword [rsp + 0x20]
movups xmmword [rbx], xmm0
movdqu xmm0, xmmword [0x005db430]
pxor xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx + 0x10], xmm0
movdqu xmm0, xmmword [0x005db440]
pxor xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx + 0x20], xmm0
movdqu xmm0, xmmword [0x005db450]
pxor xmm0, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x30], xmm0
add rsp, 0x68
pop rbx
pop rdi
ret
mov edx, 0xf0
call fcn.00417fb0
cmp byte [rbx + 0xe8], 0
je 0x41546b
mov qword [rbx + 0x58], 0xffffffffffffffff
mov qword [rbx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
jmp 0x415441
mov eax, 0xffffffff
jmp 0x415441

Function at 0x415490
Capabilities:
Hash data using sha512

Disassembly:
push r13
push r12
push rdi
sub rsp, 0xe0
mov r10, r8
mov r12, rcx
mov r8, r9
test rcx, rcx
je 0x415629
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x4155f8
lea rax, [r9 - 1]
cmp rax, 0x3f
ja 0x4155f8
test r10, r10
je 0x4155f8
lea rdi, [rcx + 0x48]
xor eax, eax
mov byte [rsp + 0x21], r9b
lea r13, [rsp + 0x60]
and rdi, 0xfffffffffffffff8
mov byte [rsp + 0x20], dl
movdqu xmm0, xmmword [0x005db420]
mov qword [rsp + 0x2a], 0
mov word [rsp + 0x3e], ax
xor eax, eax
mov qword [rsp + 0x22], 0x101
mov qword [rsp + 0x32], 0
mov dword [rsp + 0x3a], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rcx + 0x40], 0
mov qword [rcx + 0xe8], 0
sub ecx, edi
add ecx, 0xf0
shr ecx, 3
rep stosq qword [rdi], rax
mov ecx, 0x10
mov rdi, r13
mov dword [r12 + 0xe4], edx
rep stosq qword [rdi], rax
mov rdx, r10
mov rcx, r13
pxor xmm0, xmmword [rsp + 0x20]
movups xmmword [r12], xmm0
movdqu xmm0, xmmword [0x005db430]
pxor xmm0, xmmword [rsp + 0x30]
movups xmmword [r12 + 0x10], xmm0
movdqu xmm0, xmmword [0x005db440]
pxor xmm0, xmmword [rsp + 0x40]
movups xmmword [r12 + 0x20], xmm0
movdqu xmm0, xmmword [0x005db450]
pxor xmm0, xmmword [rsp + 0x50]
movups xmmword [r12 + 0x30], xmm0
call sub.msvcrt.dll_memcpy
mov r8d, pe_nt_image_headers64
mov rdx, r13
mov rcx, r12
call fcn.00415080
mov edx, pe_nt_image_headers64
mov rcx, r13
call fcn.00417fb0
xor eax, eax
add rsp, 0xe0
pop rdi
pop r12
pop r13
ret
mov edx, 0xf0
mov rcx, r12
call fcn.00417fb0
cmp byte [r12 + 0xe8], 0
je 0x415619
mov qword [r12 + 0x58], 0xffffffffffffffff
mov qword [r12 + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
jmp 0x4155e7
mov eax, 0xffffffff
jmp 0x4155e7
Function at 0x417fc0
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x828
mov r12, rcx
mov rbx, rdx
test rcx, rcx
je 0x417fe0
test rdx, rdx
jne 0x417ff1
add rsp, 0x828
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
mov r10d, dword [rdx + 0x18]
mov r11, qword [rdx]
lea r9, [rsp + 0x20]
mov ecx, pe_nt_image_headers64
mov rdi, r9
lea r8, [rsp + 0x420]
mov eax, r10d
shl rax, 0xa
lea rsi, [r11 + rax - 0x400]
rep movsq qword [rdi], qword [rsi]
mov esi, dword [rdx + 0x1c]
cmp esi, 1
jbe 0x4180c2
cmp esi, 3
jbe 0x418107
lea eax, [rsi - 4]
lea r13d, [r10 + r10 - 1]
mov edi, 3
and eax, 0xfffffffe
lea r14d, [rax + 5]
mov r8d, r13d
add r13d, r10d
mov rax, r9
xor edx, edx
mov ecx, r13d
shl r8, 0xa
shl rcx, 0xa
add r8, r11
add rcx, r11
nop dword [rax]
movdqu xmm0, xmmword [r8 + rdx]
movdqu xmm1, xmmword [r8 + rdx + 0x10]
add rax, 0x20
pxor xmm0, xmmword [rax - 0x20]
pxor xmm1, xmmword [rax - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
movdqu xmm2, xmmword [rcx + rdx + 0x10]
movdqu xmm3, xmmword [rcx + rdx]
add rdx, 0x20
pxor xmm1, xmm2
pxor xmm0, xmm3
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
cmp rdx, 0x400
jne 0x418068
lea eax, [rdi + 2]
add r13d, r10d
cmp eax, r14d
je 0x41810c
mov edi, eax
jmp 0x418048
mov rdi, r8
mov rsi, r9
mov ecx, pe_nt_image_headers64
mov edx, dword [r12 + 8]
rep movsq qword [rdi], qword [rsi]
mov rcx, qword [r12]
mov r9d, 0x400
lea r8, [rsp + 0x420]
call fcn.00415a90
mov edx, dword [rbx + 0x10]
mov rax, qword [r12 + 0x68]
mov rcx, qword [rbx]
shl rdx, 0xa
test rax, rax
je 0x418159
call rax
jmp 0x417fe0
mov edi, 1
add edi, 1
lea r8, [rsp + 0x420]
mov ecx, edi
imul ecx, r10d
sub ecx, 1
mov edx, ecx
mov rax, r9
shl rdx, 0xa
add rdx, r11
nop dword [rax]
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmmword [rax]
add rax, 0x10
add rdx, 0x10
movups xmmword [rax - 0x10], xmm0
cmp rax, r8
jne 0x418130
add ecx, r10d
cmp esi, edi
jbe 0x4180c2
add edi, 1
jmp 0x418120
call qword [sym.imp.msvcrt.dll__aligned_free]
jmp 0x417fe0
Function at 0x41cd70
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov r9, r8
test rcx, rcx
je 0x41cdc0
test rdx, rdx
je 0x41cdc0
mov r8, rdx
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov qword [rbx], rax
sete al
movzx eax, al
neg eax
add rsp, 0x30
pop rbx
ret
mov eax, 0xffffffff
jmp 0x41cdb1
Function at 0x435a70
Capabilities:
Hash data using sha512

Disassembly:
push r13
push r12
sub rsp, 0x28
movdqu xmm1, xmmword [0x005dbd80]
pxor xmm0, xmm0
movdqu xmm2, xmmword [0x005dbd90]
movdqu xmm3, xmmword [0x005dbda0]
movdqu xmm4, xmmword [0x005dbdb0]
mov r12, rcx
mov r13, rdx
mov qword [rcx + 0xd0], 0
mov rdx, r8
movups xmmword [rcx + 0x80], xmm1
mov r8, r9
movups xmmword [rcx + 0x90], xmm2
movups xmmword [rcx + 0xa0], xmm3
movups xmmword [rcx + 0xb0], xmm4
movups xmmword [rcx + 0xc0], xmm0
call fcn.00435720
mov rdx, r13
mov rcx, r12
add rsp, 0x28
pop r12
pop r13
jmp fcn.00435830