joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001d5e0
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call fcn.14001c770
mov ecx, dword [0x1400ce2f8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14001d6d8
lea r13, [rbx + 0x68]
mov rcx, r13
call fcn.14001bfc0
mov rdi, qword [rbx + 0x50]
cmp esi, dword [rbx + 0x48]
jb 0x14001d6a3
lea r15d, [rsi + 1]
mov rcx, rdi
movsxd r14, r15d
lea rdx, [r14*8]
call sub.msvcrt.dll_realloc
mov rdi, rax
test rax, rax
je 0x14001d6e5
mov rcx, qword [rbx + 0x58]
mov rdx, r14
call sub.msvcrt.dll_realloc
mov r14, rax
test rax, rax
je 0x14001d6e5
mov eax, dword [rbx + 0x48]
mov edx, r15d
sub edx, eax
lea rcx, [rdi + rax*8]
lea r8, [rdx*8]
xor edx, edx
call sub.msvcrt.dll_memset
mov ecx, dword [rbx + 0x48]
mov r8d, r15d
xor edx, edx
mov rax, rcx
add rcx, r14
sub r8d, eax
call sub.msvcrt.dll_memset
mov qword [rbx + 0x50], rdi
mov qword [rbx + 0x58], r14
mov dword [rbx + 0x48], r15d
mov qword [rdi + rsi*8], r12
mov rax, qword [rbx + 0x58]
mov rcx, r13
mov byte [rax + rsi], 1
call fcn.14001c020
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14001c820
mov rbx, rax
jmp 0x14001d61a
mov rcx, r13
call fcn.14001c020
mov eax, 0xc
jmp 0x14001d6c1

Function at 0x14001d780
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.14001c770
mov ecx, dword [0x1400ce2f8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001d7a8
mov rax, qword [rax + 0x30]
add rsp, 0x28
ret
call fcn.14001c820
test rax, rax
jne 0x14001d79a
add rsp, 0x28
ret

Function at 0x14001d810
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.14001c770
mov ecx, dword [0x1400ce2f8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001d838
add rax, 0x18
add rsp, 0x28
ret
call fcn.14001c820
test rax, rax
jne 0x14001d82a
jmp 0x14001d82e

Function at 0x14001d950
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140109d78]
test eax, eax
jne 0x14001d968
xor eax, eax
add rsp, 0x28
ret
call fcn.14001c770
mov ecx, dword [0x1400ce2f8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001d998
mov edx, dword [rax + 0x20]
test edx, edx
jg 0x14001d95e
test byte [rax + 0x40], 3
je 0x14001d95e
mov eax, dword [rax + 0x44]
and eax, 1
jmp 0x14001d960
call fcn.14001c820
test rax, rax
je 0x14001d95e
jmp 0x14001d97e

Function at 0x14001d9b0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.14001c770
mov ecx, dword [0x1400ce2f8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001d9f0
test ebx, ebx
jle 0x14001d9e0
lock add dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
lock sub dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
call fcn.14001c820
test rax, rax
jne 0x14001d9cd
add rsp, 0x20
pop rbx
ret
Function at 0x14001daf0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.14001c770
mov ecx, dword [0x1400ce2f8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14001db68
test byte [rbx + 0x40], 0xc
jne 0x14001db1f
mov eax, dword [0x140109d78]
test eax, eax
jne 0x14001db30
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.14001b9c0
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x14001db53
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x14001db53
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x14001db7c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.14001bc90
call fcn.14001c820
mov rbx, rax
test rax, rax
jne 0x14001db0f
add rsp, 0x28
pop rbx
pop rsi
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x14001db9a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.14001bc90
call fcn.14001da00
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x14001dc18
call fcn.14001b680
mov rsi, rax
mov eax, 0xffffffff
cmp rsi, rax
cmovbe rax, rsi
mov rdi, rax
call fcn.14001c770
mov ecx, dword [0x1400ce2f8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14001dc60
test rsi, rsi
je 0x14001dc2e
call fcn.14001daf0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001dc50
mov edx, edi
call fcn.14001b750
call fcn.14001daf0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.14001c770
mov ecx, dword [0x1400ce2f8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001dc70
call fcn.14001daf0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14001daf0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001dc06
call fcn.14001c820
mov rbx, rax
jmp 0x14001dbec
call fcn.14001c820
jmp 0x14001dc2e
Function at 0x14001dbb0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.14001c770
mov ecx, dword [0x1400ce2f8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14001db68
test byte [rbx + 0x40], 0xc
jne 0x14001db1f
mov eax, dword [0x140109d78]
test eax, eax
jne 0x14001db30
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.14001b9c0
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x14001db53
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x14001db53
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x14001db7c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.14001bc90
call fcn.14001c820
mov rbx, rax
test rax, rax
jne 0x14001db0f
add rsp, 0x28
pop rbx
pop rsi
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x14001db9a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.14001bc90
call fcn.14001da00
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x14001dc18
call fcn.14001b680
mov rsi, rax
mov eax, 0xffffffff
cmp rsi, rax
cmovbe rax, rsi
mov rdi, rax
call fcn.14001c770
mov ecx, dword [0x1400ce2f8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14001dc60
test rsi, rsi
je 0x14001dc2e
call fcn.14001daf0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001dc50
mov edx, edi
call fcn.14001b750
call fcn.14001daf0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.14001c770
mov ecx, dword [0x1400ce2f8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001dc70
call fcn.14001daf0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14001daf0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001dc06
call fcn.14001c820
mov rbx, rax
jmp 0x14001dbec
call fcn.14001c820
jmp 0x14001dc2e

Function at 0x14001dc80
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
call fcn.14001c770
mov ecx, dword [0x1400ce2f8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14001dcf0
test esi, esi
je 0x14001dcd0
call fcn.14001daf0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001dd00
mov edx, esi
call fcn.14001b750
call fcn.14001daf0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.14001daf0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14001daf0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.14001c820
mov rbx, rax
jmp 0x14001dca1
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001dcba
Function at 0x1400905f0
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, qword [sym.imp.msvcrt.dll__read]
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, rdi
call fcn.140090400
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call rbp
movsxd r13, eax
cmp eax, 0xffffffff
je 0x140090640
mov rax, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call r12
cmp dword [rax], 4
je 0x140090613
mov rax, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x140721c00
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword gs:[0x60]
movabs r11, 0x721c70
movabs r10, 0x721c74
mov r9, qword [rax + 0x10]
xor eax, eax
movsxd rcx, dword [r9 + 0x3c]
movsxd r11, dword [r9 + r11]
add rcx, r9
mov r10d, dword [r9 + r10]
movzx r8d, word [rcx + 0x14]
add r8, rcx
cmp dword [r8 + 0x20], eax
jbe 0x140721c66
mov edx, eax
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r8 + 0x24]
inc eax
add rcx, rdx
inc rdx
xor byte [rcx + r9], r10b
cmp eax, dword [r8 + 0x20]
jb 0x140721c50
lea rax, [r9 + r11]
jmp rax
Function at 0x140002f10
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1400410c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140002fee
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140002fe5
nop word [rax + rax]
lea rcx, [rsp + 0x4c]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140002f80
cmp qword [rbx + 0x18], 7
mov r8, rbx
jbe 0x140002f97
mov r8, qword [rbx]
mov rdx, qword [rbx + 0x10]
cmp rdx, rax
jne 0x140002fd3
test rdx, rdx
je 0x140002fc6
lea rcx, [rsp + 0x4c]
sub r8, rcx
lea rax, [rsp + 0x4c]
movzx ecx, word [rax]
cmp word [r8 + rax], cx
jne 0x140002fd3
add rax, 2
sub rdx, 1
jne 0x140002fb2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140002ff0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002f70
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14000fdb0
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x1400032d0
Capabilities:
Create http request

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rax, qword [0x1400410c0]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov rdi, r8
mov rbx, rdx
mov rdx, rcx
lea rcx, [rsp + 0x70]
call fcn.140003020
nop
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140003020
nop
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140003020
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rax, qword [rsp + 0x50]
lea r9, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova r9, qword [rsp + 0x70]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r8, str.https:__zoofxpawn.hys.cz_AC_SCAN_Detections_detekce.php_text_sip_styp_s
mov edx, 0x400
lea rcx, [rbp - 0x70]
call fcn.140002150
xor edi, edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.DataSender
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbx, rax
test rax, rax
jne 0x1400033b0
lea rdx, [0x140039698]
mov rcx, qword [0x140043df8]
call qword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x1400033fd
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
test rax, rax
jne 0x1400033eb
lea rdx, [0x1400396d8]
mov rcx, qword [0x140043df8]
call qword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x1400033f4
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000343a
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003435
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400034f1
call fcn.14000fdd0
movdqa xmm0, xmmword [0x14003af20]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], dil
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000348e
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003481
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400034f7
call fcn.14000fdd0
movdqa xmm0, xmmword [0x14003af20]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1400034d1
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400034cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400034eb
call fcn.14000fdd0
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.14000fdb0
add rsp, 0x4a0
pop rdi
pop rbx
pop rbp
ret
call fcn.140018edc
nop
call fcn.140018edc
nop
call fcn.140018edc
int3
Function at 0x140003500
Capabilities:
Capture public ip
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x170
mov rax, qword [0x1400410c0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.IPFetcher
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
xor r8d, r8d
test rax, rax
jne 0x140003582
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
lea rdx, [0x14003933d]
mov rcx, rbx
call fcn.14000c8a0
mov rax, rbx
jmp 0x14000368a
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x800000
xor r9d, r9d
lea rdx, str.https:__api.ipify.org_formattext
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rdi, rax
test rax, rax
jne 0x1400035db
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
xor r8d, r8d
lea rdx, [0x14003933d]
mov rcx, rbx
call fcn.14000c8a0
mov rax, rbx
jmp 0x14000368a
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x14003af20]
movdqu xmmword [rsp + 0x50], xmm1
mov byte [rsp + 0x40], 0
nop word [rax + rax]
lea r9, [rsp + 0x3c]
mov r8d, 0xff
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14000365d
mov eax, dword [rsp + 0x3c]
test eax, eax
je 0x14000365d
cmp rax, 0x100
jae 0x1400036b4
mov byte [rsp + rax + 0x60], 0
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140003642
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.14000b300
jmp 0x140003600
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
jmp 0x14000368a
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14000fdb0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
call fcn.14000fee0
int3
Function at 0x140003fe0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1400410c0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, rcx
xor ebp, ebp
mov rbx, qword [0x140043e00]
mov rdi, qword [0x140043e08]
cmp rbx, rdi
je 0x140004129
nop
lea r8, [0x1400399a4]
mov rdx, rsi
lea rcx, [rsp + 0x28]
call fcn.14000c330
nop
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140004042
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.14000dfb0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rbp
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], 7
mov word [rax], bp
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x1400040c2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004191
call fcn.14000fdd0
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 7
cmova rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rdx, qword [rsp + 0x60]
cmp eax, 0xffffffff
je 0x14000414e
cmp rdx, 7
jbe 0x14000411c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004117
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000418b
call fcn.14000fdd0
add rbx, 0x20
cmp rbx, rdi
jne 0x140004020
mov al, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14000fdb0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
cmp rdx, 7
jbe 0x140004187
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004182
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000418b
call fcn.14000fdd0
xor al, al
jmp 0x14000412b
call fcn.140018edc
int3
call fcn.140018edc
int3
Function at 0x140004a70
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r14
push r15
sub rsp, 0x490
mov rax, qword [0x1400410c0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r14, rdx
mov qword [rsp + 0x28], rcx
mov rsi, rcx
xor edx, edx
mov ecx, 2
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140004ada
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140004aff
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
lea rdx, [0x1400399a8]
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
xor r8d, r8d
mov rcx, rsi
mov qword [rsi + 0x18], r15
call fcn.14000c770
jmp 0x140004bee
mov qword [rsp + 0x4b8], rbx
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x4c0], rdi
nop word [rax + rax]
lea rcx, [rsp + 0x5c]
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140004b30
cmp qword [r14 + 0x18], 7
mov r9, r14
jbe 0x140004b47
mov r9, qword [r14]
mov rcx, qword [r14 + 0x10]
cmp rcx, rax
jne 0x140004b9f
test rcx, rcx
je 0x140004b81
lea rdx, [rsp + 0x5c]
sub r9, rdx
lea rax, [rsp + 0x5c]
movzx edx, word [r9 + rax]
cmp dx, word [rax]
jne 0x140004c16
add rax, 2
sub rcx, 1
jne 0x140004b62
mov eax, r15d
test eax, eax
jne 0x140004b9f
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x140004c23
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140004b20
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
lea rdx, [0x1400399a8]
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
xor r8d, r8d
mov qword [rsi + 0x18], r15
mov rcx, rsi
call fcn.14000c770
mov rdi, qword [rsp + 0x4c0]
mov rbx, qword [rsp + 0x4b8]
mov rax, rsi
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14000fdb0
mov rbp, qword [rsp + 0x4c8]
add rsp, 0x490
pop r15
pop r14
pop rsi
ret
mov eax, 1
cmovb eax, ebx
jmp 0x140004b7d
mov r9d, 0x104
lea r8, [rsp + 0x270]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
lea rax, [rsp + 0x270]
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r15
inc rbx
cmp word [rax + rbx*2], r15w
jne 0x140004c64
mov r8, rbx
lea rdx, [rsp + 0x270]
jmp 0x140004bd6
Function at 0x140007cf0
Capabilities:
Create http request

Disassembly:
push rbx
sub rsp, 0x280
mov rax, qword [0x1400410c0]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rcx, [rsp + 0x50]
call fcn.140003500
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0xc
lea rdx, str.CheckVersion
lea rcx, [rsp + 0x30]
call fcn.14000c8a0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rax, qword [rsp + 0x50]
lea r9, [0x140043e30]
cmp qword [0x140043e48], 0xf
cmova r9, qword [0x140043e30]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r8, str.https:__zoofxpawn.hys.cz_AC_SCAN_Detections_detekce.php_text_sip_styp_s
mov edx, 0x200
lea rcx, [rsp + 0x70]
call fcn.140002150
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.DataSender
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbx, rax
test rax, rax
jne 0x140007dd5
lea rdx, str.Chyba_pri_inicializaci_WinINet
mov rcx, qword [0x140043df8]
call qword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x140007e11
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
test rax, rax
je 0x140007e08
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140007e4b
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007e45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007ea3
call fcn.14000fdd0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140007e84
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007e7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007e9d
call fcn.14000fdd0
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14000fdb0
add rsp, 0x280
pop rbx
ret
call fcn.140018edc
nop
call fcn.140018edc
nop
int3

Function at 0x140010c3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140010c86
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140010c86
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140010c86
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140010c86
cmp dword [rcx + 0x84], 0xe
jbe 0x140010c86
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140010c88
xor al, al
add rsp, 0x28
ret