joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140c1cbc9
Capabilities:
Encode data using base64

Disassembly:
call fcn.140c2648e
mov esi, 0xdb1c7fa4
mov eax, 0xa1b0e998
call fcn.140c20e3c
mov ecx, 0x67088d15
mov eax, ecx
movzx esi, cx
mov rcx, qword [rbx + rax - 0x67088d15]
lea r8, [rsi + rax*2 + 0x41178513]
cwde
mov rdx, qword [rsi + rcx - 0x8d15]
mov qword [rbx + rsi*8 - 0x468a8], rdx
movsx edx, sil
movzx ecx, r8b
mov r10d, dword [rdi + rsi*2 - 0x11a2a]
imul al
lea rdi, [rdi + rsi*2 - 0x11a26]
jo 0x140c29223
mov rax, qword [rbp + rbx*8 + 0x20]
push rax
add cx, r8w
sal byte [rsp + r10 - 0xffe0], 0xc3
xor bp, cx
mov word [rbx + r10*4 - 0x3ffd2], cx
mov qword [rsp + r10 - 0xfff4], r9
movzx ecx, byte [rdi + r10*2 - 0x1ffe2]
or word [rsp + r9 + 7], 0xb100
lea rdx, [r9 + r10*4 - 0x54755560]
sal si, 0x29
lea rdi, [r10 + rdi - 0xffed]
xor cl, bpl
ror cl, 1
or qword [rsp + r10*4 - 0x3ffc0], r8
rol rdx, 0xa3
xor cl, 0x2a
mov eax, r10d
call fcn.140c109d6
lea rsp, [rsp + 0x10]
jne 0x140c0e489
jmp 0x140bfdeaf
lea r9, [rcx*8 + 0x4e19ac34]
push rdx
xor r10d, ebp
and r8d, dword [rsp + rsi*2 - 0x11a29]
adc dword [rsp + rsi*4 - 0x23453], esi
dec r10d
neg r10d
lea r9, [rax*4 - 0x22d1a24a]
div qword [rsp + rsi - 0x8d15]
cdq
rol r10d, 1
or byte [rsp + rsi - 0x8d12], ch
ror r9w, 0xe8
adc r10d, r8d
sub r8d, 0x6a9ceaa9
xor r10d, edx
lea rax, [rsi + r8*2 - 0x1a44096d]
ror edx, cl
mov qword [rsp + rsi*2 - 0x11a2a], rbp
rol ecx, 0xb8
dec ax
xor dword [rsp + rsi - 0x8d15], r10d
cdq
shl r9w, 0xc
pop rbp
inc al
movsxd r10, r10d
rol r8b, 0x67
sub eax, 0xdf9787bb
idiv eax
add r11, r10
push r8
mov qword [rsp + rax - 1], r11
ret

Function at 0x140c1e1da
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edx
movzx r9d, r10w
mov r8d, 0xada6e7bf
shl word [rsp + rax - 0x592b], 0xa4
mov qword [rsp + rax*2 - 0xb258], rbp
lea rcx, [r9 + r10*4 + 0x6eb40e26]
mov esi, r9d
xor dword [rsp + rax*2 - 0xb258], edx
lea rax, [r8 + rcx*2 + 0x768c4982]
movzx ebp, r10b
jmp fcn.140c1b6e8
pop rsi
jae 0x140c17a5d
mov r9d, 0x951e7b0c
lea rcx, [r9 + r9*4 + 0x237b5b3]
movsx r10d, r9b
mov esi, dword [rdi + r10*2 - 0x18]
sal rcx, 0x20
call fcn.140c1e906

Function at 0x140c1e5a2
Capabilities:
Authenticate hmac

Disassembly:
lea rbx, [rsi + rbx - 0x263053ec]
ror ax, 0x6c
movsx edx, al
inc r8b
or ecx, r10d
mov qword [rsp + rsi - 0x263053f0], rax
or sil, 0x17
jnp 0x140c1ce46
Function at 0x140c20754
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x18363a87
mov qword [rsp], r9
mov r9d, 0x95bfa08e
call fcn.140c178f1
xor esi, 0xe9ba38ba
jmp 0x140c226e7
push 0x7232b827
ror esi, 1
shr qword [rsp + 0x1a], 0x9d
add word [rsp + 0x1f], 0xd226
mov qword [rsp + 0x30], rbp
mov ebp, 0x833dea1c
xor dword [rsp + 0x30], esi
or rbp, rbp
sar rbp, 0xe1
mov rbp, qword [rsp + rbp + 0x30]
movsxd rsi, esi
jns 0x140bee490
jmp 0x140c20d59
Function at 0x140c268bd
Capabilities:
Execute anti-debugging instructions

Disassembly:
and si, 0x3035
mov qword [rsp + r8 - 0x63a368a7], rbp
xor dword [rsp + r8 - 0x63a368a7], ecx
mov ebp, r9d
pop rbp
shr rax, 0x77
movsxd rcx, ecx
bts si, ax
add r11, rcx
and r10w, r8w
rdtsc
lea rbx, [rbx + rsi*2 - 0x3f0e404a]
lea r10, [r10 + r8*2 - 0x3744d8e8]
mov dword [rbx + rsi*2 - 0x3f0e403e], eax
jg 0x140c28168
bts dx, 0xc
movsxd r8, r8d
div rax
cwde
add r11, r8
movzx r8d, r9w
jmp 0x140c2d656
mov qword [rsp + r8 - 0x63a36858], 0x1f87a32b
rol ecx, 3
xor ecx, 0x3231b683
not r8b
pop rsi
push rax
not ecx
jmp 0x140bedfdb
mov dword [rbx + rsi*4 - 0x7e1c8084], edx
dec r10w
ja fcn.140bfee45

Function at 0x140c28873
Capabilities:
Execute anti-debugging instructions

Disassembly:
or dword [rsp + r8*2 - 0x1ee00], 0xfe3b4f84
cwd
xor dword [rsp + r8 - 0xf6f9], r9d
mov ebp, esi
cwd
mov rbp, qword [rsp + r8*4 - 0x3dbfc]
ror cl, 0x41
lea r10, [rcx + r10*4 - 0x23f8287a]
ror rcx, 0xc5
movsxd r9, r9d
mov qword [rsp + r8*2 - 0x1edfa], r8
xor rax, r8
pop rdx
adc r11, r9
dec rdx
and esi, esi
adc qword [rsp + r8 - 0xf701], r8
cmp ebx, 4
lea rsp, [rsp + 8]
jbe 0x140c288a2
mov eax, 0x661de628
sal eax, 0xa4
movsx ecx, ax
lea edx, [rcx - 0x627c]
not eax
bts rax, rcx
lea ecx, [rbx + rcx*4 - 0x18a04]
mov eax, 0x932c4c0c
neg ax
shl ecx, 3
sub eax, eax
bts ax, ax
setb al
sal edx, 3
add eax, 0xc9bf4d28
cwde
mov rax, rbp
call fcn.140bfcfda
inc r10
add rsi, rdx
xor r9d, ebp
rol r10d, 0x81
not r9d
bts ax, si
lea r9d, [r9 + r8*2 + 0x478bda24]
xor r9d, 0xb3380f18
sub rdx, 0xfffffffffe9b2697
ror r9d, 1
and ax, 0x3606
lea rcx, [rsi*2 + 0x471c6829]
bts r8w, si
not r9d
bswap r9d
imul cx
setno sil
push rax
inc r9d
xadd r10w, ax
push r8
mov qword [rsp + r8*2 - 0x1edfa], rbp
jp 0x140c01229
mov eax, 0x7d0e38a0
mov r8d, dword [rdi + rax - 0x7d0e38a0]
mov edx, eax
lea rdi, [rdi + rdx - 0x7d0e389c]
lea r10, [rdx + rdx*4 + 0x761d4524]
xor r8d, ebp
dec rax
xor r8d, 0x35134009
mov r9d, 0x4137b68f
lea r8d, [r8 + rax - 0x6eff35f7]
bswap r10d
not r8d
movsx esi, r9b
dec r8d
ror rsi, 0x7b
mul r10w
jb 0x140c06f00
cmp ebx, 4
call fcn.140c13a88

Function at 0x140c2a3d0
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
xor r8d, ebp
ror r8d, 2
call fcn.140bf9119
Function at 0x140c2a3dc
Capabilities:
Authenticate hmac

Disassembly:
btc dx, 0xb1
inc r9d
ror ecx, 1
xadd r8d, eax
bswap ecx
sar r9b, 4
or dl, 0x99
xor ecx, 0x2cb5d7ab
div r10
imul qword [rsp + rdx*2 - 0x14c84e4e]
cwde
mov qword [rsp + rdx], rbp
ror r8w, 3
movsx ebp, r8b
xor dword [rsp + rdx*8], ecx
idiv r10
pop rbp
dec rax
bswap r10
movsxd rcx, ecx
not r9d
mul r10w
sbb dl, 0x14
add r11, rcx
ror r9d, 0xda
jmp r11
xchg dword [rsp + rdx + 2], edx
mov r9d, dword [rsp + rdx - 0x51b6]
xor ecx, ebp
lea r10, [rsi + rsi*2 + 0xfb11a1b]
mov r8d, dword [rsp + rdx - 0x51b6]
lea ecx, [rdx + rcx + 0xa85ec66]
jmp 0x140bf88b0
call fcn.140c2b2bd
xor dword [rsp + rdx - 0x7f9da82f], esi
ror r9d, cl
imul rcx, r9
inc rbp
pop rbp
push rdx
neg dl
btr r10, 0x3a
movsxd rsi, esi
adc r11, rsi
xor r10, qword [rbx + rdx - 0x7f9da8d9]
lea rax, [r9 - 0x2f4691db]
shr dword [rsp + rax + 0x2f0691db], 0xca
ror word [rsp + rdx - 0x7f9da8cd], 0xea
mov r8w, word ss:[r9 + r10 - 0x400000]
or r9b, 0x3c
mov word [rbx + rdx - 0x7f9da8d3], r8w
movzx esi, cx
lea rbx, [rbx + rsi - 2]
btc edx, r9d
rol qword [rsp + r9*4 - 0x10000f0], 0xa2
pop r10
jae fcn.140bfee45
mov dword [rbx + rdx*4], ecx
mov ecx, dword [rdi + rdx*2]
shr dl, 2
mov eax, 0x9c24d904
lea rdi, [rdx + rdi + 4]
jbe 0x140c0de9e

Function at 0x140c2a48b
Capabilities:
Authenticate hmac

Disassembly:
mov edi, 0x1a18b29e
bts rdi, rdi
movzx edi, byte [rdi + r8 - 0x5a18b29e]
push 0x463a7d25
xor edi, edx
shl byte [rsp + 4], 0x26
xor byte [rsp + 1], 0xf
sal byte [rsp + 3], 0x25
and edi, 0xff
mov edi, dword [r10 + rdi*4]
sal qword [rsp], 0x97
shr edx, 8
call fcn.140c1e385
jmp r11
xor edx, 0xb730398e
push 0xffffffffbb9e603e
ror word [rsp + 0x33], 0x41
dec r9
push 0x889f08
push 0xffffffff980d3e92
lea rsp, [rsp + 0x48]
jne 0x140bef74c
mov r9d, 0x948bae35
movsx r8d, r9w
pop rdi
not edx
mov r9d, 0x370f3627
mov r10d, r9d
lea rsi, [r9 + r10*4 + 0x6d9c582f]
mov dword [rbx + r9 - 0x370f3627], edx
or r9, 0x83d6534
jns 0x140c06da0

Function at 0x140c2b01d
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol cl, 0xa1
inc rdx
xor rsi, 0xffffffffcd0c82b9
ror r10w, 0xc2
xor rbp, rsi
rol dx, 0xc3
adc dx, r10w
push rax
mov qword [rbx + rdx*4 - 0x110], rsi
mov qword [rsp + rdx*2 - 0x78], rcx
lea rsi, [r10*4 - 0x73c714f4]
lea rbx, [rbx + rdx*2 - 0x90]
sar dx, 0xef
pop rcx
setne byte [rsp + rdx + 5]
xor r10d, dword [rdi + rdx + 0x10]
lea rdi, [rdi + rdx*8 + 0x14]
shr r9d, 0x1a
mov qword [rsp + r9 + 8], 0xffffffffd5b5c9b3
not r9d
xor r10d, ebp
xor r10d, r9d
shl byte [rsp + rdx*8 + 0xd], 0x86
add r10d, r9d
sub r9b, cl
push rax
xor r10d, 0x5038c58f
neg cl
dec r8b
setnp byte [rsp + rdx + 6]
neg r10d
jmp 0x140c129a4
Function at 0x140c2b189
Capabilities:
Authenticate hmac

Disassembly:
lea r8d, [r8 + r9*4 - 0x30a0e27d]
jo 0x140c1002e
mov edx, dword [rdx + rbx - 0x5ba69787]
mov r9d, 0x4d282415
mov ecx, r9d
push rcx
lea rbx, [rbx + r9 - 0x4d282411]
push r9
movzx ecx, word [r9 + rdi - 0x4d282415]
mov r10d, 0x17aa8522
lea rdi, [rdi + r10 - 0x17aa8520]
and r9w, 0x640b
and qword [rsp + r9 - 0x4d2823f9], r9
xor cx, bp
lea r8, [r10 + r10*8 + 0x7531e714]
lea rsi, [r8 + r10*2 + 0x632ecf1c]
add cx, 0xe418
shr dword [rsp + r10*2 - 0x2f550a42], 0xc6
movsx eax, r10b
ror cx, 1
pop r9
and byte [rsp + r9 - 0x1342413], 0x34
pop rax
not cx
dec r10w
not al
not r10d
rol cx, 1
bt r8d, 0x10
not cx
btc r8, rsi
btr r10d, 8
xor bp, cx
shl rax, 0x2e
adc r9w, r10w
dec r8
adc rcx, rsp
sub r8b, r10b
mov dword [rcx + r9*2 - 0x2693de6], edx
mov esi, dword [r9 + rdi - 0x1349ef3]
dec r8
call fcn.140bfcf48

Function at 0x140c2be07
Capabilities:
Authenticate hmac

Disassembly:
sub edx, r8d
bts r8, r10
sar esi, 0x91
ror edx, 3
shl dword [rsp + rcx - 0x58d6085e], 0x11
adc edx, r8d
call fcn.140bee5b8

Function at 0x140c2be24
Capabilities:
Authenticate hmac

Disassembly:
mov rbp, qword [rsp + rsi - 0x6122988]
movsxd rcx, ecx
inc word [rsp + rsi - 0x6122990]
adc r11, rcx
mul r8d
mov qword [rsp + rax - 0x33ece7f0], 0x4a3e8401
pop rsi
pop rdx
pop r9
jb fcn.140bfee45
mov r10d, 0xf187ba19
movsx edx, r10w
mov r10w, word [rbx + riz]
movsx r9d, dl
push r9
inc r9b
mov cx, word [rbx + r9*4 - 0x66]
jns 0x140beee56
sub r10b, r10b
neg ecx
sub r8b, 0x8e
and al, r8b
ror ecx, 1
btc eax, r9d
imul byte [rsp + rsi - 0x6102985]
mul qword [rsp + rsi*2 - 0xc205325]
dec ecx
and dword [rsp + rsi - 0x6102986], 0x48196393
ror ecx, 1
rol dx, 0xa5
neg r8
not ecx
lea ecx, [rcx + rsi*2 - 0x4feda2c]
mov qword [rsp + rsi*2 - 0xc205330], 0x1c24b03c
setno byte [rsp + rsi - 0x6102991]
mov qword [rsp + rsi*2 - 0xc205320], rbp
bts rsi, 0x11
xor dword [rsp + rsi - 0x6122988], ecx
shr al, 0x42
jae 0x140c2a4e7

Function at 0x140c2d284
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 8]
jmp 0x140c0e48f
jmp 0x140c19d49
Function at 0x140c2d2b5
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
imul r8d
dec edx
lea r9d, [r9 + r8*2 + 0x2af91653]
bt r10, rdx
shl r8d, 0xc9
push rbp
bswap r10d
mov ebp, edx
xor dword [rsp + rdx*8 - 0x498], r9d
shr r10w, 0x69
pop rbp
bts r8, rax
add ax, 0xb418
sar sil, 0x82
movsxd r9, r9d
adc r11, r9
jmp fcn.140bfee45
cdq
dec r10w
mov qword [rsp + rcx - 0x4e90b403], rdx
xor byte [rsp + rcx - 0x4e90b3f6], r8b
ja 0x140c2d869
sal rdx, cl
ror dword [rsp + rcx*2 - 0x6a4cf015], 0x5d
mov dword [rbx + rcx*2 - 0x6a4cf018], r10d
xor dl, 0x85
lea rsi, [rcx*4 + 0x6484fd97]
lea r10, [rsi + r9 + 0x778e7407]
mov edx, dword [rdi + rcx - 0x3526780c]
sar si, 0x64
cmovne si, word [rsp + rcx*2 - 0x6a4cf012]
lea rdi, [rdi + rcx*2 - 0x6a4cf014]
jne 0x140c0cfa2
mov r9d, 0xf6040330
lea r10, [r9 + r9*2 + 0x450b639a]
and r9w, r9w
mov rdx, rbx
setl r10b
dec r10
jb 0x140bf1f49
sbb rbx, 2
sal r9b, 0x41
movsx eax, r9b
mov word [rbx + rax*2 - 0xc0], dx
movsx esi, r9b
mov r9d, dword [rdi + rax - 0x60]
btr esi, esi
lea rdi, [rax + rdi - 0x5c]
xor r9d, ebp
xchg rsi, r10
movsx edx, si
lea r8, [rax + rdx*4 + 0x318ee201]
xor r9d, 0x53239919
div r8b
inc sil
rol r9d, 1
btr r8w, si
xor r8w, si
dec r9d
rol r9d, 1
jmp 0x140c29b11
neg r10w
shl al, 1
push rax
xor r10w, 0x5d36
dec dword [rsp + rcx - 0x4e90b400]
add ecx, r9d
and dword [rsp + r9 - 0x4e909ff7], r8d
rol r10w, 1
call fcn.140c21f53
Function at 0x14000e420
Capabilities:
Hash data using sha256

Disassembly:
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
mov qword [rcx + 0x20], 0
ret

Function at 0x14000ea40
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x20]
mov rsi, rdx
mov rdi, rcx
and ebx, 0x3f
mov byte [rbx + rcx + 0x28], 0x80
inc ebx
cmp ebx, 0x38
je 0x14000ea80
and ebx, 0x3f
jne 0x14000ea74
mov rcx, rdi
call fcn.14000e460
mov byte [rbx + rdi + 0x28], 0
inc ebx
cmp ebx, 0x38
jne 0x14000ea67
mov rcx, qword [rdi + 0x20]
shl rcx, 3
mov rax, rcx
bswap ecx
shr rax, 0x20
mov dword [rdi + 0x64], ecx
mov rcx, rdi
bswap eax
mov dword [rdi + 0x60], eax
call fcn.14000e460
mov r11, rdi
mov edx, 4
nop dword [rax]
mov ecx, dword [r11 + 4]
mov eax, dword [r11]
add rsi, 8
bswap eax
bswap ecx
add r11, 8
dec rdx
mov dword [rsi - 8], eax
mov dword [rsi - 4], ecx
jne 0x14000eab0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov dword [rdi], 0x6a09e667
mov dword [rdi + 4], 0xbb67ae85
mov dword [rdi + 8], 0x3c6ef372
mov dword [rdi + 0xc], 0xa54ff53a
mov dword [rdi + 0x10], 0x510e527f
mov dword [rdi + 0x14], 0x9b05688c
mov dword [rdi + 0x18], 0x1f83d9ab
mov dword [rdi + 0x1c], 0x5be0cd19
mov qword [rdi + 0x20], rdx
add rsp, 0x20
pop rdi
ret

Function at 0x14001fa60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
lea r10, [0x14002c180]
xor edx, edx
mov r8, r10
mov ecx, edx
mov eax, edx
inc edx
shr eax, 1
and ecx, 1
add r8, 4
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x14001fa72
mov eax, 0x800
movsxd rcx, edx
cmp edx, eax
jae 0x14001fb60
sub eax, edx
lea r8, [r10 + rcx*4]
mov r9d, eax
nop word [rax + rax]
mov edx, dword [r8 - 0x400]
add r8, 4
movzx ecx, dl
shr edx, 8
mov eax, dword [r10 + rcx*4]
xor eax, edx
dec r9
mov dword [r8 - 4], eax
jne 0x14001fb40
lea rax, [0x14001fec0]
lea rbx, [0x14001fdd0]
mov qword [0x14002c168], rax
mov qword [0x14002e180], rax
mov qword [0x14002c160], rbx
call fcn.14001fc90
mov rcx, qword [0x14002e180]
test eax, eax
cmove rcx, rbx
mov qword [0x14002e180], rcx
add rsp, 0x20
pop rbx
ret
Function at 0x180007e70
Capabilities:
Encode data using xor

Disassembly:
mov r9d, 0x48
jmp fcn.180005820
Function at 0x18001ccdc
Capabilities:
Parse pe header

Disassembly:
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x18001ccdc
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x18001cd4b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18001cd4b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18001cd4b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18001cd4b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18001cd4b
cmp dword [rcx + 0x84], 0xe
jbe 0x18001cd4b
cmp dword [rcx + 0xf8], 0
je 0x18001cd4b
mov ecx, ebx
call fcn.18001cc08
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.18001ce70
nop
cmp dword [rbp + 0x20], 0
je 0x18001cd99
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.18001cca8
int3

Function at 0x18001e0f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18001e118
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18001e118
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180023370
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800233a0
xor eax, eax
jmp 0x180023463
mov rbp, rbx
cmp word [rax], si
je 0x1800233c5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800233ac
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800233a8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800232c0
movsxd r14, eax
test eax, eax
jne 0x180023403
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180023399
mov rcx, r14
call fcn.18002208c
mov rdi, rax
test rax, rax
jne 0x18002341c
xor ecx, ecx
call fcn.180021630
jmp 0x1800233f8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800232c0
test eax, eax
jne 0x18002344d
mov rcx, rdi
call fcn.180021630
jmp 0x180023457
xor ecx, ecx
call fcn.180021630
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14000e500]
mov dword [rax], 1
mov rax, qword [0x14000e510]
mov dword [rax], 1
mov rax, qword [0x14000e520]
mov dword [rax], 1
mov rax, qword [0x14000e4b0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001748
Capabilities:
Connect socket
Initialize winsock library
Resolve dns

Disassembly:
push rbp
sub rsp, 0x210
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x188], 0xffffffffffffffff
mov qword [rbp - 0x28], 0
mov qword [rbp + 0x180], 0
lea rax, [rbp - 0x20]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
mov dword [rbp + 0x17c], eax
cmp dword [rbp + 0x17c], 0
je 0x1400017bb
mov eax, dword [rbp + 0x17c]
mov edx, eax
lea rax, [0x14000d03a]
mov rcx, rax
call dbg.printf
mov eax, 0
jmp 0x14000199e
lea rax, [rbp - 0x60]
mov r8d, 0x30
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp - 0x5c], 2
mov dword [rbp - 0x58], 1
mov dword [rbp - 0x54], 6
lea rdx, [rbp - 0x28]
lea rax, [rbp - 0x60]
mov r9, rdx
mov r8, rax
lea rax, [0x14000d051]
mov rdx, rax
lea rax, str.www.google.com
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_getaddrinfo]
call rax
mov dword [rbp + 0x17c], eax
cmp dword [rbp + 0x17c], 0
je 0x14000184b
mov eax, dword [rbp + 0x17c]
mov edx, eax
lea rax, str.getaddrinfo_failed:__d_n
mov rcx, rax
call dbg.printf
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 0
jmp 0x14000199e
mov rax, qword [rbp - 0x28]
mov qword [rbp + 0x180], rax
jmp 0x140001933
mov rax, qword [rbp + 0x180]
mov ecx, dword [rax + 0xc]
mov rax, qword [rbp + 0x180]
mov edx, dword [rax + 8]
mov rax, qword [rbp + 0x180]
mov eax, dword [rax + 4]
mov r8d, ecx
mov ecx, eax
mov rax, qword [sym.imp.WS2_32.dll_socket]
call rax
mov qword [rbp + 0x188], rax
cmp qword [rbp + 0x188], 0xffffffffffffffff
jne 0x1400018c5
mov rax, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rax
mov edx, eax
lea rax, str.Error_at_socket__:__ld_n
mov rcx, rax
call dbg.printf
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 0
jmp 0x14000199e
mov rax, qword [rbp + 0x180]
mov rax, qword [rax + 0x10]
mov ecx, eax
mov rax, qword [rbp + 0x180]
mov rdx, qword [rax + 0x20]
mov rax, qword [rbp + 0x188]
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_connect]
call rax
mov dword [rbp + 0x17c], eax
cmp dword [rbp + 0x17c], 0xffffffff
jne 0x140001943
mov rax, qword [rbp + 0x188]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov qword [rbp + 0x188], 0xffffffffffffffff
nop
mov rax, qword [rbp + 0x180]
mov rax, qword [rax + 0x28]
mov qword [rbp + 0x180], rax
cmp qword [rbp + 0x180], 0
jne 0x14000185b
jmp 0x140001944
nop
mov rax, qword [rbp - 0x28]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_freeaddrinfo]
call rax
cmp qword [rbp + 0x188], 0xffffffffffffffff
jne 0x14000197d
lea rax, str.Unable_to_connect_to_server__n
mov rcx, rax
call dbg.printf
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 0
jmp 0x14000199e
mov rax, qword [rbp + 0x188]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 1
add rsp, 0x210
pop rbp
ret
Function at 0x140001a83
Capabilities:
Get session user name

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp - 4], 0x101
lea rax, [rbp - 4]
mov rdx, rax
lea rax, [0x14001d380]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
test eax, eax
je 0x140001b54
lea rax, [0x14001d380]
mov rdx, rax
lea rax, str._C:Users_
mov rcx, rax
call sym.strcat
lea rax, [0x14001d380]
mov rdx, rax
lea rax, str.C:Users_
mov rcx, rax
call sym.strcat
lea rax, str._C:Users_
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, str._C:Users_
add rax, rdx
movabs rdx, 0x7379536e69575c5c
movabs rcx, 0x6578652e6d6574
mov qword [rax], rdx
mov qword [rax + 8], rcx
lea rax, str.C:Users_
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, str.C:Users_
add rax, rdx
movabs rcx, 0x747379536e69575c
mov qword [rax], rcx
movabs rdx, 0x6578652e6d6574
mov qword [rax + 7], rdx
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x140001b5f
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, [0x14001d4a0]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x140001b97
lea rax, str.Impossibile_ottenere_il_percorso_del_directory_corrente_n
mov rcx, rax
call dbg.printf
lea rax, [0x14001d4a0]
mov rdx, rax
lea rax, [0x14001d5c0]
mov rcx, rax
call sym.strcpy
lea rax, [0x14001d5c0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [0x14001d5c0]
add rax, rdx
mov word [rax], 0x5c
lea rax, [0x14001d4a0]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [0x14001d4a0]
add rax, rdx
mov word [rax], 0x5c
lea rax, [0x14001d640]
mov rdx, rax
lea rax, [0x14001d4a0]
mov rcx, rax
call sym.strcat
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x140001dc3
Capabilities:
Execute command

Disassembly:
push rbp
sub rsp, 0x120
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb0], rcx
mov rdx, qword [rbp + 0xb0]
lea rax, [rbp - 0x60]
mov r9, rdx
lea r8, str.regedit__s___s_
mov edx, 0x100
mov rcx, rax
call dbg.snprintf
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.system
test eax, eax
je 0x140001e1d
lea rax, str.Errore_durante_lesecuzione_del_file_.reg._n
mov rcx, rax
call dbg.printf
jmp 0x140001e2c
lea rax, str.File_.reg_eseguito_con_successo._n
mov rcx, rax
call dbg.printf
mov eax, 0
add rsp, 0x120
pop rbp
ret