joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140313660
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x58], rax
xor eax, eax
test eax, eax
jne 0x14031367f
mov rax, qword [rsp + 0x58]
add rax, 0x18
mov rcx, qword [rsp + 0x58]
mov r8d, dword [rcx + 0x14]
mov rdx, rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x98]
call qword [sym.imp.ws2_32.dll_connect]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0xffffffff
jne 0x1403136e1
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov rcx, qword [rsp + 0x58]
add rcx, 0xe0
mov r8d, eax
mov rdx, rcx
mov rcx, qword [rsp + 0x88]
call fcn.1403118a0
jmp 0x1403137af
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call fcn.140311da0
mov rax, qword [rsp + 0x58]
cmp dword [rax], 5
jne 0x14031370e
lea rax, str.QUIC
mov qword [rsp + 0x60], rax
jmp 0x14031371a
lea rax, [0x140454834]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x58]
add rax, 0xe0
mov rcx, qword [rsp + 0x58]
add rcx, 0x114
mov rdx, qword [rsp + 0x58]
mov edx, dword [rdx + 0x110]
mov dword [rsp + 0x40], edx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0x144]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x98]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x60]
lea r8, str._s_socket__qd_connected:___s:_d_______s:_d_
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
call fcn.1402e8610
mov edx, 1
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x98]
call fcn.140325810
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 8]
mov dword [rsp + 0x54], eax
xor eax, eax
add rsp, 0x78
ret
Function at 0x140325810
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
cmp dword [rsp + 0x48], 0
je 0x14032582e
mov dword [rsp + 0x20], 1
jmp 0x140325836
mov dword [rsp + 0x20], 0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ws2_32.dll_ioctlsocket]
add rsp, 0x38
ret

Function at 0x1403260c0
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1403260f5
mov eax, 0x1b
jmp 0x140326145
mov rax, qword [rsp + 0x40]
add rax, 8
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x140326143
xor edx, edx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
mov eax, 2
jmp 0x140326145
xor eax, eax
add rsp, 0x38
ret

Function at 0x140326150
Capabilities:
Hash data via wincrypt

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
add rsp, 0x28
ret
Function at 0x140354adc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140354b26
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140354b26
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140354b26
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140354b26
cmp dword [rcx + 0x84], 0xe
jbe 0x140354b26
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140354b28
xor al, al
add rsp, 0x28
ret

Function at 0x1403556b0
Capabilities:
Resolve dns

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov ebp, r9d
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.14028ebf0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14035570b
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x140355784
mov r8d, 1
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140011e70
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x140355791
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
je 0x140355784
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.140011e70
nop
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], bp
xor eax, eax
mov qword [rsi], rax
mov byte [rdi], 0
test rbx, rbx
jne 0x140355773
jmp 0x140355784
Function at 0x14007be4c
Capabilities:
Encode data using xor

Disassembly:
mov rdi, rax
test rax, rax
je 0x14007be37
out 0x85, eax
neg byte [0x10b8b068f]
dec dword [rax - 1]
ret
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
jo 0x14007be8e
and byte [rdi - 0x3d], bl
int3
jns 0x14007bdd7
pop rsp
and al, 8
mov qword [rax], rbx
leave
dec dword [rax - 1]
shl dword [rsi + 0x35], 0x51
jne 0x14007be90
inc rcx
xor ax, 0x4851
jne 0x14007be90
cmp rcx, rbx
jbe 0x14007beb7
add sp, 0x58
cmp eax, 0x8b861275
ret
add rdi, 8
mov rax, qword [rdi]
in al, dx
loope 0x14007bf09
mov eax, dword [rdi]
lea rax, [rax + rbx*2]
add rax, 2
jmp 0x14007becf
loop 0x14007be5c
pop rsp
and al, 0x30
mov ecx, 0x42ca420b
call fcn.140089c38
nop
xor ebx, ebx
test r14, r14
jne 0x14007bf33
test eax, 0xa8ff3f38
mov ebx, esp
add byte [rax], al
add byte [rdx + 0x52], bl
call fcn.14007c9e0
jp 0x14007bf32
add byte [rdx + 4], bh
mov qword [r14], rbx
test rdi, rdi
test edi, edi
invalid
dec byte [rdx]
test rsi, rsi
jne 0x14007bf92
test rdi, rdi
jne 0x14007bf4c
mov dword [rbp - 0x47f88a0a], 0xe0001
in al, 0x73
mov esi, dword [rbx - 0x368b3ff2]
test qword [rcx + 0x1f88bc74], rcx
jl 0x14007bf2b
call fcn.14006dac0
fisttp dword [rbx - 0x3f7ab740]
stosb byte [rdi], al
xor ebx, edi
invalid
iretd

Function at 0x1400822db
Capabilities:
Encode data using xor

Disassembly:
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
and qword [0x1128d6a5f], 0x74
sbb cl, byte [rbp + 0x60]
sal byte [rbp + rdx + 0x4d], 0x15
push qword [rbp + 0x18]
call fcn.14006fe36
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14007c9e0
xor eax, eax
add rsp, 0x60
pop rbp
ret
call 0xde5daf96
mov ecx, 0x482045ce
lea ecx, [rbp - 0x40]
mov qword [rbp - 0x10], rax
call 0x1c0082000
jmp 0x1400821ee
out dx, al
ror byte [rax - 0x7d], 0xc4
and byte [0x11602a650], ah
jne 0x140082249
mov eax, 0x244caa48
xor byte [rcx + rcx*4], cl
and al, 0x30
call 0x140e046b8
pop r14
and al, 0x30
add byte [rax + 0x4e232ac1], r8b
invalid
cmp dword [rcx], esi
jg 0x140082282
imul edi, dword [rdx], 0x987580
or al, 1
add byte [rax], al
add byte [rbx - 0x77], dl
out 0x2b, eax
rol dword [rcx + 0x6b], 0xc8
mov eax, esp
adc ch, bl
mov ecx, esp
int3

Function at 0x14008350c
Capabilities:
Encode data using xor

Disassembly:
xchg byte [rcx], sil
jne 0x1400834ed
and dword [rax - 0x43b73c01], 0x41
adc byte [rax - 0x47], cl
add dword [rbp + 7], esi
mov rbp, qword [rbx + rcx]
movabs rsp, 0x48077501b9481041
mov ebp, dword [rbx + rcx]
stosd dword [rdi], eax
add eax, 0x57894800
mov qword [rcx - 0x4e], rax
sbb al, 0x89
adc byte [r11], sil
rol bl, 0xcc
mov qword [rsp + 0x73], r10
std
and al, 0xb1
push rbp
in al, dx
sub rsp, 0x40
lea rax, [rbp + 0x10]
test al, 0xe1
or eax, 0x284d8d4c
lea rax, [rbp + 0x18]
mov al, 0x45
lock xor byte [rbp - 0x18], r8b
xor byte [rbp - 0x18], r8b
mov edi, 0xe802
cld
lea edx, [rbp - 0x57]
lea rcx, [rbp + 0x20]
mov dword [rdx + 0x28], edi
mov edi, ebp
loopne 0x140083532
or bh, ah
invalid
Function at 0x140084f00
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword [rdi]
invalid
and al, 0x40
xor dword [rbx - 0x3ca0df3c], eax
invalid
push rbx
sub rsp, 0x20
xor edi, dword [rcx + 0x6e]
test edx, edx
jne 0x140084ef6
call fcn.14006cc58
mov dword [rax], reloc.WS2_32.dll_shutdown
jmp 0x140084fd5
mov ebx, dword [rcx]
add r9, rdx
test al, al
je 0x140084fa8
cmp al, r11b
je 0x140084f76
movabs rdx, 0x7ff64cda75223cc1
mov ebp, dword [rbp + 0x1fc4c084]
scasd eax, dword [rdi]
enter 0xffffffffffffc18a, 0xffffffffffffff80
stc
and dh, byte [rbp + rcx*2 - 0x78]
or cl, byte [rcx - 1]
jnp 0x140084fb3
jg 0x140084ee2
lodsd eax, dword [rsi]
test al, al
invalid
mov al, cl
cmp cl, 0x22
je 0x140084fb2
mov byte [rdx], cl
invalid
inc edx
cmp rdx, r9
sbb dword [rdi], esp
out dx, eax
mov al, byte [rax]
mov bh, byte [rcx]
test al, al
jne 0x140084f5e
invalid
cmp dword [rax + rax*8 - 0x3f7b1c8b], eax
jrcxz 0x140084f00
test al, al
rcr dl, 0x8d
cmpsb byte [rsi], byte [rdi]
add dword [rcx + 0xf], ecx
fimul dword [rbp + 0xf4901a6]
enter 0xaeb, 0xffffffffffffff88
add ch, byte [rcx - 1]
cmp rdx, r9
je 0x140084f99
test byte [rcx], al
jno 0x140084f55
je 0x140084fb5
jmp 0x140084f6d
and dword [rdx], ebx
call fcn.14006fe58
mov dword [rax], 0x22
jmp 0x140084f3e
popfq
cmp al, bl
jne 0x140084ffd
call [r14 + rdx]
cmp byte [rcx], bl
sbb dword [rax + rdi*8 + 0x49], esi
cmp ecx, edx
je 0x140084fad
cmp rcx, r10
invalid
invalid
Function at 0x14017b2a0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14017b2ad
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14017b2bd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14017b2a5
lea eax, [rcx + 1]
jmp 0x14017b2cb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14017b2de
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14017b2c4
sub eax, 3
jb 0x14017b2fe
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14017b34d
sar eax, 1
movsxd rbp, eax
jb 0x14017b334
jmp 0x14017b30c
add ebx, ebx
jne 0x14017b30a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14017b334
inc ecx
add ebx, ebx
jne 0x14017b31a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14017b334
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14017b32d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14017b31c
add ecx, 2
jmp 0x14017b339
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14017b262
jmp 0x14017b2ad
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xde400
mov dl, 0x16
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14017b399
cmp rsi, rcx
jae 0x14017b3a1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14017b380
cmp al, 0x8f
ja 0x14017b380
cmp byte [rsi - 2], 0xf
je 0x14017b386
sub al, 0xe8
cmp al, 1
ja 0x14017b36a
cmp rsi, rcx
jae 0x14017b3a1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14017b370
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14017b3a1
lodsb al, byte [rsi]
jmp 0x14017b380
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x178000]
mov eax, dword [rdi]
or eax, eax
je 0x14017b40a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x18c354]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14017b3ae
jns 0x14017b3e3
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14017b3ed
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14017b404
mov qword [rbx], rax
add rbx, 8
jmp 0x14017b3ce
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x21f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14017b462
sub rsp, 0xffffffffffffff80
jmp 0x1400cdb10
Function at 0x100006114
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
xor ebx, ebx
mov rsi, r9
mov rbp, r8
lea ecx, [rbx + 0x40]
mov r12, rdx
mov dword [rax - 0x18], ebx
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rdi, rax
cmp rax, rbx
je 0x10000620a
mov eax, dword [rsp + 0x80]
cmp eax, ebx
jl 0x100006180
cmp eax, 1
jle 0x100006173
cmp eax, 2
jne 0x100006180
mov rax, qword [rsp + 0x78]
mov qword [rdi + 0x30], rbx
mov qword [rdi + 0x28], rax
jmp 0x100006180
mov rax, qword [rsp + 0x78]
mov qword [rdi + 0x28], rbx
mov qword [rdi + 0x30], rax
mov rax, qword [rsp + 0x88]
mov r8, qword [rsp + 0x90]
mov r9, rdi
mov qword [rdi + 0x10], rax
mov rax, qword [rsp + 0x70]
xor edx, edx
mov qword [rdi + 0x20], rax
lea rax, [rsp + 0x30]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov qword [rdi], r12
mov qword [rdi + 8], rbp
mov dword [rsp + 0x20], ebx
mov qword [rdi + 0x18], rsi
mov qword [rdi + 0x38], rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, rbx
jne 0x1000061ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [0x100010180]
lea rax, [0x100010180]
cmp rcx, rax
je 0x100006240
test byte [rcx + 0x1c], 1
je 0x100006240
mov edx, 0xb
mov r9d, ebx
jmp 0x100006230
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100006240
mov r9d, 0xe
mov ebx, r9d
mov rcx, qword [0x100010180]
lea rax, [0x100010180]
cmp rcx, rax
je 0x100006240
test byte [rcx + 0x1c], 1
je 0x100006240
lea edx, [r9 - 2]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003238]
call fcn.100008100
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop r12
ret
Function at 0x10000a508
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, rcx
xor ecx, ecx
mov r15, rdx
xor ebx, ebx
call qword [sym.imp.RPCRT4.dll_RpcImpersonateClient]
test eax, eax
jne 0x10000a727
mov rcx, qword [rdi + 0x30]
call fcn.100006068
xor esi, esi
xor r14d, r14d
or rdi, 0xffffffffffffffff
cmp qword [rsp + 0xa0], rbx
je 0x10000a575
mov rcx, rdi
mov rdi, qword [rsp + 0xa0]
xor eax, eax
repne scasw ax, word [rdi]
or rdi, 0xffffffffffffffff
not rcx
mov r12d, ecx
jmp 0x10000a578
xor r12d, r12d
mov ecx, 0x40
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rbp, rax
cmp qword [rsp + 0xa0], rbx
je 0x10000a5ab
mov ecx, r12d
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rdi, rax
jmp 0x10000a5ad
xor edi, edi
test rdi, rdi
je 0x10000a6f2
test rbp, rbp
je 0x10000a6f2
mov r8, qword [rsp + 0xa0]
mov edx, r12d
mov rcx, rdi
call fcn.100003d08
test eax, eax
jns 0x10000a611
mov rcx, qword [0x100010180]
lea rdx, [0x100010180]
cmp rcx, rdx
je 0x10000a607
test byte [rcx + 0x1c], 1
je 0x10000a607
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003570]
mov edx, 0xa
mov r9d, eax
call fcn.100008100
mov ebx, 0x18
jmp 0x10000a6f7
lea rcx, [0x1000032c0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r12d, 0x29c
mov rsi, rax
test rax, rax
je 0x10000a640
mov rdx, r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
jne 0x10000a656
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
cmove ebx, r12d
test ebx, ebx
jne 0x10000a6f7
mov rax, qword [rsp + 0x90]
mov r8, qword [rsp + 0xb8]
mov qword [rbp + 0x10], rdi
mov qword [rbp], rax
mov rax, qword [rsp + 0x98]
mov qword [rbp + 0x20], rsi
mov qword [rbp + 8], rax
mov eax, dword [rsp + 0xa8]
mov r9, rbp
mov dword [rbp + 0x3c], eax
mov rax, qword [rsp + 0xb0]
xor edx, edx
mov qword [rbp + 0x18], rax
mov rax, qword [rsp + 0x80]
xor ecx, ecx
mov rax, qword [rax + 0x30]
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x28], rax
mov eax, dword [rsp + 0xc0]
mov dword [rbp + 0x38], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x10000a6de
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10000a71f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
cmove ebx, r12d
test ebx, ebx
je 0x10000a71f
jmp 0x10000a6f7
mov ebx, 0xe
test rdi, rdi
je 0x10000a704
mov rcx, rdi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
test rbp, rbp
je 0x10000a711
mov rcx, rbp
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
test rsi, rsi
je 0x10000a71f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call qword [sym.imp.RPCRT4.dll_RpcRevertToSelf]
jmp 0x10000a729
mov ebx, eax
mov eax, ebx
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x10000c2cc
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rsi, rdx
mov rbp, rcx
xor ebx, ebx
mov rcx, qword [0x100010180]
lea r14, [0x100010180]
cmp rcx, r14
je 0x10000c31d
test byte [rcx + 0x1c], 2
je 0x10000c31d
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x12]
lea r8, [0x100003708]
call fcn.100007c50
mov rcx, qword [0x100010180]
cmp word [rsi], 0x20
jne 0x10000c48f
cmp qword [rbp + 0x48], rbx
je 0x10000c48f
mov r12, qword [rsi + 0x30]
mov rdi, qword [rsi + 0x40]
mov r13d, dword [rsi + 0x38]
cmp rcx, r14
je 0x10000c362
test byte [rcx + 0x1c], 2
je 0x10000c362
mov r9d, dword [r12 + 4]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003708]
mov edx, 0x13
call fcn.100008100
mov edx, dword [rsi + 8]
mov ecx, dword [0x1000103e0]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov r8d, r13d
mov rdx, rdi
mov rcx, r12
call qword [rbp + 0x48]
cmp dword [r12 + 4], 0x69
jne 0x10000c429
mov r12, qword [rdi + 8]
cmp qword [rbp + 0x50], rbx
je 0x10000c47f
mov ecx, 0x28
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rcx, rax
cmp rax, rbx
je 0x10000c3c1
mov rax, qword [rsi + 8]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], rax
call fcn.10000b090
mov rdi, rax
jmp 0x10000c3c4
mov rdi, rbx
cmp rdi, rbx
je 0x10000c47f
mov qword [rdi + 0x18], r12
mov rax, qword [rsi + 8]
mov rcx, qword [rbp + 0x50]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], rax
call fcn.10000b624
cmp rax, rbx
jne 0x10000c418
mov rax, qword [rsi + 8]
mov rcx, qword [rbp + 0x50]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], rax
call fcn.10000c084
cmp rax, rbx
jne 0x10000c418
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
jmp 0x10000c47f
mov rcx, qword [rax]
mov rdx, rdi
mov rcx, qword [rcx + 0x28]
call fcn.10000bcc4
jmp 0x10000c47f
cmp dword [r12 + 4], 0x6a
jne 0x10000c47f
mov rax, qword [rdi]
mov rcx, qword [rbp + 0x50]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov rax, qword [rsi + 8]
mov qword [rsp + 0x60], rax
call fcn.10000b624
mov rdi, rax
cmp rax, rbx
je 0x10000c47f
mov rax, qword [rax]
lea rdx, [rsp + 0x58]
mov rcx, qword [rax + 0x28]
call fcn.10000b624
cmp rax, rbx
je 0x10000c47f
mov rcx, qword [rdi]
lea rdx, [rsp + 0x58]
mov rcx, qword [rcx + 0x28]
call fcn.10000b984
mov ecx, dword [0x1000103e0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x10000c4b7
mov r9d, 0x57
mov ebx, r9d
cmp rcx, r14
je 0x10000c4b7
test byte [rcx + 0x1c], 1
je 0x10000c4b7
mov rcx, qword [rcx + 0x10]
lea edx, [r9 - 0x43]
lea r8, [0x100003708]
call fcn.100008100
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x10000d320
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100010340]
jne 0x10000d33b
rol rcx, 0x10
test cx, 0xffff
jne 0x10000d337
ret 0
ror rcx, 0x10
jmp 0x10000d700
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1000104f0]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x1000105e8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10000d785
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1000104f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x10000d7a7
mov rax, qword [rsp + 0x88]
mov qword [0x1000105e8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x100010588], rax
mov rax, qword [0x1000105e8]
mov qword [0x100010460], rax
mov rax, qword [rsp + 0x90]
mov qword [0x100010570], rax
mov dword [0x100010450], 0xc0000409
mov dword [0x100010454], 1
mov rax, qword [0x100010340]
mov qword [rsp + 0x68], rax
mov rax, qword [0x100010348]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100003898]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x10000d59c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x10000d5e9
cmp rcx, 0xffffffffffffffff
je 0x10000d5e9
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10000d5e1
cmp dword [rcx + 0x3c], edx
jl 0x10000d5e1
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10000d5e1
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x10000d5e9
mov rax, rdx
add rsp, 0x18
ret

Function at 0x100019de9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [rsp], 0xfffffffe
ja 0x100019ded
lea esp, [rsp - 0x34]
invalid