joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140146f80
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x498
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x40], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x48], rax
xor r14d, r14d
mov edi, 0xffffffff
xor ebx, ebx
xor r15d, r15d
cmp r8, 0x201
jae 0x140147020
jmp 0x140146fff
jae 0x1401470ca
cmp r8, 0x201
jae 0x140147020
mov esi, 0x200
lea r12, [rsp + 0x98]
mov r13, r8
jmp 0x14014704b
sub r8, r15
sub rbx, r15
cmp rbx, r8
jb 0x1401470a9
cmp r14, rdi
mov r15d, 0xffffffff
cmovb r15, r14
mov qword [rsp + 0x40], r15
mov rbx, r14
mov rsi, r15
mov r12, qword [rsp + 0x48]
mov r13, r15
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, r12
mov edx, r13d
call sub.KERNEL32.dll_GetWindowsDirectoryW
mov ebp, eax
test eax, eax
jne 0x140147070
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x140147163
mov r8d, ebp
cmp r13, r8
jne 0x140146ff0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x14014721c
add r13, r13
cmp r13, rdi
cmovae r13, rdi
mov r8, r13
cmp r8, 0x201
jb 0x140146fff
jmp 0x140147020
lea rcx, [rsp + 0x30]
mov rdx, r15
call fcn.140056cf0
mov r14, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
jmp 0x14014702b
cmp rsi, r8
jb 0x14014721c
lea r14, [rsp + 0x60]
mov rcx, r14
mov rdx, r12
call fcn.140154120
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax]
mov r8, qword [rax + 8]
mov rcx, r14
call fcn.140154dc0
mov rax, qword [rsp + 0x58]
cmp byte [rax], 0
jne 0x140147118
lea rdx, [0x141a7acd0]
lea rcx, [rsp + 0x60]
mov r8d, 3
call fcn.140156060
movabs rdi, 0x8000000000000000
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
lea rcx, [rsp + 0x80]
call fcn.1401481b0
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
cmp rsi, rdi
jne 0x14014718c
mov rcx, rdi
mov rdx, rbx
call fcn.1401528f0
mov rax, qword [rsp + 0x28]
mov qword [rax], rdi
jmp 0x1401471d1
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000000
or rax, 1
mov qword [rcx], rax
jmp 0x1401471ec
mov r14, qword [rsp + 0x90]
mov rcx, rbx
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x1401471b3
mov rax, qword [rsp + 0x28]
mov qword [rax], rsi
mov qword [rax + 8], rbx
mov qword [rax + 0x10], r14
jmp 0x1401471d1
mov rax, qword [rsp + 0x28]
mov qword [rax], rdi
test rsi, rsi
je 0x1401471d1
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x60], 0
je 0x1401471ec
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x30], 0
je 0x140147207
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x498
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x140149310
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
cmp qword [rcx], 0
je 0x140149395
mov rax, qword [0x141afc038]
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
cmp eax, 1
jne 0x1401493cc
cmp dword [rsp + 0x2c], 0
je case.0x14014922d.367
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x1401493ce
outsd dx, dword [rsi]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x1401493cc
invalid
mov edi, eax
mov ecx, eax
ud2
mov rcx, rbx
mov edx, 4
Function at 0x140149960
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
movups xmm0, xmmword [0x141a7a3f0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtReadFile
cmp eax, 0x103
jne 0x1401499c3
mov rcx, rsi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x1401499ce
xor edx, edx
jmp 0x1401499de
cmp eax, 0x103
je 0x140149a08
test eax, eax
js 0x1401499e9
mov rdx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0xa0
pop rsi
ret
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa0
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x141a7a450]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x70]
call fcn.140150730
mov rcx, rax
call fcn.1401918e0
mov ecx, 7
int 0x29
ud2

Function at 0x140149a70
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
movups xmm0, xmmword [0x141a7a3f0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x140149ada
mov rcx, rsi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x140149b0d
test eax, eax
js 0x140149aee
mov rdx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0xa0
pop rsi
ret
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa0
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x141a7a450]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x70]
call fcn.140150730
mov rcx, rax
call fcn.1401918e0
mov ecx, 7
int 0x29
ud2
Function at 0x14014a240
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140212110]
test ecx, ecx
je 0x14014a26a
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14014a283
add rax, 8
jmp 0x14014a318
lea rcx, [0x1402120f8]
call fcn.140149310
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14014a261
je 0x14014a316
xor edi, edi
test rsi, rsi
je 0x14014a29f
cmp byte [rsi], 0
mov byte [rsi], 0
movzx eax, byte [rsi + 1]
cmove eax, edi
mov edi, eax
movzx eax, byte [0x141af8129]
mov edx, 0x10
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x14014a340
mov rbx, rax
mov rsi, rax
lea rax, [0x1402120f8]
mov qword [rsi], rax
mov byte [rsi + 8], dil
mov ecx, dword [0x140212110]
test ecx, ecx
je 0x14014a320
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x140212110]
test ecx, ecx
je 0x14014a330
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x14014a311
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, rbx
jmp 0x14014a318
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1402120f8]
call fcn.140149310
mov ecx, eax
jmp 0x14014a2db
lea rcx, [0x1402120f8]
call fcn.140149310
mov ecx, eax
jmp 0x14014a2ef
ud2

Function at 0x14014b320
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rbx, r8
mov r14, rdx
mov rdi, rcx
movzx eax, byte [0x141af8129]
mov edx, 0x10
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x14014b3f0
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x14014b400]
xor ebx, ebx
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call sub.KERNEL32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x14014b3e3
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, qword [rbx]
test rax, rax
je 0x14014b39b
mov rcx, rdi
call rax
cmp qword [rbx + 8], 0
je 0x14014b3be
cmp qword [rbx + 0x10], 0x11
jb 0x14014b3ad
mov rdi, qword [rdi - 8]
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
call sub.KERNEL32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov ebx, 1
mov rax, rbx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
ud2

Function at 0x14014baa0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov ecx, dword [rsp + 0x40]
xor eax, eax
test rcx, rcx
sete al
lea rdx, [0x141a7a5a0]
cmovne rdx, rcx
add rsp, 0x58
ret
Function at 0x14014bae0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov rsi, rcx
mov ecx, dword [0x140212130]
test ecx, ecx
je 0x14014bb0f
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x14014bb28
add rax, 8
jmp 0x14014bbd9
lea rcx, [0x140212118]
call fcn.140149310
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14014bb06
je 0x14014bbd7
test rsi, rsi
je 0x14014bb44
movups xmm6, xmmword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 0
jne 0x14014bb60
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm6, xmmword [rsp + 0x20]
movzx eax, byte [0x141af8129]
mov edx, 0x18
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x14014bc06
mov rbx, rax
mov rsi, rax
lea rax, [0x140212118]
mov qword [rsi], rax
movups xmmword [rsi + 8], xmm6
mov ecx, dword [0x140212130]
test ecx, ecx
je 0x14014bbe6
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [0x140212130]
test ecx, ecx
je 0x14014bbf6
dec ecx
add rbx, 8
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x14014bbd2
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, rbx
jmp 0x14014bbd9
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140212118]
call fcn.140149310
mov ecx, eax
jmp 0x14014bb9c
lea rcx, [0x140212118]
call fcn.140149310
mov ecx, eax
jmp 0x14014bbb0
ud2

Function at 0x14014c410
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor r9d, r9d
cmp r8d, 0x3b9aca00
je 0x14014c46e
mov r9d, 0x3e8
mov rax, rdx
mul r9
mov r9d, 0xffffffff
jo 0x14014c46e
mov edx, r8d
imul rdx, rdx, 0x431bde83
shr rdx, 0x32
add rax, rdx
jb 0x14014c46e
imul edx, edx, 0xf4240
xor r10d, r10d
sub r8d, edx
setne r10b
add rax, r10
jb 0x14014c46e
mov r9d, 0xffffffff
cmp rax, r9
cmovb r9, rax
test r9, r9
je 0x14014c4ae
mov dword [rsp + 0x34], r9d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1006
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x14014c49c
xor eax, eax
add rsp, 0x38
ret
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
lea rax, [0x141a7b1c0]
add rsp, 0x38
ret

Function at 0x14014c4c0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor r9d, r9d
cmp r8d, 0x3b9aca00
je 0x14014c51e
mov r9d, 0x3e8
mov rax, rdx
mul r9
mov r9d, 0xffffffff
jo 0x14014c51e
mov edx, r8d
imul rdx, rdx, 0x431bde83
shr rdx, 0x32
add rax, rdx
jb 0x14014c51e
imul edx, edx, 0xf4240
xor r10d, r10d
sub r8d, edx
setne r10b
add rax, r10
jb 0x14014c51e
mov r9d, 0xffffffff
cmp rax, r9
cmovb r9, rax
test r9, r9
je 0x14014c55e
mov dword [rsp + 0x34], r9d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1005
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x14014c54c
xor eax, eax
add rsp, 0x38
ret
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
lea rax, [0x141a7b1c0]
add rsp, 0x38
ret
Function at 0x140150ee0
Capabilities:
Connect socket

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov eax, 1
test rcx, rcx
jne 0x140150f8d
mov rax, qword [0x141af8100]
cmp rax, 3
jne 0x140150fb3
mov rsi, rdx
movzx ecx, word [rdx]
call fcn.140157f70
test rax, rax
je 0x140150f1c
mov eax, 1
jmp 0x140150f8d
cmp word [rsi], 0
je 0x140150f3e
movups xmm0, xmmword [rsi + 4]
mov eax, dword [rsi + 0x14]
mov r9d, dword [rsi + 0x18]
movzx ecx, word [rsi + 0x1c]
mov r8d, 0x1c
mov r10w, 0x17
jmp 0x140150f53
mov eax, dword [rsi + 2]
movzx ecx, word [rsi + 6]
xorps xmm0, xmm0
mov r8d, 0x10
mov r10w, 2
rol cx, 8
mov word [rsp + 0x2c], r10w
mov word [rsp + 0x2e], cx
mov dword [rsp + 0x30], eax
movups xmmword [rsp + 0x34], xmm0
mov dword [rsp + 0x44], r9d
lea rax, [rsp + 0x2c]
mov rsi, rdx
mov rcx, rdx
mov rdx, rax
call sub.ws2_32.dll_connect
cmp eax, 0xffffffff
je 0x140150f94
xor eax, eax
mov rdx, rsi
add rsp, 0x48
pop rdi
pop rsi
ret
call sub.ws2_32.dll_WSAGetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rcx, rsi
call sub.ws2_32.dll_closesocket
mov rdx, rdi
jmp 0x140150f15
mov rsi, rdx
call fcn.140156380
mov rdx, rsi
jmp 0x140150f05

Function at 0x140150fd0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
sub rsp, 0xc0
mov rax, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x28], pe_nt_image_headers64
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x28]
mov rcx, rax
call sub.ws2_32.dll_getsockname
cmp eax, 0xffffffff
je 0x140151076
mov eax, dword [rsp + 0x28]
movzx ecx, word [rsp + 0x40]
cmp ecx, 0x17
je 0x140151085
cmp ecx, 2
jne 0x1401510d1
cmp eax, 0xf
jbe 0x1401510ea
movzx eax, word [rsp + 0x42]
rol ax, 8
mov ecx, dword [rsp + 0x44]
mov word [rsi], 0
mov word [rsi + 6], ax
mov dword [rsi + 2], ecx
add rsp, 0xc0
pop rsi
ret
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
jmp 0x1401510d8
cmp eax, 0x1b
jbe 0x1401510ea
movzx eax, word [rsp + 0x42]
rol ax, 8
mov ecx, dword [rsp + 0x44]
mov edx, dword [rsp + 0x58]
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsp + 0x30], xmm0
mov word [rsi], 1
movups xmm0, xmmword [rsp + 0x2e]
movups xmmword [rsi + 2], xmm0
movzx r8d, word [rsp + 0x3e]
mov word [rsi + 0x12], r8w
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x18], edx
mov word [rsi + 0x1c], ax
add rsp, 0xc0
pop rsi
ret
lea rax, [0x141a7ab08]
mov qword [rsi + 8], rax
mov word [rsi], 2
add rsp, 0xc0
pop rsi
ret
ud2
Function at 0x1401525c0
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov r14, r8
inc r14
sete bpl
je 0x1401527f9
js 0x1401527f9
mov rbx, r9
mov r15, r8
mov r12, rdx
mov rsi, rcx
movzx eax, byte [0x141af8129]
xor ecx, ecx
mov rdx, r14
call fcn.140146820
test rax, rax
je 0x1401527f9
mov rdi, rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0
test bpl, bpl
jne 0x1401527db
xor r14d, r14d
lea rcx, [rdi + r14]
mov rdx, r12
mov r8, r15
call sub.msvcrt.dll_memcpy
add r14, r15
mov qword [rsp + 0x38], r14
lea rax, [r12 + 7]
and rax, 0xfffffffffffffff8
sub rax, r12
jne 0x1401526a0
lea rcx, [r15 - 0x10]
xor eax, eax
movdqa xmm0, xmmword [0x14021a4d0]
movabs rdx, 0x8080808080808080
nop dword [rax]
movdqu xmm1, xmmword [r12 + rax]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r8, xmm2
test r8, rdx
jne 0x1401526c8
add rax, 0x10
cmp rax, rcx
jbe 0x140152670
jmp 0x1401526c8
cmp rax, r15
cmovae rax, r15
xor ecx, ecx
nop dword [rax]
cmp byte [r12 + rcx], 0
je 0x140152707
inc rcx
cmp rax, rcx
jne 0x1401526b0
lea rcx, [r15 - 0x10]
cmp rax, rcx
jbe 0x140152657
cmp rax, r15
je 0x1401526df
nop dword [rax]
cmp byte [r12 + rax], 0
je 0x140152707
inc rax
cmp r15, rax
jne 0x1401526d0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
movdqu xmm0, xmmword [rsp + 0x28]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.1400344b0
mov rdi, rax
mov r14, rdx
jmp 0x14015271f
mov rax, qword [rsp + 0x28]
movabs rcx, 0x8000000000000000
cmp rax, rcx
jne 0x1401527b5
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x40]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x140152772
call sub.ws2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x140152787
mov rcx, qword [rbx]
mov rax, qword [rsp + 0x28]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rdi], 0
test r14, r14
je 0x1401527cc
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rdi
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sub.KERNEL32.dll_HeapFree
lea rcx, [0x141a7ac10]
mov qword [rsi + 8], rcx
mov qword [rsi], 1
test rax, rax
jne 0x140152796
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rsp + 0x28]
xor edx, edx
mov r8, r15
call fcn.1400342f0
mov rdi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
jmp 0x14015262c
ud2
Function at 0x140152800
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, r9
mov rbx, r8
mov rdi, rcx
mov rax, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, r9
mov rdx, rax
call fcn.140154dc0
cmp byte [rbx], 0
jne 0x140152842
lea rdx, [0x141a7acd0]
mov r8d, 3
mov rcx, rsi
call fcn.140156060
movabs rbx, 0x8000000000000000
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x20]
call fcn.1401481b0
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
cmp r15, rbx
jne 0x14015287d
mov rcx, rbx
mov rdx, r14
call fcn.1401528f0
mov qword [rdi], rbx
jmp 0x1401528b5
mov r12, qword [rsp + 0x30]
mov rcx, r14
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x14015289c
mov qword [rdi], r15
mov qword [rdi + 8], r14
mov qword [rdi + 0x10], r12
jmp 0x1401528b5
mov qword [rdi], rbx
test r15, r15
je 0x1401528b5
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, r14
call sub.KERNEL32.dll_HeapFree
cmp qword [rsi], 0
je 0x1401528da
mov r8, qword [rsi + 8]
mov rcx, qword [0x141af8068]
xor edx, edx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140154810
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
movzx r9d, byte [rdx + 0x38]
movzx r8d, byte [rdx + 0x3a]
test r8b, r8b
setne al
cmp r9b, 1
ja 0x140154892
test r8b, r8b
jne 0x14015486a
movzx esi, byte [rdx + 0x10]
lea r8d, [rsi - 5]
cmp r8b, 1
clc
add dword [rdi + 0x2e], esi
xor eax, eax
xor r8d, r8d
Function at 0x140157f70
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
test cx, cx
mov eax, 2
mov ebx, 0x17
cmove ebx, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
xor edi, edi
mov ecx, ebx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140158043
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2739
je 0x140157fcd
mov esi, eax
cmp eax, 0x2726
jne 0x140158036
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x14015802f
mov rsi, rax
xor edi, edi
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
jne 0x140158043
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov rcx, rsi
call sub.ws2_32.dll_closesocket
mov edi, 1
mov rsi, rbx
jmp 0x140158043
call sub.ws2_32.dll_WSAGetLastError
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov edi, 1
mov rax, rdi
mov rdx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x1401632c0
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1a8
mov rsi, rcx
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 8
mov qword [rsp + 0x30], 0
test rax, rax
je 0x14016354a
mov rdi, rax
mov qword [rsp + 0x70], rsi
lea rcx, [rsp + 0xa4]
mov r8d, 0x104
xor edx, edx
call sub.msvcrt.dll_memset
mov qword [rsp + 0x78], 0x130
mov dword [rsp + 0x80], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x94], xmm0
lea rdx, [rsp + 0x78]
mov rcx, rdi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14016353d
lea r14, [rsp + 0x38]
jmp 0x1401633ab
mov rax, qword [rsp + 0x28]
mov rcx, rsi
shl rcx, 5
mov dword [rax + rcx], ebp
mov qword [rax + rcx + 8], r13
mov qword [rax + rcx + 0x10], rbx
mov qword [rax + rcx + 0x18], r12
inc rsi
mov qword [rsp + 0x30], rsi
mov rcx, rdi
lea rdx, [rsp + 0x78]
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x14016353d
movzx ebx, byte [rsp + 0xa4]
test bl, bl
je 0x140163460
movzx eax, byte [0x141af8129]
mov edx, 8
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x140163578
mov byte [rax], bl
mov qword [rsp + 0x38], 8
mov qword [rsp + 0x40], rax
xor ebx, ebx
jmp 0x1401633f8
mov byte [rax + rbx + 1], bpl
mov rbx, rsi
lea rsi, [rbx + 1]
mov qword [rsp + 0x48], rsi
cmp rbx, 0x103
je 0x140163440
movzx ebp, byte [rsp + rbx + 0xa5]
test bpl, bpl
je 0x140163440
cmp rsi, qword [rsp + 0x38]
jne 0x1401633f0
mov r8d, 1
mov rcx, r14
mov rdx, rsi
call fcn.140106b90
mov rax, qword [rsp + 0x40]
jmp 0x1401633f0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rsp + 0x38]
movaps xmmword [rsp + 0x50], xmm0
jmp 0x14016347b
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x60], 0
lea rcx, [rsp + 0x50]
call fcn.1400344b0
mov rsi, rax
mov r15, rdx
lea r8, [rdx - 1]
mov rcx, r14
mov rdx, rax
call fcn.1400348f0
mov r13, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
movabs rax, 0x8000000000000000
cmp r13, rax
jne 0x1401634fe
test r12, r12
je 0x1401634e5
js 0x140163578
movzx eax, byte [0x141af8129]
xor ecx, ecx
mov rdx, r12
call fcn.140146820
test rax, rax
je 0x140163578
mov rbp, rax
mov r13, r12
jmp 0x1401634ed
mov ebp, 1
xor r13d, r13d
mov rcx, rbp
mov rdx, rbx
mov r8, r12
call sub.msvcrt.dll_memcpy
mov rbx, rbp
mov byte [rsi], 0
test r15, r15
je 0x140163517
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov ebp, dword [rsp + 0x80]
mov rsi, qword [rsp + 0x30]
cmp rsi, qword [rsp + 0x20]
jne 0x140163370
lea rcx, [rsp + 0x20]
call fcn.140106ea0
jmp 0x140163370
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
mov rsi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x10], rax
mov rax, qword [rsp + 0x20]
mov qword [rsi], rax
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
add rsp, 0x1a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2