joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c7239
Capabilities:
Get system information on windows

Disassembly:
jmp 0x14020e080
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1a8]
mov rax, qword [0x14044aff8]
xor rax, rbp
mov qword [rbp + 0x158], rax
mov dword [rbp + 0x144], 0
lea rcx, [0x14046c692]
call fcn.1400c9dfe
mov qword [rbp + 8], 0x1008
mov dword [rbp + 0x24], 0xc0000004
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x14020e124
xor edx, edx
mov rcx, qword [rbp + 0x180]
call fcn.1400c7770
mov eax, dword [rbp + 0x144]
or eax, 1
mov dword [rbp + 0x144], eax
mov rax, qword [rbp + 0x180]
jmp 0x14020e1cd
jmp 0x14020e131
mov rax, qword [rbp + 8]
shl rax, 1
mov qword [rbp + 8], rax
cmp dword [rbp + 0x24], 0xc0000004
jne 0x14020e183
xor r9d, r9d
mov r8d, dword [rbp + 8]
mov rdx, qword [rbp + 0x48]
mov ecx, dword [rbp + 0x188]
call fcn.1400c8e18
mov dword [rbp + 0x24], eax
mov eax, 2
mul qword [rbp + 8]
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rdx, rax
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ucrtbased.dll_realloc]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x14020e181
jmp 0x14020e183
jmp 0x14020e126
mov edx, 8
lea rcx, [rbp + 0x68]
call fcn.1400c6fb9
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x68]
call fcn.1400c8ce2
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp + 0x180]
call fcn.1400c6163
mov eax, dword [rbp + 0x144]
or eax, 1
mov dword [rbp + 0x144], eax
lea rcx, [rbp + 0x68]
call fcn.1400c6d98
mov rax, qword [rbp + 0x180]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.d2d1.dll_Ordinal_1
call fcn.1400c9386
mov rax, rdi
mov rcx, qword [rbp + 0x158]
xor rcx, rbp
call fcn.1400c7dba
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x1400c7bb7
Capabilities:
Delete service

Disassembly:
jmp 0x140220c50
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x248
lea rbp, [rsp + 0x20]
lea rcx, reloc.d2d1.dll_Ordinal_1
call fcn.1400c9dfe
call fcn.1400c7455
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x140220c8f
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x140220cdf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x104], eax
lea rax, [rbp + 0x124]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x148]
lea rcx, [rbp + 0x124]
call fcn.1402201a0
mov rcx, rax
call fcn.1400c95f7
lea rdx, [rbp + 0x104]
mov rcx, rax
call fcn.1400c8990
xor al, al
jmp 0x140220daa
mov rcx, qword [rbp + 0x240]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140220d86
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0x430
jne 0x140220d17
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
jmp 0x140220daa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x194], eax
lea rax, [rbp + 0x1b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp + 0x1b4]
call fcn.140220280
mov rcx, rax
call fcn.1400c85a8
lea rdx, [rbp + 0x194]
mov rcx, rax
call fcn.1400c8990
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, byte [rbp + 0x248]
test eax, eax
je 0x140220d82
mov rcx, qword [rbp + 0x240]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x140220daa
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, byte [rbp + 0x250]
test eax, eax
je 0x140220da8
mov rcx, qword [rbp + 0x240]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
lea rsp, [rbp + 0x228]
pop rdi
pop rbp
ret
Function at 0x1400c82b0
Capabilities:
Terminate process

Disassembly:
jmp 0x140251930
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400c8396
Capabilities:
Stop service

Disassembly:
jmp 0x140221150
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x268
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x62
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x288]
mov rax, qword [0x14044aff8]
xor rax, rbp
mov qword [rbp + 0x238], rax
lea rcx, reloc.d2d1.dll_Ordinal_1
call fcn.1400c9dfe
call fcn.1400c7455
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x1402211b0
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x1402211fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x124], eax
lea rax, [rbp + 0x144]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x168]
lea rcx, [rbp + 0x144]
call fcn.140220210
mov rcx, rax
call fcn.1400c95f7
lea rdx, [rbp + 0x124]
mov rcx, rax
call fcn.1400c8990
xor al, al
jmp 0x14022127a
lea r8, [rbp + 0x28]
mov edx, 1
mov rcx, qword [rbp + 0x260]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14022126e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x1b4], eax
lea rax, [rbp + 0x1d4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1f8]
lea rcx, [rbp + 0x1d4]
call fcn.1402202f0
mov rcx, rax
call fcn.1400c6cd0
lea rdx, [rbp + 0x1b4]
mov rcx, rax
call fcn.1400c8990
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x14022127a
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.d2d1.dll_Ordinal_1
call fcn.1400c9386
mov rax, rdi
mov rcx, qword [rbp + 0x238]
xor rcx, rbp
call fcn.1400c7dba
lea rsp, [rbp + 0x248]
pop rdi
pop rbp
ret

Function at 0x1400c877e
Capabilities:
Write file on windows

Disassembly:
jmp 0x140102060
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, reloc.d2d1.dll_Ordinal_1
call fcn.1400c9dfe
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fwrite]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1400c87d8
Capabilities:
Get geographical location

Disassembly:
jmp 0x14024cf40
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14024cf7d
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.1400c9dd6
add rsp, 0x58
ret

Function at 0x1400c8977
Capabilities:
Read file on windows

Disassembly:
jmp 0x140101ff0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, reloc.d2d1.dll_Ordinal_1
call fcn.1400c9dfe
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1400c898b
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x140102cf0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, reloc.d2d1.dll_Ordinal_1
call fcn.1400c9dfe
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x140262e00]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x140102e35
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x140102d89
mov dword [rbp + 0x160], 1
jmp 0x140102d93
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x140102e30
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x140102e0a
cmp qword [rbp + 0x198], 2
jb 0x140102e0a
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140102e0a
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140102e0a
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x140102d54
jmp 0x140102ecf
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x140102ecf
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x140102ea6
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140102ea6
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140102ea6
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x140102e35
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400c8aa8
Capabilities:
Enumerate processes

Disassembly:
jmp 0x14020fb00
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x278
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x66
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x298]
mov rax, qword [0x14044aff8]
xor rax, rbp
mov qword [rbp + 0x248], rax
lea rcx, reloc.d2d1.dll_Ordinal_1
call fcn.1400c9dfe
mov dword [rbp + 4], 0
xor edx, edx
mov ecx, 2
call fcn.1400c7d1a
mov qword [rbp + 0x28], rax
mov r8d, 0x130
xor edx, edx
lea rcx, [rbp + 0x50]
call fcn.1400c8e95
mov dword [rbp + 0x50], 0x130
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.1400c931d
test eax, eax
je 0x14020fbb6
mov rdx, qword [rbp + 0x270]
lea rcx, [rbp + 0x7c]
call fcn.1400ca43e
test eax, eax
jne 0x14020fba5
mov eax, dword [rbp + 0x58]
mov dword [rbp + 4], eax
jmp 0x14020fbb6
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.1400c9e4e
test eax, eax
jne 0x14020fb89
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, reloc.d2d1.dll_Ordinal_1
call fcn.1400c9386
mov eax, edi
mov rcx, qword [rbp + 0x248]
xor rcx, rbp
call fcn.1400c7dba
lea rsp, [rbp + 0x258]
pop rdi
pop rbp
ret

Function at 0x1400c8b20
Capabilities:
Parse pe header

Disassembly:
jmp 0x140253b50
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140253b70
xor al, al
jmp 0x140253bf1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140253b83
xor al, al
jmp 0x140253bf1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140253bad
xor al, al
jmp 0x140253bf1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140253bc1
xor al, al
jmp 0x140253bf1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140253bd3
xor al, al
jmp 0x140253bf1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140253bef
xor al, al
jmp 0x140253bf1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400c98e5
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
jmp 0x14020f640
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x218
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x4e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x238]
mov rax, qword [0x14044aff8]
xor rax, rbp
mov qword [rbp + 0x1e8], rax
lea rcx, reloc.d2d1.dll_Ordinal_1
call fcn.1400c9dfe
mov qword [rbp + 8], 0
mov dword [rbp + 0x24], 0
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 8]
mov ecx, 0xb
call fcn.1400c8e18
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0xc0000004
jne 0x14020f704
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rbp + 0x24]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 8], rax
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 8]
mov ecx, 0xb
call fcn.1400c8e18
mov dword [rbp + 0x44], eax
jmp 0x14020f6b1
cmp dword [rbp + 0x44], 0
jge 0x14020f723
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x14020f84c
mov rax, qword [rbp + 8]
mov qword [rbp + 0x68], rax
mov dword [rbp + 0x84], 0
jmp 0x14020f745
mov eax, dword [rbp + 0x84]
inc eax
mov dword [rbp + 0x84], eax
mov rax, qword [rbp + 0x68]
mov eax, dword [rax]
cmp dword [rbp + 0x84], eax
jae 0x14020f838
mov eax, dword [rbp + 0x84]
imul rax, rax, 0x128
mov rcx, qword [rbp + 0x68]
lea rax, [rcx + rax + 8]
mov ecx, dword [rbp + 0x84]
imul rcx, rcx, 0x128
mov rdx, qword [rbp + 0x68]
movzx ecx, word [rdx + rcx + 0x2e]
lea rax, [rax + rcx + 0x28]
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.1400c7c07
mov rcx, qword [rbp + 0x210]
call fcn.1400c65aa
mov qword [rbp + 0x1d8], rax
lea rcx, [rbp + 0xa8]
call fcn.1400c65aa
mov qword [rbp + 0x1e0], rax
mov rdx, qword [rbp + 0x1d8]
mov rcx, qword [rbp + 0x1e0]
call qword [sym.imp.ucrtbased.dll__stricmp]
test eax, eax
jne 0x14020f827
mov eax, dword [rbp + 0x84]
imul rax, rax, 0x128
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx + rax + 0x18]
mov qword [rbp + 0xe8], rax
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x1c8], rax
lea rcx, [rbp + 0xa8]
call fcn.1400c6b4f
mov rax, qword [rbp + 0x1c8]
jmp 0x14020f84c
lea rcx, [rbp + 0xa8]
call fcn.1400c6b4f
jmp 0x14020f737
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402ad2e0]
call fcn.1400c9386
mov rax, rdi
mov rcx, qword [rbp + 0x1e8]
xor rcx, rbp
call fcn.1400c7dba
lea rsp, [rbp + 0x1f8]
pop rdi
pop rbp
ret
Function at 0x1400c9985
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x140102bd0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, reloc.d2d1.dll_Ordinal_1
call fcn.1400c9dfe
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x140262e00]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x140102c4f
mov dword [rbp + 0x120], 1
jmp 0x140102c59
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x140102ca2
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x140102c1a
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x1400c9d5e
Capabilities:
Write file on windows

Disassembly:
jmp 0x140212350
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x14044aff8]
xor rax, rbp
mov qword [rbp + 0x1a8], rax
lea rcx, [0x14046c7bb]
call fcn.1400c9dfe
mov rax, qword [rbp + 0x1d0]
cmp qword [rax + 0x68], 0
je 0x1402123b6
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1402123bd
mov al, 1
jmp 0x14021252f
mov rax, qword [rbp + 0x1d0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x198], rax
call fcn.1400c707c
mov dword [rbp + 0x1a0], eax
mov edx, dword [rbp + 0x1a0]
mov rcx, qword [rbp + 0x1d0]
call qword [rbp + 0x198]
mov dword [rbp + 0x164], eax
call fcn.1400c707c
mov dword [rbp + 0x184], eax
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x184]
call fcn.1400c940d
movzx eax, al
test eax, eax
je 0x140212422
xor al, al
jmp 0x14021252f
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1d0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x198], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1d0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x1a0], eax
cmp dword [rbp + 0x1a0], 0
je 0x140212495
cmp dword [rbp + 0x1a0], 1
je 0x1402124a0
cmp dword [rbp + 0x1a0], 3
je 0x14021251e
jmp 0x14021252d
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x1402124f0
mov rax, qword [rbp + 0x1d0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x1402124f0
xor al, al
jmp 0x14021252f
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14021250b
mov dword [rbp + 0x194], 1
jmp 0x140212515
mov dword [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
jmp 0x14021252f
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14021252f
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1402add80]
call fcn.1400c9386
mov rax, rdi
mov rcx, qword [rbp + 0x1a8]
xor rcx, rbp
call fcn.1400c7dba
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x1400c9d77
Capabilities:
Create thread

Disassembly:
jmp 0x1401ff090
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14044aff8]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14046c528]
call fcn.1400c9dfe
mov edx, 8
lea rcx, [rbp + 8]
call fcn.1400ca02e
mov r8, qword [rbp + 0x140]
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.1400c7ee6
nop
lea rax, [0x1400c96ec]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.1400c7b0d
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x1401ff176
lea rcx, [rbp + 8]
call fcn.1400c9f98
jmp 0x1401ff18f
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1400c6db6
nop
lea rcx, [rbp + 8]
call fcn.1400ca218
lea rcx, [rbp - 0x30]
lea rdx, reloc.d2d1.dll_Ordinal_1
call fcn.1400c9386
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1400c7dba
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret
Function at 0x1004019e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
movabs rax, 0x6e776f6e6b6e753c
mov rbx, rdx
mov qword [rsp + 0x40], rax
mov r12d, ecx
xor edx, edx
mov qword [rsp + 0x50], rax
mov rax, qword [rbx]
xor ecx, ecx
lea rdi, [rsp + 0x40]
mov dword [rsp + 0x48], 0x3e
mov word [rsp + 0x4c], dx
mov byte [rsp + 0x4e], 0
mov dword [rsp + 0x58], 0x3e
mov word [rsp + 0x5c], cx
mov byte [rsp + 0x5e], 0
test rax, rax
je 0x100401ad0
mov r13, qword [rbx + 8]
test r13, r13
je 0x100401ad0
movzx eax, byte [rax + 0x3a]
test al, al
je 0x100401ad0
sub eax, 1
mov r14d, 1
lea rbp, [rsp + 0x50]
lea rax, [rax + rax*8]
lea rsi, [r13 + rax*2 + 0x12]
jmp 0x100401a82
test r14d, r14d
jne 0x100401b40
add r13, 0x12
cmp rsi, r13
je 0x100401ad0
movzx eax, word [r13 + 0x10]
movzx edx, byte [r13 + 0xf]
shr ax, 7
xor eax, 1
and eax, 1
test dl, dl
jne 0x100401a9e
test al, al
jne 0x100401a70
cmp dl, 3
jne 0x100401a79
test al, al
je 0x100401a79
mov rdx, r13
mov r8d, 0xf
mov rcx, rbp
add r13, 0x12
call sym.strncpy
mov byte [rsp + 0x5f], 0
cmp rsi, r13
jne 0x100401a82
nop word cs:[rax + rax]
mov ecx, r12d
call sym.inet_ntoa
mov r8, rdi
lea rcx, str.new_Array___s____s__
mov rdx, rax
call sym.printf
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x100401b60
movzx ecx, byte [rax + 5]
movzx r9d, byte [rax + 2]
movzx r8d, byte [rax + 1]
movzx edx, byte [rax]
mov dword [rsp + 0x30], ecx
movzx ecx, byte [rax + 4]
mov dword [rsp + 0x28], ecx
movzx eax, byte [rax + 3]
lea rcx, str.__02x_02x_02x_02x_02x_02x____n
mov dword [rsp + 0x20], eax
call sym.printf
mov eax, 1
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov r8d, 0xf
mov rdx, r13
mov rcx, rdi
xor r14d, r14d
call sym.strncpy
mov byte [rsp + 0x4f], 0
jmp 0x100401a79
mov ecx, 0xa
call sym.putchar
jmp 0x100401b24