joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014950
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
xor r8d, r8d
mov r10, rdx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140014ade
movdqa xmm5, xmmword [0x140129e60]
lea rax, [r10 + 0x19]
lea rdx, [rcx + 0x19]
cmp rcx, rax
ja 0x140014985
cmp rdx, r10
jae 0x140014ade
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm0, xmmword [0x14012c530]
lea r9, [rcx + 4]
movdqa xmm4, xmmword [0x14012c320]
mov rdx, r10
movdqa xmm6, xmmword [str.::::]
sub rdx, rcx
movdqa xmmword [rsp], xmm0
mov r11d, dword [rsp]
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea r9, [r9 + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
mov eax, r8d
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140129e90]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r11d
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [r9 - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r11d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140129e90]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 8]
xorps xmm2, xmm0
movd dword [r9 - 8], xmm2
cmp r8d, 0x18
jl 0x1400149c0
movaps xmm6, xmmword [rsp + 0x10]
cmp eax, 0x1a
jge 0x140014b29
movsxd r9, r8d
add r9, rcx
sub r10, rcx
nop word [rax + rax]
mov eax, 0x8d3dcb09
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x30
xor al, byte [r9 + r10 - 1]
mov byte [r9 - 1], al
cmp r8d, 0x1a
jl 0x140014af0
add rsp, 0x28
ret
Function at 0x140014b30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
xor r8d, r8d
mov r10, rdx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140014cbe
movdqa xmm5, xmmword [0x140129e60]
lea rax, [r10 + 0x31]
lea rdx, [rcx + 0x31]
cmp rcx, rax
ja 0x140014b65
cmp rdx, r10
jae 0x140014cbe
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm0, xmmword [0x14012c530]
lea r9, [rcx + 4]
movdqa xmm4, xmmword [0x14012c320]
mov rdx, r10
movdqa xmm6, xmmword [str.::::]
sub rdx, rcx
movdqa xmmword [rsp], xmm0
mov r11d, dword [rsp]
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea r9, [r9 + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
mov eax, r8d
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140129e90]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r11d
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [r9 - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r11d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140129e90]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 8]
xorps xmm2, xmm0
movd dword [r9 - 8], xmm2
cmp r8d, 0x30
jl 0x140014ba0
movaps xmm6, xmmword [rsp + 0x10]
cmp eax, 0x32
jge 0x140014d09
movsxd r9, r8d
add r9, rcx
sub r10, rcx
nop word [rax + rax]
mov eax, 0x8d3dcb09
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x30
xor al, byte [r9 + r10 - 1]
mov byte [r9 - 1], al
cmp r8d, 0x32
jl 0x140014cd0
add rsp, 0x28
ret
Function at 0x140015380
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x2b0
mov rax, qword [0x1401864c0]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x24], 0
mov edx, 0x18
call fcn.14000e410
mov rcx, rdi
call fcn.140008680
mov dword [rsp + 0x24], 1
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140015461
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140015461
cmp dword [rsp + 0x68], 0
jne 0x140015410
lea rdx, [rsp + 0x60]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
nop dword [rax]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.140013ca0
mov rcx, rax
call fcn.140013c00
mov rdx, rax
lea rcx, [rsp + 0x8c]
call fcn.1400f1534
test eax, eax
jne 0x140015450
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140015c40
lea rdx, [rsp + 0x60]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140015410
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400e12a0
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x2b0
pop rdi
ret

Function at 0x140015d80
Capabilities:
Create thread

Disassembly:
sub rsp, 0x58
mov qword [0x14018b4b0], rcx
lea rcx, [rsp + 0x30]
call fcn.140008680
mov rdx, rax
lea rcx, [0x14018b4b8]
call fcn.140013b90
lea rcx, [rsp + 0x30]
call fcn.140013b20
xor eax, eax
mov byte [0x14018b4a8], 1
mov qword [rsp + 0x28], rax
lea r8, [0x1400159f0]
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x58
ret

Function at 0x140021920
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rcx
not r8d
test rdx, rdx
je 0x14002195d
lea r10, [0x14012c550]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r10 + rcx*4]
sub rdx, 1
jne 0x140021940
not r8d
mov eax, r8d
ret

Function at 0x140021970
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400219cd
lea rbx, [0x14012c550]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400219b4
cmp r10, 2
jb 0x1400219b4
cmp byte [r9], r8b
jne 0x1400219b4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140021990
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140021a0f
lea rbx, [0x14012c550]
cmp r8b, 0x23
jne 0x1400219f3
cmp byte [r9], r8b
jne 0x1400219f3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400219e0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x14003b570
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
mov r10, rdx
movzx r9d, cx
mov eax, 0x5e6ea9af
shr ecx, 0x10
mul r8d
mov ebx, r8d
mov esi, r8d
shr edx, 0xb
imul eax, edx, 0x15b0
sub ebx, eax
test r8d, r8d
je 0x14003b6bf
mov qword [rsp + 0x20], rdi
xor r11d, r11d
cmp ebx, 7
jbe 0x14003b626
lea edx, [r11 + 7]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r10]
add r11d, 8
add r9d, eax
add edx, 8
movzx eax, byte [r10 + 1]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 2]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 3]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 4]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 5]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 6]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 7]
add ecx, r9d
add r9d, eax
add r10, 8
add ecx, r9d
cmp edx, ebx
jb 0x14003b5c0
xor edx, edx
xor r8d, r8d
cmp r11d, ebx
jae 0x14003b687
mov eax, ebx
sub eax, r11d
cmp eax, 2
jb 0x14003b674
mov eax, ebx
sub eax, r11d
sub eax, 2
shr eax, 1
inc eax
mov edi, eax
lea r11d, [r11 + rax*2]
nop dword [rax]
movzx eax, byte [r10]
add r9d, eax
movzx eax, byte [r10 + 1]
add edx, r9d
add r10, 2
add r9d, eax
add r8d, r9d
sub rdi, 1
jne 0x14003b650
cmp r11d, ebx
jae 0x14003b681
movzx eax, byte [r10]
add r9d, eax
add ecx, r9d
inc r10
lea eax, [r8 + rdx]
add ecx, eax
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
sub esi, ebx
mov ebx, 0x15b0
jne 0x14003b5a7
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
shl ecx, 0x10
lea eax, [r9 + rcx]
pop rsi
ret

Function at 0x140044aa0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
call fcn.1400440d0
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rbx + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x140044ad9
mov dword [rbx + 0x2c], eax
add rsp, 0x20
pop rbx
ret

Function at 0x140045ab0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
Function at 0x14004b0b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
xor r8d, r8d
mov r10, rdx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14004b236
movdqa xmm5, xmmword [0x140129e60]
lea rax, [r10 + 0x11]
lea rdx, [rcx + 0x11]
cmp rcx, rax
ja 0x14004b0e5
cmp rdx, r10
jae 0x14004b236
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm0, xmmword [0x14013d160]
lea r9, [rcx + 4]
movdqa xmm4, xmmword [0x14013d170]
mov rdx, r10
movdqa xmm6, xmmword [str.2222]
sub rdx, rcx
movdqa xmmword [rsp], xmm0
mov r11d, dword [rsp]
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea r9, [r9 + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
mov eax, r8d
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140129e90]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r11d
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [r9 - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r11d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140129e90]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 8]
xorps xmm2, xmm0
movd dword [r9 - 8], xmm2
cmp r8d, 0x10
jl 0x14004b120
movaps xmm6, xmmword [rsp + 0x10]
cmp eax, 0x12
jge 0x14004b276
movsxd r9, r8d
add r9, rcx
sub r10, rcx
nop
mov eax, 0x51eb851f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x34
xor al, byte [r10 + r9 - 1]
mov byte [r9 - 1], al
cmp r8d, 0x12
jl 0x14004b240
add rsp, 0x28
ret
Function at 0x14004b280
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
xor r8d, r8d
mov r10, rdx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14004b406
movdqa xmm5, xmmword [0x140129e60]
lea rax, [r10 + 0x1b]
lea rdx, [rcx + 0x1b]
cmp rcx, rax
ja 0x14004b2b5
cmp rdx, r10
jae 0x14004b406
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm0, xmmword [0x14013d160]
lea r9, [rcx + 4]
movdqa xmm4, xmmword [0x14013d170]
mov rdx, r10
movdqa xmm6, xmmword [str.2222]
sub rdx, rcx
movdqa xmmword [rsp], xmm0
mov r11d, dword [rsp]
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea r9, [r9 + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
mov eax, r8d
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140129e90]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r11d
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [r9 - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r11d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140129e90]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 8]
xorps xmm2, xmm0
movd dword [r9 - 8], xmm2
cmp r8d, 0x18
jl 0x14004b2f0
movaps xmm6, xmmword [rsp + 0x10]
cmp eax, 0x1c
jge 0x14004b446
movsxd r9, r8d
add r9, rcx
sub r10, rcx
nop
mov eax, 0x51eb851f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x34
xor al, byte [r10 + r9 - 1]
mov byte [r9 - 1], al
cmp r8d, 0x1c
jl 0x14004b410
add rsp, 0x28
ret
Function at 0x140064210
Capabilities:
Get common file path
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x1401864c0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
test cl, 2
je 0x140064276
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140064259
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x140064253
shr ax, 8
cmp al, 2
je 0x140064276
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400e12a0
add rsp, 0x1e8
ret
call fcn.140083990
test eax, eax
jne 0x140064490
mov qword [rsp + 0x200], rsi
lea rcx, str.kernel32
mov qword [rsp + 0x208], rdi
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x1400642b6
mov qword [0x1401920b8], rsi
jmp 0x14006444d
mov qword [rsp + 0x1f0], rbx
lea rdx, [0x14013edb0]
mov rcx, rdi
mov qword [rsp + 0x1f8], rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rbx, str.iphlpapi.dll
mov rbp, rax
mov rcx, rbx
lea rdx, [0x14013edc0]
call fcn.1401057e8
test rax, rax
je 0x14006431a
mov rcx, rbx
test rbp, rbp
je 0x14006430c
xor edx, edx
lea r8d, [rdx + 8]
call rbp
mov rsi, rax
jmp 0x14006440c
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
jmp 0x14006440c
test rbp, rbp
je 0x140064349
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140064349
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call rbp
mov rsi, rax
jmp 0x14006440c
xor edx, edx
mov qword [rsp + 0x1e0], r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r14d, eax
test eax, eax
je 0x140064404
lea ecx, [rax + 1]
lea rcx, [rcx*2 + 0x18]
call qword [fcn.1400f1240]
mov rdi, rax
test rax, rax
je 0x1400643fb
mov edx, r14d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400643fb
mov rcx, 0xffffffffffffffff
mov rax, rcx
nop dword [rax]
cmp word [rdi + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x1400643a0
mov dword [rdi + rax*2], 0x5c
cmp word [rdi + rcx*2 + 2], si
lea rcx, [rcx + 1]
jne 0x1400643b2
lea rdx, [rcx + rcx]
sub rdx, rbx
add rdx, rdi
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rdx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x1400643d0
mov rcx, rdi
test rbp, rbp
je 0x1400643f2
xor edx, edx
lea r8d, [rdx + 8]
call rbp
jmp 0x1400643f8
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
mov rcx, rdi
call qword [fcn.1400f122c]
mov r14, qword [rsp + 0x1e0]
mov rbp, qword [rsp + 0x1f8]
mov rbx, qword [rsp + 0x1f0]
mov qword [0x1401920b8], rsi
test rsi, rsi
je 0x14006444d
lea rdx, str.if_nametoindex
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401920b0]
test rax, rax
cmovne rcx, rax
mov qword [0x1401920b0], rcx
xor edx, edx
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.140083540
test al, al
lea rcx, [0x140195508]
setne byte [0x140195500]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rdi, qword [rsp + 0x208]
xor eax, eax
mov rsi, qword [rsp + 0x200]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400e12a0
add rsp, 0x1e8
ret
Function at 0x14006c3b0
Capabilities:
Convert ip address from string

Disassembly:
cmp qword [rsp + 0x28], 0
mov qword [r9], 0
jge 0x14006c3c5
mov eax, 0xfffffffe
ret
mov qword [rsp + 0x28], r9
mov r9b, 1
jmp fcn.14006be90
Function at 0x140075360
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
movaps xmmword [rsp + 0x50], xmm6
lea rcx, [rsp + 0x30]
mov rdi, rdx
call fcn.140055d10
mov rcx, rbx
movups xmm6, xmmword [rax]
call fcn.140073320
mov rcx, rdi
mov rsi, rax
call fcn.140073320
mov r8d, 1
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140075410
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.140055d10
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
call fcn.140055da0
cmp rax, 0x3e8
ja 0x140075441
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1400753c0
test rsi, rsi
je 0x14007541d
mov rcx, rsi
call fcn.1400f122c
test rbx, rbx
je 0x14007542a
mov rcx, rbx
call fcn.1400f122c
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
test rsi, rsi
je 0x14007544e
mov rcx, rsi
call fcn.1400f122c
test rbx, rbx
je 0x14007545b
mov rcx, rbx
call fcn.1400f122c
mov eax, 1
jmp 0x14007542c
Function at 0x1400758a0
Capabilities:
Resolve dns

Disassembly:
push rdi
push r12
push r13
push r15
sub rsp, 0x28
mov r13, r9
xor edi, edi
mov qword [r9], rdi
xor r15d, r15d
lea r9, [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r12d, eax
test eax, eax
jne 0x140075a3e
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x140075a1e
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x20], r14
nop
mov rax, qword [rsi + 0x18]
test rax, rax
je 0x14007590e
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140075900
inc rbx
jmp 0x140075910
xor ebx, ebx
mov eax, dword [rsi + 4]
cmp eax, 2
jne 0x14007591d
lea ebp, [rax + 0xe]
jmp 0x140075929
cmp eax, 0x17
jne 0x1400759c1
lea ebp, [rax + 5]
cmp qword [rsi + 0x20], 0
je 0x1400759c1
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x1400759c1
cmp rax, rbp
jb 0x1400759c1
lea rcx, [rbp + 0x30]
add rcx, rbx
call qword [fcn.1400f1240]
mov r14, rax
test rax, rax
je 0x1400759d0
mov ecx, dword [rsi]
mov r8, rbp
mov dword [rax], ecx
mov ecx, dword [rsi + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rsi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rsi + 0xc]
mov dword [rax + 0xc], ecx
lea rcx, [r14 + 0x30]
mov dword [rax + 0x10], ebp
xor eax, eax
mov qword [r14 + 0x18], rax
mov qword [r14 + 0x28], rax
mov qword [r14 + 0x20], rcx
mov rdx, qword [rsi + 0x20]
call fcn.1401234d0
test rbx, rbx
je 0x1400759ae
mov rcx, qword [r14 + 0x20]
mov r8, rbx
add rcx, rbp
mov qword [r14 + 0x18], rcx
mov rdx, qword [rsi + 0x18]
call fcn.1401234d0
test rdi, rdi
cmove rdi, r14
test r15, r15
je 0x1400759be
mov qword [r15 + 0x28], r14
mov r15, r14
mov rsi, qword [rsi + 0x28]
test rsi, rsi
jne 0x1400758f0
jmp 0x1400759d6
mov r12d, 8
mov rcx, qword [rsp + 0x68]
mov r14, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x58]
test rcx, rcx
je 0x1400759f0
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r12d, r12d
je 0x140075a19
test rdi, rdi
je 0x140075a15
nop word [rax + rax]
mov rbx, qword [rdi + 0x28]
mov rcx, rdi
call qword [fcn.1400f122c]
mov rdi, rbx
test rbx, rbx
jne 0x140075a00
xor edi, edi
jmp 0x140075a2d
test rdi, rdi
jne 0x140075a2d
mov r12d, 0x2af9
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rsi, qword [rsp + 0x60]
mov eax, r12d
mov rbx, qword [rsp + 0x50]
mov qword [r13], rdi
add rsp, 0x28
pop r15
pop r13
pop r12
pop rdi
ret
Function at 0x140075f30
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbx, rdx
mov edx, 0x2b
mov rsi, r8
mov rbp, rcx
test r8, r8
je 0x140075ffb
xor r14d, r14d
nop dword [rax]
mov edi, 4
lea rdx, [rsp + 0x50]
cmp rsi, rdi
mov r8d, 4
mov rcx, rbp
cmovb rdi, rsi
call fcn.14005bcd0
cmp eax, 4
jne 0x140075fac
cmp byte [0x1401920c4], r14b
jne 0x140075fb8
lea r9d, [rax - 2]
mov dword [rsp + 0x50], r14d
mov r8d, eax
lea rdx, [rsp + 0x50]
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
mov edx, eax
test eax, eax
jne 0x140075ffd
mov eax, dword [rsp + 0x50]
jmp 0x140075fd7
imul eax, dword [0x1401920c0], 0x41c64e6d
mov edx, r14d
add eax, 0x3039
mov dword [0x1401920c0], eax
rol eax, 0x10
mov dword [rsp + 0x50], eax
test rdi, rdi
je 0x140075ff2
sub rsi, rdi
nop
mov byte [rbx], al
inc rbx
shr eax, 8
sub rdi, 1
jne 0x140075fe0
mov dword [rsp + 0x50], eax
test rsi, rsi
jne 0x140075f60
mov eax, edx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140076010
Capabilities:
Generate random numbers via winapi

Disassembly:
mov r11, rsp
push rsi
push r12
push r14
push r15
sub rsp, 0xd8
mov rax, qword [0x1401864c0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rax, r8
lea r15, [rsp + 0x30]
and rax, 0xfffffffffffffffe
mov r14, r8
mov rsi, rdx
mov r12, rcx
cmp rax, 0x100
jae 0x1400761bc
test r14b, 1
je 0x1400761bc
mov qword [r11 - 0x28], rbp
dec r14
mov qword [r11 - 0x30], rdi
mov rbp, r14
shr rbp, 1
lea rdi, [rsp + 0x30]
mov qword [r11 + 0x18], rbx
mov ecx, 0x2b
mov qword [r11 - 0x38], r13
je 0x14007613b
xor r13d, r13d
nop word [rax + rax]
mov ebx, 4
lea rdx, [rsp + 0x20]
cmp rbp, rbx
mov r8d, 4
mov rcx, r12
cmovb rbx, rbp
call fcn.14005bcd0
cmp eax, 4
jne 0x1400760dc
cmp byte [0x1401920c4], r13b
jne 0x1400760ec
lea r9d, [rax - 2]
mov dword [rsp + 0x20], r13d
mov r8d, eax
lea rdx, [rsp + 0x20]
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
mov ecx, eax
test eax, eax
jne 0x14007617d
mov eax, dword [rsp + 0x20]
jmp 0x14007610b
imul eax, dword [0x1401920c0], 0x41c64e6d
mov ecx, r13d
add eax, 0x3039
mov dword [0x1401920c0], eax
rol eax, 0x10
mov dword [rsp + 0x20], eax
test rbx, rbx
je 0x140076132
sub rbp, rbx
nop dword [rax]
nop word [rax + rax]
mov byte [rdi], al
inc rdi
shr eax, 8
sub rbx, 1
jne 0x140076120
mov dword [rsp + 0x20], eax
test rbp, rbp
jne 0x140076090
mov eax, ecx
test ecx, ecx
jne 0x14007617d
test r14, r14
je 0x140076178
lea rdx, [0x140143398]
nop dword [rax]
movzx ecx, byte [r15]
lea r15, [r15 + 1]
mov eax, ecx
and ecx, 0xf
shr rax, 4
movzx eax, byte [rax + rdx]
mov byte [rsi], al
movzx eax, byte [rcx + rdx]
mov byte [rsi + 1], al
add rsi, 2
sub r14, 2
jne 0x140076150
mov byte [rsi], 0
xor eax, eax
mov rbx, qword [rsp + 0x110]
mov r13, qword [rsp + 0xc0]
mov rbp, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400e12a0
add rsp, 0xd8
pop r15
pop r14
pop r12
pop rsi
ret
mov eax, 0x2b
jmp 0x14007619d