joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001b660
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Get common file path
Get file attributes
Move file
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x5a0]
sub rsp, 0x6a0
mov rdi, rcx
test rcx, rcx
je 0x14001b8c0
cmp word [rcx], 0
je 0x14001b8c0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001b8c0
mov qword [rsp + 0x6b0], rbx
lea rcx, [rbp + 0x350]
mov qword [rsp + 0x6b8], rsi
xor edx, edx
mov r8d, 0x250
xor sil, sil
call fcn.14014d290
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x208
call fcn.14014d290
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 0x104
call fcn.14003c218
mov r9, 0xffffffffffffffff
lea r8, str..dll
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.14003e19c
lea rdx, [rbp + 0x350]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001b872
nop word [rax + rax]
cmp word [rbp + 0x140], 0
jne 0x14001b760
xor r9d, r9d
lea rax, [rbp + 0x140]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x25]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14001b8b3
mov r9, 0xffffffffffffffff
lea r8, [rbp + 0x140]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.14003c218
mov r9, 0xffffffffffffffff
lea r8, [0x1401b667c]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.14003e19c
mov r9, 0xffffffffffffffff
lea r8, [rbp + 0x37c]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.14003e19c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001b851
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 0x104
mov sil, 1
call fcn.14003c218
mov r9, 0xffffffffffffffff
lea r8, [0x1401b667c]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.14003e19c
mov r9, 0xffffffffffffffff
lea r8, [rbp + 0x37c]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.14003e19c
mov edx, 0x80
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14001b851
xor edx, edx
lea r8d, [rax + 4]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
lea rdx, [rbp + 0x350]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14001b730
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
lea rdi, [rbp + 0x140]
mov ecx, 0x82
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x30]
mov ecx, 0x82
rep stosd dword [rdi], eax
movzx eax, sil
mov rbx, qword [rsp + 0x6b0]
mov rsi, qword [rsp + 0x6b8]
mov rdi, qword [rsp + 0x6c0]
add rsp, 0x6a0
pop rbp
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x14001b892
mov rdi, qword [rsp + 0x6c0]
xor al, al
add rsp, 0x6a0
pop rbp
ret
Function at 0x14001c210
Capabilities:
Check if file exists
Get file attributes
Set registry value

Disassembly:
test rdx, rdx
je 0x14001c472
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
je 0x14001c456
lea rax, [rsp + 0x78]
mov qword [rsp + 0x68], rax
xor r15d, r15d
mov dword [rsp + 0x70], r15d
mov dword [rsp + 0x74], 0x104
mov word [rsp + 0x78], r15w
lea rbx, [0x1401b6698]
mov qword [rsp + 0x60], rbx
mov r9, r8
mov r8, rcx
lea rdx, str._sFonts_s
lea rcx, [rsp + 0x60]
call fcn.140003670
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001c456
movzx eax, byte [rsi + 0x3d70]
test al, al
jne 0x14001c456
lea rax, [rbp + 0x198]
mov qword [rbp + 0x188], rax
mov dword [rbp + 0x190], r15d
mov dword [rbp + 0x194], 0x104
mov word [rbp + 0x198], r15w
mov qword [rbp + 0x180], rbx
mov r8, rdi
lea rdx, str.https:__download.mql5.com_cdn_web_components__s
lea rcx, [rbp + 0x180]
call fcn.140003670
mov rax, qword [rsi + 0x218]
lea rcx, [rsi + 0x218]
call qword [rax + 0x68]
mov rax, qword [rsi + 0x218]
mov rdx, qword [rbp + 0x188]
lea rcx, [rsi + 0x218]
call qword [rax + 0x78]
cmp eax, 0xc8
jne 0x14001c456
mov ebx, r15d
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0x20000
mov qword [rsp + 0x50], r15
lea rdx, [rsi + 0x3d40]
lea rax, [rsp + 0x30]
cmp rdx, rax
je 0x14001c448
mov rbx, qword [rdx]
mov rcx, qword [rdx + 8]
mov rax, qword [rdx + 0x10]
mov qword [rdx], r15
mov qword [rdx + 8], r15
mov qword [rdx + 0x10], r15
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
cmp rcx, 0x4e20
jbe 0x14001c448
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.1400041e0
test al, al
je 0x14001c448
mov rax, 0xffffffffffffffff
nop dword [rax]
lea rax, [rax + 1]
cmp word [rdi + rax*2], 0
jne 0x14001c3b0
lea esi, [rax*2 + 2]
test esi, esi
je 0x14001c427
mov qword [rbp + 0x3c8], r15
lea rax, [rbp + 0x3c8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20106
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionFonts
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c427
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
lea r9d, [rax + 1]
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp + 0x3c8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x3c8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x20], rdi
lea r9, str.value_sunitfile
lea r8, str.Install_Component
xor edx, edx
lea rcx, [0x140214a00]
call fcn.1400595c0
test rbx, rbx
je 0x14001c456
mov rcx, rbx
call fcn.14002e8a8
nop
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14001c480
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test r8, r8
je 0x14001c64d
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov r14, rdx
mov rsi, rcx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x68], rax
xor edi, edi
mov dword [rsp + 0x70], edi
mov dword [rsp + 0x74], 0x104
mov word [rsp + 0x78], di
lea rbx, [0x1401b6698]
mov qword [rsp + 0x60], rbx
mov r9, r8
mov r8, rcx
lea rdx, [0x1401bff50]
lea rcx, [rsp + 0x60]
call fcn.140003670
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001c631
movzx eax, byte [rsi + 0x3d70]
test al, al
jne 0x14001c631
lea rax, [rbp + 0x198]
mov qword [rbp + 0x188], rax
mov dword [rbp + 0x190], edi
mov dword [rbp + 0x194], 0x104
mov word [rbp + 0x198], di
mov qword [rbp + 0x180], rbx
mov r8, r14
lea rdx, str.https:__download.mql5.com_cdn_web_components__s
lea rcx, [rbp + 0x180]
call fcn.140003670
mov rax, qword [rsi + 0x218]
lea rcx, [rsi + 0x218]
call qword [rax + 0x68]
mov rax, qword [rsi + 0x218]
mov rdx, qword [rbp + 0x188]
lea rcx, [rsi + 0x218]
call qword [rax + 0x78]
cmp eax, 0xc8
jne 0x14001c631
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 0x20000
mov qword [rsp + 0x50], rdi
lea rcx, [rsi + 0x3d40]
mov edx, edi
mov ebx, edi
lea rax, [rsp + 0x30]
cmp rcx, rax
je 0x14001c5e6
mov rbx, qword [rcx]
mov rdx, qword [rcx + 8]
mov rax, qword [rcx + 0x10]
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov rdi, rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rax
cmp rdx, 0x186a0
jbe 0x14001c623
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.1400041e0
test al, al
je 0x14001c623
mov qword [rsp + 0x20], r14
lea r9, str.value_sunitfile
lea r8, str.Install_Component
xor edx, edx
lea rcx, [0x140214a00]
call fcn.1400595c0
test rbx, rbx
je 0x14001c631
mov rcx, rdi
call fcn.14002e8a8
nop
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14001e730
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov r15d, r9d
mov rdi, r8
mov r13, rdx
mov rsi, rcx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor r12d, r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x34], 0x200
mov word [rsp + 0x38], r12w
lea rax, [0x1401b7168]
mov qword [rsp + 0x20], rax
mov bl, 1
cmp r9d, 0x80
ja 0x14001e958
mov eax, dword [rcx + 0x10]
cmp eax, 1
jb 0x14001e958
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x14001e958
cmp word [rcx], r12w
je 0x14001e958
cmp eax, 3
jbe 0x14001e958
mov r9, qword [rdx + 8]
mov r8, rcx
lea rdx, [0x1401bff50]
lea rcx, [rsp + 0x20]
call fcn.140003670
lea rdx, [rbp + 0x340]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14001e953
test byte [rbp + 0x340], 0x10
je 0x14001e8cc
movzx edx, word [rbp + 0x36c]
movzx ecx, word [rbp + 0x36e]
cmp dx, 0x2e
jne 0x14001e843
test cx, cx
je 0x14001e931
cmp dx, dx
jne 0x14001e843
cmp cx, dx
jne 0x14001e843
cmp word [rbp + 0x370], 0
je 0x14001e931
lea r9, [rbp + 0x36c]
mov r8, qword [rsi + 8]
lea rdx, [0x1401bff50]
lea rcx, [rsp + 0x20]
call fcn.140003670
mov dword [rbp + 0x5d8], r12d
lea r9d, [r15 + 1]
lea r8, [rbp + 0x5d8]
mov rdx, r13
lea rcx, [rsp + 0x20]
call fcn.14001e730
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x14001e894
inc dword [rdi]
jmp 0x14001e931
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14001e92f
lea edx, [rax + 0x7b]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edx, r12d
test eax, eax
movzx ecx, bl
cmovne edx, ecx
movzx ebx, dl
jmp 0x14001e931
lea r9, [rbp + 0x36c]
mov r8, qword [rsi + 8]
lea rdx, [0x1401bff50]
lea rcx, [rsp + 0x20]
call fcn.140003670
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14001e8fb
inc dword [rdi]
jmp 0x14001e931
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14001e92f
lea edx, [rax + 0x7b]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, r12d
test eax, eax
movzx ecx, bl
cmovne edx, ecx
movzx ebx, dl
jmp 0x14001e931
xor bl, bl
lea rdx, [rbp + 0x340]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14001e801
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
movzx eax, bl
jmp 0x14001e95a
xor al, al
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14001f570
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x28
xor eax, eax
mov qword [rsp + 0x30], rax
test rcx, rcx
je 0x14001f595
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov rax, qword [rsp + 0x30]
shr rax, 0x14
add rsp, 0x28
ret
Function at 0x140024b10
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x30]
mov rbx, rcx
mov dil, 1
cmp rax, 0xffffffffffffffff
je 0x140024b96
mov rcx, qword [rcx + 0x30]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140024b68
mov rcx, rbx
xor dil, dil
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rbx + 0x30]
cmp rax, 0xffffffffffffffff
je 0x140024b5f
mov rcx, qword [rbx + 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbx + 0x30]
cmp rcx, 0xffffffffffffffff
je 0x140024b8d
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x30], 0xffffffffffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x30]
movzx eax, dil
add rsp, 0x20
pop rdi
ret
Function at 0x14002f33c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002f386
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002f386
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002f386
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002f386
cmp dword [rcx + 0x84], 0xe
jbe 0x14002f386
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002f388
xor al, al
add rsp, 0x28
ret

Function at 0x14003e3cc
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x14003e403
call fcn.1400409f4
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.140040884
xor eax, eax
jmp 0x14003e491
mov rdx, r9
mov rcx, r8
call fcn.14003e368
mov rbx, rax
test rax, rax
je 0x14003e48e
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x14003e294]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14003e47b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140040968
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14003e462
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14003e471
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.14004a07c
jmp 0x14003e48e
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14003e48b
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1400413a8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400411a4
Function at 0x14004e720
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1401f3680]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14004e777
cmp word [rdx], r13w
jne 0x14004e777
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14004e77c
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x14004e8a1
mov r11d, recv
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x14004e8c2
lea r9, [rdx + 2]
cmp cx, r11w
je 0x14004e7b5
mov rdx, r9
mov word [rbx], cx
jmp 0x14004e7dc
cmp r9, r8
jae 0x14004e7ec
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14004e796
jmp 0x14004e8a1
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004e896
cmp dword [rsp + 0x80], esi
je 0x14004e896
lea r8, [0x1401f3680]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14004e86e
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14004e83e
mov word [rbx], r13w
jmp 0x14004e89e
mov ecx, recv
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14004e84b
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14004e89e
cmp word [rsp + 0x70], r13w
jne 0x14004e87b
cmp rbx, r14
je 0x14004e838
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14004e67c
cmp word [rsp + 0x70], r13w
je 0x14004e8a1
mov ecx, recv
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1401f3680]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14004e89b
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x14004e8a1
Function at 0x140050284
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14005029a
mov al, 1
jmp 0x1400502fa
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400502ab
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400502f8
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400509ec
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400502f8
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400502f8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400502f8
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400502fa
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140051034
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400510bb
mov rsi, rbx
cmp word [rax], bp
je 0x14005107a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140051064
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140051060
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14004a0b8
mov rdi, rax
test rax, rax
je 0x1400510a8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14014cbf0
mov rbp, rdi
xor ecx, ecx
call fcn.14004a07c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400549a0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400549c8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400549c8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140058870
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0xf50]
mov eax, 0x1050
call fcn.14002ef70
sub rsp, rax
mov r14, r8
mov rdi, rdx
test rdx, rdx
je 0x140058919
lea rcx, [0x140214a00]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140219d00]
test rbx, rbx
je 0x14005890c
nop word [rax + rax]
mov rdx, rdi
mov rcx, rbx
call fcn.14003e590
test eax, eax
jne 0x140058900
mov esi, dword [rbx + 0x8b0]
cmp esi, 1
jb 0x1400588f3
lea rdx, [rbx + 0x8a8]
mov rax, qword [rdx]
test rax, rax
je 0x1400588f3
cmp word [rax], 0
je 0x1400588f3
xor al, al
jmp 0x1400588fc
mov al, 1
lea rdx, [rbx + 0x8a8]
test al, al
je 0x140058933
mov rbx, qword [rbx + 0x18f8]
test rbx, rbx
jne 0x1400588c0
lea rcx, [0x140214a00]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
lea r11, [rsp + 0x1050]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
lea rax, [rsp + 0x48]
mov qword [rsp + 0x1070], r15
xor r15d, r15d
mov qword [rsp + 0x38], rax
lea rax, [0x1401b6668]
mov dword [rsp + 0x40], r15d
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov eax, 0x7ff
mov dword [rsp + 0x44], 0x800
mov word [rsp + 0x48], r15w
cmp byte [rbx + 0x80], r15b
je 0x14005897f
mov rdx, qword [rdx]
jmp 0x14005898c
mov esi, dword [rbx + 0x10c8]
mov rdx, qword [rbx + 0x10c0]
cmp esi, 0x800
cmovae esi, eax
lea rdi, [rsi + rsi]
mov r8, rdi
call fcn.14014cbf0
mov rax, qword [rsp + 0x38]
mov dword [rsp + 0x40], esi
mov word [rdi + rax], r15w
mov byte [rbx + 0x80], r15b
test r14, r14
je 0x140058a91
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400589f1
mov edx, dword [rsp + 0x40]
test edx, edx
je 0x1400589f5
lea rdx, [0x1401b66b4]
call fcn.1400308bc
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x1400589f1
sub rax, rcx
sar rax, 1
test eax, eax
jns 0x140058a3e
mov edx, dword [rsp + 0x40]
test rcx, rcx
je 0x140058a91
lea eax, [rdx + 0xc]
cmp eax, dword [rsp + 0x44]
jae 0x140058a42
movups xmm0, xmmword [str._firstfalse]
mov eax, edx
movups xmmword [rcx + rax*2], xmm0
movsd xmm0, qword [0x1401b5fd0]
movsd qword [rcx + rax*2 + 0x10], xmm0
mov eax, dword [rsp + 0x40]
add eax, 0xc
mov ecx, eax
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x38]
mov word [rax + rcx*2], r15w
mov rcx, qword [rsp + 0x38]
mov edx, dword [rsp + 0x40]
test rcx, rcx
je 0x140058a91
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [r14 + rbx*2], r15w
jne 0x140058a50
test ebx, ebx
je 0x140058a91
lea eax, [rbx + rdx]
cmp eax, dword [rsp + 0x44]
jae 0x140058a91
mov eax, edx
mov rdx, r14
mov r8d, ebx
add r8, r8
lea rcx, [rcx + rax*2]
call fcn.14014cbf0
mov eax, dword [rsp + 0x40]
add eax, ebx
mov dword [rsp + 0x40], eax
mov edx, eax
mov rax, qword [rsp + 0x38]
mov word [rax + rdx*2], r15w
lea rcx, [0x140214a00]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r8, qword [rsp + 0x38]
lea rdx, str.open
xor r9d, r9d
mov dword [rsp + 0x28], 1
xor ecx, ecx
mov qword [rsp + 0x20], r15
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov r15, qword [rsp + 0x1070]
mov al, 1
jmp 0x14005891b
Function at 0x1400616c0
Capabilities:
Resolve dns

Disassembly:
mov r11, rsp
mov dword [r11 + 0x18], r8d
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
push r13
push r14
sub rsp, 0x70
mov r13, r9
mov rax, rdx
test rdx, rdx
je 0x1400618d2
test r9, r9
je 0x1400618d2
mov r14, qword [rsp + 0xb0]
mov ebp, dword [rsp + 0xb8]
cmp dword [r14], ebp
jge 0x1400618d2
mov qword [r11 - 0x30], r12
lea r9, [r11 + 8]
xor r12d, r12d
lea r8, [r11 - 0x68]
mov qword [r11 - 0x68], r12
xorps xmm0, xmm0
xorps xmm1, xmm1
mov dword [rsp + 0x28], 1
xor edx, edx
mov dword [rsp + 0x2c], 6
mov rcx, rax
mov qword [r11 + 8], r12
movdqu xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
test eax, eax
jne 0x1400618c0
mov qword [rsp + 0xa8], rbx
mov rbx, qword [rsp + 0x90]
test rbx, rbx
je 0x1400618b8
mov qword [rsp + 0x50], r15
movzx r15d, word [rsp + 0xc0]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rdi
test r15w, r15w
je 0x140061795
cmp dword [rbx + 4], r15d
jne 0x14006188e
mov eax, dword [rbx + 4]
cmp eax, 0x17
jne 0x140061821
cmp byte [0x14021acd1], 0
je 0x14006188e
mov rsi, qword [rbx + 0x20]
add rsi, 8
mov rax, qword [rsi]
cmp rax, qword [0x1401f3d80]
jne 0x1400617d3
mov rax, qword [rsi + 8]
cmp rax, qword [0x1401f3d88]
je 0x14006188e
movsxd rax, dword [r14]
cmp eax, ebp
jge 0x14006188e
imul rdx, rax, 0x1c
xor eax, eax
mov ecx, 7
add rdx, r13
mov rdi, rdx
rep stosd dword [rdi], eax
lea rdi, [rdx + 8]
mov ecx, 4
rep movsd dword [rdi], dword [rsi]
movzx ecx, word [rsp + 0xa0]
call qword [sym.imp.WS2_32.dll_htons]
movsxd rcx, dword [r14]
imul r8, rcx, 0x1c
add r8, r13
mov word [r8 + 2], ax
mov word [r8], 0x17
jmp 0x14006187b
cmp eax, 2
jne 0x14006188e
mov rsi, qword [rbx + 0x20]
add rsi, 4
cmp dword [rsi], 0
je 0x14006188e
movsxd rax, dword [r14]
cmp eax, ebp
jge 0x14006188e
imul rdx, rax, 0x1c
xor eax, eax
mov ecx, 7
add rdx, r13
mov rdi, rdx
rep stosd dword [rdi], eax
lea rdi, [rdx + 4]
mov ecx, 1
rep movsd dword [rdi], dword [rsi]
movzx ecx, word [rsp + 0xa0]
call qword [sym.imp.WS2_32.dll_htons]
movsxd rcx, dword [r14]
imul r8, rcx, 0x1c
add r8, r13
mov word [r8 + 2], ax
mov word [r8], 2
mov rdx, qword [rsp + 0x98]
call fcn.140061550
inc dword [r14]
inc r12d
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x140061785
mov rcx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_FreeAddrInfoW]
mov rbx, qword [rsp + 0xa8]
mov eax, r12d
mov r12, qword [rsp + 0x58]
add rsp, 0x70
pop r14
pop r13
pop rbp
ret
xor eax, eax
add rsp, 0x70
pop r14
pop r13
pop rbp
ret