joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800654e0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
cmp rdi, 0x40000000
jbe 0x180065520
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x180086b28]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x18006555e
cmp rsi, r14
jb 0x180065556
cmp rsi, r15
jae 0x180065556
cmp qword [rsi + 8], 0
jne 0x180065727
mov rsi, qword [rsi]
test rsi, rsi
jne 0x180065541
mov qword [rsp + 0xa0], rbx
mov rbx, rdi
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb0], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x1800655f2
nop dword [rax]
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x1800655e9
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800655e9
cmp dword [rsp + 0x70], 0x10000
je 0x18006566b
mov rbx, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x1800655e9
sub rbx, rbp
cmp rbx, r14
jae 0x1800655b0
test rsi, rsi
jne 0x1800656d0
cmp rdi, r15
ja 0x18006570f
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x18006570f
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18006570f
cmp dword [rsp + 0x70], 0x10000
je 0x1800656a1
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x68]
add rdi, qword [rsp + 0x50]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x180065622
jmp 0x18006570f
test rbx, rbx
je 0x1800655e9
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1800656d0
cmp rbx, r14
jae 0x180065590
jmp 0x1800655f2
test rdi, rdi
je 0x18006570f
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1800656d0
cmp rdi, r15
jbe 0x180065600
jmp 0x18006570f
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x1800656e0
mov rax, qword [0x180086b28]
mov qword [rsi], rax
mov qword [0x180086b28], rsi
mov r12, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rax, rsi
mov rsi, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
ret
Function at 0x140140b10
Capabilities:
Encode data using xor

Disassembly:
push r9
mov r9d, 0x163bd207
jmp 0x14016398d
add r9, 0xc
mov qword [rsp + 8], 0x7c1f051c
xor eax, eax
dec word [rsp + 8]
or dword [rsp + 0xc], 0xc99cc01b
test r8, r8
lea rsp, [rsp + 0x10]
je 0x1401639ef
jmp 0x14013d8f8
push 0x68055622
not eax
mov dword [r9], eax
push 0xfffffffffd9abe80
lea rsp, [rsp + 0x10]
jmp fcn.14014f498
movzx edx, r9w
lea rdx, [0x140162568]
movzx r9d, byte [rcx]
push 0xfffffffffb335722
xor r9d, eax
and r9d, 0xff
mov r9d, dword [rdx + r9*4]
shr eax, 8
xor eax, r9d
and dword [rsp + 4], 0x99a7351a
inc rcx
xor eax, 0x3fbd2836
dec r8
push 0xffffffffd5a1a102
lea rsp, [rsp + 0x10]
jne 0x140163998
mov r9d, 0x3c0dcc1f
lea r9, [r9 + r9*8 + 0x46ae8a96]
lea r9, [r9 - 0x72c4c049]
pop r9
jmp 0x14015a25c
Function at 0x140002920
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10d, dword [0x1400d5360]
lea rsi, [0x140000000]
xor r10d, dword [rcx + 4]
mov ebx, 2
mov eax, dword [rcx + 8]
mov r11, rcx
lea edi, [rbx + 6]
nop
mov ecx, r10d
shr rcx, 0x10
movzx edx, cl
mov ecx, r10d
shr rcx, 0x18
mov r9d, dword [rsi + rdx*4 + 0xd5b90]
add r9d, dword [rsi + rcx*4 + 0xd5790]
mov ecx, r10d
shr rcx, 8
movzx edx, cl
movzx ecx, r10b
xor r9d, dword [rsi + rdx*4 + 0xd6390]
add r9d, dword [rsi + rcx*4 + 0xd5f90]
lea ecx, [rbx - 1]
xor r9d, dword [rsi + rcx*4 + 0xd5360]
xor eax, r9d
mov ecx, eax
shr rcx, 0x10
movzx edx, cl
mov ecx, eax
shr rcx, 0x18
mov r8d, dword [rsi + rdx*4 + 0xd5b90]
add r8d, dword [rsi + rcx*4 + 0xd5790]
mov ecx, eax
shr rcx, 8
movzx edx, cl
movzx ecx, al
xor r8d, dword [rsi + rdx*4 + 0xd6390]
add r8d, dword [rsi + rcx*4 + 0xd5f90]
mov ecx, ebx
add ebx, 2
xor r8d, dword [rsi + rcx*4 + 0xd5360]
xor r10d, r8d
sub rdi, 1
jne 0x140002950
xor eax, dword [0x1400d53a4]
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov dword [r11 + 4], eax
mov dword [r11 + 8], r10d
ret
Function at 0x140004700
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140004722
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14000479c
mov rdi, r14
mov rcx, rbx
call fcn.140005b20
test rax, rax
jle 0x140004774
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.140073570
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000478c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x140004794
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140004736
sub r14, rdi
jmp 0x14000487f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400047b3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400047b5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400047e7
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140073570
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000487c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140004822
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000485d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400799a0
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14000487c
cmp rbp, rax
ja 0x140004830
test rbp, rbp
je 0x14000487c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400799a0
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140007b90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1400d4700]
xor rax, rsp
mov qword [rbp + 0x80], rax
movzx ebx, r8b
mov rdi, rcx
lea rcx, [0x1400c6c08]
call fcn.14007f4e0
movdqa xmm0, xmmword [0x1400c7340]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400c7380]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [0x1400c7360]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x1400c78a0]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [0x1400c73a0]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x1400c7390]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [0x1400c7810]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1400c7700]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x1400c73b0]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1400c76f0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1400c76e0]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1400c7850]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [0x1400c7860]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1400c7370]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [0x1400c7320]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x1400c7870]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm0, xmmword [0x1400c7330]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400c7830]
movdqa xmmword [rbp + 0x30], xmm1
movdqa xmm0, xmmword [0x1400c7730]
movdqa xmmword [rbp + 0x40], xmm0
mov dword [rbp + 0x50], 0x7e650763
mov dword [rbp + 0x54], 0x7f667107
mov dword [rbp + 0x58], 0x2d6368
xor edx, edx
mov eax, edx
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rsp + 0x20]
xor byte [rsp + rax + 0x21], cl
movzx ecx, byte [rsp + 0x20]
xor byte [rsp + rax + 0x22], cl
add rax, 2
cmp rax, 0x13a
jb 0x140007cf0
mov byte [rbp + 0x5b], dl
mov qword [rbp + 0x60], rdx
mov qword [rbp + 0x70], rdx
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
lea rax, [rsp + 0x21]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], dl
jne 0x140007d30
lea rdx, [rsp + 0x21]
lea rcx, [rbp + 0x60]
call fcn.140002f40
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae rdx, qword [rbp + 0x60]
mov r8, qword [rbp + 0x70]
call fcn.140009f20
lea rdx, [0x1400c6c0c]
mov rcx, rax
call fcn.140006f00
mov rcx, rax
mov rdx, rdi
call fcn.140006f00
mov rcx, rax
call fcn.140009c90
test bl, bl
je 0x140007d89
call fcn.14007a288
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x140007dc1
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007dbb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007de5
call fcn.140071270
nop
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140071250
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.140078124
int3
Function at 0x14000a1f0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1400d4700]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x4c]
mov r9, rbx
sub r9, rdx
movzx r8d, byte [rdx]
movzx ecx, byte [rdx + r9]
sub r8d, ecx
jne 0x14000a256
inc rdx
test ecx, ecx
jne 0x14000a241
test r8d, r8d
je 0x14000a297
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14000a2ba
lea rax, [rsp + 0x4c]
mov r8, rbx
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14000a293
inc rax
test ecx, ecx
jne 0x14000a280
test edx, edx
jne 0x14000a260
mov al, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140071250
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
xor al, al
jmp 0x14000a299
Function at 0x14000c580
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1400d4700]
xor rax, rsp
mov qword [rbp + 0x80], rax
movzx ebx, r8b
mov rdi, rcx
test dl, dl
je 0x14000c5c2
lea rcx, [0x1400c6c08]
call fcn.14007f4e0
movdqa xmm0, xmmword [0x1400c7510]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400c7540]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [0x1400c74e0]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x1400c7610]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [0x1400c7530]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x1400c7520]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [0x1400c75f0]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1400c77b0]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x1400c75b0]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1400c7790]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1400c77a0]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1400c7640]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [0x1400c7660]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1400c7550]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [0x1400c7500]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x1400c7650]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm0, xmmword [0x1400c74f0]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400c75c0]
movdqa xmmword [rbp + 0x30], xmm1
movdqa xmm0, xmmword [0x1400c7690]
movdqa xmmword [rbp + 0x40], xmm0
mov dword [rbp + 0x50], 0x49523054
mov dword [rbp + 0x54], 0x48514630
mov dword [rbp + 0x58], 0x1a545f
xor edx, edx
mov ecx, edx
nop dword [rax + rax]
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x22], al
add rcx, 2
cmp rcx, 0x13a
jb 0x14000c6e0
mov byte [rbp + 0x5b], dl
mov qword [rbp + 0x60], rdx
mov qword [rbp + 0x70], rdx
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
lea rax, [rsp + 0x21]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], dl
jne 0x14000c720
lea rdx, [rsp + 0x21]
lea rcx, [rbp + 0x60]
call fcn.140002f40
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae rdx, qword [rbp + 0x60]
mov r8, qword [rbp + 0x70]
call fcn.140009f20
lea rdx, [0x1400c6c0c]
mov rcx, rax
call fcn.140006f00
mov rcx, rax
mov rdx, rdi
call fcn.140006f00
test bl, bl
je 0x14000c771
call fcn.14007a288
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x14000c7a9
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c7a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c7cd
call fcn.140071270
nop
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140071250
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.140078124
int3
Function at 0x1400193d0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400194b2
call fcn.140030e60
test al, al
jne 0x1400194b2
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x140019402
mov r8, rdi
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov rcx, rbx
call fcn.14003bea0
test rax, rax
je 0x140019447
sub rax, rbx
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov r8, rax
mov rcx, rbx
call fcn.14003bea0
mov rsi, rax
test rax, rax
je 0x140019447
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x14001947b
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.14002c500
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x140019460
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14002a060
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, [0x1400aaa30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x14002a08a
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.LoadLibraryExA
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1400aaa50]
mov rcx, rbx
mov r14, rax
call fcn.1400822a0
test rax, rax
je 0x14002a0ed
mov rcx, rbx
test r14, r14
je 0x14002a0d7
xor edx, edx
lea r8d, [rdx + 8]
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test r14, r14
je 0x14002a125
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002a125
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x14002a1e8
mov qword [rsp + 0x40], rsi
mov rsi, 0xffffffffffffffff
mov rdx, rsi
nop
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x14002a150
lea ecx, [rax + 1]
add rcx, rdx
call qword [section..data]
mov rdi, rax
test rax, rax
je 0x14002a1da
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x14002a1da
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x14002a180
mov ecx, 0x5c
mov word [rax + rdi], cx
inc rsi
cmp byte [rdi + rsi], bpl
jne 0x14002a194
mov rcx, rdi
sub rcx, rbx
add rcx, rsi
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x14002a1b0
mov rcx, rdi
test r14, r14
je 0x14002a1d1
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x14002a1d7
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [fcn.14007957c]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x14003c630
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
movaps xmmword [rsp + 0x50], xmm6
lea rcx, [rsp + 0x30]
mov rdi, rdx
call fcn.1400197c0
mov rcx, rbx
movups xmm6, xmmword [rax]
call case.0x14001a82b.2
mov rcx, rdi
mov rsi, rax
call case.0x14001a82b.2
mov r8d, 1
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x14003c6e0
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.1400197c0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
call fcn.140019850
cmp rax, 0x3e8
ja 0x14003c711
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x14003c690
test rsi, rsi
je 0x14003c6ed
mov rcx, rsi
call fcn.14007957c
test rbx, rbx
je 0x14003c6fa
mov rcx, rbx
call fcn.14007957c
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
test rsi, rsi
je 0x14003c71e
mov rcx, rsi
call fcn.14007957c
test rbx, rbx
je 0x14003c72b
mov rcx, rbx
call fcn.14007957c
mov eax, 1
jmp 0x14003c6fc
Function at 0x14003cc90
Capabilities:
Resolve dns

Disassembly:
push rdi
push r12
push r13
push r15
sub rsp, 0x28
mov r13, r9
xor edi, edi
mov qword [r9], rdi
xor r15d, r15d
lea r9, [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r12d, eax
test eax, eax
jne 0x14003ce2e
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x14003ce0e
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x20], r14
nop
mov rax, qword [rsi + 0x18]
test rax, rax
je 0x14003ccfe
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x14003ccf0
inc rbx
jmp 0x14003cd00
xor ebx, ebx
mov eax, dword [rsi + 4]
cmp eax, 2
jne 0x14003cd0d
lea ebp, [rax + 0xe]
jmp 0x14003cd19
cmp eax, 0x17
jne 0x14003cdb1
lea ebp, [rax + 5]
cmp qword [rsi + 0x20], 0
je 0x14003cdb1
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x14003cdb1
cmp rax, rbp
jb 0x14003cdb1
lea rcx, [rbp + 0x30]
add rcx, rbx
call qword [section..data]
mov r14, rax
test rax, rax
je 0x14003cdc0
mov ecx, dword [rsi]
mov r8, rbp
mov dword [rax], ecx
mov ecx, dword [rsi + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rsi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rsi + 0xc]
mov dword [rax + 0xc], ecx
lea rcx, [r14 + 0x30]
mov dword [rax + 0x10], ebp
xor eax, eax
mov qword [r14 + 0x18], rax
mov qword [r14 + 0x28], rax
mov qword [r14 + 0x20], rcx
mov rdx, qword [rsi + 0x20]
call fcn.140073570
test rbx, rbx
je 0x14003cd9e
mov rcx, qword [r14 + 0x20]
mov r8, rbx
add rcx, rbp
mov qword [r14 + 0x18], rcx
mov rdx, qword [rsi + 0x18]
call fcn.140073570
test rdi, rdi
cmove rdi, r14
test r15, r15
je 0x14003cdae
mov qword [r15 + 0x28], r14
mov r15, r14
mov rsi, qword [rsi + 0x28]
test rsi, rsi
jne 0x14003cce0
jmp 0x14003cdc6
mov r12d, 8
mov rcx, qword [rsp + 0x68]
mov r14, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x58]
test rcx, rcx
je 0x14003cde0
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r12d, r12d
je 0x14003ce09
test rdi, rdi
je 0x14003ce05
nop word [rax + rax]
mov rbx, qword [rdi + 0x28]
mov rcx, rdi
call qword [fcn.14007957c]
mov rdi, rbx
test rbx, rbx
jne 0x14003cdf0
xor edi, edi
jmp 0x14003ce1d
test rdi, rdi
jne 0x14003ce1d
mov r12d, 0x2af9
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rsi, qword [rsp + 0x60]
mov eax, r12d
mov rbx, qword [rsp + 0x50]
mov qword [r13], rdi
add rsp, 0x28
pop r15
pop r13
pop r12
pop rdi
ret
Function at 0x14003d330
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbx, rdx
mov edx, Ordinal_45
mov rsi, r8
mov rbp, rcx
test r8, r8
je 0x14003d3fb
xor r14d, r14d
nop dword [rax]
mov edi, 4
lea rdx, [rsp + 0x50]
cmp rsi, rdi
mov r8d, 4
mov rcx, rbp
cmovb rdi, rsi
call fcn.1400204e0
cmp eax, 4
jne 0x14003d3ac
cmp byte [0x1400d700c], r14b
jne 0x14003d3b8
lea r9d, [rax - 2]
mov dword [rsp + 0x50], r14d
mov r8d, eax
lea rdx, [rsp + 0x50]
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
mov edx, eax
test eax, eax
jne 0x14003d3fd
mov eax, dword [rsp + 0x50]
jmp 0x14003d3d7
imul eax, dword [0x1400d7008], 0x41c64e6d
mov edx, r14d
add eax, 0x3039
mov dword [0x1400d7008], eax
rol eax, 0x10
mov dword [rsp + 0x50], eax
test rdi, rdi
je 0x14003d3f2
sub rsi, rdi
nop
mov byte [rbx], al
inc rbx
shr eax, 8
sub rdi, 1
jne 0x14003d3e0
mov dword [rsp + 0x50], eax
test rsi, rsi
jne 0x14003d360
mov eax, edx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x14003d410
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
sub rdi, 1
je 0x14003d4b2
xor ebp, ebp
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
nop
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400204e0
cmp eax, 4
jne 0x14003d47e
cmp byte [0x1400d700c], bpl
jne 0x14003d4ca
lea r9d, [rax - 2]
mov dword [rsp + 0x50], ebp
mov r8d, eax
lea rdx, [rsp + 0x50]
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
jne 0x14003d4e9
mov eax, ebp
test eax, eax
jne 0x14003d4b7
mov ecx, dword [rsp + 0x50]
cmp ecx, 0xfffffffc
jae 0x14003d440
mov eax, 0x8421085
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
imul eax, eax, 0x3e
sub ecx, eax
movzx eax, byte [rcx + r14]
mov byte [rsi], al
inc rsi
sub rdi, 1
jne 0x14003d440
mov byte [rsi], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
imul ecx, dword [0x1400d7008], 0x41c64e6d
add ecx, 0x3039
mov dword [0x1400d7008], ecx
rol ecx, 0x10
mov dword [rsp + 0x50], ecx
jmp 0x14003d486
mov eax, 2
jmp 0x14003d4b7