joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140074fd0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [str.Fm_a_]
mov rdi, rax
test rax, rax
jne 0x140075012
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140075059
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400750b2
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x140075070
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400750f3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14008747a]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14008747b]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400750c0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x140075110
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140075194
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x140075194
dec r8
sub rdx, 1
jne 0x14007517a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400763b0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1400769ac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400769f6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400769f6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400769f6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400769f6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400769f6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400769f8
xor al, al
add rsp, 0x28
ret

Function at 0x1400a6550
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1400a657c
xor al, al
jmp 0x1400a66a0
movdqa xmm0, xmmword [0x1400c6ae0]
movdqa xmm1, xmmword [0x1400c6af0]
mov rax, qword [r9]
xor r11d, r11d
mov qword [rsp + 0x50], r12
mov rcx, r8
movdqa xmmword [rsp], xmm0
movdqa xmm0, xmmword [0x1400c6b00]
movdqa xmmword [rsp + 0x10], xmm1
lea r12, [r8 + rax]
mov edx, r11d
movdqa xmm1, xmmword [0x1400c6b10]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm1
test rbx, rbx
je 0x1400a6692
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1400a65f9
mov r11d, 2
jmp 0x1400a661d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1400a6613
mov r11d, 1
jmp 0x1400a661d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, r12
ja 0x1400a66b5
mov eax, r10d
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov eax, r10d
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1400a665a
mov byte [rcx + 2], 0x3d
jmp 0x1400a666a
shr r10, 6
and r10d, 0x3f
movzx eax, byte [rsp + r10]
mov byte [rcx + 2], al
add rcx, 3
add r8, 3
test r11, r11
je 0x1400a667c
mov byte [rcx], 0x3d
jmp 0x1400a6683
movzx eax, byte [rsp + r9]
mov byte [rcx], al
inc rcx
inc r8
cmp rdx, rbx
jb 0x1400a65e0
sub rcx, rsi
mov al, 1
mov qword [rbp], rcx
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor al, al
jmp 0x1400a669b

Function at 0x1400a8f30
Capabilities:
Execute command
Self delete
Set registry value

Disassembly:
sub r11b, 0x46
or r11, 0x59871673
neg r11b
add qword [rsp + 8], 0xffffffffbfe67bcd
movzx r13, r11b
mov r11, qword [rsp + 0x28]
movabs r13, 0x34286c320242287d
or r13d, 0x3ae60a71
lea r13, [r13 + r13*4 + 0x4ca14d2e]
js 0x1400066b5
movabs r13, 0x4e0652d1435d5163
not r13d
setl r13b
call fcn.14025ee6a

Function at 0x1400b555a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not word [rsp + 0x48]
jb 0x14033a064
call fcn.1402d0e00

Function at 0x140137d03
Capabilities:
Set socket configuration

Disassembly:
or rax, rax
sub byte [rsp + 8], 0x55
mov rax, qword [rsp + 0x18]
mov rax, qword [rax]
call fcn.14009e6ba
Function at 0x140137d1d
Capabilities:
Set socket configuration

Disassembly:
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret
add qword [rsp + 0x38], 0xffffffffbfd1545d
lea rdx, [rdx + 0x33fc0275]
mov qword [rsp + 0x28], r8
xor word [rsp + 0x28], r8w
jo 0x14003e07e
cmp r8, qword [rsp + 0x28]
setge bl
xchg qword [rsp + 0x48], rdx
test qword [rsp + 0x28], rbx
seta r10b
xor r10b, byte [rsp + 0x29]
test rbx, r8
mov r10, qword [rsp + 0x30]
call fcn.1402eb11a

Function at 0x14013cdf4
Capabilities:
Delete file
Execute command

Disassembly:
push r15
movabs r15, 0x3a40cd8488a5c78
movabs r15, 0x21c237f1555c3025
call fcn.1402dbc23
not dword [rsp + 0x18]
setge byte [rsp + 0x18]
add word [rsp + 0x18], 0x6cf2
mov r11, qword [rsp + 0x10]
not byte [rsp + 0x38]
movabs r15, 0x4a8622fb220f272b
mov rcx, qword [rsp + 0x38]
call fcn.140307b7f

Function at 0x14014bebe
Capabilities:
Encode data using xor

Disassembly:
js 0x140200adb
add qword [rsp + 0x40], 0xffffffffbfcfda94
not byte [rsp + 0x30]
add qword [rsp + 0x38], 0xffffffffffe5ce6d
sub ebx, r12d
setle byte [rsp + 0x30]
mov rax, rbx
jns 0x140390b21
mov r10, rax
xor r10, qword [rsp + 0x30]
seta byte [rsp + 0x30]
mov r14, r10
or rax, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x38], rbx
call fcn.14009ee36

Function at 0x14014ccfc
Capabilities:
Delete file
Execute command

Disassembly:
ja 0x1403072b7
call fcn.1402f44d0
cmp esi, 0x61eb09d9
add qword [rsp + 0x20], 0x19e46a
call fcn.1400b6e54
mov word [rsp + 0x48], 0x1606
call fcn.1401c5784

Function at 0x14014d33b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jg 0x14031c07d
mov qword [rsp + 0x50], 0x1d265574
add qword [rsp + 0x10], 0xffffffffbfcd0eaf
sub rsi, r10
xor r13w, si
mov r13, qword [rsp + 0xc8]
jle 0x140132d3b

Function at 0x14014d35d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r13, qword [rsp + 0x70]
js 0x140362990
jl fcn.1401d4b8e
and word [rsp + 0x88], 0x1884
test byte [rsp + 0xa5], dl
call fcn.1403750a9
lea rbx, [rbx*8 + 0x53a45c74]
neg rbx
mov rbx, qword [rsp + 8]
call fcn.1400b0aac
movabs r13, 0x41682203591d07fd
call fcn.1401cf893
pushfq
movabs rbp, 0x6d357f257a112db
call fcn.1401a6c18

Function at 0x14015bb23
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.140256808
mov r12, qword [rsp]
call fcn.14028422e

Function at 0x14015bb32
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jbe 0x140255d64
push r11
call fcn.1401708d0
mov rdi, qword [rsp + 8]
mov qword [rsp + 8], 0xcb0fee6
push r8
call fcn.1400b1fb0

Function at 0x14016418a
Capabilities:
Send data
Send data on socket

Disassembly:
ja fcn.14029bbb9
mov rdi, r15
mov r11, rdi
mov r11, qword [rsp + 0x18]
or ebx, 0x44e96e92
xor bpl, 6
jge 0x140185c66
Function at 0x14018a31b
Capabilities:
Move file

Disassembly:
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.1400439e0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
call fcn.140043a70
cmp rax, 0x3e8
ja 0x14004e892
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x14004e830
xor eax, eax
mov rbx, qword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
mov rbx, qword [rsp + 0x70]
mov eax, 1
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
push rdx
lea rdx, [rdx + 1]
neg rdi
sub edi, 0x10151ba1
add di, 0x711e
mov qword [rsp + rdi*8 - 0x3408e8a0], rdx
neg di
or di, di
jg 0x14004e876
call fcn.14038b5f7

Function at 0x14018c968
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfq
add qword [rsp + 8], 0x26b518
mov rbp, qword [rsp + 0x18]
call fcn.1402ccc40

Function at 0x140195db0
Capabilities:
Get session user name

Disassembly:
movabs rax, 0xe88105a4059216b
not ax
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
lea rax, [rax + 0x722c56a2]
mov qword [rsp + 0x10], 0x349071c7
test word [rsp + 0x10], 0x37d7
push r11
call fcn.140335d23

Function at 0x1401abed3
Capabilities:
Encode data using xor

Disassembly:
setl bpl
mov rdi, qword [rsp + 0x30]
not bp
or ebp, 0x7e284315
sub ebp, dword [rsp + 0x98]
sub edx, 0x6ce42fb8
mov r9, rdx
cmp qword [rsp + 0x98], 0x44704f68
mov rbp, qword [rsp + 0xa0]
call fcn.140370158
xchg qword [rsp + 0x38], rbp
call fcn.1403867b0

Function at 0x1401bd5a0
Capabilities:
Encode data using xor

Disassembly:
mov r14b, 0x54
not r14
call fcn.14029b444
add byte [rdi], 0x22
xor esp, dword [rdi + 0x3c]
push rbx
jno 0x1401bd5ab
invalid
push rsp
and al, 8
test dword [rsp + 8], 0x34a75f4a
mov qword [rsp + 0x28], r12
lea rsi, [rsi + rcx + 0x4742f61f]
setno byte [rsp + 8]
movabs rcx, 0x4acf330378f260b2
cmovs ecx, dword [rsp + 0xa]
sub qword [rsp + 8], 0x139a38c6
xchg qword [rsp + 0x58], rsi
push rsi
push r15
or byte [rsp + 0x38], 1
push 0x27b0835
add qword [rsp + 0x28], 0xffffffffbfd0047c
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x20]
call fcn.14034b683
Function at 0x1401c6cf0
Capabilities:
Execute command
Self delete
Set registry value

Disassembly:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplications___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftRADARHeapLeakDetectionDiagnosedApplications_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__APPDATA_MicrosoftWindowsRecent.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__APPDATA_MicrosoftWindowsRecentCustomDestinations.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__APPDATA_MicrosoftWindowsRecentAutomaticDestinations.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Panther.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot__appcompatPrograms.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot__appcompatPrograms.xml
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot__appcompatProgramsInstall.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.pf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.ini
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.7db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.ebd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.bin
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Prefetch.db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_PrefetchReadyBoot.fx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__f__q__systemroot_Minidump.
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140075b80
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop rbp
ret
setno byte [rsp + 0x30]
jg 0x140006710
cmp r10w, r11w
mov r11, qword [rsp + 0x78]
not dword [rsp + 0x10]
mov dil, byte [rsp + 0x4b]
call fcn.1402fd751
clc
jl 0x1401c6d61
invalid
shl dword [rcx], 0x65
ret
Function at 0x1401cb8d8
Capabilities:
Encode data using xor

Disassembly:
lea rdi, [r11*8 + 0x3ba26db7]
cmovle r15d, dword [rsp + 0x32]
lea r15, [r11*8 + 0x5b565937]
or r11b, byte [rsp + 0x31]
mov r10, qword [rsp + 0x30]
seto r13b
mov rdi, qword [rsp + 0x88]
lea r13, [r13*4 + 0x49f07736]
test r11d, r10d
movabs r13, 0x6c394a773bda070a
ja 0x140210ab6
push rdi
push r15
call fcn.1402e17fe
lea r13, [r13 + 0x52b963a9]
mov di, 0x2934
xchg qword [rsp + 0x90], rsi
jns 0x140174fd2
movzx r10w, r10w
and r13w, r10w
movsx r15, r15b
mov r11, qword [rsp + 0x70]
call fcn.1401e398a

Function at 0x1401cf24b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not r14
mov qword [rsp + 0x20], r12
movzx r12d, bx
push rcx
cmp bx, r12w
lea rax, [rax + rbx - 0x44437d3f]
call fcn.140335942

Function at 0x1401dc855
Capabilities:
Execute command
Self delete
Set registry value

Disassembly:
sets r12b
neg r12d
mov r12w, 0x32ae
mov r12d, 0x5cf95851
ja 0x140385e44
lea r12, [r12*8 + 0x3bbe545c]
add qword [rsp], 0x8064d
xor r12b, 0xca
push 0x3e460d5a
movabs rax, 0x5f054bde67517e71
cmp byte [rsp], 0xec
mov r12w, word [rsp]
mov rax, qword [rsp + 8]
mov rax, qword [rax]
call fcn.14024a2f5

Function at 0x1401dd7f5
Capabilities:
Encode data using xor

Disassembly:
xor ecx, dword [rax + rcx*2 - 0x39]
and al, 0x20
add dword [rdx + 4], 0x8544660e
and al, 0x28
not r8w
not qword [rsp + 0x20]
call fcn.14025a5a5
and qword [rsp + 0xa8], 0x3f4f3d62
sub r11d, 0x7363321e
seta r11b
xor qword [rsp + 0x50], r11
add qword [rsp + 0xa8], r11
mov r11, qword [rsp + 0xc0]
call fcn.140287e18
cld
cmp sil, spl
mov ebx, 0xd7c59e59
jno 0x1401dd7d6
invalid

Function at 0x14021f803
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add qword [rsp + 8], 0x163b9
call fcn.1401174f8
pop rdi
call fcn.140102e19

Function at 0x1402375e9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x40]
call fcn.14047d025

Function at 0x14023761d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and byte [rsp + 0x28], 0x55
mov word [rsp + 0x50], 0x7a64
jo 0x14037526f
add qword [rsp + 0x18], 0xffffffffbfea0932
call fcn.1400a3c7a
push rax
push rbx
push r10
call fcn.1401e6ca1
call fcn.1403053dc
mov qword [rsp + 0x10], rcx
mov qword [rsp + 8], 0x60b37ca6
cmp dword [rsp + 8], 0x6edf4b1f
sete byte [rsp + 8]
call fcn.14014d4bb
mov rbx, qword [rsp + 0x18]
mov rbx, qword [rbx]
test rcx, 0xc985b80
je 0x1401611fb
cmp r10b, 0xc5
jle 0x1400a05e3
lea rbx, [rbx + 0x5a036609]
mov qword [rsp + 0x18], r10
call fcn.14029d165
mov r13, qword [rsp + 0x30]
mov qword [rsp + 0x68], rdi
push rdi
bswap rbp
lea rsi, [rsi + 0x266553c]
cmp r13w, di
not r8d
call fcn.1402ed675
Function at 0x14025f671
Capabilities:
Encode data using xor

Disassembly:
cmp r9w, word [rsp + 0x16]
mov r9, qword [rsp + 0x58]
seto r12b
not dx
xor qword [rsp + 0x88], 0x7b940572
call fcn.1401217c2
pop rbx
add ebp, ebx
setae byte [r9 + 0xee70972]
jbe 0x14025f677
xchg esp, eax
xor ah, byte [rcx + rbp*8 + 0x59a0508b]
nop
cmp edi, dword [rsp + rdx*4 + 0x39348816]
movsq qword [rdi], qword [rsi]
imul ebp, dword [rdx + 0x4bf6ca5f], 0x7f
scasb al, byte [rdi]
mov dword [rdi - 0x78], ebp
rcr dword [rdi + rbx], 1
mov cl, 0xcc
xchg esp, eax
invalid

Function at 0x140267193
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rbp, qword [rsp + 0x38]
sub r9b, 0x40
mov r8, qword [rsp + 0x40]
ja 0x1400a7f51
call fcn.14016525a

Function at 0x140269949
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r15, qword [rsp + 0x70]
call fcn.14010a8fb
mov r9, rbp
mov r9b, 0x58
xor r9, 0x7922136f
setne bpl
add qword [rsp], 0x35cb6
neg bpl
movabs rcx, 0x110067b4d1964d3
call fcn.14017f591
xchg qword [rsp + r8*2 - 0x561f2e76], rbp
mov qword [rsp + 0x20], r8
push rdi
push rbx
push r11
call fcn.1400b42e3

Function at 0x1402802fa
Capabilities:
Delete file
Execute command

Disassembly:
movabs rdx, 0x148f35ae356d310d
call 0x140139733
mov rdi, qword [rsp]
call fcn.14030ea16

Function at 0x14028035c
Capabilities:
Delete file
Execute command

Disassembly:
jg 0x140312e59
not qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
call fcn.1402dd6e3
Function at 0x1402a6c6d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add word [rsp + 0x88], 0xc3f
mov r15, qword [rsp + 0x38]
neg qword [rsp + 0x88]
call fcn.1401d6a1c
jl 0x1401df5fc
mov rdx, qword [rsp + 0x10]
xor r13, 0x702151b2
not r13d
neg r13w
lea r13, [r13 + r13*4 + 0x6dad2d4a]
setae r13b
mov r13, qword [rsp]
call fcn.1401ecb4d

Function at 0x1402c2a4c
Capabilities:
Send data
Send data on socket

Disassembly:
jb 0x140146d57
mov rdx, qword [rsp + 0x10]
jl 0x14019e9ee
jae 0x140305e4f

Function at 0x1402c2ac2
Capabilities:
Send data
Send data on socket

Disassembly:
and qword [rsp + 0x80], 0x130e2639
setbe dil
neg byte [rsp + 0x80]
mov edi, dword [rsp + 0x80]
mov rdi, qword [rsp + 0x60]
test qword [rsp + 0x18], 0x16161405
jg 0x1403049ed
setle byte [rsp + 0x80]
setl byte [rsp + 0x80]
push qword [rsp + 0x70]
popfq
lea rsp, [rsp + 0x88]
ret
neg byte [rsp + 0x18]
test word [rsp + 0x80], 0xc8e
jne 0x1402d9e86

Function at 0x1402c3d18
Capabilities:
Send data
Send data on socket

Disassembly:
call qword [sym.imp.WS2_32.dll_send]
movsxd rdi, eax
mov dword [r14], r13d
cmp rdi, 0xffffffffffffffff
jne 0x14003d004
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x14003cfd0
mov dword [r14], 0x51
mov rax, r13
jmp 0x14003d007
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov ecx, ebx
call fcn.140026a80
mov rcx, qword [rsi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.14003c930
mov rcx, qword [rsi]
mov dword [rcx + 0x11b0], ebx
mov dword [r14], Ordinal_60
mov rax, rdi
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140075b80
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
test qword [rsp + 0x30], 0x5d0d3d62
jbe 0x14003cfa3
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x40]
ret

Function at 0x1402d1051
Capabilities:
Encode data using xor

Disassembly:
lea rcx, [rbp*2 + 0x739a3ad1]
xor dword [rsp + 0x10], 0x5fce7cdc
mov qword [rsp + 8], rbp
lea rdi, [rdi + rbp + 0x46e8493f]
add byte [rsp + 8], 0xc7
call fcn.1401668bb
mov rdx, qword [rsp + 0xb0]
bswap r11
jle 0x14034905b
call fcn.1402c1182
push rdx
push rsi
pushfq
movabs rsi, 0x79564a6473073669
cmp rsi, 0x1f312880
mov si, 0x1790
push r10
not sil
mov rdx, qword [rsp + 0x20]
push r11
mov r10, rsi
movabs r11, 0x4ba6197f1ce87741
lea r11, [rsi + 0x785a17bc]
lea rdx, [rdx + 1]
call fcn.1401e3a23
sub eax, 0x4c04572e
mov r12b, 0x41
jae 0x1401c707c
cmove ecx, ebp
jno 0x14019759b
movabs r8, 0x6e94756656bc0e4b
push rcx
movabs rcx, 0x6d5667400f762f67
lea rcx, [rcx + rcx*8 + 0x3acd6321]

Function at 0x1402daf33
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.14029ea64
bswap rdi
jo 0x140177e30
add qword [rsp + 0x40], 0xffffffffffe70c6f
mov qword [rsp + 0x10], r8
add qword [rsp + 8], 0xffffffffbfdfe4ab
add r8b, 1
movabs rbp, 0x528835400cad621b
mov rdi, qword [rsp + 0x40]
mov rdi, qword [rdi]
neg rbp
mov qword [rsp + 0x40], r8
bswap r8
jl 0x14025cdab
Function at 0x1402e263d
Capabilities:
Encode data using xor

Disassembly:
jg 0x14030b339
neg word [rsp + 0x30]
not r9
call fcn.1400a9140
pop rax
push r13
movabs r13, 0x1c2426597a5f55cc
call fcn.1401fa439
jno 0x1402da119
not r8d
lea rbp, [rbp + r8 - 0x66ec555b]
call fcn.140287853

Function at 0x1402eb28e
Capabilities:
Send data
Send data on socket

Disassembly:
cmovle edi, ebp
mov rbp, qword [rsp + 0x38]
sub word [rsp + 0x30], 0x619a
mov r8, rdi
movsx r8w, r8w
and dword [rsp + 0x30], 0xefc2938
mov r8, qword [rsp + 8]
sub byte [rsp + 0x18], dil
call fcn.140141052

Function at 0x1402eb2bc
Capabilities:
Send data
Send data on socket

Disassembly:
lea rbx, [rbx + rdx - 0x8122448]
push rdi
push r10
movabs rdi, 0x2887790b1d0556ba
or dx, dx
cmp edi, edx
push rdi
mov qword [rsp + rdx*4 - 0x204890e4], rbx
call fcn.14035f2c4

Function at 0x1402eb2e4
Capabilities:
Send data
Send data on socket

Disassembly:
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140060bd8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, r15
mov r8d, eax
call fcn.14003c930
lea r9, [rbx + 4]
mov edx, 0x3e
lea r8, [rbp + 0x52]
mov rcx, r15
call fcn.1400601b0
mov rcx, qword [rbp + 0x850]
xor rcx, rsp
call fcn.140075b80
add rsp, 0x960
pop r15
pop r13
pop r12
pop rbx
pop rbp
ret
je 0x140060bb6
lea rax, [rax + 0x34ad7ca8]
neg r13b
push r9
neg r13b
xchg qword [rsp + 0x40], rax
call fcn.14015bbd1
and word [rsp + 0x30], 0x6260
and ax, ax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x28], 0x236a6b54
movabs r13, 0x73775e0e1b561746
movzx r13w, r13b
jge 0x1402c831b

Function at 0x1402f8909
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x2b]
or r8d, edx
lea rsi, [rsi + 0x6a6443b]
jb 0x14002564b
setns byte [rsp + 0x28]
jl fcn.14016d9d5
and dl, 0xa8
test edx, edx
xchg qword [rsp + 0x58], rsi
jl 0x1402ef0cc
add r8b, dl
push r12
push rbx
mov rdx, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
bswap r12d
not r8d
xor r12, 0x33207cda
mov r12, qword [rsp + 8]
or r8w, r8w
call fcn.1402468aa

Function at 0x1402fcf71
Capabilities:
Send data
Send data on socket

Disassembly:
cmp dword [rsp + 0x50], 0x7c4b335d
call fcn.1401bbdab

Function at 0x1402ff3de
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov dword [rsp + 0x50], r15d
call fcn.14015f625

Function at 0x140304a01
Capabilities:
Send data
Send data on socket

Disassembly:
mov r8, qword [rsp + 0x28]
js 0x14029bbbe
call fcn.1403750e4
je 0x140145758
add r8w, 0x714a
push r9
mov rsi, qword [rsp + 0x38]
mov rsi, qword [rsi]
call fcn.1402b4953
insd dword [rdi], dx
add byte [rbp - 0x31], al
cmp eax, 0xcf184549
rol dl, 1
xchg dword [rbp + 0x346d7230], ecx
iretq

Function at 0x1403072c3
Capabilities:
Delete file
Execute command

Disassembly:
mov byte [rsp + 0x88], 0x9c
xor qword [rsp + 0x80], 0x4e1c1f7f
sub word [rsp + 0x48], 0xb0a
call fcn.14035c040