joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003c860
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp - 0x61], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14016b140]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, r8
mov r14, rdx
mov rdi, rcx
movdqa xmm0, xmmword [0x14010ba30]
movdqu xmmword [rbp - 9], xmm0
movdqa xmm1, xmmword [str.htable]
movdqu xmmword [rbp + 7], xmm1
movdqa xmm0, xmmword [0x14010ba20]
movdqu xmmword [rbp + 0x17], xmm0
mov dword [rbp + 0x27], 0x72687409
mov dword [rbp + 0x2b], 0x6f687365
mov dword [rbp + 0x2f], 0x7078646c
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], 0x3c
lea r9, [rbp - 9]
mov r8d, 1
lea rdx, str.java.util.Hashtable
call fcn.14003ca50
mov dword [rbp - 0x19], 0x403f
mov dword [rbp - 0x15], 0x5000000
mov dword [rbp - 0x11], 0x877
mov word [rbp - 0xd], 0x700
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x39]
call fcn.140074ec0
nop
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
mov r8, rsi
lea rdx, [rbp - 0x39]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [r14 + 8]
mov byte [rbp - 0x66], cl
mov rax, rcx
shr rax, 8
mov byte [rbp - 0x67], al
mov rax, rcx
shr rax, 0x10
mov byte [rbp - 0x68], al
shr rcx, 0x18
mov byte [rbp - 0x69], cl
mov r8d, 4
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x59]
call fcn.140074ec0
nop
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
mov r8, rsi
lea rdx, [rbp - 0x59]
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [r14]
mov rbx, qword [rax]
cmp rbx, rax
je 0x14003ca03
nop dword [rax + rax]
lea rdx, [rbx + 0x20]
mov r8, rsi
mov rcx, rdi
call fcn.14003c750
lea rdx, [rbx + 0x40]
mov r8, rsi
mov rcx, rdi
call fcn.14003c750
cmp byte [rbx + 0x19], 0
jne 0x14003c9fe
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x14003c9de
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x14003c9fe
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14003c9d0
jmp 0x14003c9fe
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14003c9fb
cmp rbx, qword [rax + 0x10]
jne 0x14003c9fb
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14003c9e8
mov rbx, rax
cmp rbx, qword [r14]
jne 0x14003c990
mov r8, rsi
mov dl, 0x78
mov rcx, rdi
call fcn.14003c540
nop
lea rcx, [rbp - 0x59]
call fcn.140007ab0
nop
lea rcx, [rbp - 0x39]
call fcn.140007ab0
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140027790
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400502d0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x14016b140]
xor rax, rsp
mov qword [rsp + 0x48], rax
movdqa xmm0, xmmword [0x1401332b0]
movdqu xmmword [rsp + 0x38], xmm0
xor eax, eax
mov word [rsp + 0x28], ax
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx]
mov r9, r8
mov r8, rdx
lea rdx, [rsp + 0x28]
call qword [rax]
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rax, qword [rsp + 0x40]
cmp rax, 8
jb 0x140050385
inc rax
mov rcx, qword [rsp + 0x28]
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
ja 0x14005037f
add rax, rax
cmp rax, 0x1000
jb 0x140050378
test cl, 0x1f
jne 0x14005037f
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14005037f
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x14005037f
mov rcx, rax
call fcn.140028154
jmp 0x140050385
call fcn.1400c6d18
int3
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140027790
add rsp, 0x58
ret

Function at 0x14009e390
Capabilities:
Create directory

Disassembly:
mov eax, 0x4038
call fcn.140028080
sub rsp, rax
mov rax, qword [0x14016b140]
xor rax, rsp
mov qword [rsp + 0x4020], rax
mov r8, rcx
mov edx, 0x2000
lea rcx, [rsp + 0x20]
call fcn.1400a0000
test eax, eax
jne 0x14009e405
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14009e403
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14009e403
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xafc80
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.140027790
add rsp, 0x4038
ret
xor eax, eax
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.140027790
add rsp, 0x4038
ret

Function at 0x14009fab0
Capabilities:
Delete file

Disassembly:
mov eax, 0x4038
call fcn.140028080
sub rsp, rax
mov rax, qword [0x14016b140]
xor rax, rsp
mov qword [rsp + 0x4020], rax
mov r8, rcx
mov edx, 0x2000
lea rcx, [rsp + 0x20]
call fcn.1400a0000
test eax, eax
jne 0x14009fb23
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14009fafe
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14009fb18
xor eax, eax
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.140027790
add rsp, 0x4038
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xafc80
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.140027790
add rsp, 0x4038
ret
Function at 0x14009fb40
Capabilities:
Move file

Disassembly:
push rbx
mov eax, 0x8030
call fcn.140028080
sub rsp, rax
mov rax, qword [0x14016b140]
xor rax, rsp
mov qword [rsp + 0x8020], rax
mov rbx, rdx
mov r8, rcx
mov edx, 0x2000
lea rcx, [rsp + 0x4020]
call fcn.1400a0000
test eax, eax
jne 0x14009fbc7
mov r8, rbx
lea rcx, [rsp + 0x20]
mov edx, 0x2000
call fcn.1400a0000
test eax, eax
jne 0x14009fbc7
lea r8d, [rax + 3]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x4020]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x14009fbb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14009fbbc
xor eax, eax
jmp 0x14009fbc7
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xafc80
mov rcx, qword [rsp + 0x8020]
xor rcx, rsp
call fcn.140027790
add rsp, 0x8030
pop rbx
ret

Function at 0x1400a05c0
Capabilities:
Allocate thread local storage
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x14016b140]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov eax, dword [0x140175da8]
mov ecx, eax
inc eax
mov dword [0x140175da8], eax
test ecx, ecx
jne 0x1400a0699
lea rcx, [rsp + 0x28]
call fcn.1400a8700
test eax, eax
jne 0x1400a06b9
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140175e90], eax
call fcn.1400a0f30
test eax, eax
jne 0x1400a06be
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call fcn.1400a0d00
test eax, eax
je 0x1400a064f
mov eax, 0x4e22
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140027790
add rsp, 0x1e8
ret
mov rcx, qword [rsp + 0x20]
lea rdx, str.apr_initialize
call fcn.1400a1030
mov ecx, 2
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400a06be
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x1400a06b3
shr ax, 8
test al, al
jne 0x1400a06b3
mov rcx, qword [rsp + 0x20]
call fcn.140007ab0
mov rcx, qword [rsp + 0x20]
call fcn.1400a8640
xor eax, eax
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140027790
add rsp, 0x1e8
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, send
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140027790
add rsp, 0x1e8
ret

Function at 0x1400a1670
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov edx, reloc.WS2_32.dll_recv
mov rcx, r8
mov rbx, r8
call fcn.1400a0a70
mov qword [rdi], rax
test rax, rax
jne 0x1400a16a5
mov eax, recv
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov qword [rax], rbx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, qword [rdi]
mov dword [rcx + 8], eax
cmp eax, 0xffffffff
jne 0x1400a16c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400a16d0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x30]
add eax, 0xafc80
add rsp, 0x20
pop rdi
ret
Function at 0x1400a16f0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rdx + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rbx], rax
test rax, rax
jne 0x1400a1714
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400a171c
xor eax, eax
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xafc80
add rsp, 0x20
pop rbx
ret

Function at 0x1400a1730
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, rdx
mov rdx, rcx
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1400a1751
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400a1758
xor eax, eax
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xafc80
add rsp, 0x28
ret

Function at 0x1400a3560
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [rcx + 0x48], 0
mov rbx, rcx
je 0x1400a3644
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x38], r14
xor r14d, r14d
cmp dword [rcx + 0x78], 1
mov ebp, r14d
mov dword [rsp + 0x50], r14d
jne 0x1400a3632
mov qword [rsp + 0x68], rdi
mov rdi, qword [rcx + 0x60]
test rdi, rdi
je 0x1400a362d
mov qword [rsp + 0x60], rsi
mov rsi, qword [rcx + 0x58]
mov qword [rsp + 0x30], r15
mov r15d, 0xffffffff
nop dword [rax + rax]
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x50]
mov r8d, edi
mov qword [rsp + 0x20], r14
cmp rdi, r15
mov rdx, rsi
cmova r8d, r15d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400a35fa
mov eax, dword [rsp + 0x50]
add qword [rbx + 0x80], rax
add rsi, rax
sub rdi, rax
jne 0x1400a35c0
jmp 0x1400a361f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400a3610
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ebp, [rax + 0xafc80]
mov ecx, dword [rsp + 0x50]
add qword [rbx + 0x80], rcx
test ebp, ebp
jne 0x1400a3623
mov qword [rbx + 0x60], r14
mov rsi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x38]
mov eax, ebp
mov rbp, qword [rsp + 0x58]
add rsp, 0x40
pop rbx
ret
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x1400a4480
Capabilities:
Get user security identifier

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x160
mov rax, qword [0x14016b140]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edi, edi
mov dword [rsp + 0x44], 0x100
mov r15, rdx
mov dword [rsp + 0x40], edi
mov r12, rcx
mov r14, r9
mov rcx, r8
mov rbx, r8
lea edx, [rdi + 0x2f]
call fcn.1400c0c50
mov rbp, rax
test rax, rax
je 0x1400a44eb
mov r8, rax
mov rdx, rbx
sub r8, rbx
mov rcx, r14
call fcn.1400a03e0
mov rsi, rax
lea rbx, [rbp + 1]
jmp 0x1400a451d
mov edx, 0x5c
mov rcx, rbx
call fcn.1400c0c50
mov rbp, rax
test rax, rax
je 0x1400a451a
mov r8, rax
mov rdx, rbx
sub r8, rbx
mov rcx, r14
call fcn.1400a03e0
mov rsi, rax
lea rbx, [rbp + 1]
jmp 0x1400a451d
mov rsi, rdi
lea rax, [rsp + 0x48]
mov r8, rsi
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x44]
mov rdx, rbx
mov qword [rsp + 0x28], rax
mov rcx, rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1400a45b0
mov edx, eax
mov rcx, r14
call fcn.1400a0a70
lea rcx, [rsp + 0x48]
mov qword [r12], rax
mov qword [rsp + 0x30], rcx
lea r9, [rsp + 0x40]
lea rcx, [rsp + 0x44]
mov dword [rsp + 0x44], 0x100
mov qword [rsp + 0x28], rcx
mov r8, rax
lea rcx, [rsp + 0x50]
mov rdx, rbx
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
cmp dword [rsp + 0x40], edi
je 0x1400a45b0
test eax, eax
je 0x1400a45b0
mov qword [r15], rdi
xor eax, eax
jmp 0x1400a45c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400a45c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0xafc80]
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140027790
add rsp, 0x160
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400a45f0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x490]
sub rsp, 0x590
mov rax, qword [0x14016b140]
xor rax, rsp
mov qword [rbp + 0x480], rax
cmp dword [0x140175f00], 0x1e
mov rsi, r8
mov rdi, rcx
jl 0x1400a46bb
mov r9, r8
lea rcx, [rsp + 0x40]
mov r8, rdx
lea rdx, [rsp + 0x48]
call fcn.1400a4480
test eax, eax
jne 0x1400a4836
movups xmm0, xmmword [str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList_]
movzx eax, word [0x14011fef0]
lea rcx, [rsp + 0x50]
movups xmm1, xmmword [0x14011fec8]
mov word [rbp - 0x78], ax
or rax, 0xffffffffffffffff
movaps xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [0x14011fed8]
movaps xmmword [rsp + 0x60], xmm1
movsd xmm1, qword [0x14011fee8]
movaps xmmword [rsp + 0x70], xmm0
movsd qword [rbp - 0x80], xmm1
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400a4690
mov r8, qword [rsp + 0x40]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x30], eax
mov edx, 0x208
mov eax, eax
sub rdx, rax
add rcx, rax
call fcn.1400a4930
jmp 0x1400a472b
mov eax, dword [0x14011ff28]
lea rcx, [rsp + 0x50]
movups xmm0, xmmword [str.SOFTWAREMicrosoftWindowsCurrentVersionProfileList_]
mov dword [rbp - 0x80], eax
movzx eax, word [0x14011ff2c]
movups xmm1, xmmword [0x14011ff08]
mov word [rbp - 0x7c], ax
movzx eax, byte [0x14011ff2e]
movaps xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [0x14011ff18]
mov byte [rbp - 0x7a], al
or rax, 0xffffffffffffffff
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x70], xmm0
inc rax
cmp byte [rcx + rax], 0
jne 0x1400a4706
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x50]
mov eax, eax
mov r8d, 0x208
sub r8, rax
add rcx, rax
call fcn.1400a90d0
lea rax, [rsp + 0x38]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400a475e
add eax, 0xafc80
jmp 0x1400a4836
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x5c8], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.ProfileImagePath
mov dword [rsp + 0x30], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1400a47b5
lea eax, [rbx + 0xafc80]
jmp 0x1400a482e
mov eax, dword [rsp + 0x34]
cmp eax, 1
jne 0x1400a47c5
lea r8, [rsp + 0x50]
jmp 0x1400a47e9
cmp eax, 2
jne 0x1400a4829
mov r8d, 0x104
lea rdx, [rbp + 0x270]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea r8, [rbp + 0x270]
mov edx, 0x104
lea rcx, [rbp + 0x160]
call fcn.14009ff40
test eax, eax
jne 0x1400a482e
lea rdx, [rbp + 0x160]
mov rcx, rsi
call fcn.1400a0350
mov qword [rdi], rax
cmp byte [rax], 0
je 0x1400a4825
cmp byte [rax], 0x5c
jne 0x1400a481d
mov byte [rax], 0x2f
inc rax
cmp byte [rax], 0
jne 0x1400a4815
xor eax, eax
jmp 0x1400a482e
mov eax, 2
mov rbx, qword [rsp + 0x5c8]
mov rcx, qword [rbp + 0x480]
xor rcx, rsp
call fcn.140027790
add rsp, 0x590
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a4a30
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x6030
call fcn.140028080
sub rsp, rax
mov rax, qword [0x14016b140]
xor rax, rsp
mov qword [rsp + 0x6020], rax
mov edi, edx
mov rbx, rcx
lea rdx, [rsp + 0x2020]
mov ecx, 0x2000
mov rsi, r8
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1400a4a90
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400a4ae6
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xafc80
jmp 0x1400a4ae8
lea r8, [rsp + 0x2020]
mov edx, 0x2000
lea rcx, [rsp + 0x20]
call fcn.14009ff40
test eax, eax
jne 0x1400a4ae8
test dil, 0x10
jne 0x1400a4ad6
cmp byte [rsp + 0x20], 0
lea rax, [rsp + 0x20]
mov qword [rbx], rax
je 0x1400a4ad6
mov rax, qword [rbx]
cmp byte [rax], 0x5c
jne 0x1400a4acb
mov byte [rax], 0x2f
inc qword [rbx]
mov rax, qword [rbx]
cmp byte [rax], 0
jne 0x1400a4ac0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400a0350
mov qword [rbx], rax
xor eax, eax
mov rcx, qword [rsp + 0x6020]
xor rcx, rsp
call fcn.140027790
lea r11, [rsp + 0x6030]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400a4ce0
Capabilities:
Get disk information

Disassembly:
mov eax, 0x4038
call fcn.140028080
sub rsp, rax
mov rax, qword [0x14016b140]
xor rax, rsp
mov qword [rsp + 0x4020], rax
cmp dword [0x140175f00], 0x1e
jl 0x1400a4d2b
mov r8, rcx
mov edx, 0x2000
lea rcx, [rsp + 0x20]
call fcn.1400a0000
test eax, eax
jne 0x1400a4d40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x1400a4d31
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, eax
xor edx, edx
cmp ecx, 1
mov eax, 0x4e38
cmova eax, edx
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.140027790
add rsp, 0x4038
ret
Function at 0x1400a4f50
Capabilities:
Query environment variable

Disassembly:
push rbp
push rsi
mov eax, 0x4058
call fcn.140028080
sub rsp, rax
mov rax, qword [0x14016b140]
xor rax, rsp
mov qword [rsp + 0x4040], rax
mov rbp, r8
mov rsi, rcx
mov r8, rdx
lea rcx, [rsp + 0x40]
mov edx, 0x2000
call fcn.1400a5080
test eax, eax
jne 0x1400a5065
xor ecx, ecx
mov qword [rsp + 0x4050], rdi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jne 0x1400a4fce
mov eax, 2
jmp 0x1400a505d
mov rcx, rbp
test edi, edi
jne 0x1400a4fe6
lea rdx, [0x140108890]
call fcn.1400a0350
mov qword [rsi], rax
jmp 0x1400a505b
mov rdx, rdi
mov qword [rsp + 0x4088], rbx
add rdx, rdx
call fcn.1400a0a70
mov r8d, edi
lea rcx, [rsp + 0x40]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rbx + rcx*2], 0
jne 0x1400a5011
inc rcx
mov qword [rsp + 0x30], rcx
lea rdx, [rcx + rcx*2]
mov rcx, rbp
mov qword [rsp + 0x28], rdx
call fcn.1400a0a70
lea r9, [rsp + 0x28]
mov r8, rax
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov rdi, rax
call fcn.1400a8910
mov rbx, qword [rsp + 0x4088]
test eax, eax
jne 0x1400a505d
mov qword [rsi], rdi
xor eax, eax
mov rdi, qword [rsp + 0x4050]
mov rcx, qword [rsp + 0x4040]
xor rcx, rsp
call fcn.140027790
add rsp, 0x4058
pop rsi
pop rbp
ret

Function at 0x1400a50d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0x60]
mov edx, gethostbyaddr
mov rdi, r9
mov r14, r8
call fcn.1400a0a70
mov qword [rsi], rax
test rax, rax
jne 0x1400a5112
mov eax, recv
jmp 0x1400a51a9
mov rdx, qword [rsp + 0x60]
xor r9d, r9d
mov qword [rax + 0x18], rdi
xor r8d, r8d
mov rax, qword [rsi]
xor edi, edi
mov qword [rax + 0x20], r14
mov rax, qword [rsi]
mov qword [rax + 8], rdi
mov rcx, qword [rsi]
call fcn.1400a0d00
test eax, eax
jne 0x1400a51a9
test rbx, rbx
je 0x1400a5148
mov rax, qword [rbx + 0x10]
jmp 0x1400a514b
mov rax, rdi
mov r9, qword [rsi]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
lea r8, [0x1400a52f0]
xor ecx, ecx
mov dword [rsp + 0x20], edi
mov edx, eax
call fcn.1400c8058
mov rcx, rax
test rax, rax
jne 0x1400a518e
call fcn.1400c83dc
cmp dword [rax], edi
je 0x1400a518a
call fcn.1400c83dc
mov edi, dword [rax]
add edi, 0xafc80
mov eax, edi
jmp 0x1400a51a9
test rbx, rbx
je 0x1400a51a0
cmp dword [rbx + 8], edi
je 0x1400a51a0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400a51a7
mov rax, qword [rsi]
mov qword [rax + 8], rcx
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1400a5630
Capabilities:
Resolve dns

Disassembly:
mov r10d, dword [rsp + 0x28]
mov r11d, r8d
mov eax, r10d
mov qword [rcx], 0
and eax, 3
je 0x1400a5668
test rdx, rdx
je 0x1400a5662
test r8d, r8d
jne 0x1400a5662
cmp eax, 3
je 0x1400a5662
test r10b, 2
je 0x1400a5668
mov eax, 0x11187
ret
mov eax, reloc.WS2_32.dll_shutdown
ret
test r11d, r11d
mov r8d, 2
cmovne r8d, r11d
mov dword [rsp + 0x28], r10d
jmp 0x1400a5810
mov word [rsp + 0x20], r9w
mov qword [rsp + 8], rcx
push rbx
push rsi
push r13
push r15
sub rsp, 0x68
test rdx, rdx
lea rbx, str.0.0.0.0
mov r15, rdx
cmovne rbx, rdx
xor esi, esi
movzx eax, byte [rbx]
sub al, 0x30
cmp al, 9
ja 0x1400a594d
lea rdx, str.0123456789.
mov rcx, rbx
call fcn.1400d9f90
or rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp byte [rbx + rdx], sil
jne 0x1400a5860
cmp rax, rdx
jne 0x1400a594d
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_inet_addr]
mov qword [rsp + 0x28], rsi
lea r13, [rsp + 0x30]
mov dword [rsp + 0x98], eax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov rax, qword [r13 + 0x18]
cmp qword [rax], rsi
je 0x1400a59d2
mov qword [rsp + 0xa0], rbp
mov rbp, rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], r12
mov r12, qword [rsp + 0xb8]
mov qword [rsp + 0x50], r14
mov r14, rsi
nop word [rax + rax]
mov edx, 0x50
mov rcx, r12
call fcn.1400a0a70
xor edx, edx
mov rcx, rax
mov rdi, rax
lea r8d, [rdx + 0x50]
call fcn.1400c0ac0
movzx r8d, word [rsp + 0xa8]
mov edx, 2
mov qword [rdi], r12
mov rbx, rdi
mov rax, qword [r13 + 0x18]
mov rcx, qword [r14 + rax]
mov eax, dword [rcx]
mov rcx, rdi
mov dword [rdi + 0x44], eax
call fcn.1400a5710
test rsi, rsi
jne 0x1400a5985
test r15, r15
je 0x1400a5940
mov rdx, r15
mov rcx, r12
call fcn.1400a0350
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x90]
mov qword [rax], rbx
jmp 0x1400a5991
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov r13, rax
test rax, rax
jne 0x1400a58a3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x1400a5978
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea esi, [rax + 0xafc80]
mov eax, esi
add rsp, 0x68
pop r15
pop r13
pop rsi
pop rbx
ret
mov rax, qword [rsi + 8]
mov qword [rdi + 8], rax
mov qword [rsi + 0x38], rbx
mov rax, qword [r13 + 0x18]
inc rbp
mov rsi, rbx
lea r14, [rbp*8]
cmp qword [r14 + rax], 0
jne 0x1400a58e0
mov r14, qword [rsp + 0x50]
xor eax, eax
mov r12, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0xa0]
add rsp, 0x68
pop r15
pop r13
pop rsi
pop rbx
ret
mov eax, 0x4e2e
add rsp, 0x68
pop r15
pop r13
pop rsi
pop rbx
ret