joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007e8ec
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x140
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1405b7098]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov r12d, r8d
mov rsi, rdx
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r15d, [r12 + rax]
mov byte [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xaf
lea rbx, str.NGIOStack::CHTTPClient::OpenSession
mov r9, rbx
lea r8, [0x1405c8dd8]
mov rdx, qword [0x1405c8dd0]
lea rcx, [rsp + 0x70]
call fcn.1400169f8
nop
mov rcx, qword [r14 + 0x100]
test rcx, rcx
je 0x14007eabb
mov rax, qword [rcx]
call qword [rax + 0x98]
test rax, rax
je 0x14007ea32
mov rcx, qword [r14 + 0x100]
mov rax, qword [rcx]
call qword [rax + 0x98]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14000f690
nop
lea rcx, [rsp + 0x48]
call fcn.140025fa4
test al, al
je 0x14007ea28
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1404b9db0]
lea rcx, [rsp + 0x48]
call fcn.14000f9e4
cmp rax, 0xffffffffffffffff
je 0x14007ea28
mov r9, qword [rsp + 0x58]
sub r9, rax
mov r8, rax
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x48]
call fcn.14000f7bc
mov rdi, rax
lea rbx, [r14 + 0x98]
cmp rbx, rax
je 0x14007ea18
xor r8d, r8d
mov dl, 1
mov rcx, rbx
call fcn.14000f964
mov rdx, rdi
mov rcx, rbx
call fcn.1400111b0
nop
lea rcx, [rbp + 0x10]
call fcn.14000f670
lea rbx, str.NGIOStack::CHTTPClient::OpenSession
lea rcx, [rsp + 0x48]
call fcn.14000f670
mov rcx, qword [r14 + 0x100]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x38]
mov edi, eax
test eax, eax
je 0x14007eab5
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
lea r9, str._s_m_pIDeviceConnection__Open_returned_0x_08X
mov edx, 0x80
lea r8d, [rdx + 0x48]
lea rcx, [rsp + 0x70]
call fcn.140016e24
cmp edi, 0x83e8f4fb
je 0x14007eaae
cmp edi, 0x83e8f4fc
jne 0x14007eae3
mov dword [rsp + 0x78], 0x83e8f5f4
test r12d, r12d
je 0x14007ead3
mov ecx, reloc.OLEAUT32.dll_SetErrorInfo
call qword [sym.imp.KERNEL32.dll_Sleep]
test rsi, rsi
je 0x14007eab5
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test al, al
jne 0x14007eab5
mov ebx, 0x83e8fffe
jmp 0x14007eac0
mov ebx, 0x83e8f5f3
jmp 0x14007eac0
mov ebx, dword [rsp + 0x78]
jmp 0x14007eac4
mov ebx, 0x83e8f5fe
mov dword [rsp + 0x78], ebx
cmp ebx, 0x83e8f5f4
jne 0x14007eb0b
lea rbx, str.NGIOStack::CHTTPClient::OpenSession
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, r15d
jae 0x14007eb07
jmp 0x14007e969
cmp edi, 0x83e8f4fd
je 0x14007eb00
mov ebx, 0x83e8fff4
mov eax, 0x83e8f5fc
cmp edi, ebx
cmovne ebx, eax
mov dword [rsp + 0x78], ebx
jmp 0x14007eb0b
mov ebx, 0x83e8fffe
jmp 0x14007eafa
mov ebx, dword [rsp + 0x78]
lea rcx, [rsp + 0x70]
call fcn.140016b40
mov eax, ebx
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.1400fcfd0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400aad08
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x48
cmp dword [rcx + 0x130], 0
mov r11, rcx
mov rax, qword [rsp + 0x70]
je 0x1400aad50
mov rcx, qword [0x1405b80a0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r9
mov r9, rdx
mov rdx, qword [r11 + 0x138]
mov r10, qword [rcx]
mov dword [rsp + 0x20], r8d
mov r8b, byte [r11 + 0x141]
call qword [r10 + 0x60]
add rsp, 0x48
ret
mov rcx, qword [rcx + 0x28]
mov qword [rsp + 0x70], rax
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_WriteFile]

Function at 0x1400aad64
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x48
cmp dword [rcx + 0x130], 0
mov r11, rcx
mov rax, qword [rsp + 0x70]
je 0x1400aadac
mov rcx, qword [0x1405b80a0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r9
mov r9, rdx
mov rdx, qword [r11 + 0x138]
mov r10, qword [rcx]
mov dword [rsp + 0x20], r8d
mov r8b, byte [r11 + 0x140]
call qword [r10 + 0x58]
add rsp, 0x48
ret
mov rcx, qword [rcx + 0x28]
mov qword [rsp + 0x70], rax
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_ReadFile]

Function at 0x1400ae8c8
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov r14, rdx
mov rsi, rcx
and dword [rax - 0x38], 0
call fcn.14000f860
mov r15d, 1
mov dword [rsp + 0x20], r15d
mov rbx, qword [r14]
mov rax, qword [r14 + 8]
cmp rbx, rax
je 0x1400ae9e9
lea r12, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx edi, byte [rbx]
add rbx, r15
mov eax, edi
shr rax, 2
movzx r8d, word [r12 + rax*2]
mov rdx, r15
mov rcx, rsi
call fcn.14001d3bc
nop
mov rax, qword [r14 + 8]
and edi, 3
mov rdx, r15
mov rcx, rsi
cmp rbx, rax
je 0x1400ae9ab
movzx ebp, byte [rbx]
add rbx, r15
mov eax, ebp
shr rax, 4
shl rdi, 4
or rax, rdi
movzx r8d, word [r12 + rax*2]
call fcn.14001d3bc
nop
mov rax, qword [r14 + 8]
and ebp, 0xf
mov rdx, r15
mov rcx, rsi
cmp rbx, rax
je 0x1400ae9a4
movzx edi, byte [rbx]
add rbx, r15
mov eax, edi
shr rax, 6
shl rbp, 2
or rax, rbp
movzx r8d, word [r12 + rax*2]
call fcn.14001d3bc
mov eax, edi
and eax, 0x3f
movzx r8d, word [r12 + rax*2]
jmp 0x1400ae9d0
movzx r8d, word [r12 + rbp*8]
jmp 0x1400ae9c5
shl rdi, 5
movzx r8d, word [rdi + r12]
call fcn.14001d3bc
mov r8d, 0x3d
mov rdx, r15
mov rcx, rsi
call fcn.14001d3bc
mov r8d, 0x3d
mov rdx, r15
mov rcx, rsi
call fcn.14001d3bc
nop
mov rax, qword [r14 + 8]
cmp rbx, rax
jne 0x1400ae91c
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400afd1c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1405b7098]
xor rax, rsp
mov qword [rbp - 8], rax
mov esi, edx
mov rdi, rcx
mov qword [rbp - 0x30], rcx
xor r14d, r14d
mov dword [rbp - 0x40], r14d
lea rcx, [rbp - 0x28]
call fcn.14000f860
nop
mov rbx, qword [rbp - 0x18]
lea edx, [r14 + 0x24]
cmp rbx, rdx
ja 0x1400afd9c
cmp qword [rbp - 0x10], rdx
je 0x1400afd9c
mov r8b, 1
lea rcx, [rbp - 0x28]
call fcn.14000ff00
test al, al
je 0x1400afd9c
mov qword [rbp - 0x18], rbx
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rax, qword [rbp - 0x28]
mov word [rax + rbx*2], r14w
mov r8d, esi
mov eax, 0x66666667
imul r8d
mov ebx, edx
sar ebx, 2
mov ecx, ebx
shr ecx, 0x1f
add ebx, ecx
lea ecx, [rbx + rbx*4]
add ecx, ecx
sub r8d, ecx
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
cdqe
lea rcx, [0x1404bd898]
movsx r8d, byte [rax + rcx]
mov edx, 1
lea rcx, [rbp - 0x28]
call fcn.14001d3bc
mov r8d, ebx
test ebx, ebx
jne 0x1400afd9f
test esi, esi
jns 0x1400afdfa
lea edx, [rbx + 1]
lea r8d, [rbx + 0x2d]
lea rcx, [rbp - 0x28]
call fcn.14001d3bc
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x18]
lea r8, [rcx + rax*2]
lea rdx, [rbp - 0x28]
cmovae rdx, qword [rbp - 0x28]
jmp 0x1400afe36
sub r8, 2
cmp rdx, r8
je 0x1400afe3b
movzx ecx, word [rdx]
movzx eax, word [r8]
mov word [rdx], ax
mov word [r8], cx
add rdx, 2
cmp rdx, r8
jne 0x1400afe1b
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.140010b10
mov dword [rbp - 0x40], 1
lea rcx, [rbp - 0x28]
call fcn.14000f670
mov rax, rdi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400fcfd0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400afe7c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1405b7098]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rbp - 0x30], rcx
xor r14d, r14d
mov dword [rbp - 0x40], r14d
lea rcx, [rbp - 0x28]
call fcn.14000f860
nop
mov rbx, qword [rbp - 0x18]
lea edx, [r14 + 0x24]
cmp rbx, rdx
ja 0x1400afefd
cmp qword [rbp - 0x10], rdx
je 0x1400afefd
mov r8b, 1
lea rcx, [rbp - 0x28]
call fcn.14000ff00
test al, al
je 0x1400afefd
mov qword [rbp - 0x18], rbx
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rax, qword [rbp - 0x28]
mov word [rax + rbx*2], r14w
mov r8, rsi
movabs rax, 0x6666666666666667
imul r8
mov rbx, rdx
sar rbx, 2
mov rcx, rbx
shr rcx, 0x3f
add rbx, rcx
lea rcx, [rbx + rbx*4]
add rcx, rcx
sub r8, rcx
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
cdqe
lea rcx, [0x1404bd898]
movsx r8d, byte [rax + rcx]
mov edx, 1
lea rcx, [rbp - 0x28]
call fcn.14001d3bc
mov r8, rbx
test rbx, rbx
jne 0x1400aff00
test rsi, rsi
jns 0x1400aff69
lea edx, [rbx + 1]
lea r8d, [rbx + 0x2d]
lea rcx, [rbp - 0x28]
call fcn.14001d3bc
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x18]
lea r8, [rcx + rax*2]
lea rdx, [rbp - 0x28]
cmovae rdx, qword [rbp - 0x28]
jmp 0x1400affa5
sub r8, 2
cmp rdx, r8
je 0x1400affaa
movzx ecx, word [rdx]
movzx eax, word [r8]
mov word [rdx], ax
mov word [r8], cx
add rdx, 2
cmp rdx, r8
jne 0x1400aff8a
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.140010b10
mov dword [rbp - 0x40], 1
lea rcx, [rbp - 0x28]
call fcn.14000f670
mov rax, rdi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400fcfd0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400affec
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1405b7098]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rbp - 0x30], rcx
xor r14d, r14d
mov dword [rbp - 0x40], r14d
lea rcx, [rbp - 0x28]
call fcn.14000f860
nop
mov rbx, qword [rbp - 0x18]
lea edx, [r14 + 0x24]
cmp rbx, rdx
ja 0x1400b006d
cmp qword [rbp - 0x10], rdx
je 0x1400b006d
mov r8b, 1
lea rcx, [rbp - 0x28]
call fcn.14000ff00
test al, al
je 0x1400b006d
mov qword [rbp - 0x18], rbx
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rax, qword [rbp - 0x28]
mov word [rax + rbx*2], r14w
movabs rax, 0xcccccccccccccccd
mul rsi
mov rbx, rdx
shr rbx, 3
lea rax, [rbx + rbx*4]
add rax, rax
sub rsi, rax
mov eax, esi
cdq
xor eax, edx
sub eax, edx
cdqe
lea rcx, [0x1404bd898]
movsx r8d, byte [rax + rcx]
mov edx, 1
lea rcx, [rbp - 0x28]
call fcn.14001d3bc
mov rsi, rbx
test rbx, rbx
jne 0x1400b006d
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x18]
lea r8, [rcx + rax*2]
lea rdx, [rbp - 0x28]
cmovae rdx, qword [rbp - 0x28]
jmp 0x1400b00f2
sub r8, 2
cmp rdx, r8
je 0x1400b00f7
movzx ecx, word [rdx]
movzx eax, word [r8]
mov word [rdx], ax
mov word [r8], cx
add rdx, 2
cmp rdx, r8
jne 0x1400b00d7
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.140010b10
mov dword [rbp - 0x40], 1
lea rcx, [rbp - 0x28]
call fcn.14000f670
mov rax, rdi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400fcfd0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x1400b5c68
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
xor ebx, ebx
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.1400b15ac
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
sete al
xor al, 1
je 0x1400b5cb5
inc ebx
lea rcx, [rsp + 0x28]
call fcn.1400a13a8
mov rcx, qword [rsp + 0x28]
test rcx, rcx
sete dl
xor dl, 1
jne 0x1400b5c99
test rcx, rcx
je 0x1400b5cc0
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x1400de570
Capabilities:
Create pipe

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rsp + 0x90]
mov r10d, r9d
mov r9d, dword [rsp + 0x70]
mov r11d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rdx
mov eax, dword [rsp + 0x88]
mov r8d, r10d
mov dword [rsp + 0x30], eax
mov edx, r11d
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
add rsp, 0x40
pop rbx
ret
Function at 0x1400de5f0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [rsp + 0xb0]
mov r10, r9
mov r9, qword [rsp + 0x80]
mov r11, r8
mov qword [rsp + 0x48], rax
mov rcx, rdx
mov rax, qword [rsp + 0xa8]
mov r8, r10
mov qword [rsp + 0x40], rax
mov rdx, r11
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
add rsp, 0x50
pop rbx
ret

Function at 0x1400de670
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x70]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov qword [rsp + 0x28], rax
mov rcx, rdx
mov eax, dword [rsp + 0x68]
mov r8, r10
mov rdx, r11
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x30
pop rbx
ret

Function at 0x1400df020
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x70]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rdx
mov eax, dword [rsp + 0x68]
mov r8, r10
mov edx, r11d
mov dword [rsp + 0x20], eax
call fcn.14010a8c4
add rsp, 0x30
pop rbx
ret
Function at 0x140120938
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x14012079e
call fcn.1401021c0
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayAccessData
call fcn.140101bc0
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140120780
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140120780
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x1401207d0
lock or dword [rax + 0x14], 0x10
jmp 0x140120780
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1401207ed
mov rcx, qword [rbp + 0x20]
call fcn.140120d24
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x140120802
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x140120808
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.14011e8e0
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140129ffc
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x14012085b
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x140120780
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1401208c7
mov rcx, qword [rbp + 0x20]
call fcn.14011e8e0
cmp eax, 0xffffffff
je 0x1401208ae
mov rcx, qword [rbp + 0x20]
call fcn.14011e8e0
cmp eax, 0xfffffffe
je 0x1401208ae
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.14011e8e0
movsxd rdi, eax
lea r15, [0x1405c2eb0]
mov rcx, rbx
sar rdi, 6
call fcn.14011e8e0
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x1401208b5
lea rax, [0x1405b7520]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1401208c7
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x1401208fd
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1401208f9
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1401208f9
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x14012091b
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x140120926
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x140120785
jmp 0x14012074c
Function at 0x140124688
Capabilities:
Create thread
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r8d
mov r14, rdx
mov rbx, rcx
call fcn.14011cc38
mov bpl, al
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor edi, edi
test eax, eax
je 0x1401246db
test rbx, rbx
je 0x1401246cc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bpl, bpl
je 0x1401246db
mov edi, 4
jmp 0x140124784
call fcn.14011ca10
test al, al
jne 0x1401246f8
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb edi, edi
neg edi
add edi, 3
jmp 0x140124784
test bpl, bpl
je 0x14012475b
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
lea r8, [0x140124660]
mov dword [rsp + 0x20], edi
xor edx, edx
mov qword [rsp + 0x30], r14
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140124784
xor r8d, r8d
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rcx, rbx
test eax, eax
je 0x140124755
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140124784
mov edi, dword [rsp + 0x44]
jmp 0x14012474d
call fcn.14011cb64
test al, al
jne 0x14012476c
bts esi, 0x15
xor ecx, ecx
jmp 0x140124774
call fcn.14011ca9c
mov rcx, rax
mov r9d, esi
mov r8, r14
mov rdx, rbx
call fcn.14011c8fc
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret

Function at 0x14012c150
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rsp + 0x70]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov dword [rsp + 0x28], eax
mov rcx, rdx
mov rax, qword [rsp + 0x68]
mov r8, r10
mov rdx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
add rsp, 0x30
pop rbx
ret

Function at 0x14012c250
Capabilities:
Query or enumerate registry key

Disassembly:
sub rsp, 0x48
xor ecx, ecx
mov rax, r9
mov r9, qword [rsp + 0x70]
mov r10d, r8d
mov qword [rsp + 0x38], rcx
mov r11, rdx
mov qword [rsp + 0x30], rcx
mov r8, rax
mov qword [rsp + 0x28], rcx
mov edx, r10d
mov qword [rsp + 0x20], rcx
mov rcx, r11
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add rsp, 0x48
ret

Function at 0x14012c460
Capabilities:
Get session user name

Disassembly:
sub rsp, 0x28
mov rax, r8
mov ecx, edx
mov rdx, rax
mov r8, r9
call sub.Secur32.dll_GetUserNameExW
movzx eax, al
add rsp, 0x28
ret

Function at 0x140140930
Capabilities:
Connect socket

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rsp + 0x88]
mov r10d, r9d
mov r9, qword [rsp + 0x70]
mov r11, r8
mov qword [rsp + 0x30], rax
mov rcx, rdx
mov rax, qword [rsp + 0x80]
mov r8d, r10d
mov qword [rsp + 0x28], rax
mov rdx, r11
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSAConnect]
add rsp, 0x40
pop rbx
ret
Function at 0x14019abc8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x108
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1405b7098]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov r15, r9
mov ebx, r8d
mov r14, rdx
mov rbp, rcx
mov byte [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_DispGetParam
lea r9, [0x140216a50]
lea r8, [0x1405c5470]
mov rdx, qword [0x1405c4c90]
lea rcx, [rsp + 0x50]
call fcn.1400169f8
nop
movzx edx, bx
lea r8, str.EMFDATA
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x14019ad0d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x14019acfe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14019accc
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea rcx, [0x1402208bc]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r15
mov r9d, eax
mov r8, rbx
mov rdx, r14
mov rcx, rbp
call fcn.14019ad60
mov dword [rsp + 0x58], eax
test eax, eax
jns 0x14019acef
mov dword [rsp + 0x20], eax
lea r9, str.PrintEMFPage:_SendEMF_failed_with_HR__0x_08X
mov edx, 0x80
lea r8d, [rdx - 0x53]
lea rcx, [rsp + 0x50]
call fcn.140016e24
jmp 0x14019acef
lea r9, str.PrintEMFPage:_Failed_to_lock_EMF_page_resource
mov edx, 0x80
lea r8d, [rdx - 0x4e]
lea rcx, [rsp + 0x50]
call fcn.140016e24
mov ebx, 0x80004005
mov dword [rsp + 0x58], ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov ebx, dword [rsp + 0x58]
jmp 0x14019ad32
lea r9, str.PrintEMFPage:_Failed_to_load_EMF_page_resource
mov r8d, 0x3a
jmp 0x14019ad1a
lea r9, str.PrintEMFPage:_Failed_to_find_EMF_page_resource
mov r8d, 0x40
mov edx, 0x80
lea rcx, [rsp + 0x50]
call fcn.140016e24
mov ebx, 0x80004005
mov dword [rsp + 0x58], ebx
lea rcx, [rsp + 0x50]
call fcn.140016b40
mov eax, ebx
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1400fcfd0
add rsp, 0x108
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1401a33f0
Capabilities:
Send icmp echo request

Disassembly:
push rbx
sub rsp, 0x40
mov eax, dword [rsp + 0x90]
mov r10, r9
movzx r9d, word [rsp + 0x70]
mov r11d, r8d
mov dword [rsp + 0x38], eax
mov rcx, rdx
mov eax, dword [rsp + 0x88]
mov r8, r10
mov dword [rsp + 0x30], eax
mov edx, r11d
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call sub.IPHLPAPI.DLL_IcmpSendEcho
add rsp, 0x40
pop rbx
ret

Function at 0x1401a36a0
Capabilities:
Encrypt data using dpapi

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rsp + 0x88]
mov r10, r9
mov r9, qword [rsp + 0x70]
mov r11, r8
mov qword [rsp + 0x30], rax
mov rcx, rdx
mov eax, dword [rsp + 0x80]
mov r8, r10
mov dword [rsp + 0x28], eax
mov rdx, r11
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
add rsp, 0x40
pop rbx
ret