joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e48d0
Capabilities:
Log keystrokes
Manipulate console buffer

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rbx, rcx
mov ecx, dword [rcx + 0x58]
mov edx, ecx
and dh, 0xef
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], edx
jne 0x6e4920
test cl, 1
je 0x6e4941
test edx, 0x10000
je 0x6e490c
test edx, 0x2000000
jne 0x6e4960
and edx, 0x200000
je 0x6e49c0
xor esi, esi
mov eax, esi
add rsp, 0x70
pop rbx
pop rsi
pop rdi
ret
jns 0x6e48f0
lea rdx, str.src_win_tty.c
mov r8d, 0x402
lea rcx, [0x00d138f7]
call qword [sym.imp.msvcrt.dll__assert]
mov edx, dword [rbx + 0x58]
jmp 0x6e48f0
test cl, 4
je 0x6e48f0
mov edx, ecx
and edx, 0xffffeffb
and ecx, 8
mov dword [rbx + 0x58], edx
je 0x6e48f0
mov rax, qword [rbx + 8]
sub dword [rax + 8], 1
jmp 0x6e48f0
xor r9d, r9d
lea rdx, [rsp + 0x50]
mov r10d, 0x10
mov qword [rsp + 0x52], 0
mov qword [rsp + 0x5a], 0
mov rcx, qword [rbx + 0x110]
mov r8d, 1
mov word [rdx + 0x12], r9w
lea r9, [rsp + 0x4c]
mov word [rsp + 0x50], r10w
call qword [sym.imp.KERNEL32.DLL_WriteConsoleInputW]
test eax, eax
jne 0x6e490c
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
jmp 0x6e490e
lea rcx, [0x010a6358]
call fcn.006dffb0
mov eax, 2
xchg dword [0x010a637c], eax
cmp eax, 1
je 0x6e49f4
lea rcx, [0x010a6358]
call fcn.006dff80
or dword [rbx + 0x58], 0x200000
jmp 0x6e490c
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
mov r8d, 3
mov edx, 0xc0000000
mov qword [rsp + 0x30], 0
lea rcx, [0x00d1347b]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x6e4ac0
lea rdx, [0x010a6360]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x6e4b53
mov ecx, 1
xor edx, edx
movabs rax, 0xd000100000001
mov word [rsp + 0x50], cx
mov ecx, 0xd
mov qword [rsp + 0x54], rax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8d, 0xd
mov dword [rsp + 0x60], 0
lea rdx, [rsp + 0x50]
mov word [rsp + 0x5e], r8w
lea r9, [rsp + 0x4c]
mov rcx, qword [rbx + 0x110]
mov r8d, 1
mov word [rsp + 0x5c], ax
call qword [sym.imp.KERNEL32.DLL_WriteConsoleInputW]
test eax, eax
je 0x6e4b40
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x6e49e8
mov eax, 1
xor edx, edx
mov ecx, 0xd
mov word [rsp + 0x50], ax
movabs rax, 0xd000100000001
mov qword [rsp + 0x54], rax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, 0xd
lea r9, [rsp + 0x4c]
mov dword [rsp + 0x60], 0
mov word [rsp + 0x5e], dx
mov rcx, qword [rbx + 0x110]
lea rdx, [rsp + 0x50]
mov r8d, 1
mov word [rsp + 0x5c], ax
call qword [sym.imp.KERNEL32.DLL_WriteConsoleInputW]
test eax, eax
jne 0x6e49e8
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
test esi, esi
jne 0x6e490e
jmp 0x6e49e8
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rcx, rdi
mov esi, eax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x6e4b2a
lock or dword [0x010a6378], 1
jmp 0x6e4a4d
Function at 0x6e5320
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2d8
cmp qword [rdx + 0x70], 0xffffffffffffffff
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov ebp, r9d
mov dword [rsp + 0x48], 1
jne 0x6e54c0
lea r8, [rsp + 0x48]
mov edx, 0x8004667e
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x6e5402
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_SetHandleInformation]
test eax, eax
je 0x6e53f0
xor r9d, r9d
mov rdx, qword [rdi + 0x38]
mov r8, rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CreateIoCompletionPort]
test rax, rax
je 0x6e53f0
lea rax, [rsp + 0x4c]
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov dword [rsp + 0x4c], 0x274
mov qword [rsp + 0x20], rax
mov r8d, 0x2005
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x6e53f0
cmp dword [rsp + 0x78], 1
je 0x6e5460
mov edx, dword [rsi + 0x58]
mov qword [rsi + 0x70], rbx
cmp ebp, 0x17
je 0x6e5440
xor eax, eax
and edx, 0x400000
jne 0x6e5414
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov dword [rsp + 0x3c], eax
mov r8d, 0x79
lea rdx, str.src_win_udp.c
lea rcx, str.__handle__flags__UV_HANDLE_IPV6_
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsp + 0x3c]
jmp 0x6e53e4
or edx, 0x400000
xor eax, eax
mov dword [rsi + 0x58], edx
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_SetFileCompletionNotificationModes]
test eax, eax
je 0x6e54a0
mov rax, qword [0x00d94900]
mov edx, dword [rsi + 0x58]
mov qword [rsi + 0x198], rax
mov rax, qword [0x00d94910]
or edx, 0x20000
mov dword [rsi + 0x58], edx
mov qword [rsi + 0x1a0], rax
jmp 0x6e53d1
mov rdi, qword [sym.imp.KERNEL32.DLL_GetLastError]
call rdi
cmp eax, 1
je 0x6e53ce
call rdi
jmp 0x6e53e4
mov eax, 0xfffff00e
jmp 0x6e53e4
Function at 0x6e54d0
Capabilities:
Set socket configuration

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
xor esi, esi
mov rbx, rcx
mov rbp, rdx
mov r12d, r8d
mov edi, r9d
mov dword [rsp + 0x38], 0
test byte [rcx + 0x59], 0x20
jne 0x6e5546
mov r13d, r9d
and r13d, 1
je 0x6e550e
cmp word [rdx], 0x17
mov esi, 0x57
jne 0x6e5546
mov rcx, qword [rbx + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x6e55d0
and edi, 4
jne 0x6e5560
cmp word [rbp], 0x17
je 0x6e559a
mov r8d, r12d
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x6e5610
or dword [rbx + 0x58], 0x2000
xor esi, esi
mov eax, esi
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea r9, [rsp + 0x3c]
mov dword [rsp + 0x3c], 1
mov edx, 0xffff
mov r8d, 4
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x6e5610
cmp word [rbp], 0x17
mov rcx, qword [rbx + 0x70]
jne 0x6e5528
or dword [rbx + 0x58], 0x400000
test r13d, r13d
jne 0x6e5528
lea r9, [rsp + 0x38]
mov r8d, 0x1b
mov edx, 0x29
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x70]
jmp 0x6e5528
movzx ecx, word [rbp]
xor r8d, r8d
mov edx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x6e5610
mov rcx, qword [rbx + 8]
movzx r9d, word [rbp]
mov r8, rax
mov rdx, rbx
call fcn.006e5320
mov esi, eax
test eax, eax
jne 0x6e5620
mov rcx, qword [rbx + 0x70]
jmp 0x6e551c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
jmp 0x6e5546
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x6e5546
Function at 0x6e6230
Capabilities:
Set socket configuration

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
mov eax, dword [rcx + 0x58]
and eax, 0x402000
mov rsi, rcx
mov r12, rdx
mov rbp, r8
mov edi, r9d
cmp eax, 0x2000
je 0x6e6300
mov rdx, qword [0x00d948d0]
mov r9d, 4
mov r8d, 0x1c
call fcn.006e54d0
mov ebx, eax
test eax, eax
jne 0x6e6320
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
test rbp, rbp
je 0x6e62b5
xor edx, edx
lea r8, [rsp + 0x50]
mov rcx, rbp
call fcn.006c52d0
test eax, eax
jne 0x6e6300
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x40], eax
movdqu xmm0, xmmword [r12 + 8]
movaps xmmword [rsp + 0x30], xmm0
test edi, edi
je 0x6e6312
mov r8d, 0xc
cmp edi, 1
jne 0x6e6300
mov rcx, qword [rsi + 0x70]
lea r9, [rsp + 0x30]
mov edx, 0x29
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x6e6340
mov eax, ebx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ebx, 0xfffff019
mov eax, ebx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8d, 0xd
jmp 0x6e62d0
mov ecx, eax
call fcn.006c72f0
mov ebx, eax
mov eax, ebx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.006c72f0
mov ebx, eax
jmp 0x6e62f1
Function at 0x6e6a10
Capabilities:
Send data
Send data on socket

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov edi, dword [rsp + 0xd8]
mov rsi, rcx
mov rbx, rdx
mov r12, r8
mov r13d, r9d
test byte [rdx + 0x59], 0x20
jne 0x6e6a64
cmp edi, 0x10
je 0x6e6c70
cmp edi, 0x1c
jne 0x6e6c90
mov rdx, qword [0x00d948d0]
xor r9d, r9d
mov r8d, edi
mov rcx, rbx
call fcn.006e54d0
test eax, eax
jne 0x6e6bde
mov rbp, qword [rbx + 8]
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x6c]
mov r8d, r13d
mov rax, qword [rsp + 0xe0]
mov qword [rsi + 0x40], 0
mov rdx, r12
mov qword [rsi + 0x48], 0
mov qword [rsi + 0x78], rax
lea rax, [rsi + 0x40]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsi + 0x50], 0
mov qword [rsi + 0x58], 0
mov rcx, qword [rbx + 0x70]
mov dword [rsi + 8], 5
mov qword [rsi + 0x70], rbx
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASendTo]
test eax, eax
je 0x6e6b40
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
jne 0x6e6bd0
mov edx, r13d
mov rcx, r12
call fcn.006c5880
mov qword [rsi + 0x60], rax
add qword [rbx + 0x60], rax
mov eax, dword [rbx + 0x7c]
add dword [rbx + 0x78], 1
lea edx, [rax + 1]
add qword [rbx + 0x68], 1
mov dword [rbx + 0x7c], edx
test eax, eax
jne 0x6e6bf2
mov eax, dword [rbx + 0x58]
test al, 4
je 0x6e6c20
add dword [rbp + 0x20], 1
xor eax, eax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov edx, dword [rbx + 0x58]
test edx, 0x20000
je 0x6e6af4
mov ecx, dword [rbx + 0x7c]
mov qword [rsi + 0x60], 0
add dword [rbx + 0x78], 1
lea r8d, [rcx + 1]
add qword [rbx + 0x68], 1
mov dword [rbx + 0x7c], r8d
test ecx, ecx
je 0x6e6c40
test r8d, r8d
jg 0x6e6b96
mov dword [rsp + 0x5c], eax
mov r8d, 0x1ba
lea rdx, str.src_win_udp.c
lea rcx, str.__handle____activecnt___0
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsp + 0x5c]
mov rdx, qword [rbp + 0x48]
add dword [rbp + 0x20], 1
mov qword [rsi + 0x68], 0
test rdx, rdx
je 0x6e6c80
mov rcx, qword [rdx + 0x68]
mov qword [rsi + 0x68], rcx
mov qword [rdx + 0x68], rsi
mov qword [rbp + 0x48], rsi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x6e6b32
mov ecx, eax
call fcn.006c72f0
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test edx, edx
jg 0x6e6b2c
mov r8d, 0x1c2
lea rdx, str.src_win_udp.c
lea rcx, str.__handle____activecnt___0
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x6e6b2c
mov edx, eax
or edx, 4
mov dword [rbx + 0x58], edx
test al, 8
je 0x6e6b2c
mov rax, qword [rbx + 8]
add dword [rax + 8], 1
jmp 0x6e6b2c
test dl, 4
jne 0x6e6b96
mov ecx, edx
or ecx, 4
and edx, 8
mov dword [rbx + 0x58], ecx
je 0x6e6b96
mov rdx, qword [rbx + 8]
add dword [rdx + 8], 1
jmp 0x6e6b96
mov rdx, qword [0x00d948c0]
jmp 0x6e6a4e
mov qword [rsi + 0x68], rsi
mov qword [rbp + 0x48], rsi
jmp 0x6e6b32
mov eax, 0xfffff019
jmp 0x6e6b32
Function at 0x6e6ca0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe8
mov esi, dword [rsp + 0x130]
mov rbx, rcx
mov rbp, rdx
mov edi, r8d
test r8d, r8d
je 0x6e6d90
test r9, r9
je 0x6e6cde
lea rdx, [rsp + 0x60]
mov rcx, r9
call fcn.006ea5c0
test eax, eax
jne 0x6e6d61
cmp qword [rbx + 0x68], 0
jne 0x6e6dd3
test byte [rbx + 0x59], 0x20
jne 0x6e6d1a
cmp esi, 0x10
je 0x6e6dc0
cmp esi, 0x1c
jne 0x6e6dcc
mov rdx, qword [0x00d948d0]
xor r9d, r9d
mov r8d, esi
mov rcx, rbx
call fcn.006e54d0
test eax, eax
jne 0x6e6d76
lea rax, [rsp + 0x60]
mov rdx, rbp
mov rcx, qword [rbx + 0x70]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x5c]
mov r8d, edi
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASendTo]
mov edx, eax
mov eax, dword [rsp + 0x5c]
test edx, edx
jne 0x6e6d70
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.006c72f0
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov qword [rsp + 0x128], r9
mov r8d, 0x3e5
lea rdx, str.src_win_udp.c
lea rcx, str.nbufs___0
call qword [sym.imp.msvcrt.dll__assert]
mov r9, qword [rsp + 0x128]
jmp 0x6e6cc4
mov rdx, qword [0x00d948c0]
jmp 0x6e6d08
mov eax, 0xfffff019
jmp 0x6e6d61
mov eax, 0xfffff008
jmp 0x6e6d61

Function at 0x6e7120
Capabilities:
Get common file path

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
mov rdi, rcx
mov rsi, rdx
test rcx, rcx
je 0x6e7260
test rdx, rdx
je 0x6e7260
lea rbx, [rsp + 0x40]
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
test eax, eax
je 0x6e7224
cmp eax, 0x104
ja 0x6e7267
mov edx, eax
xor ecx, ecx
mov word [rsp + rdx*2 + 0x40], cx
lea edx, [rax - 1]
cmp word [rsp + rdx*2 + 0x40], 0x5c
je 0x6e7240
xor edx, edx
mov r9d, 0xffffffff
mov r8, rbx
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov rbp, qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rbp
test eax, eax
je 0x6e7224
mov rdx, qword [rsi]
mov ecx, edx
cmp edx, eax
jl 0x6e726e
cmp rdx, 0x7fffffff
mov eax, 0x7fffffff
mov r8, rbx
mov qword [rsp + 0x38], 0
cmova ecx, eax
mov qword [rsp + 0x20], rdi
xor edx, edx
mov r9d, 0xffffffff
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ecx
mov ecx, 0xfde9
call rbp
test eax, eax
je 0x6e7224
sub eax, 1
cdqe
mov qword [rsi], rax
xor eax, eax
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.006c72f0
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 3
je 0x6e7251
xor eax, eax
mov word [rsp + rdx*2 + 0x40], ax
jmp 0x6e7181
cmp word [rsp + 0x42], 0x3a
jne 0x6e7245
jmp 0x6e7181
mov eax, 0xfffff019
jmp 0x6e7218
mov eax, 0xfffff01a
jmp 0x6e7218
cdqe
mov qword [rsi], rax
mov eax, 0xfffff024
jmp 0x6e7218
Function at 0x6e7490
Capabilities:
Enumerate processes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x150
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
xor edx, edx
mov ecx, 2
mov edi, eax
mov dword [rsp + 0x20], 0x130
lea rsi, [rsp + 0x20]
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.DLL_Process32First
test eax, eax
jne 0x6e74df
jmp 0x6e7500
mov rdx, rsi
mov rcx, rbx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
je 0x6e7500
cmp dword [rsp + 0x28], edi
jne 0x6e74d0
mov esi, dword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, esi
add rsp, 0x150
pop rbx
pop rsi
pop rdi
ret
mov esi, 0xffffffff
jmp 0x6e74e9

Function at 0x6e8970
Capabilities:
Get common file path
Get session user name

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x468
mov rbx, rcx
test rcx, rcx
je 0x6e8ada
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x6e8a73
lea rsi, [rsp + 0x34]
lea rdi, [rsp + 0x250]
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x34], 0x104
mov r8, rsi
mov rdx, rdi
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
test eax, eax
jne 0x6e8a01
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp ebx, 0x7a
je 0x6e8ad0
mov ecx, ebx
call fcn.006c72f0
add rsp, 0x468
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rbp, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [rsp + 0x34], 0x101
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x6e8a90
mov qword [rbx + 0x18], 0
lea r8, [rbx + 0x18]
mov edx, 0xffffffff
mov rcx, rdi
call fcn.006e82f0
test eax, eax
jne 0x6e89f5
mov qword [rbx], 0
mov r8, rbx
mov edx, 0xffffffff
mov rcx, rbp
call fcn.006e82f0
test eax, eax
jne 0x6e8ab0
mov qword [rbx + 8], 0xffffffffffffffff
mov qword [rbx + 0x10], 0
jmp 0x6e89f5
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.006c72f0
add rsp, 0x468
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
je 0x6e8ad0
mov ecx, eax
call fcn.006c72f0
add rsp, 0x468
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x2c], eax
call fcn.006c2850
mov eax, dword [rsp + 0x2c]
jmp 0x6e89f5
mov eax, 0xfffff027
jmp 0x6e89f5
mov eax, 0xfffff019
jmp 0x6e89f5
Function at 0x6e8cb0
Capabilities:
Query environment variable

Disassembly:
push r12
mov eax, 0x10050
push rbp
push rdi
push rsi
push rbx
call fcn.00911360
sub rsp, rax
test rdx, rdx
mov rbp, rdx
mov rbx, r8
sete dl
test r8, r8
sete al
or dl, al
jne 0x6e8e30
test rcx, rcx
je 0x6e8e30
cmp qword [r8], 0
je 0x6e8e30
lea r8, [rsp + 0x48]
mov edx, 0xffffffff
call fcn.006e88a0
mov esi, eax
test eax, eax
je 0x6e8d15
mov eax, esi
add rsp, 0x10050
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea r12, [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov r8d, 0x7fff
mov rdx, r12
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
mov rcx, qword [rsp + 0x48]
mov edi, eax
call fcn.006c2850
cmp rdi, 0x7ffe
ja 0x6e8d72
test rdi, rdi
jne 0x6e8d8c
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xcb
je 0x6e8e3a
mov ecx, eax
call fcn.006c72f0
mov esi, eax
mov eax, esi
add rsp, 0x10050
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8d, 0x5ce
lea rdx, str.src_win_util.c
lea rcx, str.len___MAX_ENV_VAR_LENGTH
call qword [sym.imp.msvcrt.dll__assert]
xor edx, edx
mov r9d, 0xffffffff
mov r8, r12
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov rdi, qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rdi
test eax, eax
je 0x6e8e20
mov rdx, qword [rbx]
mov eax, eax
cmp rax, rdx
ja 0x6e8e44
mov dword [rsp + 0x28], edx
mov r9d, 0xffffffff
xor edx, edx
mov r8, r12
mov qword [rsp + 0x38], 0
mov ecx, 0xfde9
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rbp
call rdi
test eax, eax
je 0x6e8e20
sub eax, 1
mov qword [rbx], rax
mov eax, esi
add rsp, 0x10050
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x6e8d59
mov esi, 0xfffff019
jmp 0x6e8d05
mov esi, 0xfffff026
jmp 0x6e8d05
mov qword [rbx], rax
mov esi, 0xfffff024
jmp 0x6e8d05
Function at 0x6e9710
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rcx, str.ntdll.dll
mov rdi, qword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
call rdi
mov rsi, rax
test rax, rax
je 0x6e98b4
lea rdx, str.RtlGetVersion
mov rcx, rax
mov rbx, qword [sym.imp.KERNEL32.DLL_GetProcAddress]
call rbx
lea rdx, str.RtlNtStatusToDosError
mov rcx, rsi
mov qword [0x010aa730], rax
call rbx
mov qword [0x010aa758], rax
test rax, rax
je 0x6e98a0
lea rdx, str.NtDeviceIoControlFile
mov rcx, rsi
call rbx
mov qword [0x010aa728], rax
test rax, rax
je 0x6e98a0
lea rdx, str.NtQueryInformationFile
mov rcx, rsi
call rbx
mov qword [0x010aa748], rax
test rax, rax
je 0x6e98a0
lea rdx, str.NtSetInformationFile
mov rcx, rsi
call rbx
mov qword [0x010aa718], rax
test rax, rax
je 0x6e98a0
lea rdx, str.NtQueryVolumeInformationFile
mov rcx, rsi
call rbx
mov qword [0x010aa710], rax
test rax, rax
je 0x6e98a0
lea rdx, str.NtQueryDirectoryFile
mov rcx, rsi
call rbx
cmp qword [0x010aa710], 0
mov qword [0x010aa750], rax
je 0x6e98a0
lea rdx, str.NtQuerySystemInformation
mov rcx, rsi
call rbx
mov qword [0x010aa740], rax
test rax, rax
je 0x6e98a0
lea rdx, str.NtQueryInformationProcess
mov rcx, rsi
call rbx
mov qword [0x010aa738], rax
test rax, rax
je 0x6e98a0
lea rcx, str.kernel32.dll
call rdi
test rax, rax
je 0x6e98b4
mov rcx, rax
lea rdx, str.GetQueuedCompletionStatusEx
call rbx
lea rcx, str.powrprof.dll
mov rsi, qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov qword [0x010aa760], rax
call rsi
test rax, rax
je 0x6e9877
lea rdx, str.PowerRegisterSuspendResumeNotification
mov rcx, rax
call rbx
mov qword [0x010aa768], rax
lea rcx, str.user32.dll
call rsi
test rax, rax
je 0x6e9898
lea rdx, str.SetWinEventHook
mov rcx, rax
call rbx
mov qword [0x010aa720], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rdx, str.GetProcAddress
mov ecx, eax
call fcn.006c7230
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rdx, str.GetModuleHandleA
mov ecx, eax
call fcn.006c7230
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x6e99a0
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rbx
sub rsp, 0x468
xor edx, edx
lea r8, [0x010aa780]
lea rcx, str.0.0.0.0
call fcn.006c5280
test eax, eax
jne 0xa16b00
xor edx, edx
lea r8, [0x010aa790]
lea rcx, [0x00d142a8]
call fcn.006c52d0
test eax, eax
jne 0xa16b00
mov ecx, 0x43
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
je 0x6e9b04
lea rdx, [rsp + 0x40]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x6e9b92
xor r8d, r8d
mov edx, 1
mov ecx, 2
mov rsi, qword [sym.imp.WS2_32.dll_socket]
call rsi
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x6e9b10
lea rax, [rsp + 0x3c]
mov r8d, 0x2005
mov edx, 0xffff
mov dword [rsp + 0x3c], 0x274
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1e0]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x6e9bb4
test byte [rsp + 0x1e2], 2
jne 0x6e9a7d
mov dword [0x010aa774], 1
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
je 0x6e9bc8
xor r8d, r8d
mov edx, 1
mov ecx, 0x17
call rsi
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x6e9b50
lea rax, [rsp + 0x3c]
mov r8d, 0x2005
mov edx, 0xffff
mov dword [rsp + 0x3c], 0x274
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1e0]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x6e9ba0
test byte [rsp + 0x1e2], 2
jne 0x6e9af6
mov dword [0x010aa770], 1
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
je 0x6e9b7e
add rsp, 0x468
pop rbx
pop rsi
ret
mov rbx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbx
lea edx, [rax - 0x273b]
cmp edx, 1
jbe 0x6e9a8f
sub eax, 0x273e
cmp eax, 1
jbe 0x6e9a8f
call rbx
lea rdx, [0x00d142cd]
mov ecx, eax
call fcn.006c7230
nop word cs:[rax + rax]
mov rbx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbx
lea edx, [rax - 0x273b]
cmp edx, 1
jbe 0x6e9b04
sub eax, 0x273e
cmp eax, 1
jbe 0x6e9b04
call rbx
lea rdx, [0x00d142cd]
mov ecx, eax
call fcn.006c7230
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.closesocket
mov ecx, eax
call fcn.006c7230
lea rdx, [0x00d142ab]
mov ecx, eax
call fcn.006c7230
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [0x00d142b6]
mov ecx, eax
call fcn.006c7230
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [0x00d142b6]
mov ecx, eax
call fcn.006c7230
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.closesocket
mov ecx, eax
call fcn.006c7230
nop dword [rax]
Function at 0x6f3500
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rax, qword [rax + 0xc0]
mov rsi, rdx
lea rbp, [r9 + 1]
mov rdx, qword [rdx + 8]
test byte [rax + 0x60], 1
je 0x6f35f5
lea r9, [rbp + r8]
xor eax, eax
cmp r9, rdx
ja 0x6f35ea
mov qword [rsp + 0x28], r8
movq xmm0, qword [rsp + 0x28]
sub rdx, r8
movdqu xmm1, xmmword [rsi + 0x20]
mov rax, qword [rsi + 0x20]
mov qword [rsi + 8], rdx
punpcklqdq xmm0, xmm0
sub qword [rsi + 0x10], r8
paddq xmm0, xmm1
add rax, r8
movups xmmword [rsi + 0x20], xmm0
jmp 0x6f3600
mov ebp, 0x100
mov rdx, r11
mov r9, rbx
xor r8d, r8d
sub rdx, rbx
add rdx, qword [rsi + 0x20]
movzx eax, byte [rdx + r9 - 1]
mov r12, r9
mov rcx, rbx
sub r9, 1
xor rcx, r8
xor r12, r8
add r8, 1
xor eax, edi
or rcx, r12
movzx eax, al
xor rcx, rbx
not rax
sar rcx, 0x3f
or rax, rcx
and r10, rax
cmp rbp, r8
ja 0x6f3585
mov rax, r10
not rax
movzx eax, al
or r10, 0xffffffffffffff00
add rbx, 1
sub rax, 1
and rax, r10
sar rax, 0x3f
and rbx, rax
and eax, 0xfffffffe
sub r11, rbx
not eax
mov qword [rsi + 8], r11
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor eax, eax
cmp rbp, rdx
ja 0x6f35ea
mov rax, qword [rsi + 0x20]
mov rcx, qword [rcx + 0x430]
movzx ebx, byte [rax + rdx - 1]
call fcn.00795110
mov rdi, rbx
mov rcx, rax
call fcn.00795130
test eax, 0x200000
jne 0x6f3664
mov r11, qword [rsi + 8]
add rbp, rbx
mov rax, r11
sub rax, rbp
xor rax, rbp
xor rbp, r11
or rax, rbp
xor rax, r11
sar rax, 0x3f
mov r10, rax
not r10
cmp r11, 0xff
ja 0x6f3570
mov rbp, r11
test r11, r11
jne 0x6f3575
jmp 0x6f35c2
not rbx
add qword [rsi + 8], rbx
mov eax, 1
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret