joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400370a0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
mov rdi, rcx
lea rsi, [rsp + 0x78]
mov rcx, rsi
call fcn.14003683c
mov rsi, qword [rsi]
test rsi, rsi
je 0x1400371cc
mov qword [rsp + 0x38], rdi
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rax], 2
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor edi, edi
mov r14d, 0xffffffff
xor r12d, r12d
cmp r8, 0x201
jae 0x140037127
lea r13, [rsp + 0x78]
mov ebx, 0x200
mov rbp, r8
jmp 0x140037152
sub r8, r12
mov rax, rdi
sub rax, r12
cmp rax, r8
jb 0x1400371ab
cmp rdi, r14
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rsp + 0x70], r12
mov r13, qword [rsp + 0x28]
mov rbx, r12
mov rbp, r12
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, rsi
mov rdx, r13
mov r8d, ebp
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov r15d, eax
test eax, eax
jne 0x14003717a
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1400371f7
mov r8d, r15d
cmp rbp, r8
jne 0x1400371a3
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140037286
add rbp, rbp
cmp rbp, r14
cmovae rbp, r14
mov r8, rbp
jmp 0x14003710f
jb 0x14003710f
jmp 0x1400371df
lea rcx, [rsp + 0x60]
mov rdx, r12
call fcn.140087852
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov rdi, qword [rsp + 0x68]
jmp 0x140037135
lea rcx, [rsp + 0x78]
call fcn.140036968
mov byte [rdi + 0x18], 2
jmp 0x140037271
cmp rbx, r8
jb 0x140037286
lea rcx, [rsp + 0x40]
mov rdx, r13
call fcn.140031efe
jmp 0x14003720f
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x58], 2
mov rbx, qword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
test rdi, rdi
je 0x140037232
mov rcx, qword [0x1400ea708]
xor edx, edx
mov r8, qword [rsp + 0x28]
call qword [sym.imp.kernel32.dll_HeapFree]
cmp byte [rsp + 0x58], 2
jne 0x140037249
mov byte [rbx + 0x18], 2
mov rcx, qword [rsp + 0x40]
call fcn.14000278e
jmp 0x14003725a
movups xmm0, xmmword [rsp + 0x40]
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx], xmm0
test r14, r14
je 0x140037271
mov rcx, qword [0x1400ea708]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x478
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x140037b26
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x1400be548]
lea rax, [rsp + 0x60]
movaps xmmword [rax], xmm0
mov ecx, 0xffffffff
cmp r9, rcx
cmovb rcx, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x140037b90
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x140037b9f
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x140037bd7
cmp eax, 0x103
je 0x140037be1
test eax, eax
js 0x140037bbc
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x140037bd7
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x58]
mov byte [rcx + 4], 0
mov dword [rcx], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
lea rdx, [rsp + 0x78]
mov qword [rdx], rax
mov qword [rdx + 8], 1
lea rax, [rsp + 0x50]
mov qword [rdx + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rdx + 0x18], xmm0
call fcn.1400332db
mov rcx, rax
call fcn.14003332c
mov ecx, 7
int 0x29
ud2
Function at 0x140039b6e
Capabilities:
Create udp socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov edi, r8d
mov rsi, rcx
test dx, dx
mov eax, 2
mov ebx, 0x17
cmove ebx, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, r8d
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x140039bbf
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x140039c30
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x140039bd3
cmp eax, 0x2739
jne 0x140039c1d
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x140039c17
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call qword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
je 0x140039c38
mov qword [rsi + 8], rdi
jmp 0x140039bb6
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.ws2_32.dll_closesocket]

Function at 0x140039c62
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
mov r8d, 0x7fffffff
cmp r9, r8
cmovb r8, r9
mov rcx, rdx
mov rdx, rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
je 0x140039c92
cdqe
jmp 0x140039ca1
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x274a
jne 0x140039ca9
xor eax, eax
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140039cba
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0x20
pop rsi
ret

Function at 0x140039cc3
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov rax, r8
mov rsi, rcx
mov r8d, 0x7fffffff
cmp r9, r8
cmovb r8, r9
mov rcx, rdx
mov rdx, rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
je 0x140039cf9
cdqe
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140039d10
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0x20
pop rsi
ret
Function at 0x140039ebc
Capabilities:
Create process on windows
Encode data using base64
Get common file path
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x6d8
movaps xmmword [rsp + 0x6c0], xmm6
mov r12, rdx
mov rdi, rcx
mov dword [rsp + 0x278], 0
mov al, byte [rdx + 0x68]
test al, al
sete cl
mov rbx, qword [rdx + 0x60]
test rbx, rbx
sete dl
and dl, cl
mov byte [rsp + 0x5e], dl
mov qword [rsp + 0x68], r12
je 0x140039f13
xor eax, eax
mov qword [rsp + 0x50], rax
jmp 0x14003a930
mov qword [rsp + 0x60], rdi
xor ecx, ecx
mov qword [rsp + 0x228], rcx
mov qword [rsp + 0x238], rcx
test al, al
jne 0x14003a11f
mov qword [rsp + 0x50], rbx
call qword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x14003d2c5
mov r12, rax
lea r15, [rsp + 0x160]
lea rdi, [rsp + 0x2c0]
mov rsi, rax
call sub.kernel32.dll_GetLastError

Function at 0x14003d2f8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rcx
lea rdi, [rsp + 0x20]
mov rcx, rdi
call fcn.14003d381
mov rdi, qword [rdi]
test rdi, rdi
je 0x14003d33e
mov rbx, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14003d359
mov qword [rsi], rdi
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r14
jmp 0x14003d34f
lea rcx, [rsp + 0x20]
call fcn.140036968
mov qword [rsi], 0
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsi], 0
test rbx, rbx
je 0x14003d34f
mov rcx, qword [0x1400ea708]
xor edx, edx
mov r8, rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.kernel32.dll_HeapFree]

Function at 0x14003e171
Capabilities:
Create pipe

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x47], dl
movzx eax, dl
mov ecx, 0x40080002
sub ecx, eax
mov dword [rsp + 0x50], ecx
xor r13d, r13d
mov r15d, 8
mov dil, 1
lea rbx, [rsp + 0x58]
Function at 0x14005324f
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1e8
movaps xmmword [rsp + 0x1d0], xmm6
mov qword [rsp + 0x58], rcx
add r8, rdx
lea rax, [rsp + 0x160]
mov qword [rax], rdx
mov qword [rax + 8], r8
lea rcx, [rsp + 0xd0]
mov qword [rcx], rax
mov byte [rcx + 8], 0
call fcn.140045d2d
test al, 1
jne 0x1400532a5
mov esi, 1
xor ebx, ebx
jmp 0x140053373
mov esi, edx
mov ecx, 8
xor edx, edx
call fcn.140012d18
mov r14, rax
mov byte [rax], sil
lea rsi, [rsp + 0x60]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], 1
mov rax, qword [rsp + 0xd0]
mov cl, byte [rsp + 0xd8]
lea r15, [rsp + 0x108]
mov qword [r15], rax
mov byte [r15 + 8], cl
mov edi, 1
Function at 0x14007f8fa
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x228
xor edi, edi
xor ecx, ecx
call sub.user32.dll_GetKeyboardLayout
mov rsi, rax
xchg qword [0x1400ea7a0], rax
cmp rsi, rax
je 0x14007f9bc
lea rbx, [rsp + 0x28]
mov r8d, pe_nt_image_headers64
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov word [rbx + 0x11], 0x8080
lea r14, [rsp + 0x128]
mov r8d, pe_nt_image_headers64
mov rcx, r14
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r15d, 0xff
xor r12d, r12d
test r12b, 1
jne 0x14007f9d8
lea r13d, [rdi + 1]
cmp edi, r15d
setae r12b
cmovae r13d, r15d
mov rcx, r14
mov edx, edi
mov r8, rsi
call fcn.140080754
mov ebp, eax
mov rcx, rbx
mov edx, edi
mov r8, rsi
call fcn.140080754
mov edi, r13d
cmp ebp, eax
je 0x14007f965
mov edi, r13d
cmp ebp, 0x110000
je 0x14007f965
mov edi, r13d
cmp eax, 0x110000
je 0x14007f965
mov al, 1
xchg byte [0x1400ea7a8], al
jmp 0x14007f9c6
mov al, byte [0x1400ea7a8]
test al, al
je 0x14007f9e0
mov ecx, 0xa5
call sub.user32.dll_GetKeyState
test ax, ax
setns bl
jmp 0x14007f9e2
xor eax, eax
xchg byte [0x1400ea7a8], al
mov bl, 1
mov ecx, 0x10
call sub.user32.dll_GetKeyState
movzx esi, ax
shr esi, 0xf
lea edi, [rsi*4]
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
lea r14d, [rsi*4 + 0x20]
cmovns r14d, edi
test bl, bl
cmove r14d, edi
mov ecx, 0x12
call sub.user32.dll_GetKeyState
lea esi, [r14 + 0x100]
test ax, ax
cmovns esi, r14d
test bl, bl
cmove esi, r14d
mov ecx, 0x5b
call sub.user32.dll_GetKeyState
test ax, ax
js 0x14007fa5c
mov ecx, 0x5c
call sub.user32.dll_GetKeyState
test ax, ax
js 0x14007fa5c
and esi, 0xf7ff
jmp 0x14007fa62
or esi, 0x800
mov eax, esi
add rsp, 0x228
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14008589c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x1400858e6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400858e6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400858e6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400858e6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400858e6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400858e8
xor al, al
add rsp, 0x28
ret

Function at 0x140087078
Capabilities:
Link many functions at runtime

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rcx, [0x1400bd547]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x1400870cd
mov rdi, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1400870cd
mov rsi, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1400870cd
mov r14, rax
xor edi, edi
jmp 0x140087155
lea rcx, [0x1400e3eb2]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x1400871bf
mov rsi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1400871bf
mov rbx, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1400871bf
mov rdi, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1400871bf
mov rsi, rax
lea rcx, [rsp + 0x20]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
jne 0x1400871bf
mov r14, qword [rsp + 0x20]
mov al, byte [0x1400ea9e0]
mov ecx, 0x18
mov edx, 8
call fcn.140010eab
test rax, rax
je 0x1400871c3
mov rbx, rax
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], r14
xor eax, eax
lock cmpxchg qword [0x1400ea680], rbx
je 0x1400871b2
mov rsi, rax
cmp qword [rbx], 0
je 0x14008719d
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [0x1400ea708]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
ud2
mov ecx, 8
mov edx, 0x18
call fcn.140085d53
ud2
Function at 0x14008760a
Capabilities:
Link many functions at runtime

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rcx, [0x1400bd547]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x14008765f
mov rdi, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14008765f
mov rsi, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14008765f
mov r14, rax
xor edi, edi
jmp 0x1400876e7
lea rcx, [0x1400e3eb2]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x140087751
mov rsi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140087751
mov rbx, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140087751
mov rdi, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140087751
mov rsi, rax
lea rcx, [rsp + 0x20]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
jne 0x140087751
mov r14, qword [rsp + 0x20]
mov al, byte [0x1400ea9e0]
mov ecx, 0x18
mov edx, 8
call fcn.140010eab
test rax, rax
je 0x140087755
mov rbx, rax
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], r14
xor eax, eax
lock cmpxchg qword [0x1400ea698], rbx
je 0x140087744
mov rsi, rax
cmp qword [rbx], 0
je 0x14008772f
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [0x1400ea708]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
ud2
mov ecx, 8
mov edx, 0x18
call fcn.140085d53
ud2
Function at 0x140087bff
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rcx
mov rcx, r8
inc rcx
je 0x140087d51
mov edi, r9d
mov rbx, r8
mov r14, rdx
xor edx, edx
call fcn.140012d18
lea rcx, [rsp + 0x28]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], 0
lea r8, [r14 + rbx]
mov rdx, r14
call fcn.140012ad1
xor ecx, ecx
mov rdx, r14
mov r8, rbx
call fcn.140015a89
test rax, rax
je 0x140087c9c
mov r8, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
test r8, r8
je 0x140087cbf
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
test rbx, rbx
je 0x140087d46
mov rcx, qword [0x1400ea708]
xor edx, edx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.kernel32.dll_HeapFree]
mov rax, qword [rsp + 0x38]
lea rcx, [rsp + 0x40]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movaps xmmword [rcx], xmm0
call fcn.140012f3b
mov rbx, rax
mov r14, rdx
jmp 0x140087cc4
mov r14, qword [rsp + 0x38]
xorps xmm0, xmm0
lea r8, [rsp + 0x40]
movaps xmmword [r8], xmm0
movaps xmmword [r8 + 0x20], xmm0
movaps xmmword [r8 + 0x10], xmm0
mov dword [r8 + 8], 1
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov rcx, rbx
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x140087d16
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x140087d29
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
mov byte [rbx], 0
test r14, r14
je 0x140087d46
mov rcx, qword [0x1400ea708]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
ud2
Function at 0x140011203
Capabilities:
Terminate process

Disassembly:
jmp 0x1400164b0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011299
Capabilities:
Parse pe header

Disassembly:
jmp 0x140017800
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140017820
xor al, al
jmp 0x1400178a1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140017833
xor al, al
jmp 0x1400178a1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001785d
xor al, al
jmp 0x1400178a1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140017871
xor al, al
jmp 0x1400178a1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140017883
xor al, al
jmp 0x1400178a1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001789f
xor al, al
jmp 0x1400178a1
mov al, 1
add rsp, 0x38
ret
Function at 0x140011447
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x140013040
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2c8
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0xb2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2e8]
lea rcx, [0x14002601e]
call fcn.1400113a7
mov qword [rbp + 8], 0
mov rcx, qword [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x68], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x68]
mov eax, dword [rcx + rax + 0x88]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0xa8]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xa8]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x108], rax
mov dword [rbp + 0x124], 0
jmp 0x14001314f
mov eax, dword [rbp + 0x124]
inc eax
mov dword [rbp + 0x124], eax
mov rax, qword [rbp + 0xa8]
mov eax, dword [rax + 0x14]
cmp dword [rbp + 0x124], eax
jae 0x14001322b
mov eax, dword [rbp + 0x124]
mov rcx, qword [rbp + 0xe8]
mov eax, dword [rcx + rax*4]
mov dword [rbp + 0x144], eax
mov eax, dword [rbp + 0x144]
mov rcx, qword [rbp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x168], rax
mov rax, qword [rbp + 0x168]
mov qword [rbp + 0x188], rax
mov qword [rbp + 0x1a8], 0
mov rcx, qword [rbp + 0x188]
call fcn.14001143d
mov dword [rbp + 0x1c4], eax
mov eax, dword [rbp + 0x2c8]
cmp dword [rbp + 0x1c4], eax
jne 0x140013226
mov eax, dword [rbp + 0x124]
mov rcx, qword [rbp + 0x108]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rbp + 0xc8]
mov eax, dword [rcx + rax*4]
mov qword [rbp + 0x1a8], rax
mov rax, qword [rbp + 0x1a8]
mov rcx, qword [rbp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov r9, qword [rbp + 8]
mov r8d, dword [rbp + 0x1c4]
mov rdx, qword [rbp + 0x188]
lea rcx, str._s_:_0x_x_:__p_n
call fcn.14001119a
mov rax, qword [rbp + 8]
jmp 0x14001322b
jmp 0x140013141
lea rsp, [rbp + 0x2a8]
pop rdi
pop rbp
ret
Function at 0x140011f70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov byte [rsp + 8], cl
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x4a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
movzx ecx, byte [rsp + 0x148]
lea rcx, [0x140026005]
call fcn.1400113a7
mov byte [rbp + 4], 0
jmp 0x140011fbe
movzx eax, byte [rbp + 4]
inc al
mov byte [rbp + 4], al
movzx eax, byte [rbp + 4]
cmp eax, 4
jge 0x140012043
mov byte [rbp + 0x24], 0
jmp 0x140011fd6
movzx eax, byte [rbp + 0x24]
inc al
mov byte [rbp + 0x24], al
movzx eax, byte [rbp + 0x24]
cmp eax, 4
jge 0x14001203e
movzx eax, byte [rbp + 4]
mov rcx, qword [rbp + 0x128]
lea rax, [rcx + rax*4]
movzx ecx, byte [rbp + 0x24]
movzx edx, byte [rbp + 0x120]
shl edx, 2
movzx r8d, byte [rbp + 4]
shl r8d, 2
lea edx, [r8 + rdx*4]
movzx r8d, byte [rbp + 0x24]
add edx, r8d
movsxd rdx, edx
mov r8, qword [rbp + 0x130]
movzx edx, byte [r8 + rdx]
movzx eax, byte [rax + rcx]
xor eax, edx
movzx ecx, byte [rbp + 0x24]
movzx edx, byte [rbp + 4]
mov r8, qword [rbp + 0x128]
lea rdx, [r8 + rdx*4]
mov byte [rdx + rcx], al
jmp 0x140011fcd
jmp 0x140011fb5
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140013750
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x4a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x148]
lea rcx, [0x140026005]
call fcn.1400113a7
mov byte [rbp + 4], 0
jmp 0x140013795
movzx eax, byte [rbp + 4]
inc al
mov byte [rbp + 4], al
movzx eax, byte [rbp + 4]
cmp eax, 4
jge 0x1400137f4
mov byte [rbp + 0x24], 0
jmp 0x1400137ad
movzx eax, byte [rbp + 0x24]
inc al
mov byte [rbp + 0x24], al
movzx eax, byte [rbp + 0x24]
cmp eax, 4
jge 0x1400137f2
movzx eax, byte [rbp + 0x24]
mov rcx, qword [rbp + 0x120]
lea rax, [rcx + rax*4]
movzx ecx, byte [rbp + 4]
movzx eax, byte [rax + rcx]
lea rcx, [0x14001dcb0]
movzx edx, byte [rbp + 0x24]
mov r8, qword [rbp + 0x120]
lea rdx, [r8 + rdx*4]
movzx r8d, byte [rbp + 4]
movzx eax, byte [rcx + rax]
mov byte [rdx + r8], al
jmp 0x1400137a4
jmp 0x14001378c
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret