joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140074890
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1400748b8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400748de
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400748e0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140074939
test ecx, ecx
jle 0x140074919
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140074939
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140074939
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140074960
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140074982
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140074998
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400749b4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400749b6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400749f2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140074a8e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140074a2d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140074a6e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140074a8e
cmp rbx, rax
ja 0x140074a40
test rbx, rbx
je 0x140074a8e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140074ef0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1401c6780]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140074f1d
xor eax, eax
jmp 0x140075089
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140074f57
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140074f57
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140075089
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14007507c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140074f9a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140074fc5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140075081
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140075034
sub eax, 1
je 0x140075034
cmp eax, 2
jne 0x14007507c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140075081
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140075062
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14007507c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140075081
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400f3cc0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400752b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1401c6780]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140075383
cmp byte [rcx + 0x71], 0
je 0x140075383
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14007537f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140075344
sub eax, 1
je 0x140075348
cmp eax, 2
jne 0x14007537f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f3cc0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140075376
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14007537f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14007532c
xor al, al
jmp 0x14007532c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f3cc0
add rsp, 0x60
pop rbx
ret

Function at 0x1400761f0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x280
mov rax, qword [0x1401c6780]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xorps xmm0, xmm0
test eax, eax
js 0x1400762e4
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140076254
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140068070
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
lea r8, [rdx + rax*2]
lea rdx, [rsp + 0x40]
cmova rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.140067a40
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140076309
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400762dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400762dd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f3d24
jmp 0x140076309
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
xor r8d, r8d
lea rdx, [0x14012482f]
mov rcx, rbx
call fcn.140003610
mov rax, rbx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400f3cc0
add rsp, 0x280
pop rbx
ret
Function at 0x14008a130
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1401c6780]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, Ordinal_35
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [rsp + 0x40]
call fcn.140003610
nop
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0xf
jbe 0x14008a186
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140002e80
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x14008a2ab
mov byte [rsp + 0x38], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14008a2ab
mov byte [rsp + 0x39], 3
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x39]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14008a2ab
mov byte [rsp + 0x3a], 3
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x3a]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14008a2ab
mov eax, dword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14008a271
mov rbx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14008a2ab
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
sete bl
jmp 0x14008a2ad
xor bl, bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14008a2ed
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008a2e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008a2e8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f3d24
movzx eax, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400f3cc0
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x14008dc10
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1401c6780]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, qword [rdx]
mov rbx, rcx
xor edx, edx
mov dword [rsp + 0x20], 0x130
lea rcx, [rsp + 0x24]
mov r8d, Ordinal_301
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14008dc7f
mov rax, qword [rbx + 8]
mov ecx, dword [rax]
cmp dword [rsp + 0x28], ecx
je 0x14008dca2
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14008dc61
xor al, al
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400f3cc0
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
mov al, 1
jmp 0x14008dc81

Function at 0x14008dcf0
Capabilities:
Enumerate processes

Disassembly:
add rcx, 8
jmp 0x14008dd20
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x1401c6780]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rdi, qword [rdx]
mov rbx, rcx
xor edx, edx
mov dword [rsp + 0x40], 0x130
lea rcx, [rsp + 0x44]
mov r8d, Ordinal_301
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14008dda9
mov rax, qword [rbx]
lea r8, [rsp + 0x6c]
mov rax, qword [rax]
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14008dd93
inc rax
test ecx, ecx
jne 0x14008dd80
test edx, edx
je 0x14008ddcc
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14008dd71
xor al, al
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400f3cc0
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x180
pop rdi
ret
mov eax, dword [rsp + 0x48]
xorps xmm0, xmm0
mov rcx, qword [rbx + 8]
xorps xmm1, xmm1
movups xmmword [rsp + 0x20], xmm0
mov r8, 0xffffffffffffffff
movdqu xmmword [rsp + 0x30], xmm1
mov dword [rcx], eax
lea rax, [rsp + 0x6c]
inc r8
cmp byte [rax + r8], 0
jne 0x14008ddf3
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.140003610
mov rbx, qword [rbx + 8]
lea rax, [rsp + 0x20]
add rbx, 8
cmp rbx, rax
je 0x14008de79
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14008de54
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14008de4f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14008deae
mov rcx, r8
call fcn.1400f3d24
movups xmm0, xmmword [rsp + 0x20]
mov qword [rbx + 0x10], 0
mov eax, reloc.WS2_32.dll_ntohs
movups xmm1, xmmword [rsp + 0x30]
mov byte [rsp + 0x20], 0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
jmp 0x14008de7e
mov rax, qword [rsp + 0x38]
cmp rax, 0xf
jbe 0x14008deba
mov rcx, qword [rsp + 0x20]
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008deb5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008deb5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f3d24
mov al, 1
jmp 0x14008ddab
Function at 0x14008dd20
Capabilities:
Enumerate processes

Disassembly:
add rcx, 8
jmp 0x14008dd20
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x1401c6780]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rdi, qword [rdx]
mov rbx, rcx
xor edx, edx
mov dword [rsp + 0x40], 0x130
lea rcx, [rsp + 0x44]
mov r8d, Ordinal_301
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14008dda9
mov rax, qword [rbx]
lea r8, [rsp + 0x6c]
mov rax, qword [rax]
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14008dd93
inc rax
test ecx, ecx
jne 0x14008dd80
test edx, edx
je 0x14008ddcc
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14008dd71
xor al, al
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400f3cc0
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x180
pop rdi
ret
mov eax, dword [rsp + 0x48]
xorps xmm0, xmm0
mov rcx, qword [rbx + 8]
xorps xmm1, xmm1
movups xmmword [rsp + 0x20], xmm0
mov r8, 0xffffffffffffffff
movdqu xmmword [rsp + 0x30], xmm1
mov dword [rcx], eax
lea rax, [rsp + 0x6c]
inc r8
cmp byte [rax + r8], 0
jne 0x14008ddf3
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.140003610
mov rbx, qword [rbx + 8]
lea rax, [rsp + 0x20]
add rbx, 8
cmp rbx, rax
je 0x14008de79
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14008de54
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14008de4f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14008deae
mov rcx, r8
call fcn.1400f3d24
movups xmm0, xmmword [rsp + 0x20]
mov qword [rbx + 0x10], 0
mov eax, reloc.WS2_32.dll_ntohs
movups xmm1, xmmword [rsp + 0x30]
mov byte [rsp + 0x20], 0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
jmp 0x14008de7e
mov rax, qword [rsp + 0x38]
cmp rax, 0xf
jbe 0x14008deba
mov rcx, qword [rsp + 0x20]
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008deb5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008deb5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400f3d24
mov al, 1
jmp 0x14008ddab
Function at 0x1400971f0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400972d2
call fcn.1400a9070
test al, al
jne 0x1400972d2
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x140097222
mov r8, rdi
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov rcx, rbx
call fcn.1400b35b0
test rax, rax
je 0x140097267
sub rax, rbx
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov r8, rax
mov rcx, rbx
call fcn.1400b35b0
mov rsi, rax
test rax, rax
je 0x140097267
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x14009729b
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.1400a2510
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x140097280
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14009da60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
cmp byte [rcx + 0xa8f], 0
mov rbp, r9
mov r14, r8
movsxd rsi, edx
mov rdi, rcx
je 0x14009db29
cmp qword [rcx + 0x258], 0
je 0x14009dade
mov qword [rsp + 0x40], rbx
call fcn.140093d50
mov dl, 1
mov rcx, rdi
movzx ebx, al
call fcn.140093ea0
mov rcx, qword [rdi + 0x1d0]
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov r8, r14
mov rcx, rdi
mov edx, esi
call qword [rdi + 0x258]
movzx edx, bl
mov rcx, rdi
call fcn.140093ea0
mov rbx, qword [rsp + 0x40]
jmp 0x14009db29
mov ecx, esi
test edx, edx
je 0x14009daee
sub ecx, 1
je 0x14009daee
cmp ecx, 1
jne 0x14009db29
mov r9, qword [rdi + 0x1c8]
lea rax, [0x1400fb668]
mov edx, 2
lea rcx, [rsi + rsi*2]
add rcx, rax
lea r8d, [rdx - 1]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r9, qword [rdi + 0x1c8]
mov r8d, 1
mov rdx, rbp
mov rcx, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1400a0660
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
cdqe
add rsp, 0x28
ret
Function at 0x1400a5f30
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 1
mov edx, ebx
xor ecx, ecx
xor ebp, ebp
call qword [case.0x14009891b.1]
mov rdi, rax
test rax, rax
je 0x1400a5fad
nop word [rax + rax]
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
mov rbp, rdi
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
je 0x1400a5fd8
cmp ebx, esi
je 0x1400a5fd8
cmp ebx, 0x8000
ja 0x1400a5fd8
cmp ebx, esi
jb 0x1400a5fd3
mov edx, ebx
mov rcx, rdi
call qword [case.0x14009891b.1]
mov rdi, rax
test rax, rax
jne 0x1400a5f70
mov rcx, rbp
call qword [case.0x14009891b.0]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rdi
jmp 0x1400a5fb8
mov rcx, rdi
jmp 0x1400a5fb0
Function at 0x1400b3d60
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
movaps xmmword [rsp + 0x50], xmm6
lea rcx, [rsp + 0x30]
mov rdi, rdx
call fcn.1400975e0
mov rcx, rbx
movups xmm6, xmmword [rax]
call case.0x14009891b.2
mov rcx, rdi
mov rsi, rax
call case.0x14009891b.2
mov r8d, 1
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x1400b3e10
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.1400975e0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
call fcn.140097670
cmp rax, 0x3e8
ja 0x1400b3e41
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x1400b3dc0
test rsi, rsi
je 0x1400b3e1d
mov rcx, rsi
call case.0x14009891b.0
test rbx, rbx
je 0x1400b3e2a
mov rcx, rbx
call case.0x14009891b.0
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
test rsi, rsi
je 0x1400b3e4e
mov rcx, rsi
call case.0x14009891b.0
test rbx, rbx
je 0x1400b3e5b
mov rcx, rbx
call case.0x14009891b.0
mov eax, 1
jmp 0x1400b3e2c
Function at 0x1400b43c0
Capabilities:
Resolve dns

Disassembly:
push rdi
push r12
push r13
push r15
sub rsp, 0x28
mov r13, r9
xor edi, edi
mov qword [r9], rdi
xor r15d, r15d
lea r9, [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r12d, eax
test eax, eax
jne 0x1400b455e
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x1400b453e
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x20], r14
nop
mov rax, qword [rsi + 0x18]
test rax, rax
je 0x1400b442e
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400b4420
inc rbx
jmp 0x1400b4430
xor ebx, ebx
mov eax, dword [rsi + 4]
cmp eax, 2
jne 0x1400b443d
lea ebp, [rax + 0xe]
jmp 0x1400b4449
cmp eax, 0x17
jne 0x1400b44e1
lea ebp, [rax + 5]
cmp qword [rsi + 0x20], 0
je 0x1400b44e1
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x1400b44e1
cmp rax, rbp
jb 0x1400b44e1
lea rcx, [rbp + 0x30]
add rcx, rbx
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x1400b44f0
mov ecx, dword [rsi]
mov r8, rbp
mov dword [rax], ecx
mov ecx, dword [rsi + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rsi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rsi + 0xc]
mov dword [rax + 0xc], ecx
lea rcx, [r14 + 0x30]
mov dword [rax + 0x10], ebp
xor eax, eax
mov qword [r14 + 0x18], rax
mov qword [r14 + 0x28], rax
mov qword [r14 + 0x20], rcx
mov rdx, qword [rsi + 0x20]
call sub.VCRUNTIME140.dll_memcpy
test rbx, rbx
je 0x1400b44ce
mov rcx, qword [r14 + 0x20]
mov r8, rbx
add rcx, rbp
mov qword [r14 + 0x18], rcx
mov rdx, qword [rsi + 0x18]
call sub.VCRUNTIME140.dll_memcpy
test rdi, rdi
cmove rdi, r14
test r15, r15
je 0x1400b44de
mov qword [r15 + 0x28], r14
mov r15, r14
mov rsi, qword [rsi + 0x28]
test rsi, rsi
jne 0x1400b4410
jmp 0x1400b44f6
mov r12d, 8
mov rcx, qword [rsp + 0x68]
mov r14, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x58]
test rcx, rcx
je 0x1400b4510
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r12d, r12d
je 0x1400b4539
test rdi, rdi
je 0x1400b4535
nop word [rax + rax]
mov rbx, qword [rdi + 0x28]
mov rcx, rdi
call qword [case.0x14009891b.0]
mov rdi, rbx
test rbx, rbx
jne 0x1400b4520
xor edi, edi
jmp 0x1400b454d
test rdi, rdi
jne 0x1400b454d
mov r12d, 0x2af9
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rsi, qword [rsp + 0x60]
mov eax, r12d
mov rbx, qword [rsp + 0x50]
mov qword [r13], rdi
add rsp, 0x28
pop r15
pop r13
pop r12
pop rdi
ret

Function at 0x1400b4850
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex
test rax, rax
je 0x1400b4886
cmp rax, 0xffffffffffffffff
cmovne rbx, rax
mov rax, rbx
add rsp, 0x30
pop rbx
ret
add rsp, 0x30
pop rbx
ret