joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e060
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov r15, rdx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32_CreateFileA
mov rdi, rax
test rdi, rdi
je 0x42e14a
lea rcx, [rbp - 8]
call sub.KERNEL32_GetLocalTime
movzx r8d, word [rbp - 6]
movzx r9d, word [rbp - 2]
movzx eax, word [rbp - 8]
movzx ecx, word [rbp]
movzx edx, word [rbp + 2]
movzx ebx, word [rbp + 4]
movzx esi, word [rbp + 6]
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
lea rbx, [0x00444720]
lea rdx, [0x00437a80]
mov rcx, rbx
call sub.USER32_wsprintfA
mov rcx, rbx
call fcn.004212a0
mov qword [rsp + 0x20], 0
lea r14, [rbp - 8]
mov rcx, rdi
mov rdx, rbx
mov r8d, eax
mov r9, r14
call sub.KERNEL32_WriteFile
mov rcx, r15
call fcn.004212a0
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, r15
mov r8d, eax
mov r9, r14
call sub.KERNEL32_WriteFile
mov rcx, rdi
call sub.KERNEL32_CloseHandle
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret

Function at 0x42e170
Capabilities:
Write file on windows

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc0
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov rcx, qword [0x00444758]
test rcx, rcx
mov rax, qword [0x00444750]
jne 0x42e245
test rax, rax
jne 0x42e245
cmp dword [0x004416b0], 0
je 0x42e28f
lea rdi, [rbp - 0x50]
xor ecx, ecx
mov r8d, 0x80
mov rdx, rdi
call sub.KERNEL32_GetModuleFileNameA
mov edx, 0x5c
mov rcx, rdi
call fcn.0042df10
test rax, rax
jne 0x42e1ed
mov edx, 0x3a
mov rcx, rdi
call fcn.0042df10
test rax, rax
je 0x42e1f3
inc rax
mov rdi, rax
mov dword [rbp + 0x3c], 0
call sub.KERNEL32_GetVersion
mov r9d, 0x12010
test eax, eax
jns 0x42e233
call sub.KERNEL32_GetCurrentThreadId
lea rdx, [0x0042e350]
lea r8, [rbp + 0x3c]
mov ecx, eax
call sub.USER32_EnumThreadWindows
cmp dword [rbp + 0x3c], 0
mov eax, 0x11010
mov r9d, 0x12010
cmove r9d, eax
xor ecx, ecx
mov rdx, rsi
mov r8, rdi
call sub.USER32_MessageBoxA
jmp 0x42e303
test rax, rax
je 0x42e25f
cmp eax, 0xffffffff
je 0x42e303
mov rcx, rsi
call rax
mov rcx, qword [0x00444758]
test rcx, rcx
je 0x42e303
cmp ecx, 0xffffffff
je 0x42e303
cmp byte [rcx], 0
je 0x42e303
mov rdx, rsi
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.0042e060
mov ecx, 0xfffffff4
call sub.KERNEL32_GetStdHandle
mov rdi, rax
mov qword [rsp + 0x20], 0
lea r14, [0x00437ab0]
lea rbx, [rbp - 0x50]
mov r8d, 2
mov rcx, rdi
mov rdx, r14
mov r9, rbx
call sub.KERNEL32_WriteFile
mov rcx, rsi
call fcn.004212a0
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, eax
mov r9, rbx
call sub.KERNEL32_WriteFile
mov qword [rsp + 0x20], 0
mov r8d, 2
mov rcx, rdi
mov rdx, r14
mov r9, rbx
call sub.KERNEL32_WriteFile
nop
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x42e9f0
Capabilities:
Terminate process

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, r8d
mov ebx, edx
mov edi, ecx
test edi, edi
je 0x42ea15
test ebx, ebx
je 0x42ea2c
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rcx, r9
call fcn.0042e800
call fcn.0042fd80
call qword [0x00441670]
test ebx, ebx
jne 0x42ea0c
test edi, edi
jne 0x42ea3c
call qword [0x00441678]
call qword [0x00441680]
mov ecx, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
jmp fcn.0042fc70
push rbp
mov rbp, rsp
mov eax, ecx
mov r9, qword [0x00439090]
mov ecx, 1
xor edx, edx
mov r8d, eax
pop rbp
jmp 0x42e9f0

Function at 0x42ea70
Capabilities:
Terminate process

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, r8d
mov ebx, edx
mov edi, ecx
test edi, edi
je 0x42ea15
test ebx, ebx
je 0x42ea2c
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rcx, r9
call fcn.0042e800
call fcn.0042fd80
call qword [0x00441670]
test ebx, ebx
jne 0x42ea0c
test edi, edi
jne 0x42ea3c
call qword [0x00441678]
call qword [0x00441680]
mov ecx, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
jmp fcn.0042fc70
push rbp
mov rbp, rsp
mov eax, ecx
mov r9, qword [0x00439090]
mov ecx, 1
xor edx, edx
mov r8d, eax
pop rbp
jmp 0x42e9f0

Function at 0x42ea90
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
mov eax, ecx
mov r9, qword [0x00439090]
mov ecx, 1
xor edx, edx
mov r8d, eax
pop rbp
jmp 0x42e9f0
Function at 0x42f6a0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rax, qword [0x004547c0]
test rax, rax
je 0x42f6e9
mov rcx, qword [rax]
test rcx, rcx
je 0x42f760
add rax, 8
xor esi, esi
nop
cmp byte [rcx], 1
sbb esi, 0
inc esi
mov rcx, qword [rax]
add rax, 8
test rcx, rcx
jne 0x42f6d0
jmp 0x42f791
mov r14, qword [0x00454840]
test r14, r14
jne 0x42f71c
call sub.KERNEL32_GetEnvironmentStrings
mov r14, rax
mov qword [0x00454840], r14
test r14, r14
jne 0x42f71c
lea rcx, [0x00437b50]
call fcn.0042e330
mov r14, qword [0x00454840]
mov rcx, r14
call fcn.004212a0
xor r15d, r15d
test eax, eax
je 0x42f764
xor edi, edi
xor esi, esi
mov rbx, r14
nop word cs:[rax + rax]
lea edi, [rax + rdi + 1]
inc esi
cdqe
lea rbx, [rbx + rax + 1]
mov rcx, rbx
call fcn.004212a0
test eax, eax
jne 0x42f740
inc edi
movsxd rbx, edi
jmp 0x42f76b
xor esi, esi
jmp 0x42f791
mov ebx, 1
xor esi, esi
mov rcx, rbx
call fcn.0041bdb0
mov qword [0x004547b8], rax
test rax, rax
je 0x42f86b
mov rcx, rax
mov rdx, r14
mov r8, rbx
call fcn.00420890
lea eax, [rsi + 4]
mov dword [0x004547c8], eax
add esi, 5
movsxd rcx, esi
mov edx, 8
call fcn.0041bda0
mov rdi, rax
test rdi, rdi
je 0x42f802
mov r14, qword [0x004547c0]
test r14, r14
je 0x42f807
mov rdx, qword [r14]
test rdx, rdx
je 0x42f856
lea rax, [r14 + 8]
xor ecx, ecx
cmp byte [rdx], 0
je 0x42f7f0
mov rdx, qword [rax - 8]
movsxd rbx, ecx
mov qword [rdi + rbx*8], rdx
jmp 0x42f7f2
dec ecx
inc ecx
mov rdx, qword [rax]
add rax, 8
test rdx, rdx
jne 0x42f7d0
jmp 0x42f851
xor r15d, r15d
jmp 0x42f86b
mov rbx, qword [0x004547b8]
mov rcx, rbx
call fcn.004212a0
test eax, eax
je 0x42f85e
movabs r15, 0x100000000
mov rsi, rdi
nop word [rax + rax]
mov qword [rsi], rbx
shl rax, 0x20
add rax, r15
sar rax, 0x20
add rbx, rax
mov rcx, rbx
call fcn.004212a0
add rsi, 8
test eax, eax
jne 0x42f830
test r14, r14
je 0x42f85e
mov rcx, r14
call fcn.0041bdc0
mov qword [0x004547c0], rdi
mov r15d, 1
mov eax, r15d
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret

Function at 0x42fed0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov rbx, r9
mov edi, r8d
mov r14, rdx
mov rsi, rcx
mov dword [rbp - 0x10], 1
mov qword [rbp - 8], rsi
cmp edi, 1
jne 0x42ff31
mov eax, dword [0x004548c0]
lea ecx, [rax + 1]
mov dword [0x004548c0], ecx
test eax, eax
jne 0x42ff31
call sub.KERNEL32_GetEnvironmentStrings
mov qword [0x00454840], rax
mov rcx, qword [rsi + 0x88]
call fcn.004226d0
lea rcx, [rbp - 0x10]
xor edx, edx
call fcn.0042fc80
mov rcx, r14
mov edx, edi
mov r8, rbx
call qword [rsi + 0x30]
mov esi, eax
test edi, edi
jne 0x42ff7c
dec dword [0x004548c0]
jne 0x42ff7c
mov rcx, r14
call fcn.0042e800
lea rcx, [rbp - 0x10]
mov edx, 1
call fcn.0042fc80
mov rcx, qword [0x00454840]
test rcx, rcx
je 0x42ff7c
call sub.KERNEL32_FreeEnvironmentStringsA
mov qword [0x00454840], 0
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x4300a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov ecx, dword [0x004548d0]
call sub.KERNEL32_TlsGetValue
mov rsi, rax
test rsi, rsi
je 0x4300e3
mov ecx, dword [0x004548d0]
xor edx, edx
call sub.KERNEL32_TlsSetValue
call sub.KERNEL32_GetProcessHeap
xor edx, edx
mov rcx, rax
mov r8, rsi
add rsp, 0x28
pop rsi
pop rbp
jmp 0x434238
nop
add rsp, 0x28
pop rsi
pop rbp
ret
jmp qword [sym.imp.KERNEL32_HeapFree]

Function at 0x430150
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov esi, ecx
cmp byte [0x004390a4], 0
je 0x4301b2
mov ecx, dword [0x004548d0]
call sub.KERNEL32_TlsGetValue
test rax, rax
jne 0x4301be
call fcn.0042ffa0
mov edi, eax
test edi, edi
je 0x4301a5
call sub.KERNEL32_GetProcessHeap
movsxd r8, edi
mov edx, 8
mov rcx, rax
call sub.KERNEL32_HeapAlloc
mov ecx, dword [0x004548d0]
mov rdx, rax
call sub.KERNEL32_TlsSetValue
mov ecx, dword [0x004548d0]
call sub.KERNEL32_TlsGetValue
jmp 0x4301be
mov rax, qword gs:[0x58]
mov rax, qword [rax]
movsxd rcx, esi
add rcx, rax
mov rax, rcx
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e9078
Capabilities:
Enumerate processes

Disassembly:
jmp 0x14010f130
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x758
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x13e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x778]
mov rax, qword [0x14032f1c0]
xor rax, rbp
mov qword [rbp + 0x728], rax
mov dword [rbp + 0x714], 0
lea rcx, [0x14035011c]
call fcn.1400ef031
nop
xor edx, edx
mov ecx, 2
call fcn.1400ebd9b
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x14010f1f1
lea rdx, str.Chyba:_Nelze_vytvorit_snapshot_procesu.
lea rcx, [0x140332780]
call fcn.1400ec15b
lea rdx, [0x1400ebeae]
mov rcx, rax
call fcn.1400edbb9
nop
lea rdx, [0x1402daa2c]
mov rcx, qword [rbp + 0x750]
call fcn.1400eb0a8
mov eax, dword [rbp + 0x714]
or eax, 1
mov dword [rbp + 0x714], eax
mov rax, qword [rbp + 0x750]
jmp 0x14010f304
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1400ec9f8
test eax, eax
je 0x14010f2d0
lea rdx, [rbp + 0x5c]
mov rcx, qword [rbp + 0x758]
call fcn.1400eb148
movzx eax, al
test eax, eax
je 0x14010f2bb
mov r8d, dword [rbp + 0x38]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x288], rax
cmp qword [rbp + 0x288], 0
je 0x14010f2bb
mov r9d, 0x104
lea r8, [rbp + 0x2b0]
xor edx, edx
mov rcx, qword [rbp + 0x288]
call fcn.1400eb98b
test eax, eax
je 0x14010f2ad
mov rcx, qword [rbp + 0x288]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rbp + 0x2b0]
mov rcx, qword [rbp + 0x750]
call fcn.1400eb0a8
mov eax, dword [rbp + 0x714]
or eax, 1
mov dword [rbp + 0x714], eax
mov rax, qword [rbp + 0x750]
jmp 0x14010f304
mov rcx, qword [rbp + 0x288]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1400ee24e
test eax, eax
jne 0x14010f20d
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [0x1402daa2c]
mov rcx, qword [rbp + 0x750]
call fcn.1400eb0a8
mov eax, dword [rbp + 0x714]
or eax, 1
mov dword [rbp + 0x714], eax
mov rax, qword [rbp + 0x750]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402d6d10]
call fcn.1400edf7e
mov rax, rdi
mov rcx, qword [rbp + 0x728]
xor rcx, rbp
call fcn.1400ebe63
lea rsp, [rbp + 0x738]
pop rdi
pop rbp
ret
Function at 0x1400e9b1d
Capabilities:
Capture public ip
Create http request
Read data from internet
Receive data

Disassembly:
jmp 0x14010f3c0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2c8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x76
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2e8]
mov rax, qword [0x14032f1c0]
xor rax, rbp
mov qword [rbp + 0x280], rax
mov dword [rbp + 0x264], 0
lea rcx, [0x14035011c]
call fcn.1400ef031
nop
lea rdx, [0x1402dacbe]
lea rcx, [rbp + 0x108]
call fcn.1400ebbb1
nop
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.IPFetcher
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14010f4b1
lea rdx, str.Chyba_pri_inicializaci_WinINet.
lea rcx, [0x1403324c0]
call fcn.1400e9a91
lea rdx, [0x1400e93ca]
mov rcx, rax
call fcn.1400ec110
nop
lea rdx, [0x1402dacbe]
mov rcx, qword [rbp + 0x2b0]
call fcn.1400ebbb1
mov eax, dword [rbp + 0x264]
or eax, 1
mov dword [rbp + 0x264], eax
lea rcx, [rbp + 0x108]
call fcn.1400ea1da
nop
mov rax, qword [rbp + 0x2b0]
jmp 0x14010f617
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
lea rdx, str.http:__api.ipify.org
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x14010f54d
lea rdx, str.Chyba_pri_pripojeni_k_serveru.
lea rcx, [0x1403324c0]
call fcn.1400e9a91
lea rdx, [0x1400e93ca]
mov rcx, rax
call fcn.1400ec110
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
lea rdx, [0x1402dacbe]
mov rcx, qword [rbp + 0x2b0]
call fcn.1400ebbb1
mov eax, dword [rbp + 0x264]
or eax, 1
mov dword [rbp + 0x264], eax
lea rcx, [rbp + 0x108]
call fcn.1400ea1da
nop
mov rax, qword [rbp + 0x2b0]
jmp 0x14010f617
lea r9, [rbp + 0x44]
mov r8d, 0x7f
lea rdx, [rbp + 0x70]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14010f5cb
mov eax, dword [rbp + 0x44]
mov qword [rbp + 0x208], rax
cmp qword [rbp + 0x208], 0x80
jae 0x14010f582
jmp 0x14010f588
call fcn.1400ed542
nop
mov rax, qword [rbp + 0x208]
mov byte [rbp + rax + 0x70], 0
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x228]
call fcn.1400ebbb1
mov qword [rbp + 0x278], rax
mov rdx, qword [rbp + 0x278]
lea rcx, [rbp + 0x108]
call fcn.1400ea9e6
lea rcx, [rbp + 0x228]
call fcn.1400ea1da
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
lea rdx, [rbp + 0x108]
mov rcx, qword [rbp + 0x2b0]
call fcn.1400ee9fb
mov eax, dword [rbp + 0x264]
or eax, 1
mov dword [rbp + 0x264], eax
lea rcx, [rbp + 0x108]
call fcn.1400ea1da
nop
mov rax, qword [rbp + 0x2b0]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1402d6700]
call fcn.1400edf7e
mov rax, rdi
mov rcx, qword [rbp + 0x280]
xor rcx, rbp
call fcn.1400ebe63
lea rsp, [rbp + 0x298]
pop rdi
pop rbp
ret
Function at 0x1400ea0cc
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14018a850
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x14018a878
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x14018a8c2
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14018a86d
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret
Function at 0x1400ebb0c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1401e0380
mov rax, rcx
neg rcx
test rax, 7
je 0x1401e039d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1401e03f8
test al, 7
jne 0x1401e0390
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1401e03b1
mov rdx, qword [rax - 8]
test dl, dl
je 0x1401e0422
test dh, dh
je 0x1401e041c
shr rdx, 0x10
test dl, dl
je 0x1401e0416
test dh, dh
je 0x1401e0410
shr rdx, 0x10
test dl, dl
je 0x1401e040a
test dh, dh
je 0x1401e0404
shr edx, 0x10
test dl, dl
je 0x1401e03fe
test dh, dh
jne 0x1401e03b1
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400ebb57
Capabilities:
Query environment variable

Disassembly:
jmp 0x14029b8c0
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14029b440
lea rcx, [rsp + 0x20]
call fcn.14029b490
movzx eax, al
test eax, eax
jne 0x14029b905
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.14029b470
mov rax, qword [rsp + 0x40]
jmp 0x14029b9ff
lea rcx, [rsp + 0x20]
call fcn.14029b590
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.14029b530
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400ebf6c
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400eb3d2
lea rcx, [rsp + 0x28]
call fcn.1400ec4f3
movzx eax, al
test eax, eax
jne 0x14029b99f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1400edcef
lea rcx, [rsp + 0x20]
call fcn.14029b470
mov rax, qword [rsp + 0x50]
jmp 0x14029b9ff
lea rcx, [rsp + 0x20]
call fcn.14029b590
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.1400eef0f
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400ebe90
lea rcx, [rsp + 0x28]
call fcn.1400efa4a
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1400edcef
lea rcx, [rsp + 0x20]
call fcn.14029b470
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x1400ec147
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1401dc420
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1401dbda0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401dc45f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140351020]
jmp 0x1401dc469
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x1400ec408
Capabilities:
Query environment variable

Disassembly:
jmp 0x14029b610
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14029b440
lea rcx, [rsp + 0x40]
call fcn.14029b5c0
movzx eax, al
test eax, eax
jne 0x14029b658
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.14029b470
mov rax, qword [rsp + 0x70]
jmp 0x14029b829
lea rcx, [rsp + 0x40]
call fcn.14029b590
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.14029b530
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.14029b590
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1400ed894
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14029b6fe
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.14029b470
mov rax, qword [rsp + 0x80]
jmp 0x14029b829
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400ebf6c
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400ebcec
lea rcx, [rsp + 0x48]
call fcn.1400eb64d
movzx eax, al
test eax, eax
jne 0x14029b765
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1400e9f19
lea rcx, [rsp + 0x40]
call fcn.14029b470
mov rax, qword [rsp + 0x88]
jmp 0x14029b829
lea rcx, [rsp + 0x48]
call fcn.1400ec9da
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.14029b590
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1400ed894
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x14029b7fb
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1400e9f19
lea rcx, [rsp + 0x40]
call fcn.14029b470
mov rax, qword [rsp + 0xa0]
jmp 0x14029b829
lea rcx, [rsp + 0x48]
call fcn.1400ebc92
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1400e9f19
lea rcx, [rsp + 0x40]
call fcn.14029b470
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x1400ec421
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1401dc350
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1401dbd20
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401dc391
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140351020]
jmp 0x1401dc397
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x1400ec4fd
Capabilities:
Get geographical location

Disassembly:
jmp 0x14027af00
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.140279e30
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14027af67
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x140351030]
jmp 0x14027af89
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400eb594
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1400ec511
Capabilities:
Terminate process

Disassembly:
jmp 0x1401b8c00
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x1400ec66f
Capabilities:
Create http request

Disassembly:
jmp 0x140110cd0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x9e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [0x14032f1c0]
xor rax, rbp
mov qword [rbp + 0x3e8], rax
lea rcx, [0x14035011c]
call fcn.1400ef031
nop
mov rcx, qword [rbp + 0x420]
call fcn.1400e9901
mov qword [rbp + 0x3d8], rax
mov rcx, qword [rbp + 0x418]
call fcn.1400e9901
mov qword [rbp + 0x3e0], rax
mov rcx, qword [rbp + 0x410]
call fcn.1400e9901
mov rcx, qword [rbp + 0x3d8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x3e0]
mov qword [rsp + 0x20], rcx
mov r9, rax
lea r8, str.http:__zuffpwn.hys.cz_AC_SCAN_Detections_detekce.php_text_sip_styp_s
mov edx, 0x200
lea rcx, [rbp + 0x50]
call fcn.1400ed245
nop
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.DataSender
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140110dd7
lea rdx, str.Chyba_pri_inicializaci_WinINet.
lea rcx, [0x1403324c0]
call fcn.1400e9a91
lea rdx, [0x1400e93ca]
mov rcx, rax
call fcn.1400ec110
nop
jmp 0x140110e4d
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140110e37
lea rdx, str.Chyba_pri_pripojeni_k_serveru.
lea rcx, [0x1403324c0]
call fcn.1400e9a91
lea rdx, [0x1400e93ca]
mov rcx, rax
call fcn.1400ec110
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
jmp 0x140110e4d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x1402d6b80]
call fcn.1400edf7e
mov rcx, qword [rbp + 0x3e8]
xor rcx, rbp
call fcn.1400ebe63
lea rsp, [rbp + 0x3f8]
pop rdi
pop rbp
ret