joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001790
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov dword [rsp + 0x20], 1
xor eax, eax
cmp eax, 1
je 0x14000196f
xor edx, edx
mov rcx, qword [rsp + 0x70]
call fcn.1400019d0
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 1
jne 0x1400017f6
call fcn.140002e40
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x80]
mov dword [rax], 1
jmp 0x14000196f
cmp dword [rsp + 0x24], 2
jne 0x140001813
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x80]
mov dword [rax], 1
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x1074]
mov rcx, qword [rsp + 0x70]
mov r8d, dword [rcx + 0x1078]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.1400078f0
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
call fcn.140007770
mov dword [rsp + 0x28], eax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140001430
nop
cmp dword [rsp + 0x28], 0
je 0x140001873
cmp qword [rsp + 0x30], 0
jne 0x14000188a
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x38]
call fcn.140001450
jmp 0x14000196f
mov rcx, qword [rsp + 0x30]
call fcn.140001ed0
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140001b90
nop
lea rcx, str.Start_SendLogToCloud_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.140001b30
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.140001b30
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rsp + 0x48]
call qword [sym.imp.AliyunWrap.dll_bool___cdecl_SendLogToCloud_class_std::vector_struct_std::pair_wchar_t____ptr64__wchar_t____ptr64___class_std::allocator_struct_std::pair_wchar_t____ptr64__wchar_t____ptr64____const____ptr64_]
movzx eax, al
test eax, eax
jne 0x14000191b
mov dword [rsp + 0x20], 0
lea rcx, [0x140024240]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
lea rcx, [rsp + 0x48]
call fcn.140001b60
nop
lea rcx, [rsp + 0x38]
call fcn.140001450
jmp 0x14000196f
lea rcx, str.SendLogToCloud_Success_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x78]
call fcn.140007830
test eax, eax
jne 0x140001955
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x48]
call fcn.140001b60
nop
lea rcx, [rsp + 0x38]
call fcn.140001450
jmp 0x14000196f
lea rcx, [rsp + 0x48]
call fcn.140001b60
nop
lea rcx, [rsp + 0x38]
call fcn.140001450
jmp 0x1400017b4
mov eax, dword [rsp + 0x20]
add rsp, 0x68
ret
Function at 0x1400027d0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x480
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdx, [rsp + 0x50]
lea rcx, [0x1400242a0]
call fcn.140002680
test eax, eax
jne 0x140002822
jmp 0x140002913
lea rax, [rsp + 0x260]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rcx, [rsp + 0x260]
call fcn.140002750
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
mov r9, qword [rsp + 0x490]
lea r8, [rsp + 0x260]
lea rdx, [0x1400242c8]
lea rcx, [0x1400242d8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x490]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], 0xffffffffffffffff
inc qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
cmp word [rax + rcx*2], 0
jne 0x140002893
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x40]
movzx eax, word [rax + rcx*2 - 2]
cmp eax, 0x5c
je 0x140002909
cmp qword [rsp + 0x40], 0x103
jae 0x140002901
mov eax, 0x5c
mov rcx, qword [rsp + 0x490]
mov rdx, qword [rsp + 0x40]
mov word [rcx + rdx*2], ax
xor eax, eax
mov rcx, qword [rsp + 0x490]
mov rdx, qword [rsp + 0x40]
mov word [rcx + rdx*2 + 2], ax
jmp 0x140002909
mov dword [rsp + 0x30], 0
xor eax, eax
test eax, eax
jne 0x1400027f7
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140008d50
add rsp, 0x480
pop rdi
ret
Function at 0x140002b50
Capabilities:
Delete file
Download url
Read file on windows
Receive data

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov dword [rsp + 0x48], 0
cmp qword [rsp + 0x2b0], 0
jne 0x140002b8c
jmp 0x140002d01
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rcx, [rsp + 0x80]
call fcn.1400027d0
test eax, eax
jne 0x140002bb6
jmp 0x140002d01
lea r8, str.tempInfo.web
mov edx, 0x104
lea rcx, [rsp + 0x80]
call fcn.14000cc3c
nop
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x80]
mov rdx, qword [rsp + 0x2b0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 0
jne 0x140002cf5
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0xffffffffffffffff
je 0x140002cf5
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x14
rep stosb byte [rdi], al
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, 0x14
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002cdc
cmp dword [rsp + 0x40], 0
je 0x140002cdc
lea rcx, [rsp + 0x60]
call fcn.14000dcb0
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x140002cbe
mov dword [rsp + 0x44], 1
jmp 0x140002cc6
mov dword [rsp + 0x44], 0
mov rax, qword [rsp + 0x2b8]
mov ecx, dword [rsp + 0x44]
mov dword [rax], ecx
mov dword [rsp + 0x48], 1
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140002cf7
xor eax, eax
test eax, eax
jne 0x140002b7c
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140008d50
add rsp, 0x2a0
pop rdi
ret

Function at 0x140002d20
Capabilities:
Delete file
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x44], 0
cmp qword [rsp + 0x70], 0
jne 0x140002d3e
jmp 0x140002dd4
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0xffffffffffffffff
je 0x140002dca
mov eax, 0xfeff
mov word [rsp + 0x40], ax
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, 2
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x44], eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test eax, eax
jne 0x140002d31
mov eax, dword [rsp + 0x44]
add rsp, 0x68
ret
Function at 0x1400034e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x258
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rax, qword [rsp + 0x260]
lea rdx, [0x140024538]
mov rcx, rax
call fcn.140008640
nop
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x260]
call fcn.1400035a0
movzx eax, al
test eax, eax
je 0x140003559
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x140003559
lea rcx, [rsp + 0x30]
call fcn.140002d20
nop
mov rax, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140008d50
add rsp, 0x258
ret

Function at 0x140003630
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x258
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x260]
call fcn.1400035a0
movzx eax, al
test eax, eax
jne 0x14000367b
jmp 0x1400036b0
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rsp + 0x268]
lea rcx, [0x140024588]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rcx, qword [rsp + 0x270]
mov dword [rcx], eax
mov dword [rsp + 0x20], 1
xor eax, eax
test eax, eax
jne 0x140003660
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140008d50
add rsp, 0x258
ret

Function at 0x1400037a0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x268
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov dword [rsp + 0x30], 0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x270]
call fcn.1400035a0
movzx eax, al
test eax, eax
jne 0x1400037eb
jmp 0x14000382b
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
mov r9, qword [rsp + 0x280]
lea r8, [0x14002430c]
mov rdx, qword [rsp + 0x278]
lea rcx, [0x1400245b0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [rsp + 0x30], eax
xor eax, eax
test eax, eax
jne 0x1400037d0
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140008d50
add rsp, 0x268
ret
Function at 0x140005d20
Capabilities:
Get mac address on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0x2c0
mov eax, dword [rsp + 0x28]
lea rdx, [0x140029a20]
mov ecx, eax
call fcn.1400092b8
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0x6f
jne 0x140005dd1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.140008d74
mov eax, dword [rsp + 0x28]
lea rdx, [0x140029a20]
mov ecx, eax
call fcn.1400092b8
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x140005eaa
mov rax, qword [rsp + 0x20]
cmp dword [rax + 0x194], 6
jne 0x140005eaa
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x2c], 0
jmp 0x140005e0a
mov eax, dword [rsp + 0x2c]
inc eax
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x194]
cmp dword [rsp + 0x2c], eax
jae 0x140005e8b
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x14
rep stosb byte [rdi], al
movsxd rax, dword [rsp + 0x2c]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax + 0x198]
mov r8d, eax
lea rdx, str._02X_
lea rcx, [rsp + 0x60]
call fcn.140005840
mov eax, 0x104
sub eax, dword [rsp + 0x30]
cdqe
movsxd rcx, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x90]
lea rcx, [rdx + rcx*2]
lea r8, [rsp + 0x60]
mov rdx, rax
call fcn.14000cbc4
mov eax, dword [rsp + 0x30]
add eax, 3
mov dword [rsp + 0x30], eax
jmp 0x140005e00
mov eax, 2
imul rax, rax, 0x11
xor ecx, ecx
mov rdx, qword [rsp + 0x90]
mov word [rdx + rax], cx
mov dword [rsp + 0x38], 1
cmp qword [rsp + 0x20], 0
je 0x140005ecf
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.140008d74
mov qword [rsp + 0x20], 0
xor eax, eax
test eax, eax
jne 0x140005d44
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140008d50
add rsp, 0x80
pop rdi
ret
Function at 0x140006440
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x40
rep stosb byte [rdi], al
mov dword [rsp + 0x30], 0x40
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x1400064ad
mov r8, qword [rsp + 0x38]
lea rdx, str._M:_I64X
mov rcx, qword [rsp + 0x90]
call fcn.140005840
mov dword [rsp + 0x20], 1
xor eax, eax
test eax, eax
jne 0x140006464
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140008d50
add rsp, 0x80
pop rdi
ret
Function at 0x1400079c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x50]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0xffffffffffffffff
inc qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
cmp word [rax + rcx*2], 0
jne 0x1400079f5
mov rax, qword [rsp + 0x28]
cmp rax, 0x104
jae 0x140007a64
mov rax, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov edx, 0x104
mov rcx, rax
call fcn.14000cbc4
mov rax, qword [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x140007a64
mov rax, qword [rsp + 0x50]
mov rcx, rax
call fcn.140002d20
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.140008030
mov rax, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140007ef0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x260
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x278]
mov qword [rax], 0
mov rax, qword [rsp + 0x280]
mov qword [rax], 0
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x270]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x140024eb0]
lea rcx, [0x140024ec8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x140007f9a
lea rcx, [rsp + 0x40]
call fcn.14000dc84
mov rcx, qword [rsp + 0x278]
mov qword [rcx], rax
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x270]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x140024ee0]
lea rcx, [0x140024ef8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x140007ff5
lea rcx, [rsp + 0x40]
call fcn.14000dc84
mov rcx, qword [rsp + 0x280]
mov qword [rcx], rax
mov dword [rsp + 0x30], 1
xor eax, eax
test eax, eax
jne 0x140007f21
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140008d50
add rsp, 0x260
pop rdi
ret
Function at 0x140008200
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x24], 0
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x64
rep stosb byte [rdi], al
mov rax, qword [rsp + 0xd0]
mov r9, qword [rax]
lea r8, [0x140024fdc]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.140005890
mov rax, qword [rsp + 0xc0]
mov r9, rax
mov r8d, 0xffffffff
lea rdx, [0x140024fe8]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov eax, eax
mov rcx, qword [rsp + 0xd0]
mov qword [rcx], rax
mov rax, qword [rsp + 0xd0]
cmp qword [rax], 0xffffffffffffffff
je 0x1400082ae
mov dword [rsp + 0x20], 1
jmp 0x1400082b6
mov dword [rsp + 0x20], 0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
xor eax, eax
test eax, eax
jne 0x140008231
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140008d50
add rsp, 0xb0
pop rdi
ret

Function at 0x1400082f0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x30], 0
cmp qword [rsp + 0x58], 0
je 0x140008328
cmp qword [rsp + 0x60], 0
je 0x140008328
cmp qword [rsp + 0x68], 0
jne 0x14000832a
jmp 0x14000835e
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x19000
mov r9, qword [rsp + 0x68]
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [rsp + 0x30], eax
xor eax, eax
test eax, eax
jne 0x140008310
mov eax, dword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x140010694
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400104b8
Function at 0x140007af0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x18
xor r10d, r10d
test rdx, rdx
setg al
jle 0x140007cc7
test r9, r9
jle 0x140007cc7
xor r10d, r10d
lea r11, [0x140297920]
lea rsi, [0x140297a20]
lea rdi, [0x140297a40]
xor r14d, r14d
mov qword [rsp], r8
nop word [rax + rax]
movzx ebp, byte [rcx + r14]
test bpl, bpl
js 0x140007b60
mov r15d, 1
jmp 0x140007c95
mov eax, ebp
movsx r15, byte [rax + r11]
add rax, 0xffffffffffffff40
cmp rax, 0x3d
ja 0x140007c6d
mov rax, rdx
sub rax, r14
cmp rax, 2
mov r11d, 1
cmovl rax, r11
dec rax
cmp r15, 3
mov r12d, 2
cmovge r12, r15
lea rsi, [r12 - 2]
cmp rax, rsi
jbe 0x140007ce2
lea rax, [rcx + r14]
lea r8, [r12 - 1]
test rsi, rsi
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], r8
je 0x140007cb2
lea rdi, [rax + 1]
mov rsi, r8
and rsi, 0xfffffffffffffffe
neg rsi
mov ebx, 1
xor r13d, r13d
nop dword [rax]
movzx eax, byte [rdi + rbx - 1]
mov r11d, eax
and r11b, 0xc0
cmp r11b, 0x80
setne r11b
or r11b, r13b
movzx r8d, byte [rdi + rbx]
mov r13d, r8d
and r13b, 0xc0
cmp r13b, 0x80
setne r13b
or r13b, r11b
shl ebp, 0xc
shl eax, 6
add ebp, r8d
add ebp, eax
lea rax, [rsi + rbx]
add rax, 2
add rbx, 2
cmp rax, 1
jne 0x140007be0
test byte [rsp + 0x10], 1
je 0x140007c52
mov rax, qword [rsp + 8]
movzx eax, byte [rax + rbx]
mov r8d, eax
and r8b, 0xc0
cmp r8b, 0x80
setne r8b
or r13b, r8b
shl ebp, 6
add ebp, eax
mov r8, qword [rsp]
lea r11, [0x140297920]
lea rsi, [0x140297a20]
lea rdi, [0x140297a40]
jmp 0x140007c76
mov r12d, 1
xor r13d, r13d
xor eax, eax
cmp r12, r15
jne 0x140007cd1
test r13b, 1
jne 0x140007cd1
sub ebp, dword [rsi + r15*4]
cmp ebp, 0x10ffff
ja 0x140007cd1
cmp dword [rdi + r15*4], ebp
ja 0x140007ce2
mov byte [r8 + r10], bpl
add r14, r15
inc r10
cmp r14, rdx
setl al
jge 0x140007cc7
cmp r10, r9
jl 0x140007b40
jmp 0x140007cc7
mov ebx, 1
xor r13d, r13d
test byte [rsp + 0x10], 1
jne 0x140007c32
jmp 0x140007c52
cmp r10, r9
setne cl
xor al, 1
or al, cl
add rsp, 0x18
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x140007cd1
Function at 0x140007cf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
xor r10d, r10d
test rdx, rdx
setg al
jle 0x140007f0c
test r9, r9
jle 0x140007f0c
lea rax, [r9 - 1]
mov qword [rsp + 0x10], rax
xor esi, esi
lea r11, [0x140297920]
lea rdi, [0x140297a20]
lea r14, [0x140297a40]
xor r10d, r10d
mov qword [rsp + 8], r9
mov qword [rsp], r8
nop word cs:[rax + rax]
movzx r13d, byte [rcx + rsi]
test r13b, r13b
js 0x140007d70
mov r12d, 1
mov ebp, r13d
jmp 0x140007ef0
movsx r12, byte [r13 + r11]
mov rax, r13
add rax, 0xffffffffffffff40
cmp rax, 0x3d
ja 0x140007e3e
mov rax, rdx
sub rax, rsi
cmp rax, 2
mov r11d, 1
cmovl rax, r11
dec rax
cmp r12, 3
mov ebx, 2
cmovge rbx, r12
lea r11, [rbx - 2]
cmp rax, r11
jbe 0x140007f27
lea rax, [rcx + rsi]
lea r14, [rbx - 1]
test r11, r11
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], r14
je 0x140007e4b
lea r11, [rax + 1]
and r14, 0xfffffffffffffffe
neg r14
mov edi, 1
xor r15d, r15d
mov ebp, r13d
nop word [rax + rax]
movzx eax, byte [r11 + rdi - 1]
mov r8d, eax
and r8b, 0xc0
cmp r8b, 0x80
setne r8b
or r8b, r15b
movzx r9d, byte [r11 + rdi]
mov r15d, r9d
and r15b, 0xc0
cmp r15b, 0x80
setne r15b
or r15b, r8b
shl ebp, 0xc
shl eax, 6
add ebp, r9d
add ebp, eax
lea rax, [r14 + rdi]
add rax, 2
add rdi, 2
cmp rax, 1
jne 0x140007df0
jmp 0x140007e56
mov ebx, 1
xor r15d, r15d
mov ebp, r13d
jmp 0x140007e9b
mov edi, 1
xor r15d, r15d
mov ebp, r13d
test byte [rsp + 0x20], 1
lea r14, [0x140297a40]
je 0x140007e84
mov rax, qword [rsp + 0x18]
movzx eax, byte [rax + rdi]
mov r8d, eax
and r8b, 0xc0
cmp r8b, 0x80
setne r8b
or r15b, r8b
shl ebp, 6
add ebp, eax
mov r9, qword [rsp + 8]
mov r8, qword [rsp]
lea r11, [0x140297920]
lea rdi, [0x140297a20]
xor eax, eax
cmp rbx, r12
jne 0x140007f16
test r15b, 1
jne 0x140007f16
sub ebp, dword [rdi + r12*4]
cmp ebp, 0x10ffff
ja 0x140007f16
cmp dword [r14 + r12*4], ebp
ja 0x140007f27
cmp r13b, 0xf0
jb 0x140007ef0
cmp r10, qword [rsp + 0x10]
je 0x140007f27
mov eax, ebp
shr eax, 0xa
add eax, 0xffffd7c0
mov word [r8 + r10*2], ax
and ebp, 0x3ff
or ebp, 0xdc00
mov word [r8 + r10*2 + 2], bp
inc r10
jmp 0x140007ef5
mov word [r8 + r10*2], bp
add rsi, r12
inc r10
cmp rsi, rdx
setl al
jge 0x140007f0c
cmp r10, r9
jl 0x140007d50
cmp r10, r9
setne cl
xor al, 1
or al, cl
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x140007f16

Function at 0x1400095d0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x14039ce38]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [rsp + 0x2c]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140258ea0
mov rax, rsi
add rsp, 0x60
pop rsi
ret
Function at 0x140009610
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
test dl, dl
mov eax, 0x40
mov r9d, 4
cmovne r9d, eax
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14000965a
mov rbx, rax
mov ecx, reloc.WS2_32.dll_recv
call fcn.140259128
mov rdi, rax
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov rax, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x14000a6d0
Capabilities:
Create tcp socket

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rcx
mov rax, qword [0x14039ce38]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rsi, [rcx + 0x20]
mov rcx, rsi
call sub.KERNEL32.dll_EnterCriticalSection
mov ecx, 0x180
call fcn.140006990
mov rbx, rax
lea r14, [rax + 0x58]
lea rcx, [rax + 0x48]
movss xmm0, dword [0x140298080]
movups xmmword [rax + 0x28], xmm0
mov r8d, 0x130
xor edx, edx
call fcn.14025c7b0
mov ecx, 2
mov edx, 1
mov r8d, 6
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx + 0x20], rax
mov r10, qword [rdi + 0xd0]
xorps xmm0, xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx], xmm0
mov rcx, qword [rdi + 0xa0]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x4c]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x90
mov dword [rsp + 0x20], 0x90
mov rdx, rax
mov r8, r14
xor r9d, r9d
call r10
test eax, eax
jne 0x14000a793
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x14000a7bd
inc dword [rdi + 0xe0]
mov dil, 1
mov rcx, rsi
call fcn.140233540
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140258ea0
mov eax, edi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, rbx
call fcn.140261f34
mov ecx, edi
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor edi, edi
jmp 0x14000a79c