joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7021af30
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
mov rbp, rsp
sub rsp, 0x150
cmp qword [0x70343a00], 0
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov byte [rbp - 0x111], 1
je 0x7021b02d
mov rax, qword [0x7032a630]
lea rcx, [rbp - 0x110]
mov rdx, qword [rax]
mov qword [rax], rcx
add rcx, 0x10
mov qword [rbp - 0x110], rdx
mov rdx, rbp
call sub.msvcrt.dll__setjmp
cdqe
test rax, rax
mov qword [rbp - 0x108], rax
jne 0x7021b050
xor ebx, ebx
cmp qword [rbp + 0x20], 0
je 0x7021afff
mov rcx, qword [rbp + 0x20]
call sub.msvcrt.dll_strlen
mov edx, 0x18
mov qword [rbp - 0x128], 7
cmp rax, 6
mov rsi, rax
jbe 0x7021afc9
lea rdx, [rax + 0x11]
mov qword [rbp - 0x128], rax
mov r8, qword [0x7032a640]
mov rcx, qword [0x7032a6a0]
call fcn.70217740
mov rdx, qword [rbp + 0x20]
movq xmm0, rsi
lea rcx, [rax + 0x10]
movhps xmm0, qword [rbp - 0x128]
mov rbx, rax
movups xmmword [rax], xmm0
lea r8, [rsi + 1]
call sub.msvcrt.dll_memcpy
mov rcx, rbx
call qword [0x70343a00]
mov rax, qword [0x7032a630]
mov byte [rbp - 0x111], 0
cmp qword [rbp - 0x108], 0
mov rdx, qword [rax]
mov rdx, qword [rdx]
mov qword [rax], rdx
jne 0x7021b0c9
movzx eax, byte [rbp - 0x111]
test al, al
jne 0x7021b0e0
add rsp, 0x150
pop rbx
pop rsi
pop rbp
ret
mov rax, qword [0x7032a630]
mov rdx, qword [rax]
mov rdx, qword [rdx]
mov qword [rbp - 0x108], 0
mov qword [rax], rdx
mov rdx, qword [0x7032a620]
mov rax, qword [rdx]
mov rbx, qword [rax + 0x28]
test rbx, rbx
je 0x7021b08b
add qword [rbx - 0x10], 8
mov rax, qword [rdx]
test rax, rax
je 0x7021b0b1
mov rsi, qword [rax - 0x10]
lea rdx, [rax - 0x10]
lea rcx, [rsi - 8]
cmp rcx, 7
mov qword [rax - 0x10], rcx
ja 0x7021b0b1
mov rcx, qword [0x7032a640]
add rcx, 0x18
call fcn.702167c0
mov rax, qword [0x7032a620]
cmp qword [rbp - 0x108], 0
mov qword [rax], rbx
je 0x7021b02d
call fcn.7021ae80
jmp 0x7021b02d
mov ecx, 2
call qword [fcn.7021cf80]
mov rcx, qword [rbp + 0x20]
mov edx, 1
mov r8, qword [rbp + 0x28]
mov rbx, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fflush
jmp 0x7021b03c
Function at 0x7021ca60
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x7032a5a0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x7021cacd
mov rcx, r8
call fcn.7021c940
test eax, eax
je 0x7021cacd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x7021cacd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x7021cac4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x7021cacf
add rax, 0x28
cmp rax, r9
jne 0x7021cab0
xor eax, eax
add rsp, 0x28
ret

Function at 0x7021d0e0
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x702013a0]
jmp 0x70201380
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.7021cf80
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.7021cf80
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x70201390
Function at 0x140004bc0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x280
movdqa xmmword [rsp + 0x2e0], xmm6
movdqa xmmword [rsp + 0x2f0], xmm7
movdqa xmmword [rsp + 0x300], xmm8
movdqa xmmword [rsp + 0x310], xmm9
movdqa xmmword [rsp + 0x320], xmm10
movdqa xmmword [rsp + 0x330], xmm11
movdqa xmmword [rsp + 0x340], xmm12
movdqa xmmword [rsp + 0x350], xmm13
movdqa xmmword [rsp + 0x360], xmm14
movdqa xmmword [rsp + 0x370], xmm15
mov eax, dword [0x14044f6c8]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x280]
mov qword [rdx + 8], r8
call fcn.1401013b0
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x14044f6c8]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x140004d50
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x140004d6c
cmp rcx, r8
jl 0x140004d5f
mov qword [rdx + 0x80], rcx
test dword [0x140448930], 1
je 0x140004d9b
cmp byte [rsp + 0xd0], 0
je 0x140004d9b
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x1400048c0
mov rsp, r8
jmp rax
Function at 0x140004da0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x14044f6c8]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14006ad18
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x1401df520]
test rax, rax
je 0x14006ad62
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006ad62
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006ad62
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006ad62
cmp dword [rcx + 0x84], 0xe
jbe 0x14006ad62
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006ad64
xor al, al
add rsp, 0x28
ret

Function at 0x140077a90
Capabilities:
Inspect section memory permissions

Disassembly:
push rbp
push rsi
sub rsp, 0x48
lea rbp, [rsp + 0x50]
mov rsi, rcx
mov eax, dword [rsi + 0x40]
cmp eax, 0xffffffff
je 0x140077aad
add rsp, 0x48
pop rsi
pop rbp
ret
mov dword [rsp + 0x20], 0x10
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x20]
mov rcx, rsi
mov r9d, 4
call fcn.1401308d0
mov ecx, eax
test ecx, ecx
jne 0x140077b25
xor eax, eax
test byte [rbp - 0x10], 0x30
jne 0x140077ade
mov eax, 0x40000000
test byte [rbp - 0x10], 2
je 0x140077ae9
or eax, 0x80000000
test dword [rbp - 0x10], 0x800
je 0x140077af7
or eax, 0x10000000
test byte [rbp - 0x10], 4
je 0x140077b02
or eax, 0x8000000
test dword [rbp - 0x10], 0x1000
je 0x140077b10
or eax, 0x4000000
test byte [rbp - 0x10], 8
je 0x140077b1b
or eax, 0x20000000
mov dword [rsi + 0x40], eax
add rsp, 0x48
pop rsi
pop rbp
ret
call fcn.140130870
mov ecx, eax
lea rdx, [0x140413008]
call fcn.1400fd460
mov rcx, rax
call fcn.1400049b0
int3
Function at 0x14008c570
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbp
push rbx
mov qword [rsp + 0x60], r9
mov r10, qword [rcx]
mov ecx, dword [rcx + 8]
mov r11, qword [rdx]
mov esi, ecx
and esi, 0xfffffffc
mov edi, dword [rdx + 8]
xor ebx, ebx
xor ebp, ebp
test ecx, ecx
je 0x14008c795
lea r14, [0x140335328]
mov eax, esi
sar eax, 2
lea eax, [rax + rax*2]
cmp edi, eax
jl 0x14008c5b7
lea r15d, [rsi - 4]
jmp 0x14008c5ce
mov edx, 0x55555556
mov eax, edx
imul edi
mov r15d, edx
shr r15d, 0x1f
add r15d, edx
shl r15d, 2
test r15d, r15d
jle 0x14008c676
movsxd rax, ebx
lea rax, [r10 + rax*2]
movzx edx, word [rax]
movzx r12d, word [rax + 2]
movzx r13d, word [rax + 4]
movzx eax, word [rax + 6]
mov r9d, edx
or r9d, r12d
or r9d, r13d
or r9d, eax
test r9d, 0xffffff00
je 0x14008c60c
mov r9d, 0xffffffff
jmp 0x14008c643
movsxd rdx, edx
movsx rdx, byte [r14 + rdx]
movsxd r9, r12d
movsx r12, byte [r14 + r9]
movsxd r9, r13d
movsx r13, byte [r14 + r9]
cdqe
movsx rax, byte [r14 + rax]
shl edx, 0x12
shl r12d, 0xc
shl r13d, 6
or eax, edx
mov edx, eax
or r12d, r13d
or edx, r12d
mov r9d, edx
test r9d, r9d
jl 0x14008c7b2
movsxd rax, ebp
add rax, r11
mov edx, r9d
sar edx, 0x10
mov byte [rax], dl
mov edx, r9d
sar edx, 8
mov byte [rax + 1], dl
mov byte [rax + 2], r9b
add ebp, 3
add ebx, 4
cmp ebx, r15d
jl 0x14008c5d7
lea eax, [rsi - 4]
cmp r15d, eax
jne 0x14008c7b2
cmp ebx, esi
je 0x14008c7b2
lea eax, [rsi - 4]
cdqe
movzx eax, word [r10 + rax*2]
lea edx, [rsi - 3]
movsxd rdx, edx
movzx edx, word [r10 + rdx*2]
lea r9d, [rsi - 2]
movsxd r9, r9d
movzx r9d, word [r10 + r9*2]
lea r15d, [rsi - 1]
movsxd r15, r15d
movzx r10d, word [r10 + r15*2]
mov r15d, eax
or r15d, edx
or r15d, r9d
or r15d, r10d
test r15d, 0xffffff00
jne 0x14008c7b2
cdqe
movsx rax, byte [r14 + rax]
movsxd rdx, edx
movsx rdx, byte [r14 + rdx]
shl eax, 0x12
shl edx, 0xc
or eax, edx
cmp r10d, 0x3d
je 0x14008c73b
movsxd r9, r9d
movsx r9, byte [r14 + r9]
movsxd r10, r10d
movsx r10, byte [r14 + r10]
shl r9d, 6
or r10d, eax
mov eax, r10d
or eax, r9d
jl 0x14008c7b2
add edi, 0xfffffffd
cmp ebp, edi
jg 0x14008c7b2
movsxd r9, ebp
add r11, r9
mov edx, eax
sar edx, 0x10
mov byte [r11], dl
mov edx, eax
sar edx, 8
mov byte [r11 + 1], dl
mov byte [r11 + 2], al
add ebp, 3
jmp 0x14008c78e
cmp r9d, 0x3d
je 0x14008c777
movsxd r9, r9d
movsx r9, byte [r14 + r9]
shl r9d, 6
or eax, r9d
jl 0x14008c7b2
lea edx, [rdi - 2]
cmp ebp, edx
jg 0x14008c7b2
mov edx, eax
sar edx, 0x10
movsxd r9, ebp
mov byte [r11 + r9], dl
sar eax, 8
lea edx, [rbp + 1]
movsxd rdx, edx
mov byte [r11 + rdx], al
add ebp, 2
jmp 0x14008c78e
test eax, eax
jl 0x14008c7b2
lea edx, [rdi - 1]
cmp ebp, edx
jg 0x14008c7b2
sar eax, 0x10
movsxd rdx, ebp
mov byte [r11 + rdx], al
inc ebp
add ebx, 4
cmp esi, ecx
jne 0x14008c7b2
mov dword [r8], ebx
mov r9, qword [rsp + 0x60]
mov dword [r9], ebp
mov eax, 1
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
mov dword [r8], ebx
mov r9, qword [rsp + 0x60]
mov dword [r9], ebp
xor eax, eax
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400b8c60
Capabilities:
Hash data using sha1

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp qword [rsi], 0
jne 0x1400b8c8a
lea rcx, [0x140390850]
mov edx, 0x55
call fcn.140004570
mov rdx, rax
mov rcx, rsi
call fcn.140004790
xor eax, eax
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], eax
mov rax, qword [rsi]
cmp dword [rax + 8], 0x50
jbe 0x1400b8cf8
mov dword [rax + 0x150], 0x67452301
mov rax, qword [rsi]
cmp dword [rax + 8], 0x51
jbe 0x1400b8cf8
mov dword [rax + 0x154], 0xefcdab89
mov rax, qword [rsi]
cmp dword [rax + 8], 0x52
jbe 0x1400b8cf8
mov dword [rax + 0x158], 0x98badcfe
mov rax, qword [rsi]
cmp dword [rax + 8], 0x53
jbe 0x1400b8cf8
mov dword [rax + 0x15c], 0x10325476
mov rax, qword [rsi]
cmp dword [rax + 8], 0x54
jbe 0x1400b8cf8
mov dword [rax + 0x160], 0xc3d2e1f0
add rsp, 0x20
pop rsi
ret
call fcn.14012c6c0
int3
Function at 0x140001410
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
mov ecx, 0xbeef
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000142a
test ebx, ebx
je 0x140001446
lea rdx, str.debug_by_an_CloseHandle_exception_
call fcn.1400013f0
mov ecx, 0x4000
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x20
pop rbx
ret

Function at 0x140001450
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, 1
call fcn.14000f469
jmp 0x140001464
test ebx, ebx
je 0x140001480
lea rdx, str.debug_by_a_Single_Step_Exception_
call fcn.1400013f0
mov ecx, 0x4001
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x20
pop rbx
ret

Function at 0x140001530
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str._s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x140001543
add rsp, 0x28
ret
Function at 0x140002020
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x140080178]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor eax, eax
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x38], eax
lea r9, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov qword [rsp + 0x28], rax
lea rcx, [0x14006c860]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x14000208f
mov edx, dword [rsp + 0x60]
mov rcx, rbx
call fcn.14000e150
mov rax, rbx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14005dc60
add rsp, 0x70
pop rbx
ret
lea rdx, str.failed_to_get_hwid
lea rcx, [rsp + 0x48]
call fcn.140001710
lea rdx, [0x14007d288]
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14000f3f0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
xor rax, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 2]
and rax, 0xff
ret

Function at 0x14000f407
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
xor rax, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0xbc]
and rax, 0x70
ret

Function at 0x14000f43d
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov qword [rcx], rdx
mov qword [rcx + 8], rax
xor rax, rax
mov rax, 5
shr rax, 2
sub rax, rbx
cmp rax, rcx
rdtsc
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], rax
ret
Function at 0x140018d54
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov r9d, dword [rdi]
mov r8d, dword [rsi]
mov rdx, qword [r14]
mov rcx, qword [r15]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x140018da0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x140018d7c
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x140018dc0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, qword [rcx + 8]
mov r14, qword [rcx]
mov ecx, dword [r14]
xor r9d, r9d
inc ecx
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x140018e0b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x140018de0
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x140018e24
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, qword [rcx + 8]
mov r14, qword [rcx]
mov ecx, dword [r14]
xor r9d, r9d
inc ecx
mov qword [rsp + 0x20], rdi
mov r8, rsi
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x140018e6e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x140018e44
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x140018e88
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov r9d, dword [rdi]
mov r8d, dword [rsi]
mov rdx, qword [r14]
mov rcx, qword [r15]
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
test eax, eax
jns 0x140018ed4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x140018eb0
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
Function at 0x140018ef4
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, qword [rcx + 0x20]
mov rsi, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov ecx, dword [r15]
mov r9, rsi
inc ecx
mov qword [rsp + 0x20], rdi
mov r8, rbp
mov rdx, r14
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x140018f4a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x140018f1f
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x140025e14
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rsi, rdx
mov dword [rax + 8], 1
mov rbx, r8
mov rdi, rcx
mov rcx, rsi
lea r8, [rax + 8]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov r8d, dword [rbx + 0x10]
mov rcx, rsi
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x140025ea5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x140025e7e
mov rax, qword [rdi + 8]
mov dword [rax], 2
xor al, al
jmp 0x140025f69
mov r8, qword [rdi + 0x18]
mov rcx, rsi
mov rdx, qword [rdi + 0x10]
mov r8, qword [r8]
mov rdx, qword [rdx]
call fcn.14003a540
mov ecx, eax
mov rax, qword [rdi + 8]
mov dword [rax], ecx
mov rax, qword [rdi + 8]
cmp dword [rax], 0
jne 0x140025e77
and dword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
mov edx, 0x8004667e
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rax, qword [rdi + 0x28]
lea r9, [rsp + 0x40]
movabs r14, 0x20c49ba5e353f7cf
mov dword [rsp + 0x20], 4
mov ebx, 0xffff
mov r8d, 0x1006
mov rcx, qword [rax]
mov rax, r14
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rdi + 0x20]
imul ecx, dword [rax], 0x3e8
add edx, ecx
mov rcx, rsi
mov dword [rsp + 0x40], edx
mov edx, ebx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rdi + 0x38]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov rcx, qword [rax]
mov rax, r14
imul rcx
sar rdx, 7
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
mov rcx, qword [rdi + 0x30]
imul r8d, dword [rcx], 0x3e8
mov rcx, rsi
add edx, r8d
mov r8d, 0x1005
mov dword [rsp + 0x40], edx
mov edx, ebx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rdi + 8]
mov al, 1
and dword [rcx], 0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret