joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180035c70
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rbx, rcx
mov qword [rcx + 8], rsi
call sym.libjpeg.dll_jpeg_mem_init
mov edx, 0xa0
mov dword [rsp + 0x38], eax
mov rcx, rbx
call sym.libjpeg.dll_jpeg_get_large
mov rdi, rax
test rax, rax
jne 0x180035cc6
mov rcx, rbx
call sym.libjpeg.dll_jpeg_mem_term
mov rcx, qword [rbx]
mov dword [rcx + 0x28], 0x38
mov rcx, qword [rbx]
mov dword [rcx + 0x2c], esi
mov rcx, rbx
mov rdx, qword [rbx]
call qword [rdx]
mov dword [rdi + 0x5c], 0x3b9aca00
lea rax, [fcn.180035990]
mov qword [rdi], rax
lea rcx, str.JPEGMEM
lea rax, [fcn.1800357b0]
mov qword [rdi + 8], rax
lea rax, [fcn.1800358a0]
mov qword [rdi + 0x10], rax
lea rax, [fcn.1800356c0]
mov qword [rdi + 0x18], rax
lea rax, [0x180036060]
mov qword [rdi + 0x20], rax
lea rax, [0x180035fb0]
mov qword [rdi + 0x28], rax
lea rax, [0x180035de0]
mov qword [rdi + 0x30], rax
lea rax, [0x180035430]
mov qword [rdi + 0x38], rax
lea rax, [0x180035190]
mov qword [rdi + 0x40], rax
lea rax, [0x180035b20]
mov qword [rdi + 0x48], rax
lea rax, [0x180036110]
mov qword [rdi + 0x50], rax
mov eax, dword [rsp + 0x38]
mov dword [rdi + 0x58], eax
mov qword [rdi + 0x68], rsi
mov qword [rdi + 0x78], rsi
mov qword [rdi + 0x60], rsi
mov qword [rdi + 0x70], rsi
mov qword [rdi + 0x80], rsi
mov qword [rdi + 0x88], rsi
mov qword [rdi + 0x90], 0xa0
mov qword [rbx + 8], rdi
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x180035dcf
lea r9, [rsp + 0x30]
mov byte [rsp + 0x30], 0x78
lea r8, [rsp + 0x38]
mov rcx, rax
lea rdx, str._ld_c
call fcn.1800363b0
test eax, eax
jle 0x180035dcf
movzx eax, byte [rsp + 0x30]
sub al, 0x4d
test al, 0xdf
jne 0x180035dc2
imul eax, dword [rsp + 0x38], 0x3e8
jmp 0x180035dc6
mov eax, dword [rsp + 0x38]
imul eax, eax, 0x3e8
mov dword [rdi + 0x58], eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x180036630
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rdi
push r13
push r15
sub rsp, 0x30
mov r13d, dword [rcx + 0x64]
mov rdi, rcx
mov rbx, qword [rcx + 0x270]
cmp r13d, 1
mov r8d, 0x2fe
mov qword [rsp + 0x68], rbx
sete al
mov edx, 1
mov byte [rbx + 0x38], al
mov rax, qword [rcx + 8]
mov ecx, pe_nt_image_headers64
mov r9d, dword [rdi + 0x7c]
cmovne r8d, ecx
mov rcx, rdi
call qword [rax + 0x10]
mov ebp, dword [rbx + 0x28]
xor r15d, r15d
mov qword [rbx + 0x30], rax
cmp dword [rdi + 0x7c], r15d
jle 0x1800367b1
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x28], r12
lea r12, [rbx + 0x3c]
mov qword [rsp + 0x20], r14
xor r14d, r14d
nop dword [rax]
mov esi, dword [r12]
mov eax, ebp
cdq
idiv esi
mov ebp, eax
cmp r13d, 1
jne 0x1800366cd
mov rax, qword [rbx + 0x30]
add qword [r14 + rax], 0xff
mov rax, qword [rbx + 0x30]
lea r11d, [rsi*2 - 2]
xor r8d, r8d
xor r10d, r10d
mov rdi, qword [r14 + rax]
lea eax, [rsi + 0xfe]
cdq
idiv r11d
xor ebx, ebx
mov r9d, eax
cmp r10d, r9d
jle 0x180036727
imul ecx, r8d, 0x1fe
add ecx, 0xfe
add ecx, esi
nop word [rax + rax]
add ecx, 0x1fe
inc r8d
mov eax, ecx
cdq
idiv r11d
mov r9d, eax
cmp r10d, eax
jg 0x180036710
movzx eax, r8b
inc r10d
movzx ecx, bpl
imul ecx, eax
mov byte [rbx + rdi], cl
inc rbx
cmp rbx, 0xff
jle 0x1800366f2
cmp r13d, 1
jne 0x180036783
mov ecx, r13d
lea rdx, [rdi - 1]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi]
mov byte [rdx], al
lea rdx, [rdx - 1]
movzx eax, byte [rdi + 0xff]
mov byte [rdi + rcx + 0xff], al
inc rcx
cmp rcx, 0xff
jle 0x180036760
mov rax, qword [rsp + 0x60]
inc r15d
mov rbx, qword [rsp + 0x68]
add r12, 4
add r14, 8
cmp r15d, dword [rax + 0x7c]
jl 0x1800366b0
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r13
pop rdi
pop rbp
pop rbx
ret
Function at 0x14002e910
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14002e91d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14002e92d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14002e915
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14002e945
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14002e932
sub eax, 3
jb 0x14002e95f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14002e996
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14002e986
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14002e984
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14002e973
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14002e8d2
jmp 0x14002e91d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x17200
mov dl, 5
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14002e9e6
cmp rsi, rcx
jae 0x14002e9ee
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14002e9cd
cmp al, 0x8f
ja 0x14002e9cd
cmp byte [rsi - 2], 0xf
je 0x14002e9d3
sub al, 0xe8
cmp al, 1
ja 0x14002e9b7
cmp rsi, rcx
jae 0x14002e9ee
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14002e9bd
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14002e9ee
lodsb al, byte [rsi]
jmp 0x14002e9cd
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x2c000]
mov eax, dword [rdi]
or eax, eax
je 0x14002ea4b
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x2e000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14002e9fb
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14002ea45
mov qword [rbx], rax
add rbx, 8
jmp 0x14002ea1b
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14002ea85
cmp al, 0xef
ja 0x14002ea77
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14002ea57
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14002ea66
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x20f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14002ead9
sub rsp, 0xffffffffffffff80
jmp 0x140013b60
Function at 0x14005b120
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14005b12d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14005b13d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14005b125
lea eax, [rcx + 1]
jmp 0x14005b14b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14005b15e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14005b144
sub eax, 3
jb 0x14005b17e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14005b1cd
sar eax, 1
movsxd rbp, eax
jb 0x14005b1b4
jmp 0x14005b18c
add ebx, ebx
jne 0x14005b18a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14005b1b4
inc ecx
add ebx, ebx
jne 0x14005b19a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14005b1b4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14005b1ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14005b19c
add ecx, 2
jmp 0x14005b1b9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14005b0e2
jmp 0x14005b12d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x27800
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14005b21d
cmp rsi, rcx
jae 0x14005b225
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14005b204
cmp al, 0x8f
ja 0x14005b204
cmp byte [rsi - 2], 0xf
je 0x14005b20a
sub al, 0xe8
cmp al, 1
ja 0x14005b1ee
cmp rsi, rcx
jae 0x14005b225
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14005b1f4
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14005b225
lodsb al, byte [rsi]
jmp 0x14005b204
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x58000]
mov eax, dword [rdi]
or eax, eax
je 0x14005b282
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x5bb44]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14005b232
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14005b27c
mov qword [rbx], rax
add rbx, 8
jmp 0x14005b252
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14005b2bc
cmp al, 0xef
ja 0x14005b2ae
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14005b28e
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14005b29d
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x20f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14005b310
sub rsp, 0xffffffffffffff80
jmp 0x140013ad0
Function at 0x1400053e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.14001320c
mov qword [rax], rbx
mov qword [rsp + 0x40], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400055e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x14000543a
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14000d7f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x300]
sub rsp, 0x400
mov dword [rsp + 0x20], 0x54
xor eax, eax
mov byte [rsp + 0x24], 0xf
mov byte [rsp + 0x25], 0x79
mov byte [rsp + 0x26], 9
mov byte [rsp + 0x27], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x28], 0x10
mov byte [rsp + 0x29], 0x31
mov byte [rsp + 0x2a], 0x38
mov byte [rsp + 0x2b], 0x31
mov byte [rsp + 0x2c], 0x20
mov byte [rsp + 0x2d], 0x3d
mov byte [rsp + 0x2e], 0x3a
mov byte [rsp + 0x2f], 0x33
mov byte [rsp + 0x30], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x31], 0x27
mov byte [rsp + 0x32], 0x31
mov byte [rsp + 0x33], 0x38
mov byte [rsp + 0x35], al
mov byte [rsp + 0x34], 0x32
movzx eax, byte [rsp + 0x24]
xor eax, eax
nop dword [rax + rax]
movzx ecx, byte [rsp + rax + 0x24]
mov edx, dword [rsp + 0x20]
xor dl, cl
mov byte [rsp + rax + 0x24], dl
inc rax
cmp rax, 0x11
jb 0x14000d870
lea rdx, [rsp + 0x24]
mov byte [rsp + 0x35], 0
lea rcx, [rbp - 0x50]
call fcn.140003760
mov rcx, rax
call fcn.14000d750
xor edx, edx
lea rcx, [rbp - 0x30]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x1f0]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0xe0]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rbp - 0x30]
xor ecx, ecx
call qword [0x14001fee8]
mov r8d, 0x104
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x30]
call qword [0x14001fdd8]
mov r8d, 0x104
lea rdx, [rbp + 0x1f0]
lea rcx, str.COMSPEC
call qword [0x14001ff48]
lea rdx, str._c_del
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.___nul
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor eax, eax
mov dword [rsp + 0x40], WSACleanup
mov qword [rbp - 0x5c], rax
lea rcx, [rsp + 0x40]
mov dword [rbp - 0x54], eax
xorps xmm0, xmm0
mov qword [rsp + 0x48], rax
lea rax, str.Open
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x74], xmm0
mov qword [rsp + 0x68], 0
movups xmmword [rbp - 0x7c], xmm0
mov dword [rsp + 0x70], 0
movups xmmword [rbp - 0x6c], xmm0
mov dword [rsp + 0x44], 0x40
call qword [0x14001fe60]
test eax, eax
je 0x14000da23
mov rcx, qword [rbp - 0x58]
mov edx, 0x40
call qword [0x14001fe70]
call qword [0x14001fe20]
mov rcx, rax
mov edx, pe_nt_image_headers64
call qword [0x14001fe70]
call qword [0x14001fe28]
mov rcx, rax
mov edx, 0xf
call qword [0x14001ff20]
xor r9d, r9d
lea r8, [rbp - 0x30]
lea edx, [r9 + 5]
lea ecx, [rdx - 1]
call qword [0x14001fda8]
call qword [0x14001fe20]
mov rcx, rax
xor edx, edx
call qword [0x14001fee0]
call qword [0x14001fe20]
mov rcx, rax
xor edx, edx
call qword [0x14001fee0]
add rsp, 0x400
pop rbp
ret
Function at 0x14000e430
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rbx, rcx
lea rdi, [rcx + 0x18]
cmp qword [rdi], 0xf
jbe 0x14000e462
mov rcx, qword [rcx]
lea rbp, [rbx + 0x18]
jmp 0x14000e465
mov rbp, rdi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [0x14001fe88]
mov rsi, rax
mov r14, rdi
cmp rax, 0xffffffffffffffff
je 0x14000e523
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, rsi
test eax, eax
je 0x14000e51a
xorps xmm6, xmm6
cvtsi2sd xmm6, qword [rsp + 0x70]
mulsd xmm6, qword [0x140019ed0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rdi]
cmp rdx, 0xf
jbe 0x14000e507
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000e4fe
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000e513
mov rcx, r8
call fcn.140013248
lea rdi, [rbx + 0x18]
mov qword [rdi], 0xf
movaps xmm0, xmm6
jmp 0x14000e567
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, rbp
mov rdx, qword [rdi]
cmp rdx, 0xf
jbe 0x14000e558
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000e553
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000e58d
mov rcx, r8
call fcn.140013248
mov qword [r14], 0xf
movsd xmm0, qword [0x140019f08]
mov byte [rbx], 0
mov qword [rbx + 0x10], 0
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14000e5a0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x210
mov rbx, rdx
mov rdi, rcx
mov ecx, 0x202
lea rdx, [rsp + 0x70]
xor r14d, r14d
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14000e617
cmp qword [rbx + 0x18], 0xf
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x44], 2
mov dword [rsp + 0x48], 1
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
jbe 0x14000e5f5
mov rbx, qword [rbx]
lea r9, [rsp + 0x240]
xor edx, edx
lea r8, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x14000e635
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rdx, [0x140019c32]
mov rcx, rdi
call fcn.140003760
mov rax, rdi
add rsp, 0x210
pop r14
pop rdi
pop rbx
ret
mov rbx, qword [rsp + 0x240]
mov qword [rsp + 0x230], rbp
mov ebp, 0x16
mov qword [rsp + 0x238], rsi
test rbx, rbx
je 0x14000e68c
nop word [rax + rax]
mov rdx, qword [rbx + 0x20]
lea r8, [rsp + 0x28]
add rdx, 4
mov r9, rbp
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_ntop]
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x14000e660
mov rbx, qword [rsp + 0x240]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
call qword [sym.imp.WS2_32.dll_WSACleanup]
xorps xmm0, xmm0
lea rax, [rsp + 0x28]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov rbx, 0xffffffffffffffff
mov qword [rdi + 0x18], r14
inc rbx
cmp byte [rax + rbx], r14b
jne 0x14000e6b5
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x14000e7a6
mov qword [rdi + 0x18], 0xf
cmp rbx, 0xf
ja 0x14000e6fc
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x28]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], r14b
jmp 0x14000e787
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x14000e731
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14001320c
test rax, rax
je 0x14000e753
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14000e767
cmp rax, rbp
mov rsi, rax
cmovb rsi, rbp
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14000e75a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000e7ac
jmp 0x14000e716
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14000e767
call fcn.14001320c
mov r14, rax
mov r8, rbx
mov qword [rdi], r14
lea rdx, [rsp + 0x28]
mov qword [rdi + 0x10], rbx
mov rcx, r14
mov qword [rdi + 0x18], rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
mov rbp, qword [rsp + 0x230]
mov rax, rdi
mov rsi, qword [rsp + 0x238]
add rsp, 0x210
pop r14
pop rdi
pop rbx
ret
call fcn.1400030a0
int3
call fcn.140003000
int3
Function at 0x14000f460
Capabilities:
Enumerate process modules

Disassembly:
push rdi
mov eax, 0x1240
call fcn.140013e80
sub rsp, rax
mov rdi, rcx
lea r8, [rsp + 0x1258]
lea rcx, [rsp + 0x230]
mov edx, 0x1000
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x14000f49a
add rsp, 0x1240
pop rdi
ret
mov eax, dword [rsp + 0x1258]
mov qword [rsp + 0x1260], rbp
xor ebp, ebp
shr eax, 2
test eax, eax
je 0x14000f55b
mov qword [rsp + 0x1250], rbx
lea rbx, [rsp + 0x230]
mov qword [rsp + 0x1238], rsi
mov qword [rsp + 0x1230], r14
mov r14d, eax
nop dword [rax]
mov r8d, dword [rbx]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14000f539
mov r9d, 0x104
lea r8, [rsp + 0x20]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x14000f530
cmp qword [rdi + 0x18], 7
mov rdx, rdi
jbe 0x14000f51f
mov rdx, qword [rdi]
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14000f530
inc ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub r14, 1
jne 0x14000f4e0
mov r14, qword [rsp + 0x1230]
mov rsi, qword [rsp + 0x1238]
mov rbx, qword [rsp + 0x1250]
mov eax, ebp
mov rbp, qword [rsp + 0x1260]
add rsp, 0x1240
pop rdi
ret

Function at 0x140012d10
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x14
jb 0x140012d20
mov byte [rcx + 0x18], 0
ret

Function at 0x140012d40
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x28
jb 0x140012d50
mov byte [rcx + 0x2c], 0
ret

Function at 0x140012d70
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x11
mov rdx, rax
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
mov r9d, dword [rcx]
xor r9b, r8b
mov byte [rdx - 1], r9b
sub r10, 1
jne 0x140012d80
mov byte [rcx + 0x15], r10b
ret

Function at 0x140012dd0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xa
mov rdx, rax
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
mov r9d, dword [rcx]
xor r9b, r8b
mov byte [rdx - 1], r9b
sub r10, 1
jne 0x140012de0
mov byte [rcx + 0xe], r10b
ret

Function at 0x140012e90
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x2e
jb 0x140012ea0
mov byte [rcx + 0x32], 0
ret

Function at 0x140012ec0
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x32
jb 0x140012ed0
mov byte [rcx + 0x36], 0
ret
Function at 0x140012f50
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x29
jb 0x140012f60
mov byte [rcx + 0x2d], 0
ret

Function at 0x140012f80
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 7
jb 0x140012f90
mov byte [rcx + 0xb], 0
ret

Function at 0x140012fb0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x29
mov rdx, rax
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
mov r9d, dword [rcx]
xor r9b, r8b
mov byte [rdx - 1], r9b
sub r10, 1
jne 0x140012fc0
mov byte [rcx + 0x2d], r10b
ret

Function at 0x140012fe0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x12
mov rdx, rax
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
mov r9d, dword [rcx]
xor r9b, r8b
mov byte [rdx - 1], r9b
sub r10, 1
jne 0x140012ff0
mov byte [rcx + 0x16], r10b
ret

Function at 0x140013010
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x30
mov rdx, rax
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
mov r9d, dword [rcx]
xor r9b, r8b
mov byte [rdx - 1], r9b
sub r10, 1
jne 0x140013020
mov byte [rcx + 0x34], r10b
ret

Function at 0x140013070
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x2f
jb 0x140013080
mov byte [rcx + 0x33], 0
ret

Function at 0x1400130a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, r8
mov rsi, rcx
mov ecx, 0x20
call fcn.14001320c
mov rdx, qword [rsp + 0x60]
mov qword [rax], rdx
mov rdx, qword [rbx]
mov qword [rax + 8], rdx
mov rdx, qword [rdi]
mov qword [rax + 0x10], rdx
lea rcx, [0x140006ca0]
mov qword [rax + 0x18], rcx
mov qword [rsp + 0x48], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140013160]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsi], rax
test rax, rax
je 0x14001312a
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140013b60
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140013baa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140013baa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140013baa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140013baa
cmp dword [rcx + 0x84], 0xe
jbe 0x140013baa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140013bac
xor al, al
add rsp, 0x28
ret