joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e5f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400a45f8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14001e61d
xor eax, eax
jmp 0x14001e77a
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x14001e648
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x14001e648
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x14001e77a
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14001e76d
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14001e68b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14001e6b6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001e772
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14001e725
sub eax, 1
je 0x14001e725
cmp eax, 2
jne 0x14001e76d
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001e772
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14001e753
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14001e76d
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14001e772
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140077b10
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14001eee0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14001ef02
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x14001ef11
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14001ef34
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001ef36
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14001ef72
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14001f00e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14001efad
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14001efee
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14001f00e
cmp rbx, rax
ja 0x14001efc0
test rbx, rbx
je 0x14001f00e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
neg ecx
Function at 0x14001f030
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x14001f051
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14001f07e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14001f080
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14001f0d9
test ecx, ecx
jle 0x14001f0b9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14001f0d9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14001f0d9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
neg ecx
wait
cli
invalid
Function at 0x140025520
Capabilities:
Check os version

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x1400a45f8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x94
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1400255a7
cmp dword [rsp + 0x30], 2
jne 0x140025596
mov eax, dword [rsp + 0x24]
cmp eax, 5
jne 0x140025579
cmp dword [rsp + 0x28], 1
jmp 0x14002557c
cmp eax, 6
jb 0x140025596
mov eax, 1
mov word [0x1400a5d50], ax
call fcn.1400255c0
call fcn.140025a60
jmp 0x1400255a2
mov eax, 2
mov word [0x1400a5d50], ax
call fcn.1400389c0
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140077b10
add rsp, 0xd8
ret
Function at 0x140028420
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140028457
movsxd r8, dword [rcx + 0x3c]
mov r9d, 0x454c
add r8, rcx
movzx ecx, word [r8]
movzx eax, cx
sub ax, r9w
mov r9d, 0xfffd
test r9w, ax
je 0x14002845d
cmp dword [r8], 0x4550
je 0x140028464
mov eax, 1
ret
cmp cx, 0x4550
jne 0x140028457
movups xmm0, xmmword [r8 + 0x18]
lea rax, [r8 + 0x98]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [r8 + 0x28]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [r8 + 0x38]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [r8 + 0x48]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [r8 + 0x58]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [r8 + 0x68]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [r8 + 0x78]
movups xmmword [rdx + 0x60], xmm0
sub rdx, 0xffffffffffffff80
movups xmm0, xmmword [r8 + 0x88]
movups xmmword [rdx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmmword [rdx], xmm1
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm1
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm0
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm1
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm0
movups xmm1, xmmword [rax + 0x60]
xor eax, eax
movups xmmword [rdx + 0x60], xmm1
ret

Function at 0x140028550
Capabilities:
Parse pe header

Disassembly:
mov edx, 0x5a4d
cmp word [rcx], dx
jne 0x140028591
movsxd rax, dword [rcx + 0x3c]
mov r9d, 0x454c
lea r8, [rax + rcx]
movzx eax, word [rax + rcx]
movzx ecx, ax
sub cx, r9w
mov r9d, 0xfffd
test r9w, cx
je 0x14002858d
mov eax, 0x4550
cmp dword [r8], eax
cmove edx, eax
mov eax, edx
ret
movzx eax, ax
ret
xor eax, eax
ret

Function at 0x140028720
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1400a45f8]
xor rax, rsp
mov qword [rsp + 0x38], rax
movsxd rbp, edx
mov rsi, rcx
mov r14d, 6
mov dword [rsp + 0x20], reloc.WSOCK32.dll_recv
mov ecx, r14d
mov edx, 5
mov r8d, 0x4e8
call fcn.140026910
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400287cf
movsxd r8, dword [rsp + 0x20]
lea rcx, [rsp + 0x28]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rdi
mov word [rsp + 0x28], r14w
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
je 0x1400287cf
lea r8, [rsp + 0x20]
mov rcx, rdi
lea rdx, [rsp + 0x28]
call sub.WSOCK32.dll_getsockname
cmp eax, 0xffffffff
je 0x1400287cf
mov rdx, rbp
lea r8, str.00_00_00_00_FF_FF_FF_FF_FF_FF
mov rcx, rsi
call fcn.1400292e0
mov rcx, rdi
call sub.WSOCK32.dll_closesocket
xor eax, eax
jmp 0x1400287e6
mov rdx, rbp
lea r8, str.00_00_00_00_FF_FF_FF_FF_FF_FF
mov rcx, rsi
call fcn.1400292e0
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140077b10
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140028c40
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
mov qword [rsp + 0x38], rbp
mov rbp, rcx
mov qword [rsp + 0x68], rdi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x60], edi
lea r8, [rsp + 0x68]
mov dword [rsp + 0x58], edi
lea rdx, str.SystemCurrentControlSetControlProductOptions
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x140028d5f
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.ProductSuite
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140028d5f
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x140028d5f
mov edx, eax
mov qword [rsp + 0x30], rsi
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x140028d5a
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, str.ProductSuite
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140028d51
cmp dword [rsp + 0x60], 7
jne 0x140028d51
mov qword [rsp + 0x50], rbx
mov rbx, rsi
cmp byte [rsi], dil
je 0x140028d4c
nop dword [rax + rax]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x140028d47
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cdqe
add rbx, rax
cmp byte [rbx], dil
jne 0x140028d20
jmp 0x140028d4c
mov edi, 1
mov rbx, qword [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x38]
test rcx, rcx
je 0x140028d74
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
add rsp, 0x40
pop rdi
ret

Function at 0x140029000
Capabilities:
Check os version

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x1400a45f8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x9c
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x140029082
cmp dword [rsp + 0x24], 6
jne 0x140029082
cmp dword [rsp + 0x28], 0
jne 0x140029082
cmp word [rsp + 0xb4], 0
jne 0x140029082
cmp byte [rsp + 0xba], 1
jne 0x140029082
mov eax, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140077b10
add rsp, 0xd8
ret
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140077b10
add rsp, 0xd8
ret
Function at 0x140029180
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x2e0
mov rax, qword [0x1400a45f8]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov r8d, Ordinal_265
lea rdx, [rsp + 0x1c0]
xor ecx, ecx
mov edi, 1
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor r8d, r8d
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_OpenFile]
xor r14d, r14d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], r14d
mov rbx, qword [rsp + 0x30]
cmp rbx, 0xffffffffffffffff
je 0x1400292ae
mov qword [rsp + 0x28], r14
lea r8d, [rdi + 1]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
xor edx, edx
mov qword [rsp + 0x2f8], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rsi, rax
test rax, rax
je 0x14002929d
xor r9d, r9d
mov qword [rsp + 0x2f0], rbp
xor r8d, r8d
mov qword [rsp + 0x20], r14
lea edx, [rdi + 3]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbp, rax
test rax, rax
je 0x14002928c
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rbp
call fcn.140028550
cmp eax, 0x4550
jne 0x14002928c
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.140028420
test eax, eax
jne 0x14002928c
movzx eax, word [rsp + 0x84]
cmp eax, 3
je 0x140029289
add eax, 0xfffffffb
test eax, 0xfffffffd
jne 0x14002928c
mov edi, r14d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x2f0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x2f8]
mov eax, edi
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.140077b10
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140035fa0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x400]
sub rsp, 0x500
mov rax, qword [0x1400a45f8]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], 0x40
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp eax, 1
jne 0x140036029
lea r8, [rsp + 0x30]
mov edx, 0x200
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov r8d, 0x40
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x30]
call fcn.14004a720
lea rcx, [rsp + 0x30]
mov edx, 0x40
cmp eax, 0xffffffff
jne 0x140036023
lea r8, str.NoName
jmp 0x14003604e
lea r8, [rbp - 0x50]
jmp 0x14003604e
lea r8, str.NoName
mov edx, 0x40
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea r8, [rsp + 0x30]
mov edx, 0x200
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea rcx, [rsp + 0x70]
call fcn.140049a60
lea r8, [rsp + 0x70]
mov byte [rbp - 0x51], 0
mov edx, 0x200
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov r8d, 0x40
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp - 0x10]
call fcn.14004a720
lea rcx, [rbp - 0x10]
mov edx, 0x200
lea r8, str.NoShareString
cmp eax, 0xffffffff
je 0x1400360a8
lea r8, [rbp + 0x1f0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
xor ebx, ebx
lea rax, [rbp - 0x10]
mov dword [rsp + 0x20], ebx
or rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp byte [rax + rdx], bl
jne 0x1400360c0
lea r8, [rsp + 0x20]
lea rcx, [rbp - 0x10]
call fcn.140049c80
mov ecx, dword [rsp + 0x20]
cmp eax, 0xffffffff
cmove ecx, ebx
mov dword [0x1400a72a4], ecx
mov eax, ecx
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.140077b10
mov rbx, qword [rsp + 0x510]
add rsp, 0x500
pop rbp
ret
Function at 0x14003c810
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov dword [r11 + 0x20], r9d
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
movzx ebp, byte [rsp + 0xe8]
xor ecx, ecx
movzx r14d, word [rsp + 0xe0]
mov eax, r9d
mov r15d, dword [rsp + 0xd8]
mov edi, r8d
movzx r12d, word [rsp + 0xd0]
mov esi, edx
mov r13d, dword [rsp + 0xc8]
mov r8d, eax
mov ebx, dword [rsp + 0xc0]
mov edx, edi
mov byte [rsp + 0x48], bpl
mov r9d, ebx
mov word [r11 - 0x58], r14w
mov dword [r11 - 0x60], r15d
mov word [r11 - 0x68], r12w
mov dword [r11 - 0x70], r13d
mov word [rsp + 0x20], cx
mov ecx, esi
call fcn.140039be0
test ax, ax
je 0x14003c8aa
mov rcx, qword [rsp + 0xa0]
mov word [rcx + 6], ax
jmp 0x14003c95e
cmp word [0x1400a7308], 0
jne 0x14003c95c
lea rax, [rsp + 0x54]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea r8, [fcn.140039b00]
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, rax
mov qword [0x1400a7328], rax
mov edx, 0x1b58
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14003c95c
movzx eax, word [rsp + 0x50]
cmp ax, 2
jne 0x14003c976
cmp dword [rsp + 0xb8], 0xffffffff
jne 0x14003c918
test ebx, ebx
jns 0x14003c918
or r8d, 0xffffffff
jmp 0x14003c91e
mov r8d, 1
mov byte [rsp + 0x48], bpl
mov eax, 2
mov word [rsp + 0x40], r14w
mov r9d, ebx
mov dword [rsp + 0x38], r15d
mov edx, edi
mov word [rsp + 0x30], r12w
mov ecx, esi
mov dword [rsp + 0x28], r13d
mov word [rsp + 0x20], ax
call fcn.140039be0
mov rcx, qword [0x1400a7328]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test ax, ax
je 0x14003c94f
cmp dword [rsp + 0xb8], 1
jne 0x14003c993
test ebx, ebx
jle 0x14003c993
mov eax, 1
mov r8d, eax
jmp 0x14003c99c
mov eax, 1
or r8d, 0xffffffff
mov byte [rsp + 0x48], bpl
mov r9d, ebx
mov word [rsp + 0x40], r14w
mov edx, edi
mov dword [rsp + 0x38], r15d
mov ecx, esi
mov word [rsp + 0x30], r12w
mov dword [rsp + 0x28], r13d
mov word [rsp + 0x20], ax
call fcn.140039be0
mov rcx, qword [rsp + 0xa0]
mov ebx, 0x46
mov word [rcx + 6], bx
mov rcx, qword [0x1400a7328]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bx
jmp 0x14003c95e

Function at 0x14003cd80
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x1400a36a8]
mov dword [rsp + 0x38], 0
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14003cdf2
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x38], 0x103
jne 0x14003cdf2
mov rcx, qword [0x1400a36a8]
mov edx, 0x7530
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14003cdda
mov rcx, qword [0x1400a36a8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x1400a36a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1400a36a8], 0
add rsp, 0x28
ret
Function at 0x14003f170
Capabilities:
Create thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
movzx edi, dx
mov rbx, rcx
call fcn.140029520
mov rsi, rax
test rbx, rbx
jne 0x14003f198
mov eax, 2
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov eax, 0x7242
cmp word [rsi + 0x18], ax
jne 0x14003f18b
test byte [rsi + 0x2a], 4
jne 0x14003f1bf
mov eax, 0xb39
mov word [rsi + 0x1e], ax
mov eax, reloc.WSOCK32.dll_gethostname
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x68], rbp
xor ecx, ecx
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
call fcn.140057c30
mov word [rsi + 0xe8], di
bt eax, 8
mov ebp, eax
mov ecx, 0
cmovae ebp, ecx
mov eax, 8
mov word [rsi + 0x48], ax
mov r15d, 0x103
mov dword [rsi + 0xe0], ebp
mov r13d, 3
mov word [rsi + 0x50], di
mov eax, 0xffff
mov word [rsi + 0x52], di
movzx ecx, r13w
xor dil, dil
mov dword [rsi + 0x4c], 0xff0000
mov dword [rsi + 0x54], 0xffff0000
lea r12d, [r15 - 4]
mov r14d, 0xfffb
nop dword [rax + rax]
lea eax, [rcx - 3]
test r14w, ax
jne 0x14003f272
lea rcx, [rsi + 0x18]
mov byte [rsi + 0x22], dil
call fcn.140029460
cmp ax, r15w
jne 0x14003f263
mov ecx, 0x112
jmp 0x14003f26a
and ax, r12w
movzx ecx, ax
inc dil
cmp dil, r13b
jbe 0x14003f240
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r12, qword [rsp + 0x70]
cmp cx, 9
je 0x14003f2dc
test cx, cx
je 0x14003f294
movzx eax, cx
jmp 0x14003f32c
and byte [rsi], 0xfc
mov r8b, 0x91
movzx ecx, word [rsi + 0x54]
movzx eax, byte [rsi]
cmp cx, 5
jne 0x14003f2ae
or al, 2
mov r8b, 1
jmp 0x14003f2b6
cmp cx, 7
jne 0x14003f2b8
or al, 1
mov byte [rsi], al
test ebp, ebp
je 0x14003f2e2
mov ebx, dword [rsi + 0xe0]
mov edx, ebp
movzx ecx, r8b
call fcn.140044d10
cmp ebx, eax
je 0x14003f2e2
mov ecx, ebp
call fcn.140057ae0
cmp ebx, eax
je 0x14003f2e2
movzx eax, r13w
jmp 0x14003f32c
xor ebx, ebx
cmp qword [0x1400a36a8], 0xffffffffffffffff
jne 0x14003f329
lea rax, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9, [0x1400a7344]
lea r8, [0x140046670]
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
cmp byte [0x1400a7340], 1
mov qword [0x1400a36a8], rax
jne 0x14003f329
lea eax, [rbx + 0x68]
jmp 0x14003f32c
movzx eax, bx
mov rbp, qword [rsp + 0x68]
mov r13, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x140044d10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x1400a45f8]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov ebx, edx
movzx edi, cl
test cl, cl
jns 0x140044ec8
mov eax, edx
shr ebx, 0x10
mov r8d, edx
mov r10d, edx
and eax, 0xff00
shl r8d, 0x10
and r10d, 0xff0000
movzx edx, cl
or eax, r8d
or r10d, ebx
shl eax, 8
xor r9d, r9d
shr r10d, 8
and edx, 0xf
je 0x140044e79
sub edx, 1
je 0x140044e33
sub edx, 1
je 0x140044de7
cmp edx, 1
jne 0x140044ea7
lea r11d, [r9 + 0x20]
nop dword [rax]
nop dword [rax + rax]
mov ecx, r9d
mov edx, r10d
shl edx, 0xb
xor edx, eax
shr ecx, 1
shl edx, 5
xor edx, eax
and edx, 0xffff0000
shl edx, 0xf
mov r9d, edx
mov edx, eax
shr edx, 0x12
or r9d, ecx
xor edx, eax
mov ecx, eax
shr edx, 7
xor edx, r10d
shr ecx, 1
shl edx, 0x1f
mov eax, edx
shr r10d, 1
or eax, ecx
sub r11, 1
jne 0x140044da0
jmp 0x140044ea7
mov r11d, 0x20
nop dword [rax]
mov edx, eax
mov ecx, r9d
shl edx, 0xc
mov r8d, r10d
shr ecx, 1
shl r8d, 0x1f
xor edx, r8d
shr r10d, 1
and edx, 0x80000000
mov r9d, edx
mov edx, eax
shr edx, 0xf
or r9d, ecx
xor edx, eax
mov ecx, eax
shr edx, 8
shl edx, 0x1f
xor edx, r8d
shr ecx, 1
mov eax, edx
or eax, ecx
sub r11, 1
jne 0x140044df0
jmp 0x140044ea7
mov r11d, 0x20
nop dword [rax]
mov edx, eax
mov ecx, r9d
and edx, 0xffff0000
shr ecx, 1
shl edx, 0xf
mov r9d, edx
mov edx, eax
shr edx, 8
or r9d, ecx
xor edx, eax
mov ecx, eax
shr edx, 0xc
xor edx, r10d
shr ecx, 1
shl edx, 0x1f
mov eax, edx
shr r10d, 1
or eax, ecx
sub r11, 1
jne 0x140044e40
jmp 0x140044ea7
mov r11d, 0x20
nop
mov ecx, eax
shr r9d, 1
shr ecx, 0xd
mov edx, r10d
shl ecx, 0x1f
or r9d, ecx
shl edx, 0x1f
xor edx, ecx
shr r10d, 1
mov ecx, eax
mov eax, edx
shr ecx, 1
or eax, ecx
sub r11, 1
jne 0x140044e80
mov eax, r9d
movzx ecx, r9b
shr eax, 8
and r9d, 0xffff0000
movzx eax, al
shl ecx, 8
or eax, ecx
or eax, r9d
jmp 0x140044f56
lea rdx, [rbp + 0x37]
mov dword [rbp + 0x37], 0x39b25629
lea rcx, [rbp - 0x79]
mov dword [rbp + 0x3b], 0x87ebcea0
mov dword [rbp + 0x3f], 0xfb76b452
mov dword [rbp + 0x43], 0x7137940c
call fcn.140054780
mov eax, ebx
mov byte [rbp + 0x37], bl
shr eax, 8
lea rcx, [rbp + 0x3b]
mov byte [rbp + 0x38], al
mov r8d, recv
mov eax, ebx
movzx edx, dil
shr eax, 0x10
shr ebx, 0x18
mov byte [rbp + 0x39], al
mov byte [rbp + 0x3a], bl
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x37]
lea rcx, [rbp - 0x79]
call fcn.1400545d0
lea rdx, [rbp + 0x37]
lea rcx, [rbp - 0x79]
call fcn.140054780
movzx ecx, byte [rbp + 0x39]
movzx eax, byte [rbp + 0x3a]
shl eax, 8
or eax, ecx
movzx ecx, byte [rbp + 0x38]
shl eax, 8
or eax, ecx
movzx ecx, byte [rbp + 0x37]
shl eax, 8
or eax, ecx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140077b10
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret