joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001d98
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x14008fd4c
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14008fddd
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x14008fddd
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14008fddd
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x14008fdc1
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14008fdbb
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x14008fdc3
add rdx, 0x28
jmp 0x14008fda0
xor edx, edx
test rdx, rdx
jne 0x14008fdcc
xor al, al
jmp 0x14008fde3
test dword [rdx + 0x24], 0x80000000
je 0x14008fdd9
xor al, al
jmp 0x14008fde3
mov al, 1
jmp 0x14008fde3
xor al, al
jmp 0x14008fde3
add rsp, 0x18
ret

Function at 0x140001f05
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x140115330
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
add r8, rcx
mov r10, rdx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
test r11d, r11d
je 0x140115371
mov edx, dword [rax + 0xc]
cmp r10, rdx
jb 0x140115365
mov ecx, dword [rax + 8]
add ecx, edx
cmp r10, rcx
jb 0x140115373
inc r9d
add rax, 0x28
cmp r9d, r11d
jb 0x140115353
xor eax, eax
ret

Function at 0x140002045
Capabilities:
Get geographical location

Disassembly:
jmp 0x1400fb440
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r9d
mov rsi, r8
mov ebp, edx
lea r9, [0x1401482f8]
mov r14, rcx
lea r8, [0x1401482f0]
lea rdx, [0x140148300]
mov ecx, listen
call fcn.1400faa2c
mov rbx, rax
test rax, rax
je 0x1400fb4a3
mov rcx, rax
call qword [section..00cfg]
mov r9d, edi
mov r8, rsi
mov edx, ebp
mov rcx, r14
call rbx
jmp 0x1400fb4bd
xor edx, edx
mov rcx, r14
call fcn.1400030c6
mov ecx, eax
mov r9d, edi
mov r8, rsi
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140002347
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1400c2bd0
sub rsp, 0x58
mov rax, qword [0x14016c4a0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov r9, rdx
cmp rax, 0x20
mov r8, rcx
jae 0x1400c2c68
mov byte [rsp + rax + 0x20], 0
inc rax
cmp rax, 0x20
jl 0x1400c2bef
mov al, byte [rdx]
jmp 0x1400c2c22
movzx edx, al
shr rdx, 3
movzx eax, al
and eax, 7
movzx ecx, byte [rsp + rdx + 0x20]
bts ecx, eax
inc r9
mov byte [rsp + rdx + 0x20], cl
mov al, byte [r9]
test al, al
jne 0x1400c2c03
jmp 0x1400c2c47
movzx eax, r9b
mov edx, 1
movzx ecx, r9b
and ecx, 7
shr rax, 3
shl edx, cl
test byte [rsp + rax + 0x20], dl
jne 0x1400c2c63
inc r8
mov r9b, byte [r8]
test r9b, r9b
jne 0x1400c2c28
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140004ca5
add rsp, 0x58
ret
mov rax, r8
jmp 0x1400c2c51
call fcn.140002275
int3
Function at 0x140002ea5
Capabilities:
Access the windows event log

Disassembly:
jmp 0x140085f90
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x98
movzx esi, dx
movzx ebp, cx
xorps xmm0, xmm0
lea rdx, str.DPTF
xor ecx, ecx
xor ebx, ebx
movdqu xmmword [rsp + 0x50], xmm0
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
je 0x140086051
mov rdx, qword [rsp + 0xd0]
lea rax, [0x14013e3a8]
lea r8, [rsp + 0xd8]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x78]
call fcn.140004b29
mov ecx, 2
mov r9d, 0x100
movzx r8d, bp
movups xmm0, xmmword [rax]
lea rax, str.Error_in_formatting_event_message
movups xmmword [rsp + 0x60], xmm0
mov rbx, qword [rsp + 0x64]
test rbx, rbx
cmovne rax, rbx
xor edx, edx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edx
mov word [rsp + 0x28], cx
mov rcx, rdi
mov qword [rsp + 0x20], rdx
movzx edx, si
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
test rbx, rbx
je 0x14008605e
mov rcx, rbx
call fcn.140002d65
test rdi, rdi
je 0x14008606c
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
add rsp, 0x98
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140003215
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400902a4
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
test rax, rax
jne 0x1400902bc
xor al, al
jmp 0x1400902f3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400902b8
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x1400902b8
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x1400902b8
cmp dword [rax + 0x84], 0xe
jbe 0x1400902b8
cmp dword [rax + 0xf8], 0
setne al
add rsp, 0x28
ret

Function at 0x1400033ff
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400e4d78
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1400e49f0

Function at 0x14000354e
Capabilities:
Terminate process

Disassembly:
jmp 0x14009f548
sub rsp, 0x28
mov ecx, reloc.WSOCK32.dll_socket
call sub.KERNEL32.dll_IsProcessorFeaturePresent
test eax, eax
je 0x14009f561
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
lea ecx, [r8 + 1]
call fcn.140001cda
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x14000376f
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400dbff4
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x60
test rdx, rdx
je 0x1400dc02e
test r8, r8
je 0x1400dc02e
test r9, r9
jne 0x1400dc036
call fcn.1400033cd
mov dword [rax], socket
call fcn.140004845
xor eax, eax
add rsp, 0x60
pop rbp
ret
lea rax, [rbp + 0x28]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x28]
lea rax, [rbp + 0x10]
mov qword [rbp - 0x30], r9
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x38]
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x30]
lea rax, [rbp + 0x20]
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x10], rax
call fcn.1400015eb
jmp 0x1400dc030
Function at 0x1400039b3
Capabilities:
Terminate process

Disassembly:
jmp 0x14008ec7c
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x140003a99
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x140095e18
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x140143310]
mov ecx, 4
lea r8, [0x140143308]
lea rdx, [0x140143318]
call fcn.1400956d0
mov rbx, rax
test rax, rax
je 0x140095e5b
mov rcx, rax
call fcn.140002f18
mov rcx, rdi
call rbx
jmp 0x140095e61
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140003b43
Capabilities:
Get common file path

Disassembly:
jmp 0x1400eecf0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x14016c4a0]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor edi, edi
lea rcx, [rsp + 0x22]
xor edx, edx
mov word [rsp + 0x20], di
mov r8d, 0x208
call fcn.1400033e1
lea rdx, [rsp + 0x20]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp eax, 0x104
ja 0x1400eed6a
movzx ecx, word [rsp + 0x20]
test cx, cx
je 0x1400eedc7
cmp word [rsp + 0x22], 0x3a
jne 0x1400eedc7
lea eax, [rcx - 0x61]
cmp ax, 0x19
movzx eax, cx
ja 0x1400eed65
sub eax, 0x20
lea edi, [rax - 0x40]
jmp 0x1400eedc7
lea esi, [rax + 1]
mov edx, 2
mov ecx, esi
call fcn.140003db9
mov rbx, rax
test rax, rax
je 0x1400eed90
mov rdx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1400eed9d
call fcn.1400033cd
mov dword [rax], listen
jmp 0x1400eedbf
cmp word [rbx], di
je 0x1400eedbf
cmp word [rbx + 2], 0x3a
jne 0x1400eedbf
movzx eax, word [rbx]
sub ax, 0x61
cmp ax, 0x19
movzx eax, word [rbx]
ja 0x1400eedbc
sub eax, 0x20
lea edi, [rax - 0x40]
mov rcx, rbx
call fcn.140005173
mov eax, edi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140004ca5
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140003eef
Capabilities:
Delete file

Disassembly:
jmp 0x1400ff2b4
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400ff2d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140004138
or eax, 0xffffffff
jmp 0x1400ff2d6
xor eax, eax
add rsp, 0x28
ret
Function at 0x140003ffd
Capabilities:
Delete directory
Delete file

Disassembly:
jmp 0x140084590
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 4]
test rcx, rcx
je 0x1400845af
call fcn.140002d65
mov qword [rbx + 4], 0
mov rcx, qword [rbx + 0x2c]
test rcx, rcx
je 0x1400845d4
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbx + 0x2c]
test rcx, rcx
je 0x1400845cc
call fcn.140002d65
mov qword [rbx + 0x2c], 0
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400845f9
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400845f1
call fcn.140002d65
mov qword [rbx + 0x18], 0
add rsp, 0x20
pop rbx
ret

Function at 0x140004089
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400fb1fc
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x140148208]
mov ecx, 5
lea r8, [0x140148200]
lea rdx, [0x140143358]
call fcn.1400faa2c
mov rdi, rax
test rax, rax
je 0x1400fb23e
mov rcx, rax
call qword [section..00cfg]
mov ecx, ebx
call rdi
jmp 0x1400fb246
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000438b
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1400fb268
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x140148218]
mov edi, ecx
lea rdx, [0x140143378]
mov ecx, 6
lea r8, [0x140148210]
call fcn.1400faa2c
mov rsi, rax
test rax, rax
je 0x1400fb2b5
mov rcx, rax
call qword [section..00cfg]
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x1400fb2c0
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400043ef
Capabilities:
Read file on windows

Disassembly:
jmp 0x1400f3590
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15d, r8d
mov r13, rdx
movsxd rsi, ecx
cmp esi, 0xfffffffe
jne 0x1400f35cc
call fcn.140004e0d
and dword [rax], 0
call fcn.1400033cd
mov dword [rax], 9
jmp 0x1400f3691
test ecx, ecx
js 0x1400f3679
cmp esi, dword [0x14018557c]
jae 0x1400f3679
mov r14, rsi
mov r12, rsi
sar r12, 6
lea rax, [0x1401850b0]
and r14d, 0x3f
shl r14, 6
mov rax, qword [rax + r12*8]
movzx ecx, byte [rax + r14 + 0x38]
and ecx, 1
je 0x1400f3679
xor eax, eax
cmp r8d, 0x7fffffff
setbe al
test eax, eax
jne 0x1400f362d
call fcn.140004e0d
and dword [rax], 0
call fcn.1400033cd
mov dword [rax], socket
jmp 0x1400f368c
mov ecx, esi
call fcn.140003e22
or ebx, 0xffffffff
lea rax, [0x1401850b0]
mov rax, qword [rax + r12*8]
test byte [rax + r14 + 0x38], 1
jne 0x1400f365f
call fcn.1400033cd
mov dword [rax], 9
call fcn.140004e0d
and dword [rax], 0
jmp 0x1400f366e
mov r8d, r15d
mov rdx, r13
mov ecx, esi
call fcn.1400024a5
mov ebx, eax
mov ecx, esi
call fcn.1400017a8
mov eax, ebx
jmp 0x1400f3694
call fcn.140004e0d
and dword [rax], 0
call fcn.1400033cd
mov dword [rax], 9
call fcn.140004845
or eax, 0xffffffff
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x14000456b
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1400fb124
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x1401481e8]
mov ecx, 3
lea r8, [0x1401481e0]
lea rdx, [0x140143318]
call fcn.1400faa2c
mov rbx, rax
test rax, rax
je 0x1400fb168
mov rcx, rax
call qword [section..00cfg]
mov rcx, rdi
call rbx
jmp 0x1400fb16e
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400046f1
Capabilities:
Get common file path

Disassembly:
jmp 0x14007d680
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x240
mov rax, qword [0x14016c4a0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.1400033e1
xor eax, eax
mov dword [rbx], 9
mov qword [rbx + 4], rax
lea rcx, [rsp + 0x20]
mov edx, 0x104
mov qword [rbx + 0xc], rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r14d, eax
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14007d789
lea ecx, [rax + 1]
mov qword [rsp + 0x250], rsi
lea rsi, [rcx + rcx]
mov qword [rsp + 0x258], rdi
mov qword [rsp + 0x260], r15
mov r15d, ecx
mov rcx, rsi
call fcn.1400037c9
mov rdi, rax
test rax, rax
je 0x14007d726
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.1400033e1
mov rsi, qword [rsp + 0x250]
mov qword [rbx + 4], rdi
test rdi, rdi
je 0x14007d754
lea r8, [rsp + 0x20]
mov rdx, r15
mov rcx, rdi
call fcn.140004142
lea ecx, [r14 + r14]
lea eax, [rcx + 2]
mov dword [rbx + 0x10], ecx
mov dword [rbx + 0xc], eax
mov rdi, qword [rsp + 0x258]
mov rax, rbx
mov r15, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140004ca5
mov rbx, qword [rsp + 0x268]
add rsp, 0x240
pop r14
ret
mov rax, rbx
jmp 0x14007d767
Function at 0x140003e7c
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov rbp, rdx
mov rdi, rcx
call fcn.14009fccc
xor r14d, r14d
test eax, eax
je 0x140003ec2
cmp qword [rdi - 0x10], r14
jbe 0x140003eba
mov rbx, qword [rdi - 0x18]
add rbx, 0x18
add rbx, rdi
jmp 0x140003ebd
mov rbx, r14
mov rbx, qword [rbx]
jmp 0x140003ec5
mov rbx, r14
test rdi, rdi
jne 0x140003ecf
mov rax, r14
jmp 0x140003edc
mov edx, 0xfffc
mov rcx, rdi
call fcn.1401e9dbc
test rbx, rbx
je 0x140003f70
cmp dword [rbx + 0x50], r14d
je 0x140003f70
lea r8, [0x14026f804]
mov rdx, rax
mov rcx, rdi
call fcn.1400a91c0
lea rsi, [0x14031b480]
mov ecx, 0x8000
mov rdx, rsi
lea ebx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov qword [rsp + 0x38], r14
mov r8, rsi
mov qword [rsp + 0x30], r14
mov r9d, eax
lea r14, [0x140319480]
mov dword [rsp + 0x28], 0x1000
xor edx, edx
mov qword [rsp + 0x20], r14
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rax, ebx
lea r8, [0x14026f808]
add rax, rdi
mov ebx, 0x10000
mov edx, ebx
mov qword [rsp + 0x20], rax
mov r9, r14
mov rcx, rsi
call fcn.140001114
jmp 0x140003f90
mov ebx, 0x10000
lea rsi, [0x14031b480]
mov edx, ebx
lea r8, [0x14026eeac]
mov rcx, rsi
mov r9, rdi
call fcn.140001114
mov rdx, rbx
mov rcx, rsi
call fcn.1401e9dbc
cmp byte [rbp], 0x2e
mov rdx, rax
mov rcx, rsi
jne 0x140003fb5
lea r8, [0x14026f810]
call fcn.1400a91c0
jmp 0x140003fc3
lea r8, [0x14026f804]
call fcn.1400a91c0
inc eax
movsxd rcx, eax
lea r8, [0x14026eeac]
sub rbx, rcx
mov r9, rbp
mov rdx, rbx
add rcx, rsi
call fcn.140001114
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140009db8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r15
mov rbp, rsp
sub rsp, 0x30
and qword [rbp + 0x38], 0
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
je 0x140009ddf
and qword [rdx], 0
mov r8, qword [rcx + 0x38]
lea r12, [0x140317480]
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0x1000
or r9d, 0xffffffff
mov qword [rsp + 0x20], r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [0x14026fb9c]
mov rdx, r12
lea rcx, [rbp + 0x38]
call fcn.1401e6f50
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x140009fa9
mov edx, 0xfffffff0
lea r8d, [rdx + 0x12]
call fcn.1401e7a0c
mov r9, qword [rbp + 0x38]
lea rcx, [0x14031a480]
mov r8d, reloc.WS2_32.dll_recv
lea r15d, [r8 - 0xf]
mov edx, r15d
call fcn.1401ea344
mov rax, qword [0x14031a480]
cmp rax, qword [0x14030dbf0]
jne 0x140009fa0
mov rax, qword [0x14031a488]
cmp rax, qword [0x14030dbf8]
jne 0x140009fa0
mov rcx, qword [rbp + 0x38]
lea edx, [r15 - 0x15]
mov r8d, r15d
call fcn.1401e7a0c
mov r9, qword [rbp + 0x38]
lea r8d, [r15 + 3]
mov edx, r15d
lea rcx, [rbp + 0x30]
call fcn.1401ea344
cmp rax, 4
jne 0x140009fa0
mov ecx, dword [rbp + 0x30]
call qword [sym.imp.WS2_32.dll_ntohl]
mov rcx, qword [rbp + 0x38]
lea edx, [r15 - 5]
sub edx, eax
mov dword [rbp + 0x30], eax
mov r8d, r15d
call fcn.1401e7a0c
movsxd rdx, dword [rbp + 0x30]
mov eax, 0xffffffff
mov rcx, rdx
cmp rdx, rax
jae 0x140009ef0
mov eax, 0xffffffe7
cmp rdx, rax
jae 0x140009ef0
add rcx, 0x18
call fcn.1401ea40c
mov edx, dword [rbp + 0x30]
jmp 0x140009ef2
xor eax, eax
movsxd rdx, edx
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call fcn.14009faa0
mov rdi, rax
test rbx, rbx
je 0x140009f0e
mov qword [rbx], rax
movsxd r8, dword [rbp + 0x30]
mov rdx, r15
mov r9, qword [rbp + 0x38]
mov rcx, rdi
call fcn.1401ea344
movsxd rcx, dword [rbp + 0x30]
cmp rax, rcx
jne 0x140009fa0
test rbx, rbx
jne 0x140009fa0
mov rcx, qword [rsi + 0x38]
lea rdx, str..msh
and qword [rbp + 0x40], rbx
call fcn.140003e7c
or r9d, 0xffffffff
mov dword [rsp + 0x28], 0x1000
mov r8, rax
mov qword [rsp + 0x20], r12
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [0x1402719b0]
mov rdx, r12
lea rcx, [rbp + 0x40]
call fcn.1401e6f50
mov r9, qword [rbp + 0x40]
test r9, r9
je 0x140009f98
movsxd r8, dword [rbp + 0x30]
mov rdx, r15
mov rcx, rdi
call fcn.1401e8c3c
mov rcx, qword [rbp + 0x40]
call fcn.1401e757c
mov rcx, rdi
call fcn.14009fb80
mov rcx, qword [rbp + 0x38]
call fcn.1401e757c
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000a160
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x14030cf00]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov edi, ecx
xor r9d, r9d
mov ecx, 0xe00
xor r8d, r8d
xor edx, edx
call fcn.14009fd78
xor edx, edx
lea rcx, str.Shcore.dll
mov r8d, 0x800
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rbx + 0x78], rax
test rax, rax
je 0x14000a1df
lea rdx, str.SetProcessDpiAwareness
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x80], rax
test rax, rax
jne 0x14000a1df
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
and qword [rbx + 0x78], 0
mov ecx, 0x18
mov dword [rbx + 0xb9c], 4
call fcn.1400a06b4
mov rcx, rax
mov qword [rbx], rax
call fcn.1400aabf8
or edi, 0x118
mov qword [rbx + 0x30], rax
xor edx, edx
mov dword [rbx + 0x298], edi
mov r8d, 0x800
lea rcx, str.Ws2_32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14000a249
lea rdx, str.GetHostNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000a27e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rbx + 0x29c]
mov edx, 0xff
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
movzx ecx, byte [rsp + 0x41]
mov edx, ecx
sub edx, 0x80
je 0x14000a2cf
cmp edx, 0x7f
jne 0x14000a2d4
xor ecx, ecx
jmp 0x14000a2d4
mov edx, 0x104
lea rcx, [rsp + 0x50]
call rax
test eax, eax
jne 0x14000a2c4
and qword [rsp + 0x38], 0
lea rax, [rbx + 0x29c]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x50]
mov dword [rsp + 0x28], 0xff
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14000a25b
mov ecx, 3
mov dword [rbx + 0xbac], ecx
mov edx, reloc.WS2_32.dll_recv
mov rax, qword [rbx]
test rax, rax
lea rcx, [rax + 0x9c8]
mov rax, rbx
cmove rcx, rdx
mov qword [rcx], rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401d9e80
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x140010ee4
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov r14, r9
cmp qword [0x1403161c0], rbx
mov edi, edx
mov rsi, rcx
je 0x140010fa3
cmp edx, 2
jl 0x140010f53
movzx ecx, word [rcx]
call qword [sym.imp.WS2_32.dll_ntohs]
cmp ax, 0xa
jne 0x140010f53
mov qword [rsp + 0x28], rbx
lea r8, [0x14000fab4]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140010f53
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1403161c0]
mov r8d, edi
mov rdx, rsi
call fcn.1400ac9bc
mov rax, qword [0x140315f60]
test rax, rax
je 0x140010f75
mov rbx, qword [rax + 8]
movzx ecx, word [rsi]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
lea r9, str.KVM__Master_:_Write_Input__Type___u_
mov edx, 0x100
mov dword [rsp + 0x20], eax
mov r8d, 4
mov rcx, rbx
call fcn.1400acec4
mov eax, edi
jmp 0x140010fc8
mov ebp, ebx
jmp 0x140010fb6
add ebp, eax
mov edx, edi
sub edx, ebp
movsxd rcx, ebp
add rcx, rsi
mov r9, r14
lea r8, [0x140001c30]
call fcn.1400102e0
test eax, eax
jne 0x140010fa7
mov eax, ebp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret