joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140066800
Capabilities:
Create process on windows
Self delete

Disassembly:
sub rsp, 0x718
mov rax, qword [0x1401200c0]
xor rax, rsp
mov qword [rsp + 0x700], rax
xorps xmm0, xmm0
lea rdx, [rsp + 0xe0]
xor eax, eax
mov r8d, 0x104
xor ecx, ecx
mov qword [rsp + 0xd0], rax
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r9, [rsp + 0xe0]
mov edx, 0x208
lea r8, str.cmd.exe__C_ping_1.1.1.1__n_1__w_3000___Nul__Del__f__q___s_
lea rcx, [rsp + 0x2f0]
call fcn.140066910
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x2f0]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x700]
xor rcx, rsp
call fcn.1400c6ee0
add rsp, 0x718
ret
Function at 0x140066fa0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.140067150
mov r10, qword [rbx]
mov rdi, rax
shl rdi, 0x20
mov r9d, 0x270
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x140067011
lea r8, [r10 + 8]
nop
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140066fd0
mov ecx, dword [r10]
jmp 0x1400670f6
cmp ecx, 0x4e0
jb 0x1400670f6
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop dword [rax]
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140067030
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140067080
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov rbx, qword [rsp + 0x30]
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
or rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x140067150
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, qword [rcx]
mov r9d, 0x270
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x1400671b1
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140067170
mov ecx, dword [r10]
jmp 0x14006729a
cmp ecx, 0x4e0
jb 0x14006729a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400671d0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140067220
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
add rsp, 8
ret
Function at 0x1400672f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov ebp, r9d
mov r15, r8
mov r14, rdx
mov rsi, rcx
call fcn.140067150
mov rdi, rax
add ebp, 0xffffffff
je 0x1400674ce
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r12
xor r12d, r12d
nop word [rax + rax]
mov r10, qword [rsi]
shl rdi, 0x20
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x140067394
lea rax, [r10 + 8]
mov r9d, ecx
nop dword [rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x140067350
mov ecx, dword [r10]
jmp 0x140067477
cmp ecx, 0x4e0
jb 0x140067477
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400673b0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140067400
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov ecx, edx
mov dword [r10], eax
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
xor rdx, rax
mov rcx, rdx
shr rcx, 0x12
xor rcx, rdx
or rdi, rcx
add ebp, 0xffffffff
jne 0x140067330
mov r12, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rax, r15
mul rdi
mov qword [r14], rax
mov rax, r14
mov qword [r14 + 8], rdx
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400696f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140069713
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x13]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x140069700
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x140069720
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x140069743
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x13]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x140069730
mov byte [rcx + 0x44], 0
mov rax, rcx
ret
Function at 0x140069750
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140069773
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x13]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140069760
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x14006c950
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov ecx, dword [0x140166038]
mov rax, qword gs:[0x58]
mov r15, qword [rax + rcx*8]
mov edi, 0x1398
mov eax, dword [rdi + r15]
mov r14d, reloc.WS2_32.dll_recv
test al, 1
jne 0x14006c9fa
or eax, 1
mov dword [rdi + r15], eax
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov edx, eax
mov dword [r15 + r14 + 0x1384], 0xffffffff
mov dword [r15 + r14 + 4], eax
lea ecx, [rbp + 1]
lea r8, [r14 + 8]
add r8, r15
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x14006c9d0
mov dword [r15 + r14], 0x270
mov eax, dword [rdi + r15]
mov r12d, 0x13a0
test al, 2
jne 0x14006ca1c
or eax, 2
mov dword [rdi + r15], eax
mov qword [r15 + r12], rbp
mov qword [r15 + r12 + 8], 0x3d
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov dword [rsp + 0x20], 1
mov rdx, rsi
mov rcx, rbx
call fcn.14000e680
test rsi, rsi
je 0x14006cace
lea rbp, [r15 + r14]
dec rsi
mov r14, qword [str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov qword [rsp + 0x28], rbp
mov rdi, qword [r15 + r12]
mov rdx, qword [r15 + r12 + 8]
sub rdx, rdi
lea rcx, [rsp + 0x28]
cmp rdx, 0xffffffffffffffff
jne 0x14006ca7e
call fcn.140066fa0
jmp 0x14006ca86
inc rdx
call fcn.1400663e0
add rax, r14
movzx r9d, byte [rax + rdi]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x14006caba
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x14006caaf
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14006cac9
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.140002ae0
test rsi, rsi
jne 0x14006ca51
mov rax, rbx
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14007b050
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x1401200c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r9
mov r15, r8
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x60], r9
xor ebp, ebp
mov dword [rsp + 0x30], ebp
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x48], rbp
xor eax, eax
mov qword [rcx], rax
call fcn.1400037e0
mov rcx, rax
test rax, rax
je 0x14007b22b
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rdi], rax
mov ebx, 1
mov dword [rsp + 0x30], ebx
mov r9d, 0x20019
mov r8, qword [r15]
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.14007b3e0
test eax, eax
jne 0x14007b1af
mov rax, qword [rdi]
sub ebx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, 0x100
or ecx, ebx
jge 0x14007b110
mov edx, 0x100
mov rcx, rdi
call fcn.14007b4e0
mov rsi, qword [rdi]
mov dword [rsp + 0x68], 0x100
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x6c]
xor r8d, r8d
mov rdx, qword [r14]
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14007b161
mov eax, dword [rsp + 0x6c]
dec eax
cmp eax, 1
ja 0x14007b161
test rsi, rsi
je 0x14007b161
cmp dword [rsp + 0x68], 0
jne 0x14007b161
mov byte [rsi], 0
mov rcx, qword [rdi]
test rcx, rcx
jne 0x14007b16d
mov eax, ebp
jmp 0x14007b17f
movsxd rdx, dword [rcx - 0xc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
test eax, eax
js 0x14007b220
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x14007b220
mov dword [rcx - 0x10], eax
mov edx, eax
mov rax, qword [rdi]
mov byte [rdx + rax], 0
test rbx, rbx
je 0x14007b1b4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rbp
mov qword [rsp + 0x38], rbx
jmp 0x14007b1b4
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x14007b1c3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [r15]
sub rdx, 0x18
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14007b1e5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14007b200
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
mov rax, rdi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400c6ee0
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80070057
call fcn.1400036d0
nop
mov ecx, 0x80004005
call fcn.1400036d0
int3
Function at 0x14007b7a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14007b818
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14007b818
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x14007b805
nop
cmp rbx, rcx
jae 0x14007b818
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x14007b7f0
cmp rbx, rcx
jae 0x14007b818
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x14007b81a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14007c2d0
Capabilities:
Get mac address on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x60
mov rax, qword [0x1401200c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rcx
mov rbx, rcx
xor r14d, r14d
mov dword [rsp + 0x48], 0x2c0
lea ecx, [r14 + 0x12]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, 0x2c0
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
jne 0x14007c360
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.140002e40
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xorps xmm0, xmm0
mov r8, 0xffffffffffffffff
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
nop dword [rax]
inc r8
cmp byte [r14 + r8], r14b
jne 0x14007c350
xor edx, edx
jmp 0x14007c49c
lea rdx, [rsp + 0x48]
mov rcx, rbp
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x14007c3d0
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
jne 0x14007c3d0
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.140002e40
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xorps xmm0, xmm0
mov r8, 0xffffffffffffffff
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
nop dword [rax + rax]
inc r8
cmp byte [r14 + r8], r14b
jne 0x14007c3c0
xor edx, edx
jmp 0x14007c49c
lea rdx, [rsp + 0x48]
mov rcx, rbp
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x14007c470
mov qword [rsp + 0x88], rdi
mov rdi, rbp
movzx ecx, byte [rdi + 0x19c]
movzx edx, byte [rdi + 0x19b]
movzx eax, byte [rdi + 0x19d]
movzx r10d, byte [rdi + 0x19a]
movzx r9d, byte [rdi + 0x199]
movzx r8d, byte [rdi + 0x198]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov rcx, rsi
mov dword [rsp + 0x28], edx
lea rdx, str._02X:_02X:_02X:_02X:_02X:_02X
mov dword [rsp + 0x20], r10d
call fcn.140039c00
lea rdx, [rdi + 0x1c0]
mov r8, rsi
lea rcx, str.Address:__s__mac:__s_n
call fcn.140002e40
lea rcx, reloc.WS2_32.dll_ioctlsocket
call fcn.140002e40
mov rdi, qword [rdi]
test rdi, rdi
jne 0x14007c3f1
mov rdi, qword [rsp + 0x88]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xorps xmm0, xmm0
mov r8, 0xffffffffffffffff
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
nop
inc r8
cmp byte [rsi + r8], r14b
jne 0x14007c490
mov rdx, rsi
mov rcx, rbx
call fcn.1400029e0
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400c6ee0
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r14
pop rsi
pop rbp
ret
Function at 0x14007c4d0
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x1401200c0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x28]
mov rbx, rcx
mov dword [rsp + 0x28], 0x64
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], 0
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14007c530
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400029e0
mov rax, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400c6ee0
add rsp, 0xb0
pop rbx
ret

Function at 0x14007c570
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x1401200c0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x28]
mov rbx, rcx
mov dword [rsp + 0x28], 0x64
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], 0
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14007c5d0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400029e0
mov rax, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400c6ee0
add rsp, 0xb0
pop rbx
ret
Function at 0x14007f340
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret
Function at 0x14008e120
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x14008e17e
mov dl, 1
call fcn.140081410
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.140081410
mov eax, ebx
jmp 0x14008e1c2
cmp ebx, 2
ja 0x14008e1c0
mov r9, qword [rdi + 0x668]
lea rdx, [0x1400d1230]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14008e1e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x1401200c0]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
jne 0x14008e223
cmp qword [rcx + 0x678], 0
je 0x14008e300
mov r8, rdx
mov qword [rsp + 0x158], rbx
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.14007f680
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x14008e251
mov rcx, qword [rdi + 0x678]
test rcx, rcx
je 0x14008e298
cmp byte [rdi + 0x1597], 0
jne 0x14008e298
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x14008e280
mov byte [rdi + 0x1597], 1
cmp byte [rdi + 0xf1e], 0
je 0x14008e2f8
mov byte [rsp + rbx + 0x30], 0xa
inc rbx
cmp rbx, 0x102
jae 0x14008e353
cmp qword [rdi + 0x718], 0
mov byte [rsp + rbx + 0x30], 0
je 0x14008e319
mov dl, 1
mov rcx, rdi
call fcn.140081410
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.140081410
mov rbx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400c6ee0
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x668]
lea rcx, [0x1400d1230]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x14008e2f8
call fcn.1400c74ec
int3
Function at 0x14008e360
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x14008e4c6
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rdi
sub rsp, 0x860
mov rax, qword [0x1401200c0]
xor rax, rsp
mov qword [rsp + 0x840], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
je 0x14008e4ae
mov r8, rdx
mov qword [r11 - 0x10], rbx
mov edx, 0x801
lea r9, [r11 + 0x18]
lea rcx, [rsp + 0x30]
call fcn.14007f680
movsxd rcx, eax
mov rbx, 0xffffffffffffffff
cmp rcx, 0x801
jb 0x14008e421
mov rcx, qword [rsp + 0x878]
mov rax, rbx
nop word [rax + rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x14008e3e0
cmp byte [rax + rcx - 1], 0xa
jne 0x14008e408
lea r8, str...._n
mov edx, 5
lea rcx, [rsp + 0x82c]
jmp 0x14008e41c
lea r8, [0x140102c54]
mov edx, 4
lea rcx, [rsp + 0x82d]
call fcn.14007f580
lea rax, [rsp + 0x30]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14008e426
cmp qword [rdi + 0x718], 0
je 0x14008e46e
mov dl, 1
mov rcx, rdi
call fcn.140081410
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.140081410
jmp 0x14008e4a6
mov r9, qword [rdi + 0x668]
lea rcx, [0x1400d1230]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbx, qword [rsp + 0x858]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1400c6ee0
add rsp, 0x860
pop rdi
ret

Function at 0x14008e560
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x14008e5a2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, Ordinal_60
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret