joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a65f0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [reloc.WS2_32.dll_accept]
lea rcx, str.POSIXLY_CORRECT
xor edi, edi
mov rbx, r8
mov qword [0x1401456d8], rdi
mov dword [0x1401456c0], eax
mov dword [0x1401456c4], eax
call fcn.1400e1900
cmp byte [rbx], 0x2d
movsxd rcx, eax
mov qword [0x1401456c8], rcx
jne 0x1400a6642
mov dword [0x1401456d0], 2
inc rbx
jmp 0x1400a6659
cmp byte [rbx], 0x2b
jne 0x1400a664c
inc rbx
jmp 0x1400a6653
cmp rcx, rdi
sete dil
mov dword [0x1401456d0], edi
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400a7470
Capabilities:
Encode data using xor

Disassembly:
mov eax, r8d
shr eax, 2
test eax, eax
je 0x1400a7492
mov r10d, eax
mov eax, dword [rcx]
add rcx, 4
xor eax, r9d
mov dword [rdx], eax
add rdx, 4
sub r10, 1
jne 0x1400a747d
and r8d, 3
jbe 0x1400a74b0
sub rdx, rcx
mov al, byte [rcx]
xor al, r9b
shr r9d, 8
mov byte [rdx + rcx], al
inc rcx
sub r8, 1
jne 0x1400a749b
repz ret

Function at 0x1400a7a78
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, r9d
mov bpl, r8b
mov rdi, rdx
mov rsi, rcx
cmp r9d, 0xffffffff
jne 0x1400a7aa9
mov rcx, rdx
call fcn.1400e1d50
mov rbx, rax
test rdi, rdi
je 0x1400a7b3b
test ebx, ebx
je 0x1400a7b3b
mov r8, qword [rsi + 8]
mov ecx, 1
lea edx, [rbx + 1]
mov eax, dword [r8 - 0xc]
sub ecx, dword [r8 - 8]
sub eax, edx
or ecx, eax
jge 0x1400a7add
lea rcx, [rsi + 8]
call fcn.14001d8f0
mov rcx, qword [rsi + 8]
test ebx, ebx
je 0x1400a7afa
mov edx, ebx
mov al, byte [rdi]
inc rdi
xor al, bpl
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1400a7ae7
mov byte [rcx], 0
mov rcx, qword [rsi + 8]
test rcx, rcx
jne 0x1400a7b0a
xor eax, eax
jmp 0x1400a7b17
movsxd rdx, dword [rcx - 0xc]
call fcn.1400e23c4
test eax, eax
js 0x1400a7b30
mov rcx, qword [rsi + 8]
cmp eax, dword [rcx - 0xc]
jg 0x1400a7b30
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rsi + 8]
mov byte [rcx + rax], 0
jmp 0x1400a7b44
mov ecx, 0x80070057
call fcn.14001cd80
int3
lea rcx, [rsi + 8]
call fcn.1400a74b4
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a7c9c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor edx, edx
lea rsi, [rcx + 0x1020]
mov rbx, rcx
lea r8d, [rdx + 0x20]
mov rcx, rsi
call fcn.1400e1fc0
and dword [rbx + 0x101c], 0
cmp byte [rbx + 0x1040], 0
jne 0x1400a7d34
mov rcx, qword [rbx + 8]
lea rdx, [rbx + 0x79]
lea r9, [rbx + 0x101c]
mov r8d, 0xf9c
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400a7d18
cmp dword [rbx + 0x101c], 0
ja 0x1400a7d34
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400a7d34
cmp eax, 0x3e5
je 0x1400a7d34
cmp eax, 0x2733
jmp 0x1400a7d23
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1400a7d34
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [rbx + 0x1040], 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400a7d54
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov dil, byte [rcx + 0x50]
xor r15d, r15d
mov rbx, rcx
cmp qword [rcx + 0x30], r15
je 0x1400a7e80
cmp byte [rcx + 0x1040], r15b
je 0x1400a7d94
xor al, al
jmp 0x1400a7e83
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov r13d, eax
mov eax, 0x2710
sub ecx, dword [rbx + 0x54]
cmp ecx, eax
jbe 0x1400a7daf
mov byte [rbx + 0x50], 1
cmp byte [rbx + 0x50], r15b
je 0x1400a7d8d
mov esi, dword [rbx + 0x30]
mov dword [rbx + 0x54], r13d
mov r12b, 1
cmp esi, eax
cmova esi, r15d
cmp esi, r15d
jbe 0x1400a7e80
mov rax, qword [rbx + 0x20]
mov rbp, qword [rax + 0x10]
cmp rbp, r15
je 0x1400a7e77
mov rcx, rbp
call fcn.1400a71c4
mov rcx, rbp
mov r14d, eax
call fcn.1400a71b0
mov rcx, qword [rbx + 8]
xor r9d, r9d
mov r8d, r14d
mov rdx, rax
call qword [sym.imp.WS2_32.dll_send]
cmp eax, r14d
jne 0x1400a7e3b
lea rcx, [rbx + 0x18]
call fcn.1400d19e8
mov r11, qword [rbp]
mov edx, 1
mov rcx, rbp
call qword [r11]
add dword [rbx + 0x58], r14d
dec esi
cmp r14d, r15d
jbe 0x1400a7e31
mov dword [rbx + 0x10], r13d
cmp esi, r15d
jne 0x1400a7e77
mov dil, 1
jmp 0x1400a7e77
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2736
je 0x1400a7e6a
cmp eax, 0x2744
jbe 0x1400a7e64
cmp eax, 0x2746
jbe 0x1400a7e6a
cmp eax, 0x2748
jbe 0x1400a7e64
cmp eax, 0x274a
jbe 0x1400a7e6a
mov byte [rbx + 0x50], r15b
jmp 0x1400a7e71
mov byte [rbx + 0x1040], 1
mov r12b, r15b
mov dil, r15b
cmp r12b, r15b
jne 0x1400a7dc5
mov al, dil
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400a896c
Capabilities:
Connect socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ebx, edx
lea rdx, [rsp + 0x20]
movzx ebp, r8w
xor dil, dil
call fcn.1400a80f8
mov rsi, rax
test rax, rax
je 0x1400a8a11
mov edi, 1
movzx ecx, bp
mov dword [rsp + 0x2c], ebx
lea r12d, [rdi + 1]
mov word [rsp + 0x28], r12w
call qword [sym.imp.WS2_32.dll_htons]
xor r8d, r8d
mov edx, edi
mov ecx, r12d
mov word [rsp + 0x2a], ax
call qword [sym.imp.WS2_32.dll_socket]
mov r8d, dword [0x1401456e4]
mov rdx, qword [0x1401456e8]
lea ebp, [rdi + 0xf]
mov rcx, rax
mov rbx, rax
mov r9d, ebp
call qword [sym.imp.WS2_32.dll_WSAAsyncSelect]
lea rdx, [rsp + 0x28]
mov r8d, ebp
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_connect]
and dword [rsi + 8], 0
lea rcx, [rsi + 0x10]
mov rdx, rbx
call fcn.1400a7f14
mov al, dil
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400e2890
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400a8fe0
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
cmp dword [rcx + 8], 0
mov rbx, rcx
je 0x1400a900b
mov eax, 1
jmp 0x1400a902b
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1400a9023
xor eax, eax
jmp 0x1400a902b
mov eax, 1
mov dword [rbx + 8], eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400e2890
add rsp, 0x1d0
pop rbx
ret
Function at 0x1400ad940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x68
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp dword [rdx + 0x14], 0x18
mov r12, qword [rsp + 0xc0]
mov r13, r9
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
jae 0x1400ad97d
xor al, al
jmp 0x1400adb2b
mov rax, qword [rcx]
mov esi, 1
call qword [rax + 0x88]
lea r8d, [rsi + 0x17]
lea rcx, [rsp + 0x40]
mov dword [r12], eax
mov eax, dword [rdi]
xor edx, edx
mov dword [rbp], eax
call fcn.1400e1fc0
mov r11d, dword [rdi + 0x18]
mov dword [rsp + 0x40], r11d
sub r11d, 0x33100006
je 0x1400ada7d
sub r11d, esi
je 0x1400ada43
sub r11d, esi
je 0x1400ada24
cmp r11d, esi
jne 0x1400adb28
and dword [rbp + 4], 0
cmp dword [rdi + 0x28], 0x19
jb 0x1400ada65
mov r8d, dword [rdi + 0x40]
mov eax, dword [rdi + 0x28]
add r8, 0x19
cmp r8, rax
jne 0x1400ada65
mov edx, dword [rdi + 0x24]
mov rcx, rbx
call fcn.1400a949c
test rax, rax
je 0x1400ada65
mov r10, qword [rax]
and dword [rsp + 0x20], 0
lea rdx, [rdi + 0x2c]
xor r9d, r9d
mov r8d, 0x33110001
mov rcx, rax
call qword [r10 + 0x40]
test al, al
je 0x1400ada65
xor sil, sil
jmp 0x1400ada65
cmp dword [rdi + 0x28], 0x10
jb 0x1400adb28
mov rax, qword [rbx]
mov r8d, dword [rdi + 0x34]
mov edx, dword [rdi + 0x30]
mov rcx, rbx
call qword [rax + 0x80]
jmp 0x1400ada5d
cmp dword [rdi + 0x28], 0x10
jb 0x1400adb28
mov rax, qword [rbx]
mov r8d, dword [rdi + 0x34]
mov edx, dword [rdi + 0x30]
mov rcx, rbx
call qword [rax + 0x78]
movzx r11d, al
mov dword [rbp + 4], r11d
lea rdx, [rsp + 0x40]
mov r8d, 0x18
mov rcx, r13
call fcn.1400a70dc
jmp 0x1400adb28
mov rax, qword [rbx]
mov r8d, dword [rdi + 0x20]
mov edx, dword [rdi + 0x1c]
lea r9, [rsp + 0x34]
mov rcx, rbx
call qword [rax + 0x70]
xor ecx, ecx
test eax, eax
mov edx, eax
mov dword [rsp + 0x34], eax
setne cl
and dword [rsp + 0x38], 0
mov dword [rbp + 4], ecx
mov ecx, dword [rdi + 0x20]
mov dword [rsp + 0x3c], ecx
mov rcx, rbx
call fcn.1400a949c
test rax, rax
je 0x1400adad8
mov r10, qword [rax]
and dword [rsp + 0x20], 0
lea rdx, [rsp + 0x38]
xor r9d, r9d
mov r8d, 0x33100001
mov rcx, rax
call qword [r10 + 0x40]
mov ebp, 0x28
xor edx, edx
mov rcx, r13
mov r8d, ebp
call fcn.1400a70dc
mov rcx, r13
call fcn.1400a71b0
mov r8, rbp
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.1400e1fc0
lea rcx, [rbx + 0x14]
lea r8d, [rbp - 0x18]
lea rdx, [rsp + 0x30]
call fcn.1400e0ec0
mov r11d, dword [rdi + 0x18]
mov dword [rbx], r11d
mov ecx, dword [rdi + 0x20]
mov dword [rbx + reloc.WS2_32.dll_recv], 0x10
mov dword [rbx + 0xc], ecx
mov al, sil
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400e2890
add rsp, 0x68
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400af578
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
cmp dword [rcx + 0x110], 0
mov dil, dl
mov rbx, rcx
je 0x1400af5f6
mov rcx, qword [rcx + 0x100]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbx + 0x100]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test dil, dil
je 0x1400af5f6
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x19]
call fcn.1400e1fc0
mov eax, dword [rbx + 0x110]
lea rdx, [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x2c], eax
mov dword [rsp + 0x20], 0x33120105
call fcn.1400ae91c
mov rcx, qword [rbx + 0xf0]
test rcx, rcx
je 0x1400af610
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbx + 0xf0], 0
mov rcx, qword [rbx + 0xf8]
test rcx, rcx
je 0x1400af62a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbx + 0xf8], 0
xor edx, edx
lea rcx, [rbx + 0x100]
lea r8d, [rdx + 0x18]
call fcn.1400e1fc0
xor edx, edx
lea rcx, [rbx + 0x118]
lea r8d, [rdx + 0x68]
call fcn.1400e1fc0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400e2890
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x1400af668
Capabilities:
Check for time delay via gettickcount
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1070
call fcn.1400fd8d0
sub rsp, rax
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x1060], rax
xor esi, esi
mov edi, edx
mov rbx, rcx
lea ebp, [rsi + 1]
cmp dword [rcx + 0x110], esi
je 0x1400af7b7
mov rcx, qword [rcx + 0xf0]
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp eax, esi
je 0x1400af7ac
cmp dword [rsp + 0x30], esi
jbe 0x1400af74f
mov rcx, qword [rbx + 0xf0]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov r8d, 0xfff
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, esi
jne 0x1400af70a
mov dl, bpl
mov rcx, rbx
call fcn.1400af578
jmp 0x1400af741
xor edx, edx
lea rcx, [rsp + 0x38]
lea r8d, [rdx + 0x19]
call fcn.1400e1fc0
mov r9d, dword [rsp + 0x30]
lea r8, [rsp + 0x60]
mov byte [rsp + r9 + 0x60], sil
lea rdx, [rsp + 0x38]
mov rcx, rbx
inc r9d
mov dword [rsp + 0x38], 0x33120103
call fcn.1400ae91c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x180], eax
jmp 0x1400af7b7
mov eax, edi
sub eax, dword [rbx + 0x180]
cmp eax, dword [rbx + 0x184]
jbe 0x1400af7b7
xor edx, edx
lea rcx, [rsp + 0x38]
lea r8d, [rdx + 0x19]
call fcn.1400e1fc0
lea rdx, str.Timeout__QUIT___
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x38], 0x33120103
call fcn.1400e2e20
lea rcx, [rsp + 0x60]
call fcn.1400e1d50
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x38]
lea r9d, [rax + 1]
mov rcx, rbx
mov dword [rsp + 0x30], eax
call fcn.1400ae91c
mov dl, bpl
mov rcx, rbx
call fcn.1400af578
mov edx, edi
mov rcx, rbx
call fcn.1400a95d8
movzx ecx, sil
cmp al, sil
cmovne ecx, ebp
mov al, cl
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.1400e2890
mov rbx, qword [rsp + 0x10a0]
add rsp, 0x1070
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400afb90
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x100], 0
mov rbx, rcx
je 0x1400afbe5
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
test r8d, r8d
je 0x1400afbbf
lea r9d, [r8 - 1]
cmp byte [r9 + rdx], 0
cmove r8d, r9d
mov rcx, qword [rcx + 0xf8]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400afbe5
mov dl, 1
mov rcx, rbx
call fcn.1400af578
add rsp, 0x30
pop rbx
ret

Function at 0x1400afcdc
Capabilities:
Get hostname
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x80], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
lea rcx, [rsp + 0x11c]
mov edx, 0x40
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], gethostname
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov r11d, dword [rsp + 0x28]
xor edx, edx
lea r8d, [rdx + 0x19]
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x15c], r11d
call fcn.1400e1fc0
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x58]
mov r9d, 0xe0
mov rcx, rbx
mov dword [rsp + 0x58], 0x33110101
call fcn.1400ae91c
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400e2890
add rsp, 0x170
pop rbx
ret
Function at 0x1400b33d0
Capabilities:
Delete file
Get common file path

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x170
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov ebp, r8d
mov r13d, edx
mov r12, rcx
mov rbx, qword [rsp + 0x1c0]
xor edi, edi
test rbx, rbx
je 0x1400b354a
mov eax, dword [rsp + 0x1c8]
dec eax
cmp eax, 0x102
ja 0x1400b354a
call fcn.1400d18e8
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1400b344f
mov ecx, 0x80004005
call fcn.14001cd80
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, [0x140112240]
lea rcx, [rsp + 0x20]
call fcn.1400a8b84
lea rdx, [0x1400cef90]
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call fcn.1400cf9f8
mov rsi, rax
test rax, rax
je 0x1400b352a
mov eax, ebp
test ebp, ebp
je 0x1400b34dd
cmp eax, 1
jne 0x1400b3506
mov rcx, rsi
call fcn.1400b5bb8
test rax, rax
je 0x1400b34c6
mov edi, ebp
jmp 0x1400b3506
mov rcx, rsi
call fcn.1400b5bc8
test al, al
je 0x1400b34d6
xor edi, edi
jmp 0x1400b352f
mov edi, 2
jmp 0x1400b3506
mov rcx, rsi
call fcn.1400b4094
test rax, rax
je 0x1400b34f1
mov edi, 1
jmp 0x1400b3506
mov rcx, rsi
call fcn.1400b431c
test al, al
je 0x1400b3501
xor edi, edi
jmp 0x1400b352f
mov edi, 2
mov rcx, rsi
call fcn.1400cf7a4
cmp edi, 2
jne 0x1400b352f
cmp ebp, 1
jne 0x1400b352f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400b352f
lea edi, [rbp + 3]
jmp 0x1400b352f
mov edi, 3
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400b354a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
lea r8d, [rdx + 0x19]
lea rcx, [rsp + 0x30]
call fcn.1400e1fc0
mov dword [rsp + 0x30], 0x33120401
mov dword [rsp + 0x34], r13d
mov dword [rsp + 0x3c], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.1400acf60
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400e2890
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x170
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b35a8
Capabilities:
Delete file
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x170
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov ebp, r9d
mov r12d, r8d
mov r14d, edx
mov r13, rcx
mov rbx, qword [rsp + 0x1d0]
xor edi, edi
test rbx, rbx
je 0x1400b370e
cmp dword [rsp + 0x1d8], edi
je 0x1400b370e
call fcn.1400d18e8
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1400b3620
mov ecx, 0x80004005
call fcn.14001cd80
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov r9, rbx
lea r8, [rsp + 0x50]
lea rdx, [0x140112240]
lea rcx, [rsp + 0x20]
call fcn.1400a8b84
lea rdx, [0x1400cef90]
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call fcn.1400cf9f8
mov rsi, rax
test rax, rax
jne 0x1400b367c
lea edi, [rax + 1]
jmp 0x1400b36f1
mov eax, ebp
test ebp, ebp
je 0x1400b36ab
cmp eax, 1
jne 0x1400b36ce
mov rcx, rsi
call fcn.1400b5bb8
test rax, rax
jne 0x1400b3698
mov edi, ebp
jmp 0x1400b36ce
mov rcx, rsi
call fcn.1400b5c3c
neg al
sbb edi, edi
not edi
and edi, 2
jmp 0x1400b36ce
mov rcx, rsi
call fcn.1400b4094
test rax, rax
jne 0x1400b36bd
lea edi, [rax + 1]
jmp 0x1400b36ce
mov rcx, rsi
call fcn.1400b4108
neg al
sbb edi, edi
not edi
and edi, 2
mov rcx, rsi
call fcn.1400cf7a4
test edi, edi
jne 0x1400b36f1
cmp r12d, 1
jne 0x1400b36f1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [rdi + 3]
test eax, eax
cmove edi, ecx
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400b3713
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400b3713
mov edi, 1
xor edx, edx
lea r8d, [rdx + 0x19]
lea rcx, [rsp + 0x30]
call fcn.1400e1fc0
mov dword [rsp + 0x30], 0x33120404
mov dword [rsp + 0x3c], edi
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x34], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400acf60
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400e2890
add rsp, 0x170
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400b446c
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.1400e1fc0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r8, str.test.tmp
lea rdx, [rsp + 0x20]
lea rcx, [0x1401457d8]
call fcn.1400b432c
mov al, 1
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400e2890
add rsp, 0x148
ret

Function at 0x1400b526c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov edi, edx
mov rsi, rcx
lea rax, vtable.CResourceThreadUnit.0
mov qword [rcx], rax
add rcx, 0x28
mov ebx, 0xa
mov rdx, rbx
call fcn.1400d1abc
nop
lea rcx, [rsi + 0x68]
mov rdx, rbx
call fcn.1400d1abc
and qword [rsi + 8], 0
lea rbx, [rsi + 0x10]
and dword [rbx], 0
mov dword [rsi + 0x14], edi
mov byte [rsi + 0x18], 1
mov byte [rsi + 0x19], 0
mov byte [rsi + 0x1a], 0
and dword [rsi + 0x1c], 0
mov byte [rsi + 0x1b], 0
and qword [rsi + 0x60], 0
lea rcx, [rsi + 0xa0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsi + 0x20], eax
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
mov r9, rsi
lea r8, [0x1400b5220]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400b551c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.1400b53ac
cmp qword [rdi + 8], 0
je 0x1400b558c
lea rcx, [rdi + 0xa0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rdi + 0xa0]
mov byte [rdi + 0x18], 0
mov byte [rdi + 0x19], 1
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rdi + 8]
mov edx, 0x7d0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400b5579
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rdi + 8], 0
and dword [rdi + 0x10], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400b5b18
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r8, str.dtest.tmp
lea rdx, [rsp + 0x20]
lea rcx, [0x140145810]
call fcn.1400b59d8
mov al, 1
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400e2890
add rsp, 0x148
ret
Function at 0x1400b6f58
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rcx]
mov ebp, edx
mov sil, r8b
xor ebx, ebx
lea rdx, [rsp + 0x34]
xor r9d, r9d
mov r8d, 0x2230004
mov rdi, rbx
mov dword [rsp + 0x20], ebx
call qword [rax + 0x40]
cmp al, bl
je 0x1400b6fa3
cmp dword [rsp + 0x34], ebx
je 0x1400b6fa3
mov edi, dword [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov ecx, ebp
call fcn.1400aa014
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
movzx ecx, ax
mov dword [rsp + 0x38], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1400b7035
movzx ecx, word [rsp + 0x42]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx r11d, ax
cmp bx, ax
je 0x1400b7035
cmp rdi, rbx
je 0x1400b7035
mov r10, qword [rdi]
movzx r9d, ax
mov rcx, rdi
cmp sil, bl
je 0x1400b7008
movzx edx, byte [rsp + 0x30]
mov r8d, 0x2210106
mov dword [rsp + 0x20], edx
jmp 0x1400b7017
movzx eax, byte [rsp + 0x30]
mov r8d, 0x2210107
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x34]
call qword [r10 + 0x40]
cmp al, bl
je 0x1400b7035
cmp dword [rsp + 0x34], ebx
movzx eax, bl
mov ecx, 1
cmova eax, ecx
mov bl, al
mov al, bl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400e2890
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret