joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400013de
Capabilities:
Write file on windows

Disassembly:
jmp 0x140013630
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
xor edi, edi
mov r14, r9
mov r15, r8
mov rbp, rdx
movsxd rbx, ecx
test rdx, rdx
je 0x14001366b
mov edx, 0x104
mov rcx, rbp
call fcn.14008d154
mov rsi, rax
jmp 0x14001366d
mov esi, edi
lea rbx, [rbx + rbx*2]
lea r12, [0x140127a70]
shl rbx, 4
lea rax, [rbx + r12]
mov rcx, rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
lea rax, [r12 + 0x28]
add rax, rbx
mov qword [rsp + 0x78], rax
cmp qword [rax], rdi
je 0x1400137a4
mov rdx, r14
mov rcx, r15
mov qword [rsp + 0x70], r13
call fcn.1400909bc
lea r12d, [rax + 2]
movsxd r13, r12d
mov rcx, r13
call fcn.14008c958
mov rbx, rax
test rax, rax
je 0x14001379f
mov r8, r13
xor edx, edx
mov rcx, rax
call fcn.14008ca20
mov r9, r15
or r8, 0xffffffffffffffff
mov rdx, r13
mov rcx, rbx
mov qword [rsp + 0x20], r14
call fcn.1400981b8
mov rcx, rbx
movsxd r11, eax
cmp byte [rbx], dil
je 0x14001371a
nop
cmp byte [rcx + 1], dil
lea rdx, [rcx + 1]
je 0x14001371a
cmp byte [rcx], 0xa
jne 0x140013712
mov byte [rcx], 9
mov rcx, rdx
cmp byte [rdx], dil
jne 0x140013700
test rbp, rbp
je 0x140013774
cmp r11d, esi
jle 0x140013774
lea edi, [rsi + r11]
cmp edi, r12d
jge 0x140013774
movsxd rax, esi
mov rcx, r11
mov r10, rbp
sub rcx, rax
add rcx, rbx
sub r10, rcx
nop
movzx r8d, byte [rcx]
movzx eax, byte [rcx + r10]
sub r8d, eax
jne 0x140013755
inc rcx
test eax, eax
jne 0x140013740
test r8d, r8d
je 0x140013774
test r12d, r12d
je 0x140013771
or r9, 0xffffffffffffffff
mov r8, rbp
mov rdx, r13
mov rcx, rbx
call fcn.14008e9ac
mov r11d, edi
mov rsi, qword [rsp + 0x78]
movsxd r8, r11d
mov edx, 1
mov r9, qword [rsi]
mov rcx, rbx
call fcn.14009092c
mov rcx, qword [rsi]
mov rdi, rax
call fcn.1400923e8
mov rcx, rbx
call fcn.14008c8c8
mov r13, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
lea r11, [rsp + 0x40]
mov eax, edi
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140001433
Capabilities:
Enumerate files on windows

Disassembly:
jmp 0x140006e90
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x5f0
mov rax, qword [0x140125350]
xor rax, rsp
mov qword [rsp + 0x5e0], rax
mov rdi, rcx
lea rcx, [rsp + 0x2b1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x2b0], 0
call fcn.14008ca20
lea rcx, [rsp + 0x3c1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x3c0], 0
call fcn.14008ca20
xor ebp, ebp
cmp qword [0x1401279d0], rbp
je 0x140006f8c
mov qword [rsp + 0x618], r15
lea r15, [0x1401279d0]
xor r14d, r14d
mov rbx, r15
nop dword [rax + rax]
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.14000123a
mov rsi, rax
test rax, rax
je 0x140006f64
mov r8, qword [r14 + r15 + 0x10]
mov rdx, qword [r14 + r15 + 8]
mov rcx, qword [rax + 0x60]
call fcn.140001898
or dword [rsi + 0x54], 0x8000000c
mov rcx, rsi
call fcn.140001361
test eax, eax
je 0x140006f64
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.140001136
inc ebp
lea rcx, [rbp*2]
add rcx, rbp
lea r14, [rcx*8]
cmp qword [r14 + r15], 0
lea rbx, [r14 + r15]
jne 0x140006f20
mov r15, qword [rsp + 0x618]
xor r9d, r9d
lea rcx, [rsp + 0x2b0]
mov edx, 0x104
lea r8d, [r9 + 2]
mov qword [rsp + 0x20], 0
call fcn.140001b59
lea rcx, [rsp + 0x2b0]
call fcn.140007850
lea r14, [0x1400dd488]
lea r8, [0x1400dd48c]
lea rdx, [rsp + 0x3c0]
mov r9, r14
mov ecx, 0x104
call fcn.140007b70
mov ecx, 0x104
call fcn.14008c958
mov rbx, rax
test rax, rax
je 0x140007150
xor edx, edx
mov r8d, 0x104
mov rcx, rax
call fcn.14008ca20
lea rax, [rsp + 0x3c0]
lea r9, [rsp + 0x2b0]
mov qword [rsp + 0x28], rax
lea rax, [0x1400dd47c]
lea r8, [0x1400dd480]
lea rdx, [rsp + 0x4d0]
mov ecx, 0x104
mov qword [rsp + 0x20], rax
call fcn.140007b70
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140007144
lea r8, [rsp + 0x19c]
or r9, 0xffffffffffffffff
mov edx, 0x104
mov rcx, rbx
call fcn.14008cdb8
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.14008ca20
mov edx, 0x104
mov rcx, rbx
call fcn.14008d154
mov rcx, rax
add rax, 0xfffffffffffffffc
cmp rax, 0xff
ja 0x14000711f
mov byte [rbx + rcx - 3], 0
mov rdx, rbx
mov rcx, rdi
call fcn.140001519
test rax, rax
jne 0x14000711f
mov rdx, rbx
mov rcx, rdi
call fcn.14000123a
mov rsi, rax
test rax, rax
je 0x14000711f
lea r9, [rax + 0x14]
lea rcx, [rsp + 0x30]
mov edx, 0x104
mov r8d, 2
mov qword [rsp + 0x20], r14
call fcn.140001b59
mov rcx, qword [rsi + 0x60]
lea r8, [0x1400dd490]
lea rdx, [rsp + 0x30]
call fcn.1400014f1
mov rcx, rsi
call fcn.140001361
test eax, eax
je 0x14000711f
mov rdx, rbx
mov rcx, rdi
call fcn.140001136
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x14000713b
lea r8, [rsp + 0x5c]
jmp 0x140007069
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbx
call fcn.14008c8c8
xor eax, eax
jmp 0x140007155
mov eax, 0x708
mov rcx, qword [rsp + 0x5e0]
xor rcx, rsp
call fcn.14008d900
lea r11, [rsp + 0x5f0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140001479
Capabilities:
Write file on windows

Disassembly:
jmp 0x140080b70
jmp 0x14007ff90
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14007ffe5
mov rcx, qword [rcx]
test rcx, rcx
je 0x14007ffe5
call fcn.140001db1
test eax, eax
je 0x14007ffe5
cmp qword [rbx + 0x248], 0
je 0x14007ffe5
mov rcx, qword [rbx]
mov r8d, edi
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140001127
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0x210], edi
jne 0x140080b9d
lea ecx, [rdi + 0x15]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
test rdx, rdx
jne 0x140080bb8
lea ecx, [rdx + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea r9, [rsp + 0x40]
cmp dword [rcx + 0x218], edi
jne 0x140080be2
mov rcx, qword [rcx + 0x208]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov qword [rcx + 0x258], rdi
mov qword [rsp + 0x48], rsi
lea rsi, [rcx + 0x250]
mov rcx, qword [rcx + 0x208]
mov qword [rsi], rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test eax, eax
jne 0x140080c48
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140080c46
mov rcx, qword [rbx + 0x208]
lea r9d, [rdi + 1]
lea r8, [rsp + 0x40]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov eax, edi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140001483
Capabilities:
Terminate process

Disassembly:
jmp 0x140080d70
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov edi, 1
xor eax, eax
lock cmpxchg dword [rcx], edi
je 0x140080da3
nop word [rax + rax]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lock cmpxchg dword [rbx], edi
jne 0x140080d90
dec dword [rbx + 4]
mov eax, dword [rbx + 4]
mov edi, 0
cmovs eax, edi
mov dword [rbx + 4], eax
test eax, eax
jne 0x140080e4c
mov rcx, qword [rbx + 0x68]
test rcx, rcx
je 0x140080dfb
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x140080ded
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x60], rdi
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x68], rdi
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x140080e34
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbx + 0x48]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x140080e34
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 8]
mov qword [rbx + 0x48], rdi
mov qword [rbx + 0x50], rdi
mov dword [rbx + 0x58], 0xffffffff
call fcn.14000195b
xchg dword [rbx], edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400016c2
Capabilities:
Get common file path

Disassembly:
jmp 0x14007aa90
mov qword [rsp + 0x20], rbx
push r15
sub rsp, 0x240
mov rax, qword [0x140125350]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
xor eax, eax
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], ax
call fcn.14008ca20
xor eax, eax
mov dword [rbx], 9
mov qword [rbx + 4], rax
lea rcx, [rsp + 0x20]
mov edx, 0x104
mov qword [rbx + 0xc], rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [rax - 1]
mov r15d, eax
cmp ecx, 0x102
ja 0x14007aba0
lea ecx, [rax + 1]
mov qword [rsp + 0x250], rsi
mov qword [rsp + 0x258], rdi
lea rsi, [rcx + rcx]
mov qword [rsp + 0x260], r14
mov r14d, ecx
mov rcx, rsi
call fcn.14008c958
mov rdi, rax
test rax, rax
je 0x14007ab3d
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.14008ca20
mov rsi, qword [rsp + 0x250]
mov qword [rbx + 4], rdi
test rdi, rdi
je 0x14007ab6b
lea r8, [rsp + 0x20]
mov rdx, r14
mov rcx, rdi
call fcn.140094ebc
lea ecx, [r15 + r15]
lea eax, [rcx + 2]
mov dword [rbx + 0x10], ecx
mov dword [rbx + 0xc], eax
mov rdi, qword [rsp + 0x258]
mov r14, qword [rsp + 0x260]
mov rax, rbx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14008d900
mov rbx, qword [rsp + 0x268]
add rsp, 0x240
pop r15
ret
mov rax, rbx
jmp 0x14007ab7e

Function at 0x1400016db
Capabilities:
Access the windows event log

Disassembly:
jmp 0x140083870
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x98
movzx esi, dx
xorps xmm0, xmm0
movzx ebp, cx
lea rdx, str.DPTF
xor ebx, ebx
xor ecx, ecx
mov qword [rsp + 0x6c], rbx
movdqu xmmword [rsp + 0x50], xmm0
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
je 0x14008393d
mov rdx, qword [rsp + 0xd0]
lea rax, [0x1400fe858]
lea r8, [rsp + 0xd8]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x50], rax
call fcn.140001811
mov ecx, 2
mov r9d, 0x100
movzx r8d, bp
movups xmm0, xmmword [rax]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x70], eax
lea rax, str.Error_in_formatting_event_message
movups xmmword [rsp + 0x60], xmm0
mov rbx, qword [rsp + 0x64]
test rbx, rbx
cmovne rax, rbx
xor edx, edx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edx
mov word [rsp + 0x28], cx
mov qword [rsp + 0x20], rdx
mov rcx, rdi
movzx edx, si
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
test rbx, rbx
je 0x14008394a
mov rcx, rbx
call fcn.14008c8c8
test rdi, rdi
je 0x140083958
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
add rsp, 0x98
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000179e
Capabilities:
Get common file path
Query environment variable

Disassembly:
jmp 0x14007b180
push rbp
lea rbp, [rsp - 0x480]
sub rsp, 0x580
mov rax, qword [0x140125350]
xor rax, rsp
mov qword [rbp + 0x470], rax
lea rcx, [rbp + 0x141]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x140], 0
call fcn.14008ca20
lea rcx, [rbp + 0x251]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x250], 0
call fcn.14008ca20
lea rcx, [rbp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x30], 0
call fcn.14008ca20
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.14008ca20
lea rcx, [rbp + 0x361]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x360], 0
call fcn.14008ca20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea rcx, [rbp + 0x140]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
test eax, eax
jne 0x14007b265
lea r8, [0x1400fcfb0]
lea rcx, [rbp + 0x140]
or r9, 0xffffffffffffffff
mov edx, 0x104
call fcn.14008cdb8
lea rcx, [rbp + 0x250]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x14007b297
lea r8, [0x1400fcfc0]
lea rcx, [rbp + 0x250]
or r9, 0xffffffffffffffff
mov edx, 0x104
call fcn.14008cdb8
lea rdx, [rbp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, eax
cmp rax, 1
jbe 0x14007b2c4
dec rax
cmp rax, 0x104
jae 0x14007b3ff
mov byte [rbp + rax + 0x30], 0
jmp 0x14007b2dd
lea r8, [0x1400fcfd8]
lea rcx, [rbp + 0x30]
or r9, 0xffffffffffffffff
mov edx, 0x104
call fcn.14008cdb8
lea rdx, [rsp + 0x20]
lea rcx, [0x1400fcff0]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x14007b32f
lea rdx, [rsp + 0x20]
lea rcx, [0x1400fd000]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x14007b32f
lea r8, [0x1400fd010]
lea rcx, [rsp + 0x20]
or r9, 0xffffffffffffffff
mov edx, 0x104
call fcn.14008cdb8
lea r9, [rsp + 0x20]
lea r8, [0x1400fd028]
lea rdx, [rbp + 0x360]
mov ecx, 0x104
call fcn.14007a750
lea r8, [rbp + 0x140]
lea rdx, [0x1400fd070]
lea rcx, [0x140124d10]
mov r9d, 0x400
call fcn.140001d25
lea r8, [rbp + 0x250]
lea rdx, [0x1400fd080]
lea rcx, [0x140124d10]
mov r9d, 0x400
call fcn.140001d25
lea r8, [rbp + 0x30]
lea rdx, [0x1400fd08c]
lea rcx, [0x140124d10]
mov r9d, 0x400
call fcn.140001d25
lea r8, [rsp + 0x20]
lea rdx, [0x1400fd098]
lea rcx, [0x140124d10]
mov r9d, 0x400
call fcn.140001d25
lea r8, [rbp + 0x360]
lea rdx, [0x1400fd0ac]
lea rcx, [0x140124d10]
mov r9d, 0x400
call fcn.140001d25
mov rcx, qword [rbp + 0x470]
xor rcx, rsp
call fcn.14008d900
add rsp, 0x580
pop rbp
ret
call fcn.14008cf94
int3
Function at 0x140001848
Capabilities:
Get common file path

Disassembly:
jmp 0x14007abf0
mov qword [rsp + 0x20], rbx
push r15
sub rsp, 0x240
mov rax, qword [0x140125350]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
xor eax, eax
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], ax
call fcn.14008ca20
xor eax, eax
mov dword [rbx], 9
mov qword [rbx + 4], rax
lea rdx, [rsp + 0x20]
mov ecx, 0x104
mov qword [rbx + 0xc], rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [rax - 1]
mov r15d, eax
cmp ecx, 0x102
ja 0x14007ad00
lea ecx, [rax + 1]
mov qword [rsp + 0x250], rsi
mov qword [rsp + 0x258], rdi
lea rsi, [rcx + rcx]
mov qword [rsp + 0x260], r14
mov r14d, ecx
mov rcx, rsi
call fcn.14008c958
mov rdi, rax
test rax, rax
je 0x14007ac9d
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.14008ca20
mov rsi, qword [rsp + 0x250]
mov qword [rbx + 4], rdi
test rdi, rdi
je 0x14007accb
lea r8, [rsp + 0x20]
mov rdx, r14
mov rcx, rdi
call fcn.140094ebc
lea ecx, [r15 + r15]
lea eax, [rcx + 2]
mov dword [rbx + 0x10], ecx
mov dword [rbx + 0xc], eax
mov rdi, qword [rsp + 0x258]
mov r14, qword [rsp + 0x260]
mov rax, rbx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14008d900
mov rbx, qword [rsp + 0x268]
add rsp, 0x240
pop r15
ret
mov rax, rbx
jmp 0x14007acde
Function at 0x140001870
Capabilities:
Hash data using sha1

Disassembly:
jmp 0x14000df40
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x140125350]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor eax, eax
mov r13, rcx
xor ecx, ecx
mov qword [rbp - 0x65], rax
mov qword [rbp - 0x5d], rax
mov qword [rbp - 0x35], rax
mov qword [rbp - 0x2d], rax
mov qword [rbp - 0x25], rax
mov qword [rbp - 0x1d], rax
mov qword [rbp - 0x15], rax
mov qword [rbp - 0xd], rax
mov qword [rbp - 5], rax
mov dword [rbp + 3], eax
lea rax, [0x14000e640]
mov dword [rbp - 0x69], ecx
mov qword [rbp + 7], rax
lea rax, [0x14000e660]
mov dword [rbp - 0x39], ecx
lea rcx, [0x14000e650]
mov qword [rbp + 0x17], rax
lea rax, [rbp - 0x39]
mov r10, rdx
mov dword [rbp - 0x51], 0x5a827999
mov dword [rbp - 0x4d], 0x6ed9eba1
mov qword [rbp + 0xf], rcx
mov qword [rbp + 0x1f], rcx
mov dword [rbp - 0x49], 0x8f1bbcdc
sub r10, rax
mov dword [rbp - 0x45], 0xca62c1d6
lea r8, [rbp - 0x39]
mov r9d, reloc.WSOCK32.dll_recv
nop dword [rax + rax]
mov ecx, dword [r10 + r8]
lea r8, [r8 + 4]
mov edx, ecx
mov eax, ecx
shr eax, 0x10
and edx, 0xff0000
or edx, eax
mov eax, ecx
and ecx, 0xff00
shl eax, 0x10
shr edx, 8
or eax, ecx
shl eax, 8
or edx, eax
mov dword [r8 - 4], edx
dec r9
jne 0x14000e000
mov r9d, socket
lea rcx, [rbp - 0x69]
mov r8, r13
mov edx, r9d
call fcn.14008cc4c
mov edx, dword [rbp - 0x61]
xor bl, bl
xor r12b, r12b
xor r14b, r14b
nop word [rax + rax]
movzx r15d, r14b
and r15b, 0xf
cmp r14b, 0x10
jb 0x14000e0ab
movzx eax, r15b
movzx r8d, r15b
lea r10, [rbp - 0x39]
lea r10, [r10 + rax*4]
lea eax, [r8 - 3]
lea ecx, [r8 - 8]
and eax, 0xf
and ecx, 0xf
mov r9d, dword [rbp + rcx*4 - 0x39]
xor r9d, dword [rbp + rax*4 - 0x39]
lea eax, [r8 + 2]
and eax, 0xf
xor r9d, dword [rbp + rax*4 - 0x39]
xor r9d, dword [r10]
rol r9d, 1
mov dword [r10], r9d
mov r8d, dword [rbp - 0x5d]
mov ecx, dword [rbp - 0x65]
movzx edi, bl
call qword [rbp + rdi*8 + htons]
mov esi, dword [rbp - 0x69]
movzx ecx, r15b
rol esi, 5
lea rdx, [rbp - 0x69]
mov r8d, reloc.WSOCK32.dll_recv
add esi, dword [rbp + rcx*4 - 0x39]
lea rcx, [rbp - 0x65]
add esi, dword [rbp + rdi*4 - 0x51]
add esi, dword [rbp - 0x59]
add esi, eax
call fcn.14008d930
mov edx, dword [rbp - 0x61]
inc r12b
ror edx, 2
mov dword [rbp - 0x69], esi
mov dword [rbp - 0x61], edx
cmp r12b, 0x14
jne 0x14000e10f
movzx ebx, bl
xor r12b, r12b
inc ebx
and ebx, 0x80000003
jge 0x14000e10f
dec ebx
or ebx, 0xfffffffc
inc ebx
inc r14b
cmp r14b, 0x4f
jbe 0x14000e060
lea r8, [rbp - 0x69]
mov rcx, r13
mov edx, 5
sub r8, r13
nop dword [rax + rax]
mov eax, dword [r8 + rcx]
lea rcx, [rcx + 4]
add dword [rcx - 4], eax
dec rdx
jne 0x14000e130
add qword [r13 + 0x18], 0x200
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14008d900
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14000195b
Capabilities:
Delete directory
Delete file

Disassembly:
jmp 0x140081de0
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 4]
test rcx, rcx
je 0x140081dff
call fcn.14008c8c8
mov qword [rbx + 4], 0
mov rcx, qword [rbx + 0x2c]
test rcx, rcx
je 0x140081e24
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbx + 0x2c]
test rcx, rcx
je 0x140081e1c
call fcn.14008c8c8
mov qword [rbx + 0x2c], 0
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140081e49
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140081e41
call fcn.14008c8c8
mov qword [rbx + 0x18], 0
add rsp, 0x20
pop rbx
ret
Function at 0x140001bea
Capabilities:
Delete directory
Delete file

Disassembly:
jmp 0x140067a90
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x40]
mov rbx, rcx
test rax, rax
je 0x140067ab3
mov rdx, qword [rcx + 0x28]
xor ecx, ecx
call rax
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x140067abe
call rax
mov rcx, qword [rbx + 8]
xor esi, esi
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x38], rsi
mov qword [rbx + 0x40], rsi
mov qword [rbx + 0x48], rsi
test rcx, rcx
je 0x140067ae3
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 8], rsi
lea rcx, [rbx + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14000195b
Function at 0x140001d70
Capabilities:
Connect pipe

Disassembly:
jmp 0x140080100
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x208]
xor eax, eax
cmp rcx, 0xffffffffffffffff
je 0x140080168
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rsi
cmp dword [rdi + 0x214], eax
jne 0x14008014d
cmp dword [rdi + 0x218], eax
jne 0x14008016e
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ebx, eax
test eax, eax
jne 0x14008014d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x14008015c
mov ebx, 1
mov dword [rdi + 0x210], 1
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rdx, [rdi + 0x278]
mov qword [rdi + 0x278], rax
mov qword [rdi + 0x280], rax
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ebx, eax
test eax, eax
jne 0x140080152
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140080146
mov rcx, qword [rdi + 0x208]
lea r9d, [rbx + 1]
lea r8, [rsp + 0x30]
lea rdx, [rdi + 0x278]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ebx, eax
test eax, eax
jne 0x140080152
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140001d98
Capabilities:
Hash data using sha1

Disassembly:
jmp 0x14000e670
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140125350]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov ebx, r8d
mov rdi, rdx
mov qword [rsp + 0x24], rax
mov qword [rsp + 0x2c], rax
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
mov dword [rsp + 0x30], 0xc3d2e1f0
mov qword [rsp + 0x38], rax
mov rsi, rcx
mov dword [rsp + 0x20], 0x67452301
test r8d, 0xfffffe00
je 0x14000e6ff
nop dword [rax + rax]
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.140001870
add ebx, 0xfffffe00
add rdi, 0x40
test ebx, 0xfffffe00
jne 0x14000e6e0
lea rcx, [rsp + 0x20]
movzx r8d, bx
mov rdx, rdi
call fcn.140001168
lea r9, [rsp + 0x20]
mov r8d, 5
sub r9, rsi
nop
mov ecx, dword [r9 + rsi]
lea rsi, [rsi + 4]
mov edx, ecx
mov eax, ecx
shr eax, 0x10
and edx, 0xff0000
or edx, eax
mov eax, ecx
shl ecx, 0x10
and eax, 0xff00
shr edx, 8
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rsi - 4], edx
dec r8
jne 0x14000e720
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008d900
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret