joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41edf0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
mov edx, 0xffffffff
test rax, rax
jle 0x41ee1c
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x41f9f0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp byte [0x004a6e90], 0
jne 0x41faf6
mov byte [0x004a6e90], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x41facc
mov rbx, qword [rax + 8]
lea r9, [rsp + 0x2c]
xor eax, eax
cmp byte [rbx], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add rbx, rax
mov rcx, rbx
call sym.__cxa_demangle
mov ecx, 2
mov rsi, qword [sym.__acrt_iob_func]
mov rdi, rax
call rsi
mov edx, 1
mov r8d, 0x30
lea rcx, str.terminate_called_after_throwing_an_instance_of_
mov r9, rax
call sym.fwrite
mov edx, dword [rsp + 0x2c]
mov ecx, 2
test edx, edx
je 0x41fabd
call rsi
mov rcx, rbx
mov rdx, rax
call sym.fputs
mov ecx, 2
call rsi
mov r8d, 2
mov edx, 1
lea rcx, [0x004a73c1]
mov r9, rax
call sym.fwrite
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x41fab8
mov rcx, rdi
call sym.free
call sym.__cxa_rethrow
call rsi
mov rcx, rdi
mov rdx, rax
call sym.fputs
jmp 0x41fa87
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov r8d, 0x2d
mov edx, 1
lea rcx, str.terminate_called_without_an_active_exception_n
mov r9, rax
call sym.fwrite
call sym.abort
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov r8d, 0x1d
mov edx, 1
lea rcx, str.terminate_called_recursively_n
mov r9, rax
call sym.fwrite
call sym.abort
sub rdx, 1
mov rcx, rax
jne 0x41fb8b
call sym.__cxa_begin_catch
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sym.fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
jmp 0x41faf1
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x41faf1

Function at 0x46da70
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rbp, rcx
mov rdi, rdx
mov esi, r8d
jmp 0x46da98
call r12
cmp dword [rax], 4
jne 0x46dab6
mov rcx, rbp
call method.std::__basic_file_char_.fd__
mov r8d, esi
mov rdx, rdi
mov ecx, eax
call sym.read
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
je 0x46da90
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x47ee50
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rbx, rcx
lea rdx, str.mt19937
mov rcx, rsi
call method.std::string.compare_char_const__const
mov ecx, 0x1571
test eax, eax
jne 0x47eeb5
mov dword [rbx], ecx
mov edx, 1
jmp 0x47ee84
mov ecx, dword [rbx + rdx*4 - 4]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul eax, eax, 0x6c078965
add eax, edx
mov dword [rbx + rdx*4], eax
add rdx, 1
cmp rdx, 0x270
jne 0x47ee80
mov qword [rbx + 0x9c0], 0x270
add rsp, 0x38
pop rbx
pop rsi
ret
mov rsi, qword [rsi]
lea rdx, [rsp + 0x28]
xor r8d, r8d
mov rcx, rsi
call sym.strtoul
cmp byte [rsi], 0
mov ecx, eax
je 0x47eed9
mov rax, qword [rsp + 0x28]
cmp byte [rax], 0
je 0x47ee74
lea rcx, str.random_device::random_device_const_std::string_
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x4a3650
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400072b8
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x14003b3c0]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [0x14003e518]
xor ebx, ebx
test al, 1
jne 0x14000731c
or eax, 1
lea rcx, [0x14002a718]
mov qword [0x14003e538], 0xf
mov qword [0x14003e530], rbx
mov byte [0x14003e520], bl
mov dword [0x14003e518], eax
call fcn.1400145b0
cmp byte [rsp + 0x20], bl
je 0x140007336
lea rcx, [rsp + 0x20]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], bl
jne 0x14000732b
mov rbx, rax
mov r8, rbx
lea rbx, [0x14003e520]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140004d6c
mov dl, 0x5c
mov rcx, rbx
call fcn.14000b244
lea rdx, str.Fojgaiu.dll
mov rcx, rbx
call fcn.14000b300
lea rdx, str.64.dll
mov rcx, rbx
call fcn.14000b300
cmp qword [0x14003e538], 0x10
cmovae rbx, qword [0x14003e520]
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140014130
add rsp, 0x140
pop rbx
ret
Function at 0x1400073a4
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0xc8]
sub rsp, 0x1b0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14003b3c0]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rbx, rcx
mov edx, 0x104
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r14d, 0xf
mov qword [rsp + 0x60], r14
xor esi, esi
mov qword [rsp + 0x58], rsi
mov byte [rsp + 0x48], sil
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rsi
mov byte [rsp + 0x28], sil
mov qword [rbp - 0x80], r14
mov qword [rsp + 0x78], rsi
mov byte [rsp + 0x68], sil
or r15, 0xffffffffffffffff
cmp byte [rbx], sil
jne 0x140007434
mov r8d, esi
jmp 0x140007440
mov r8, r15
inc r8
cmp byte [rbx + r8], sil
jne 0x140007437
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140004d6c
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x68]
mov cl, 0x5c
call fcn.140013eec
test al, al
sete dil
cmp qword [rbp - 0x80], 0x10
jb 0x14000747b
mov rcx, qword [rsp + 0x68]
call fcn.140014150
test dil, dil
je 0x1400074a3
cmp byte [rbx], sil
jne 0x14000748a
mov r8, rsi
jmp 0x140007496
mov r8, r15
inc r8
cmp byte [rbx + r8], sil
jne 0x14000748d
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140004d6c
mov eax, dword [0x14003e51c]
test al, 1
jne 0x1400074d7
or eax, 1
mov dword [0x14003e51c], eax
mov qword [0x14003e558], r14
mov qword [0x14003e550], rsi
mov byte [0x14003e540], sil
lea rcx, [0x14002a754]
call fcn.1400145b0
cmp byte [rbp - 0x70], sil
jne 0x1400074e2
mov r8, rsi
jmp 0x1400074f2
lea rax, [rbp - 0x70]
mov r8, r15
inc r8
cmp byte [rax + r8], sil
jne 0x1400074e9
lea rdx, [rbp - 0x70]
lea rbx, [0x14003e540]
mov rcx, rbx
call fcn.140004d6c
mov dl, 0x5c
mov rcx, rbx
call fcn.14000b244
mov r9, r15
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.14000b5b0
cmp qword [0x14003e558], 0x10
cmovae rbx, qword [0x14003e540]
cmp qword [rsp + 0x40], 0x10
jb 0x140007544
mov rcx, qword [rsp + 0x28]
call fcn.140014150
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rsi
mov byte [rsp + 0x28], sil
cmp qword [rsp + 0x60], 0x10
jb 0x140007565
mov rcx, qword [rsp + 0x48]
call fcn.140014150
mov rax, rbx
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.140014130
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400077c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x14003b3c0]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov r15, rdx
mov r14, rcx
mov rdi, qword [r8]
xor ebx, ebx
test rdi, rdi
je 0x140007915
mov dword [rsp + 0x30], 0x100
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.ProxyEnable
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000790c
cmp dword [rsp + 0x60], ebx
je 0x14000790c
mov dword [rsp + 0x30], 0x100
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.ProxyServer
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov ecx, dword [rsp + 0x30]
cmp rcx, 0x100
jae 0x140007906
mov byte [rsp + rcx + 0x60], bl
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x140007915
mov qword [rsp + 0x58], socket
mov qword [rsp + 0x50], rbx
mov byte [rsp + 0x40], bl
cmp byte [rsp + 0x60], bl
je 0x1400078cb
lea rcx, [rsp + 0x60]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], bl
jne 0x1400078c0
mov rbx, rax
mov r8, rbx
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140004d6c
nop
mov r8, r15
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.140007594
mov ebx, eax
cmp qword [rsp + 0x58], 0x10
jb 0x140007902
mov rcx, qword [rsp + 0x40]
call fcn.140014150
mov eax, ebx
jmp 0x140007917
call fcn.140015d7c
int3
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.140014130
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x170
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000793c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14003b3c0]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
movzx r14d, dx
mov esi, ecx
lea r12d, [rbx + 2]
lea edx, [rbx + 1]
lea r8d, [rbx + 6]
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000798c
xor eax, eax
jmp 0x140007a4a
xor eax, eax
movzx ecx, r14w
mov qword [rbp - 0x48], rax
mov word [rbp - 0x48], r12w
mov qword [rbp - 0x40], rax
call qword [sym.imp.WS2_32.dll_htons]
mov dword [rbp - 0x44], esi
mov word [rbp - 0x46], ax
call qword [sym.imp.WS2_32.dll_WSACreateEvent]
mov esi, 0x10
mov r8d, esi
mov rcx, rdi
mov rdx, rax
mov qword [rbp - 0x50], rax
call qword [sym.imp.WS2_32.dll_WSAEventSelect]
lea rdx, [rbp - 0x48]
mov r8d, esi
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_connect]
mov esi, eax
cmp eax, 0xffffffff
jne 0x140007a2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2733
jne 0x140007a2f
lea r9d, [rax - 0x23]
lea rdx, [rbp - 0x50]
lea ecx, [rsi + 2]
xor r8d, r8d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
cmp eax, 0xffffffff
je 0x140007a35
cmp eax, 0x102
je 0x140007a35
mov rdx, qword [rbp - 0x50]
lea r8, [rbp - 0x38]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
test eax, eax
jne 0x140007a35
cmp dword [rbp - 0x24], ebx
sete bl
jmp 0x140007a35
cmp esi, 0xffffffff
setne bl
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.WS2_32.dll_WSACloseEvent]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140014130
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140007a70
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push rbx
sub rsp, 0x200
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x14003b3c0]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, 0x202
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140007b62
lea rcx, str.www.google.com
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x140007b64
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov edx, 0x50
mov ecx, dword [rcx]
call fcn.14000793c
test eax, eax
jne 0x140007b5b
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140007b20
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x34]
call fcn.1400077c0
jmp 0x140007b22
xor eax, eax
test eax, eax
je 0x140007b57
movzx ebx, word [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
mov r8d, ebx
lea rcx, str.Proxy_detected:__s:_i__trying_to_connect_n
call fcn.140012a78
movzx edx, word [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
call fcn.14000793c
jmp 0x140007b64
xor eax, eax
jmp 0x140007b64
mov eax, 1
jmp 0x140007b64
xor eax, eax
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.140014130
add rsp, 0x200
pop rbx
ret
Function at 0x1400082e4
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
push rdi
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 0x31], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rax, qword [0x14003b3c0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rax, r8
mov r15d, 0xf
mov qword [rbp - 0x11], r15
xor esi, esi
mov qword [rbp - 0x19], rsi
mov byte [rbp - 0x29], sil
cmp byte [r8], sil
jne 0x140008335
mov r8d, esi
jmp 0x140008342
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], sil
jne 0x140008339
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.140004d6c
nop
mov qword [rbp + 0xf], r15
mov qword [rbp + 7], rsi
mov byte [rbp - 9], sil
mov r8d, 0x2a
lea rdx, str.SYSTEMCurrentControlSetServicesWinSock2
lea rcx, [rbp - 9]
call fcn.140004d6c
nop
mov qword [rbp + 0x2f], r15
mov qword [rbp + 0x27], rsi
mov byte [rbp + 0x17], sil
mov al, byte [str.HKLM]
neg al
sbb r8, r8
and r8d, 4
lea rdx, str.HKLM
lea rcx, [rbp + 0x17]
call fcn.140004d6c
mov ebx, 1
mov qword [rbp - 0x39], rsi
mov edx, ebx
lea rcx, str.SeBackupPrivilege
call fcn.140013d34
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0x10
cmovae rcx, qword [rbp + 0x17]
lea rdx, str.HKCU
call fcn.140015574
neg eax
sbb rdi, rdi
neg rdi
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 0x10
cmovae rdx, qword [rbp - 9]
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rcx, [rdi - 0x7fffffff]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140008467
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0x10
cmovae rcx, qword [rbp - 0x29]
call fcn.140013ea4
test eax, eax
je 0x14000843b
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0x10
cmovae rcx, qword [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14000843b
mov eax, dword [rbp - 0x39]
jmp 0x140008456
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0x10
cmovae rdx, qword [rbp - 0x29]
xor r8d, r8d
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegSaveKeyA]
test eax, eax
cmovne ebx, esi
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140008483
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 0x10
cmovae rdx, qword [rbp - 9]
lea rcx, [rdi - 0x7fffffff]
call fcn.140013de4
mov ebx, esi
xor edx, edx
lea rcx, str.SeBackupPrivilege
call fcn.140013d34
cmp qword [rbp + 0x2f], 0x10
jb 0x1400084a1
mov rcx, qword [rbp + 0x17]
call fcn.140014150
mov qword [rbp + 0x2f], r15
mov qword [rbp + 0x27], rsi
mov byte [rbp + 0x17], sil
cmp qword [rbp + 0xf], 0x10
jb 0x1400084bd
mov rcx, qword [rbp - 9]
call fcn.140014150
mov qword [rbp + 0xf], r15
mov qword [rbp + 7], rsi
mov byte [rbp - 9], sil
cmp qword [rbp - 0x11], 0x10
jb 0x1400084d9
mov rcx, qword [rbp - 0x29]
call fcn.140014150
mov eax, ebx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140014130
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
Function at 0x140008730
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r14
lea rbp, [rax - 0x378]
sub rsp, 0x460
mov rax, qword [0x14003b3c0]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov ecx, dword [0x14003c8e0]
lea rdx, [rsp + 0x20]
xor edi, edi
and dword [rsp + 0x20], edi
call fcn.1400010e0
mov r14, rax
test rax, rax
jne 0x140008789
lea eax, [rdi + 1]
jmp 0x14000887b
xor esi, esi
cmp dword [rsp + 0x20], esi
jle 0x140008867
lea ebx, [rsi + 1]
movsxd rax, esi
lea rcx, [r14 + 0x14]
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x24]
lea rdx, [rbp + 0x140]
mov dword [rsp + 0x24], 0x103
imul r12, rax, 0x274
add rcx, r12
call qword [sym.imp.WS2_32.dll_WSCGetProviderPath]
cmp eax, 0xffffffff
je 0x1400088a7
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x140]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1400088a7
add r12, 0x74
lea r8, [rsp + 0x30]
lea rcx, str.Trying_to_load_provider:__S__file_name:__S__result__
add r12, r14
mov rdx, r12
call fcn.140012a78
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140008827
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14000885b
lea r8, [rsp + 0x30]
lea rcx, str.Failed_to_load_provider:__S__file_name:__S_n
mov rdx, r12
call fcn.140012a78
lea rdx, str.Tym_Abe
mov rcx, r12
call fcn.140015a60
test rax, rax
je 0x140008856
mov edi, 2
jmp 0x14000885b
test edi, edi
cmove edi, ebx
add esi, ebx
cmp esi, dword [rsp + 0x20]
jl 0x140008798
mov rcx, qword [0x14003def0]
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.140014130
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, ebx
jmp 0x14000887b
Function at 0x140011a84
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x14003b3c0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov ebx, edx
test edx, edx
je 0x140011ae1
mov ecx, dword [0x14003c8e0]
and dword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
call fcn.1400010e0
mov r8, rax
test rax, rax
je 0x140011ae1
mov edx, dword [rsp + 0x20]
xor eax, eax
test edx, edx
jle 0x140011ae1
lea rcx, [r8 + 0x24]
cmp dword [rcx], ebx
je 0x140011afc
inc eax
add rcx, 0x274
cmp eax, edx
jl 0x140011ad0
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140014130
add rsp, 0x250
pop rbx
ret
add r8, 0x14
cdqe
lea r9, [rsp + 0x24]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x103
imul rcx, rax, 0x274
add rcx, r8
lea r8, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSCGetProviderPath]
cmp eax, 0xffffffff
jne 0x140011b36
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140011ae1
lea rdx, [0x14003e560]
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x140011b2e
lea rax, [0x14003e560]
jmp 0x140011ae3

Function at 0x1400131a8
Capabilities:
Encode data using xor
Hash data using crc32b
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x10030
call fcn.14001cbb0
sub rsp, rax
mov rax, qword [0x14003b3c0]
xor rax, rsp
mov qword [rsp + 0x10020], rax
lea r14, [0x14003df50]
xor r10d, r10d
mov r11, rcx
mov r9, r14
lea esi, [r10 + 1]
xor r8d, r8d
mov edx, r10d
lea ecx, [r8 + 7]
test sil, dl
je 0x140013202
mov eax, esi
shl eax, cl
or r8d, eax
sub ecx, esi
shr edx, 1
cmp ecx, 0xffffffff
jg 0x1400131f6
shl r8d, 0x18
mov ecx, 8
mov dword [r9], r8d
mov eax, r8d
and eax, 0x80000000
neg eax
lea eax, [r8 + r8]
sbb edx, edx
and edx, 0x4c11db7
xor edx, eax
mov r8d, edx
sub rcx, rsi
jne 0x140013217
xor r8d, r8d
mov dword [r9], edx
lea ecx, [r8 + 0x1f]
test sil, dl
je 0x14001324d
mov eax, esi
shl eax, cl
or r8d, eax
sub ecx, esi
shr edx, 1
cmp ecx, 0xffffffff
jg 0x140013241
add r10d, esi
mov dword [r9], r8d
add r9, 4
cmp r10d, 0xff
jle 0x1400131ec
lea rdx, [0x140034848]
mov rcx, r11
call fcn.14001552c
mov rdi, rax
test rax, rax
je 0x1400132e0
xor ebx, ebx
mov rcx, rax
jmp 0x1400132cd
lea rcx, [rsp + 0x20]
mov r9, rdi
mov r8d, 0xffff
mov rdx, rsi
call fcn.1400169bc
not ebx
lea r9, [rsp + 0x20]
mov r8, rax
test eax, eax
je 0x1400132c8
movzx eax, byte [r9]
movzx edx, bl
add r9, rsi
xor rdx, rax
mov eax, ebx
mov ebx, dword [r14 + rdx*4]
shr eax, 8
xor ebx, eax
sub r8d, esi
jne 0x1400132ab
not ebx
mov rcx, rdi
call fcn.14001532c
test eax, eax
je 0x140013287
mov rcx, rdi
call fcn.14001516c
mov eax, ebx
mov rcx, qword [rsp + 0x10020]
xor rcx, rsp
call fcn.140014130
lea r11, [rsp + 0x10030]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14001368c
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x14003b3c0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov eax, dword [0x14003c948]
cmp eax, 0x11
jne 0x1400137ce
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x9c
lea ebx, [rax - 2]
call fcn.140018c80
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x140013701
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x140013701
lea eax, [rbx + 1]
jmp 0x1400137ce
mov eax, dword [rsp + 0x30]
dec eax
je 0x140013799
dec eax
jne 0x1400137c6
mov r10d, dword [rsp + 0x24]
mov r8d, dword [rsp + 0x28]
mov eax, 3
lea edx, [rax + 1]
lea ecx, [rax - 2]
lea r9d, [rax - 1]
cmp r10d, edx
lea r11d, [rdx + 1]
cmovbe ebx, eax
mov al, byte [rsp + 0xba]
cmp r10d, r11d
jne 0x140013764
test r8d, r8d
cmove ebx, edx
cmp r8d, ecx
cmove ebx, r11d
cmp r8d, r9d
jne 0x1400137c6
cmp al, cl
jne 0x14001375f
mov ebx, r11d
jmp 0x1400137c6
mov ebx, 6
cmp r10d, 6
jne 0x1400137c6
cmp r8d, r9d
jne 0x14001377d
lea ebx, [r10 + 7]
cmp al, cl
lea edx, [rbx - 2]
cmove ebx, edx
jmp 0x1400137c6
cmp r8d, ecx
jne 0x14001378d
sub al, cl
neg al
sbb ebx, ebx
add ebx, 0xa
jmp 0x1400137c6
xor ebx, ebx
cmp al, cl
setne bl
add ebx, 7
jmp 0x1400137c6
mov edx, 4
cmp dword [rsp + 0x24], edx
jne 0x1400137c6
mov edx, dword [rsp + 0x28]
mov eax, edx
neg eax
sbb ecx, ecx
and ebx, ecx
mov ecx, 1
cmp edx, 0xa
cmove ebx, ecx
lea r9d, [rcx + 1]
cmp edx, 0x5a
cmove ebx, r9d
mov dword [0x14003c948], ebx
mov eax, ebx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140014130
add rsp, 0xd0
pop rbx
ret

Function at 0x1400186a0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140018508
Function at 0x1800358a7
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1800800e4
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1800b5360]
mov ecx, 3
lea r8, [0x1800b5358]
lea rdx, str.FlsAlloc
call fcn.18007f790
test rax, rax
je 0x180080120
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x1800da020]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]