joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001487
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14004bb00]
mov dword [rax], 1
mov rax, qword [0x14004bb10]
mov dword [rax], 1
mov rax, qword [0x14004bb20]
mov dword [rax], 1
mov rax, qword [0x14004baa0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014d8
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140001504
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000152a
cmp eax, 0x20b
je 0x140001551
jmp 0x140001580
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000153d
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001585
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000156c
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001585
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140027a20
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Hash data with crc32

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp byte [0x1400544e0], 0
mov r12, rcx
mov r13, rdx
mov rdi, r8
je 0x140027aa8
lea rdx, [0x140049e8a]
mov rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140027bb0
mov rsi, qword [0x1400544d8]
jmp 0x140027a65
lea rsi, [rdx + rax + 4]
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_strcmp
mov rcx, rsi
mov ebx, eax
call sub.msvcrt.dll_strlen
lea rdx, [rsi + rax + 1]
mov eax, dword [rdx]
test ebx, ebx
jne 0x140027a60
movzx r9d, word [rdx + 4]
lea r8, [rdx + 6]
mov rcx, r12
mov rdx, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.1400264f0
mov r8d, 0xa
mov edx, 3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rax
mov r9d, dword [rax]
mov eax, dword [rax + 4]
lea rcx, [rdx + 8]
mov qword [0x1400544d8], rcx
test eax, eax
je 0x140027b98
sub eax, 1
lea r8, [rdx + rax + 9]
mov eax, 0xffffffff
nop dword [rax + rax]
movzx edx, byte [rcx]
xor edx, eax
mov eax, edx
and edx, 1
neg edx
shr eax, 1
and edx, 0xedb88320
xor eax, edx
mov edx, eax
and eax, 1
neg eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
mov eax, edx
and edx, 1
neg edx
shr eax, 1
and edx, 0xedb88320
xor eax, edx
mov edx, eax
and eax, 1
neg eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
mov eax, edx
and edx, 1
neg edx
shr eax, 1
and edx, 0xedb88320
xor eax, edx
mov edx, eax
and eax, 1
neg eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
mov eax, edx
shr eax, 1
and edx, 1
add rcx, 1
neg edx
and edx, 0xedb88320
xor eax, edx
mov edx, eax
and eax, 1
neg eax
shr edx, 1
and eax, 0xedb88320
xor eax, edx
cmp r8, rcx
jne 0x140027b00
not eax
cmp r9d, eax
jne 0x140027c4a
mov byte [0x1400544e0], 1
jmp 0x140027a3e
cmp byte [0x1400544d0], 0
jne 0x140027a55
mov rbx, qword [sym.imp.python38.dll_PyDict_New]
call rbx
mov qword [0x140054528], rax
call rbx
mov qword [0x140054520], rax
call rbx
mov qword [0x140054518], rax
call rbx
mov qword [0x140054558], rax
call rbx
mov qword [0x140054550], rax
call rbx
mov qword [0x140054548], rax
call rbx
mov qword [0x140054538], rax
call rbx
mov rbp, qword [sym.imp.python38.dll_PyLong_FromLong]
mov rsi, qword [0x14004b990]
mov rbx, 0xfffffffffffffffb
mov qword [0x140054530], rax
nop dword [rax]
mov ecx, ebx
call rbp
mov qword [rsi + rbx*8 + 0x28], rax
add rbx, 1
cmp rbx, 0x101
jne 0x140027c28
mov byte [0x1400544d0], 1
jmp 0x140027a55
lea rcx, str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
xor eax, eax
ret
Function at 0x140030920
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.140041d90
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.140041d90
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x1400315d2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1400549c8]
test eax, eax
je 0x14003166a
lea rax, [0x1400549a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400549d0]
mov qword [rbp - 8], rax
jmp 0x14003164e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140031642
cmp qword [rbp - 0x10], 0
je 0x140031642
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140031608
lea rax, [0x1400549a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14003166b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140031770
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140031798
mov eax, 0
jmp 0x1400317e6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400317c1
mov eax, 0
jmp 0x1400317e6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1400317e1
mov eax, 0
jmp 0x1400317e6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x1400317ec
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14003186a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140031861
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140031861
mov rax, qword [rbp - 8]
jmp 0x14003187f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140031834
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14001d8e0
Capabilities:
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, rcx
mov r12d, edx
lea rcx, [0x14009c560]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r9, qword gs:[0x58]
mov r13, rax
mov edi, 4
add rdi, qword [r9]
mov r9d, dword [rdi]
cmp dword [0x1400cc0cc], r9d
jle 0x14001d961
lea rcx, [0x1400cc0cc]
call fcn.1400892d8
cmp dword [0x1400cc0cc], 0xffffffff
jne 0x14001d961
lea rcx, [0x14008c480]
call fcn.140089694
lea rcx, [0x1400cc0cc]
call fcn.14008926c
mov r8d, 0x1000
mov rdx, rsi
call fcn.14001d770
xor ecx, ecx
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov r8d, 0x3000
mov r15, rax
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movaps xmm0, xmmword [0x1400af0e0]
lea rbp, [r15 + 0x60]
mov r8, qword [rsp + 0x70]
mov r14, rax
mov edx, 0x50
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400af0f0]
lea rcx, [r14 + 0x78]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400af100]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400af110]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x1400af120]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x1400af130]
movups xmmword [rax + 0x50], xmm1
mov qword [rax + 6], rbp
mov rax, qword [0x14008d2c0]
mov qword [r14 + 0x68], rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov eax, dword [rdi]
cmp dword [0x1400cc0cc], eax
jle 0x14001da2b
lea rcx, [0x1400cc0cc]
call fcn.1400892d8
cmp dword [0x1400cc0cc], 0xffffffff
jne 0x14001da2b
lea rcx, [0x14008c480]
call fcn.140089694
lea rcx, [0x1400cc0cc]
call fcn.14008926c
mov r9, r14
mov dword [rsp + 0x20], reloc.WLDAP32.dll_Ordinal_200
mov r8, r15
mov rdx, rsi
call fcn.14001d6b0
mov r9d, r12d
mov r8, r13
mov rdx, r15
mov ecx, 7
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
cmp dword [r14 + 0x60], 2
mov r12, rax
je 0x14001dac0
nop
mov ecx, dword [rdi]
cmp dword [0x1400cc0cc], ecx
jle 0x14001da97
lea rcx, [0x1400cc0cc]
call fcn.1400892d8
cmp dword [0x1400cc0cc], 0xffffffff
jne 0x14001da97
lea rcx, [0x14008c480]
call fcn.140089694
lea rcx, [0x1400cc0cc]
call fcn.14008926c
lea r9, [r14 + 0x60]
mov dword [rsp + 0x20], WSAGetLastError
mov r8, rbp
mov rdx, rsi
call fcn.14001d5f0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [r14 + 0x60], 2
jne 0x14001da60
mov rbx, qword [r14 + 0x70]
mov rcx, r12
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [rdi]
cmp dword [0x1400cc0cc], eax
jle 0x14001db04
lea rcx, [0x1400cc0cc]
call fcn.1400892d8
cmp dword [0x1400cc0cc], 0xffffffff
jne 0x14001db04
lea rcx, [0x14008c480]
call fcn.140089694
lea rcx, [0x1400cc0cc]
call fcn.14008926c
mov r8, r15
mov rdx, rsi
call fcn.14001d820
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbp, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001db40
Capabilities:
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, rcx
mov r12d, edx
lea rcx, [0x14009c560]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r10, qword gs:[0x58]
mov r13, rax
mov edi, 4
add rdi, qword [r10]
mov r9d, dword [rdi]
cmp dword [0x1400cc0cc], r9d
jle 0x14001dbbe
lea rcx, [0x1400cc0cc]
call fcn.1400892d8
cmp dword [0x1400cc0cc], 0xffffffff
jne 0x14001dbbe
lea rcx, [0x14008c480]
call fcn.140089694
lea rcx, [0x1400cc0cc]
call fcn.14008926c
mov r8d, 0x1000
mov rdx, rsi
call fcn.14001d770
mov edx, reloc.WS2_32.dll_WSACleanup
xor ecx, ecx
mov r8d, 0x3000
mov r15, rax
lea r9d, [rdx - 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movaps xmm0, xmmword [0x1400af140]
lea rbp, [r15 + 0x5c]
mov rcx, qword [rsp + 0x80]
mov r14, rax
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400af150]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400af160]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400af170]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x1400af180]
movups xmmword [rax + 0x40], xmm0
movsd xmm0, qword [0x1400af190]
movsd qword [rax + 0x50], xmm0
mov eax, dword [0x1400af198]
mov dword [r14 + 0x58], eax
mov rax, qword [rsp + 0x88]
mov qword [r14 + 6], rbp
mov qword [r14 + 0x6c], rcx
mov eax, dword [rax + 0x28]
add rax, rcx
mov qword [r14 + 0x64], rax
mov eax, dword [rdi]
cmp dword [0x1400cc0cc], eax
jle 0x14001dc93
lea rcx, [0x1400cc0cc]
call fcn.1400892d8
cmp dword [0x1400cc0cc], 0xffffffff
jne 0x14001dc93
lea rcx, [0x14008c480]
call fcn.140089694
lea rcx, [0x1400cc0cc]
call fcn.14008926c
mov r9, r14
mov dword [rsp + 0x20], reloc.WS2_32.dll_WSACleanup
mov r8, r15
mov rdx, rsi
call fcn.14001d6b0
mov r9d, r12d
mov r8, r13
mov rdx, r15
mov ecx, 7
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
cmp dword [r14 + 0x5c], 2
mov r12, rax
je 0x14001dd30
nop word [rax + rax]
mov ecx, dword [rdi]
cmp dword [0x1400cc0cc], ecx
jle 0x14001dd07
lea rcx, [0x1400cc0cc]
call fcn.1400892d8
cmp dword [0x1400cc0cc], 0xffffffff
jne 0x14001dd07
lea rcx, [0x14008c480]
call fcn.140089694
lea rcx, [0x1400cc0cc]
call fcn.14008926c
lea r9, [r14 + 0x5c]
mov dword [rsp + 0x20], Ordinal_26
mov r8, rbp
mov rdx, rsi
call fcn.14001d5f0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [r14 + 0x5c], 2
jne 0x14001dcd0
mov rcx, r12
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [rdi]
cmp dword [0x1400cc0cc], eax
jle 0x14001dd70
lea rcx, [0x1400cc0cc]
call fcn.1400892d8
cmp dword [0x1400cc0cc], 0xffffffff
jne 0x14001dd70
lea rcx, [0x14008c480]
call fcn.140089694
lea rcx, [0x1400cc0cc]
call fcn.14008926c
mov r8, r15
mov rdx, rsi
call fcn.14001d820
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_VirtualFree]
Function at 0x14001ddb0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r14
mov r14, rcx
mov rsi, r8
mov rbp, rdx
sub r14, qword [r8 + 0x30]
je 0x14001df32
test byte [r8 + 0x5e], 0x40
jne 0x14001dddd
xor eax, eax
mov rbp, qword [rsp + 0x30]
pop r14
pop rsi
ret
movzx edx, word [rsi + 0x14]
movzx eax, word [rsi + 6]
add rdx, 0x18
mov r8d, dword [r8 + 0xb0]
add rdx, rsi
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x14001df32
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14001de16
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x14001de2d
add rdx, 0x28
cmp rdx, r9
jb 0x14001de04
mov eax, 1
mov rbp, qword [rsp + 0x30]
pop r14
pop rsi
ret
mov qword [rsp + 0x18], rbx
mov ebx, dword [rdx + 0x14]
sub rbx, rcx
mov qword [rsp + 0x28], r15
mov r15d, dword [rsi + 0xb4]
add rbx, r8
add rbx, rbp
add r15, rbx
test rbx, rbx
je 0x14001df28
cmp rbx, r15
jae 0x14001df28
mov qword [rsp + 0x20], rdi
mov eax, dword [rbx + 4]
test eax, eax
je 0x14001df23
add eax, 0xfffffff8
shr eax, 1
je 0x14001df14
lea r11, [rbx + 8]
mov edi, eax
movzx r8d, word [r11]
movzx eax, r8w
shr ax, 0xc
and r8d, 0x80000fff
jge 0x14001dea2
dec r8d
or r8d, 0xfffff000
inc r8d
cmp ax, 3
je 0x14001deae
cmp ax, 0xa
jne 0x14001df06
movzx eax, word [rsi + 0x14]
movzx ecx, word [rsi + 6]
add rax, 0x18
mov r9d, dword [rbx]
add rax, rsi
lea rdx, [rcx + rcx*4]
lea r10, [rax + rdx*8]
cmp rax, r10
jae 0x14001defb
nop dword [rax]
mov edx, dword [rax + 0xc]
cmp r9, rdx
jb 0x14001dee2
mov ecx, dword [rax + 8]
add ecx, edx
cmp r9, rcx
jb 0x14001deed
add rax, 0x28
cmp rax, r10
jb 0x14001ded0
jmp 0x14001defb
mov ecx, dword [rax + 0x14]
sub rcx, rdx
add rcx, r9
add rcx, rbp
jne 0x14001defe
mov rcx, rbp
movzx eax, r8w
add qword [rax + rcx], r14
add r11, 2
sub rdi, 1
jne 0x14001de80
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, r15
jb 0x14001de64
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov r15, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov eax, 1
pop r14
pop rsi
ret
Function at 0x14001df40
Capabilities:
Enumerate pe sections

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r13
sub rsp, 0x38
movzx eax, word [r9 + 0x14]
lea r10, [r9 + 0x18]
mov r11d, dword [r9 + 0x90]
add r10, rax
movzx eax, word [r9 + 6]
mov rbp, r9
mov r13, r8
mov edi, edx
mov rsi, rcx
lea r9, [rax + rax*4]
lea r8, [r10 + r9*8]
cmp r10, r8
jae 0x14001dfa3
mov ecx, dword [r10 + 0xc]
cmp r11, rcx
jb 0x14001df9a
mov eax, dword [r10 + 8]
add eax, ecx
cmp r11, rax
jb 0x14001e02e
add r10, 0x28
cmp r10, r8
jb 0x14001df82
xor eax, eax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
test r11d, r11d
je 0x14001e00b
cmp dword [rbp + 0x94], 0
je 0x14001e00b
lea rbx, [rax + 0x10]
movzx edx, word [rbp + 0x14]
movzx eax, word [rbp + 6]
add rdx, 0x18
mov r8d, dword [rbx - 4]
add rdx, rbp
mov qword [rsp + 0x78], rbx
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x14001e00b
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14001e002
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x14001e040
add rdx, 0x28
cmp rdx, r9
jb 0x14001dff0
mov eax, 1
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x70]
add rsp, 0x38
pop r13
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [r10 + 0x14]
sub rax, rcx
add rax, r11
add rax, r13
jmp 0x14001dfa5
mov r15d, dword [rdx + 0x14]
sub r15, rcx
add r15, r8
add r15, r13
je 0x14001e00b
mov r8, r15
mov edx, edi
mov rcx, rsi
call fcn.14001d8e0
mov r12, rax
test rax, rax
je 0x14001e179
movzx edx, word [rbp + 0x14]
movzx eax, word [rbp + 6]
add rdx, 0x18
mov r8d, dword [rbx]
add rdx, rbp
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x14001e0a2
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14001e099
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x14001e0c7
add rdx, 0x28
cmp rdx, r9
jb 0x14001e087
xor r14d, r14d
mov rdi, qword [r14]
test rdi, rdi
je 0x14001e15e
jns 0x14001e0d6
xor edx, edx
mov rcx, r15
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
movzx edx, di
jmp 0x14001e122
mov r14d, dword [rdx + 0x14]
sub r14, rcx
add r14, r8
add r14, r13
jmp 0x14001e0a5
movzx eax, word [rbp + 0x14]
movzx ecx, word [rbp + 6]
add rax, 0x18
add rax, rbp
lea rdx, [rcx + rcx*4]
lea r8, [rax + rdx*8]
cmp rax, r8
jae 0x14001e10d
mov edx, dword [rax + 0xc]
cmp rdi, rdx
jb 0x14001e104
mov ecx, dword [rax + 8]
add ecx, edx
cmp rdi, rcx
jb 0x14001e16b
add rax, 0x28
cmp rax, r8
jb 0x14001e0f2
xor esi, esi
xor edx, edx
mov rcx, r15
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea rdx, [rsi + 2]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov rcx, rbx
sub rdi, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rax, [rdi + r12]
mov qword [r14], rax
add r14, 8
mov rdi, qword [r14]
test rdi, rdi
jne 0x14001e0b1
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x60]
mov edi, dword [rsp + 0x68]
add rbx, 0x14
jmp 0x14001dfcb
mov esi, dword [rax + 0x14]
sub rsi, rdx
add rsi, rdi
add rsi, r13
jmp 0x14001e10f
jmp 0x14001e010
Function at 0x14001e5c0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1400af080]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, Ordinal_35
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [rsp + 0x40]
call fcn.140023ea0
nop
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0x10
jb 0x14001e616
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140023060
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x14001e73b
mov byte [rsp + 0x38], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14001e73b
mov byte [rsp + 0x39], 3
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x39]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14001e73b
mov byte [rsp + 0x3a], 3
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x3a]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14001e73b
mov eax, dword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14001e701
mov rbx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14001e73b
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
sete bl
jmp 0x14001e73d
xor bl, bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14001e77d
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e778
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001e778
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400896ac
movzx eax, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140089210
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x140050140
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x140050182
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, Ordinal_60
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140050320
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x138
mov rax, qword [0x1400af080]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r14, qword [rsp + 0x1a0]
mov rsi, rcx
movsxd rcx, edx
xor r13d, r13d
mov rax, rcx
mov r12, r9
shl rax, 5
mov r15, r8
lea rbx, [rsi + 0x508]
mov rbp, qword [rsi + rcx*8 + 0x4c0]
add rbx, rax
mov rax, qword [rsi + 0x698]
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x7c], 3
je 0x140050427
lea rax, [0x1400501d0]
cmp qword [rsi + rcx*8 + 0x4e8], rax
jne 0x140050427
cmp qword [rbx], r13
je 0x1400503ae
test rdi, rdi
je 0x140050427
mov rdx, 0xffffffffffffffff
xor r9d, r9d
mov r8, rdx
mov rcx, rbp
call fcn.14005f8a0
cmp eax, 0xffffffff
je 0x140050427
test al, 1
je 0x140050427
mov rax, qword [rbx]
test rax, rax
jne 0x140050400
mov rax, qword [rsi]
mov ecx, dword [rax + 0xb70]
add ecx, ecx
movsxd rcx, ecx
mov qword [rbx + 8], rcx
call qword [fcn.14008a3fe]
mov rdi, qword [rbx + 8]
mov qword [rbx], rax
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
test rax, rax
je 0x140050423
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rax
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x140050427
add qword [rbx + 0x10], rcx
jmp 0x140050427
mov qword [rbx + 8], r13
xor r9d, r9d
mov r8d, r12d
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
movsxd rdi, eax
mov dword [r14], r13d
cmp rdi, 0xffffffffffffffff
jne 0x140050494
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x140050460
mov dword [r14], 0x51
mov rax, r13
jmp 0x140050497
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov ecx, ebx
call fcn.14003a230
mov rcx, qword [rsi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.14004fdc0
mov rcx, qword [rsi]
mov dword [rcx + 0x11b0], ebx
mov dword [r14], Ordinal_60
mov rax, rdi
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140089210
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140050b30
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x558], 0
je 0x140050b4d
call fcn.140049cd0
test eax, eax
jne 0x140050b73
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x4c0]
cmp rcx, 0xffffffffffffffff
je 0x140050b46
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x140050b46
mov al, 1
add rsp, 0x28
ret