joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42de40
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42e0e6
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x1278]
mov rcx, qword [rax + 0x1268]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42e0da
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x00597391], 0
jne 0x42dea2
xor edx, edx
xor ebx, ebx
nop
jmp 0x42deea
xor edx, edx
jmp 0x42decd
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call fcn.0041d840
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42dea6
add rax, 0x1268
call fcn.0042dcc0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42e074
mov rsi, qword [rax + rdx*8 + 0x1278]
nop dword [rax + rax]
cmp rsi, 0x1000
jb 0x42dee7
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.004117e0
test rax, rax
jne 0x42df42
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42dee7
nop
mov rsi, rcx
shr rcx, 3
add rcx, qword [rbx + 0x50]
movzx r8d, byte [rcx]
and esi, 7
mov rdx, rcx
mov rcx, rsi
mov r9d, 1
shl r9d, cl
nop
test r9b, r8b
je 0x42df85
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42dee7
nop
lock or byte [rdx], r9b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42e0cd
lea r10, [0x005697f0]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r10d, byte [r9 + rcx + 0x21040]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x21040]
shr r8, 0xd
and r8d, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42e00b
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42e045
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop dword [rax]
jmp 0x42dee7
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42e0c5
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42dee7
cmp rbx, 0x200
ja 0x42e0b8
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.004239c0
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call fcn.0042dcc0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
call fcn.0045e760
mov rax, r8
call fcn.0045e6e0
mov rax, r8
mov ecx, 0x40
call fcn.0045e700
mov edx, 0x200
nop
call fcn.0045e740
nop
mov qword [rsp + 8], rax
call fcn.00460740
mov rax, qword [rsp + 8]
jmp fcn.0042de40
Function at 0x442f60
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4430cf
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x442f78
cmp edx, ecx
jne 0x4430bd
nop dword [rax]
test rsi, rsi
jne 0x4430bd
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x442fd6
nop
call fcn.00460000
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.00442e60
mov rcx, qword [0x005435a8]
mov rdx, qword [0x005435a0]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
sar esi, 5
mov r8d, esi
shl esi, 5
sub edi, esi
test edi, edi
jl 0x4430b8
cmp edi, 0x20
sbb esi, esi
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x4430ad
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x00543f30]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x00543f30], rbx
mov edx, 1
lea rsi, [0x00543f38]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x44309c
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1228], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x004af977]
mov ebx, 0x28
call fcn.00434a20
mov rcx, rax
mov rax, rsi
call fcn.0045e6e0
call fcn.00432f40
lea rax, [0x004aee5f]
mov ebx, 0x23
call fcn.00434a20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c000
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00442f60
Function at 0x140013290
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov byte [rax + 0x68], 0
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x10], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x10], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x10325476
ret

Function at 0x1400186c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400186e3
mov dword [rsp + 0x20], 1
jmp 0x1400186eb
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x14001e1a0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
mov eax, 4
imul rax, rax, 0
movsx ecx, byte [rsp + 0x10]
mov rdx, qword [rsp + 8]
mov eax, dword [rdx + rax]
xor eax, ecx
and eax, 0xff
cdqe
lea rcx, [0x1401b30d0]
mov edx, 4
imul rdx, rdx, 0
mov r8, qword [rsp + 8]
mov edx, dword [r8 + rdx]
shr edx, 8
mov eax, dword [rcx + rax*4]
xor eax, edx
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 8]
mov dword [rdx + rcx], eax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov eax, dword [rcx + rax]
and eax, 0xff
mov ecx, 4
imul rcx, rcx, 1
mov rdx, qword [rsp + 8]
add eax, dword [rdx + rcx]
mov ecx, 4
imul rcx, rcx, 1
mov rdx, qword [rsp + 8]
mov dword [rdx + rcx], eax
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
imul eax, dword [rcx + rax], 0x8088405
inc eax
mov ecx, 4
imul rcx, rcx, 1
mov rdx, qword [rsp + 8]
mov dword [rdx + rcx], eax
mov eax, 4
imul rax, rax, 2
mov ecx, 4
imul rcx, rcx, 1
mov rdx, qword [rsp + 8]
mov ecx, dword [rdx + rcx]
shr ecx, 0x18
mov rdx, qword [rsp + 8]
mov eax, dword [rdx + rax]
xor eax, ecx
and eax, 0xff
mov eax, eax
lea rcx, [0x1401b30d0]
mov edx, 4
imul rdx, rdx, 2
mov r8, qword [rsp + 8]
mov edx, dword [r8 + rdx]
shr edx, 8
mov eax, dword [rcx + rax*4]
xor eax, edx
mov ecx, 4
imul rcx, rcx, 2
mov rdx, qword [rsp + 8]
mov dword [rdx + rcx], eax
ret

Function at 0x14001fa70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [rsp + 0x68]
imul rax, qword [rsp + 0x70]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x78]
movzx eax, byte [rax]
test eax, eax
je 0x14001faed
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jne 0x14001fae0
mov rax, qword [rsp + 0x78]
mov byte [rax + 0x10], 1
mov eax, dword [rsp + 0x3c]
xor edx, edx
div qword [rsp + 0x68]
jmp 0x14001fb61
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x2c]
add eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
cmp eax, dword [rcx + 0x28]
jbe 0x14001fb19
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x78]
mov ecx, dword [rcx + 0x2c]
mov eax, dword [rax + 0x28]
sub eax, ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
mov ecx, dword [rcx + 0x2c]
mov rdx, qword [rsp + 0x78]
add rcx, qword [rdx + 0x20]
mov rdi, qword [rsp + 0x60]
mov rsi, rcx
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x2c]
add eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x78]
mov dword [rcx + 0x2c], eax
mov eax, dword [rsp + 0x34]
xor edx, edx
div qword [rsp + 0x68]
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x140021a60
Capabilities:
Get common file path

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
jne 0x140021a8e
mov rax, qword [rsp + 0x60]
cmp dword [rax + 8], 0xffffffff
je 0x140021a98
mov eax, 0x1000000
jmp 0x140021bd4
mov rax, qword [rsp + 0x60]
add rax, 0x250
mov rdx, rax
mov ecx, 0x103
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rax, qword [rsp + 0x60]
add rax, 0x250
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0xffffffffffffffff
inc qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp word [rax + rcx*2], 0
jne 0x140021aca
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
lea rax, [rcx + rax*2 + 0x24e]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5c
je 0x140021b3c
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x2f
je 0x140021b3c
mov eax, 2
imul rax, rax, 1
mov ecx, 0x2f
mov rdx, qword [rsp + 0x38]
mov word [rdx + rax], cx
mov eax, 2
imul rax, rax, 2
xor ecx, ecx
mov rdx, qword [rsp + 0x38]
mov word [rdx + rax], cx
cmp dword [rsp + 0x78], 1
jne 0x140021b83
mov rcx, qword [rsp + 0x68]
call fcn.140018590
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xffffffff
je 0x140021b62
mov dword [rsp + 0x24], 1
jmp 0x140021b6a
mov dword [rsp + 0x24], 0
movzx eax, byte [rsp + 0x24]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140021b83
mov eax, 0x2000000
jmp 0x140021bd4
lea r9, [rsp + 0x2c]
mov r8d, dword [rsp + 0x78]
mov edx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call fcn.14001f610
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x140021bae
mov eax, dword [rsp + 0x2c]
jmp 0x140021bd4
mov rcx, qword [rsp + 0x40]
call fcn.14001ff30
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
jne 0x140021bd2
mov eax, 0x200
jmp 0x140021bd4
xor eax, eax
add rsp, 0x58
ret
Function at 0x140024940
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
push rdi
mov rax, qword [rsp + 0x10]
add rax, 0x1c
mov rdi, rax
xor eax, eax
mov ecx, 0x40
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x10]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x10]
mov qword [rax + 0x68], 0
mov rax, qword [rsp + 0x10]
mov dword [rax + 0x70], 0x67452301
mov rax, qword [rsp + 0x10]
mov dword [rax + 0x74], 0xefcdab89
mov rax, qword [rsp + 0x10]
mov dword [rax + 0x78], 0x98badcfe
mov rax, qword [rsp + 0x10]
mov dword [rax + 0x7c], 0x10325476
pop rdi
ret
Function at 0x140033250
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0xe0], 0
je 0x140033289
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0xe0]
call fcn.14006b630
mov rax, qword [rsp + 0x30]
mov qword [rax + 0xe0], 0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call fcn.14006b270
mov rax, qword [rsp + 0x30]
add rax, 0xe8
mov rcx, rax
call fcn.140007df0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rax, qword [rsp + 0x30]
add rax, 0xe8
mov rcx, rax
call fcn.1400065b0
mov rax, qword [rsp + 0x30]
add rax, 0xb0
mov rcx, rax
call fcn.1400065b0
mov rax, qword [rsp + 0x30]
add rax, 0x88
mov rcx, rax
call fcn.1400065b0
mov rax, qword [rsp + 0x30]
add rax, 0x68
mov rcx, rax
call fcn.1400065b0
mov rax, qword [rsp + 0x30]
add rax, 0x48
mov rcx, rax
call fcn.1400065b0
mov rax, qword [rsp + 0x30]
add rax, 0x28
mov rcx, rax
call fcn.1400065b0
mov rax, qword [rsp + 0x30]
add rax, 8
mov rcx, rax
call fcn.1400065b0
add rsp, 0x28
ret
Function at 0x14003d7b0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1401deb80]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov eax, 0x20
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x1401e5c48], eax
jle 0x14003d860
lea rcx, [0x1401e5c48]
call fcn.140149bd8
cmp dword [0x1401e5c48], 0xffffffff
jne 0x14003d860
lea rdx, str.MmAllocatePagesForMdl
lea rcx, [rbp + 0x20]
call fcn.140007e10
nop
lea r8, [rbp + 0x20]
mov rdx, qword [0x1401e45e8]
mov rcx, qword [rsp + 0x110]
call fcn.14003e280
mov qword [0x1401e5bf0], rax
lea rcx, [rbp + 0x20]
call fcn.1400065b0
nop
lea rcx, [0x1401e5c48]
call fcn.140149b78
cmp qword [0x1401e5bf0], 0
jne 0x14003d8d7
lea rax, [rbp]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 1]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 2]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
call fcn.140005d70
mov qword [rbp + 0x18], rax
movzx r9d, byte [rbp]
movzx r8d, byte [rbp + 1]
movzx edx, byte [rbp + 2]
lea rcx, [rbp + 0x40]
call fcn.140043c10
mov rcx, rax
call fcn.1400422a0
mov qword [rbp + 0x10], rax
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x18]
call fcn.14000bec0
xor eax, eax
jmp 0x14003d935
mov qword [rbp + 8], 0
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x118]
mov r8, qword [0x1401e5bf0]
lea rdx, [rbp + 8]
mov rcx, qword [rsp + 0x110]
call fcn.140043cc0
movzx eax, al
test eax, eax
jne 0x14003d931
xor eax, eax
jmp 0x14003d935
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140149a30
add rsp, 0xf8
pop rdi
pop rbp
ret
Function at 0x14004e8c0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
mov rax, qword [rsp]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14004e8e4
xor eax, eax
jmp 0x14004e912
mov rax, qword [rsp]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
cmp dword [rax], 0x4550
je 0x14004e90d
xor eax, eax
jmp 0x14004e912
mov rax, qword [rsp + 8]
add rsp, 0x18
ret
Function at 0x140051b90
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2e8
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1401deb80]
xor rax, rsp
mov qword [rbp + 0x290], rax
mov dword [rbp + 4], 0
lea rax, [rbp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rdx, [rbp + 0x80]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [rbp + 8], eax
cmp dword [rbp + 8], 0
je 0x140051bfa
cmp dword [rbp + 8], 0x105
jbe 0x140051c8d
lea rax, [rbp]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 1]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 2]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
call fcn.140005d70
mov qword [rbp + 0x30], rax
movzx r9d, byte [rbp]
movzx r8d, byte [rbp + 1]
movzx edx, byte [rbp + 2]
lea rcx, [rbp + 0x60]
call fcn.140052b20
mov rcx, rax
call fcn.140052610
mov qword [rbp + 0x28], rax
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x30]
call fcn.14000bec0
lea rdx, [0x1401b4a3c]
mov rcx, qword [rsp + 0x300]
call fcn.14000efa0
mov eax, dword [rbp + 4]
or eax, 1
mov dword [rbp + 4], eax
mov rax, qword [rsp + 0x300]
jmp 0x140051d38
lea rax, [rbp + 0x80]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x10], 0xffffffffffffffff
inc qword [rbp + 0x10]
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x10]
cmp word [rax + rcx*2], 0
jne 0x140051ca0
mov rax, qword [rbp + 0x10]
movzx eax, word [rbp + rax*2 + 0x7e]
cmp eax, 0x5c
jne 0x140051d13
lea rax, [rbp + 0x80]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x18], 0xffffffffffffffff
inc qword [rbp + 0x18]
mov rax, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x18]
cmp word [rax + rcx*2], 0
jne 0x140051cd4
mov rax, qword [rbp + 0x18]
lea rax, [rax + rax - 2]
mov qword [rbp + 0x20], rax
cmp qword [rbp + 0x20], 0x20a
jae 0x140051d00
jmp 0x140051d05
call fcn.14014a0b0
xor eax, eax
mov rcx, qword [rbp + 0x20]
mov word [rbp + rcx + 0x80], ax
lea rdx, [rbp + 0x80]
mov rcx, qword [rsp + 0x300]
call fcn.14000efa0
mov eax, dword [rbp + 4]
or eax, 1
mov dword [rbp + 4], eax
mov rax, qword [rsp + 0x300]
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.140149a30
add rsp, 0x2e8
pop rdi
pop rbp
ret
Function at 0x140051f20
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x1401deb80]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x24], 0
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x28]
mov ecx, listen
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xc0000004
jne 0x140051fc9
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rsp + 0x24]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x28]
mov ecx, listen
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x30], eax
jmp 0x140051f6d
cmp dword [rsp + 0x30], 0
jge 0x140051ff2
cmp qword [rsp + 0x28], 0
je 0x140051feb
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x14005210c
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14005200b
xor eax, eax
jmp 0x14005210c
mov dword [rsp + 0x20], 0
jmp 0x14005201f
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
cmp dword [rsp + 0x20], eax
jae 0x1400520f7
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 8]
mov ecx, dword [rsp + 0x20]
imul rcx, rcx, 0x128
mov rdx, qword [rsp + 0x38]
movzx ecx, word [rdx + rcx + 0x2e]
lea rax, [rax + rcx + 0x28]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140007e10
mov rcx, qword [rsp + 0xa0]
call fcn.140007df0
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x60]
call fcn.140007df0
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call fcn.14016122c
test eax, eax
jne 0x1400520e8
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax + 0x18]
mov qword [rsp + 0x50], rax
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x60]
call fcn.1400065b0
mov rax, qword [rsp + 0x58]
jmp 0x14005210c
lea rcx, [rsp + 0x60]
call fcn.1400065b0
jmp 0x140052015
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140149a30
add rsp, 0x98
ret
Function at 0x140052280
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], 0xffffffffffffffff
inc qword [rsp + 0x30]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
cmp byte [rax + rcx], 0
jne 0x1400522a9
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x88]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 0
jmp 0x140052313
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jae 0x1400523d9
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x80]
mov rcx, rax
call fcn.14014eed0
test eax, eax
jne 0x1400523d4
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x38], 0xffffffffffffffff
inc qword [rsp + 0x38]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
cmp byte [rax + rcx], 0
jne 0x14005236f
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x48], rax
jne 0x1400523d4
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0xc], 0
jne 0x14005239f
xor eax, eax
jmp 0x1400523db
cmp qword [rsp + 0x90], 0
je 0x1400523bc
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 8]
mov dword [rax], ecx
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
jmp 0x1400523db
jmp 0x140052309
xor eax, eax
add rsp, 0x78
ret
Function at 0x140074110
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rsi, [rcx + rdx]
mov rbx, rcx
mov edi, 0x1505
cmp rcx, rsi
jae 0x140073dab
movzx ecx, byte [rbx]
call fcn.140082e50
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x140073d90
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
movzx eax, dil
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140074146
call fcn.140083fc0
test al, al
jne 0x140074146
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400743e0
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x140073d70
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14007d430
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x14007d472
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14007d5a0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x130
mov rax, qword [0x1401deb80]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rbx, qword [rsp + 0x180]
mov rdi, r8
movsxd r8, edx
mov rsi, r9
mov rdx, qword [rcx + 0x18]
mov rbp, rcx
mov r14, qword [rdx + r8*8 + 0x1e8]
call fcn.14007da80
test eax, eax
je 0x14007d5f8
mov dword [rbx], reloc.WLDAP32.dll_Ordinal_27
mov rax, 0xffffffffffffffff
jmp 0x14007d665
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
movsxd rdi, eax
mov dword [rbx], 0
cmp rdi, 0xffffffffffffffff
jne 0x14007d662
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp eax, 0x2733
jne 0x14007d632
xor edi, edi
mov dword [rbx], 0x51
jmp 0x14007d662
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov ecx, esi
call fcn.14006b6b0
mov r8, rax
lea rdx, str.Send_failure:__s
mov rcx, rbp
call fcn.14007d230
mov dword [rbp + 0xdd4], esi
mov dword [rbx], gethostname
mov rax, rdi
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140149a30
add rsp, 0x130
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret