joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400012c0
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x140065ec0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbp, rdx
mov r13, rcx
movsxd rdx, dword [rdx + 0x3c]
movzx eax, word [rdx + rbp + 6]
dec eax
cdqe
lea rcx, [rax + rax*4]
movzx eax, word [rdx + rbp + 0x14]
add rax, rdx
lea rdx, [rax + rcx*8]
lea rax, [rdx + rbp + 0x18]
lea rdi, [0x14004fb48]
mov rsi, rax
mov ecx, 7
repe cmpsb byte [rsi], byte [rdi]
je 0x140001331
xor eax, eax
jmp 0x14000148e
mov edi, dword [rax + 0x14]
mov esi, dword [rax + 0x10]
mov ecx, esi
call fcn.140026dfc
mov rbx, rax
lea rdx, [rbp + rdi]
mov r8d, esi
mov rcx, rax
call fcn.140027770
mov r12d, dword [rbx]
lea rbp, [rbx + 4]
xor r14d, r14d
mov ebx, r14d
test r12d, r12d
je 0x140001489
nop word [rax + rax]
mov edx, 0xf
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], r14
mov byte [rsp + 0x38], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rdi, rcx
cmp rcx, 0xfffffffffffffffe
ja 0x14000147c
cmp rcx, rdx
jbe 0x1400013be
xor r8d, r8d
mov rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.140002880
mov rdx, qword [rsp + 0x50]
jmp 0x1400013cc
test rcx, rcx
jne 0x1400013cc
mov qword [rsp + 0x48], r14
mov byte [rsp + 0x38], al
test rdi, rdi
setne al
test al, al
je 0x14000140a
lea rcx, [rsp + 0x38]
cmp rdx, 0x10
cmovae rcx, qword [rsp + 0x38]
mov r8, rdi
mov rdx, rbp
call fcn.140027770
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rax, qword [rsp + 0x38]
mov byte [rax + rdi], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
add rbp, rcx
mov eax, dword [rbp]
mov dword [rsp + 0x20], eax
add rbp, 4
mov edi, eax
mov ecx, eax
call fcn.140026dfc
mov rsi, rax
mov r8d, edi
mov rdx, rbp
mov rcx, rax
call fcn.140027770
add rbp, rdi
lea rcx, [r13 + 0x28]
lea rdx, [rsp + 0x38]
call fcn.1400015a0
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
mov qword [rax + 8], rsi
cmp qword [rsp + 0x50], 0x10
jb 0x14000146f
mov rcx, qword [rsp + 0x38]
call fcn.14002747c
inc ebx
cmp ebx, r12d
jb 0x140001370
jmp 0x140001489
lea rcx, str.string_too_long
call fcn.140026d14
int3
mov eax, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400274a0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140004ea0
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [0x140065ec0]
xor rax, rsp
mov qword [rsp + 0x288], rax
mov edx, 1
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp eax, 0xffffffff
jne 0x140004ede
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x140004ff6
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140004f0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140004ff6
mov qword [rsp + 0x2a0], rsi
mov qword [rsp + 0x2a8], rdi
xor esi, esi
lea rcx, [rsp + 0x4c]
call fcn.14002828c
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x278], 7
mov rdx, rax
xor eax, eax
mov qword [rsp + 0x270], rsi
mov rdi, rdx
mov word [rsp + 0x260], si
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x260]
call fcn.140002b50
cmp qword [rsp + 0x278], 8
lea rdx, [rsp + 0x260]
cmovae rdx, qword [rsp + 0x260]
lea rcx, str.iProcManagerX64.exe
call fcn.1400287c0
test eax, eax
jne 0x140004fad
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x100400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x14000500f
cmp qword [rsp + 0x278], 8
jb 0x140004fc5
mov rcx, qword [rsp + 0x260]
call fcn.14002747c
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140004f20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rsi, qword [rsp + 0x2a0]
mov rdi, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.1400274a0
add rsp, 0x290
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x278], 8
jb 0x140005030
mov rcx, qword [rsp + 0x260]
call fcn.14002747c
mov rax, rdi
jmp 0x140004fe6
Function at 0x140007070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x140065ec0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rdx
mov ebp, 0x20
mov dword [rsp + 0x50], 0x200020
mov dword [rsp + 0x54], 0x200020
mov dword [rsp + 0x58], 0x200020
mov dword [rsp + 0x5c], 0x200020
mov dword [rsp + 0x60], 0x200020
xor esi, esi
mov word [rsp + 0x64], si
mov edx, ecx
lea rcx, [rsp + 0x28]
call fcn.140006d40
nop
lea r8, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae r8, qword [rsp + 0x28]
lea rdx, str._s
lea rcx, [rsp + 0x50]
call fcn.1400058d0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
mov word [rsp + rcx*2 + 0x4e], bp
mov word [rsp + 0x64], si
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140003320
lea r8d, [rbp - 0x1f]
lea rdx, reloc.OLEAUT32.dll_VariantCopy
mov rcx, rbx
call fcn.140003320
nop
cmp qword [rsp + 0x40], 8
jb 0x14000715f
mov rcx, qword [rsp + 0x28]
call fcn.14002747c
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400274a0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000b180
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140065ec0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
lea r8, [rsp + 0x34]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
xor ebx, ebx
lea r8, [rsp + 0x30]
lea r9d, [rbx + 0x10]
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400274a0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x14000c560
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x2a0
mov rax, qword [0x140065ec0]
xor rax, rsp
mov qword [rsp + 0x290], rax
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp eax, 0xffffffff
jne 0x14000c5a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xffffffff
jmp 0x14000c6b0
lea rdx, [rsp + 0x50]
mov rcx, rax
mov dword [rsp + 0x50], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x14000c5d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x14000c6b0
mov qword [rsp + 0x2b8], rbp
mov qword [rsp + 0x2c0], rdi
xor ebp, ebp
lea rcx, [rsp + 0x7c]
call fcn.14002828c
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x40], 7
mov rdx, rax
xor eax, eax
mov qword [rsp + 0x38], rbp
mov rdi, rdx
mov word [rsp + 0x28], bp
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x28]
call fcn.140002b50
lea rcx, [rsp + 0x7c]
mov rdx, rsi
call fcn.1400287c0
test eax, eax
jne 0x14000c66c
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x20]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov ecx, dword [rsp + 0x58]
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], ebp
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov edx, dword [rsp + 0x24]
cmp dword [rsp + 0x20], edx
je 0x14000c6d1
test edx, edx
je 0x14000c6d1
cmp qword [rsp + 0x40], 8
jb 0x14000c67e
mov rcx, qword [rsp + 0x28]
call fcn.14002747c
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000c5e6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
mov rbp, qword [rsp + 0x2b8]
mov rdi, qword [rsp + 0x2c0]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400274a0
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x2a0
pop rsi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x40], 8
mov edi, dword [rsp + 0x58]
jb 0x14000c6f0
mov rcx, qword [rsp + 0x28]
call fcn.14002747c
mov eax, edi
jmp 0x14000c6a0
Function at 0x1400148e0
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push rbp
lea rbp, [rsp - 0xfb0]
mov eax, 0x10b0
call fcn.14002b1d0
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x10c8], rbx
mov qword [rsp + 0x10d0], rsi
mov qword [rsp + 0x10d8], rdi
mov rax, qword [0x140065ec0]
xor rax, rsp
mov qword [rbp + 0xfa0], rax
mov rbx, rcx
xor esi, esi
mov word [rbp - 0x60], si
xor edx, edx
mov r8d, 0xffe
lea rcx, [rbp - 0x5e]
call fcn.14002a2d0
xor r9d, r9d
lea r8d, [rsi + 0x23]
lea rdx, [rbp - 0x60]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x60]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x60]
mov rcx, rbx
call fcn.140002b50
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001498a
and eax, 0x10
jne 0x140014996
xor edx, edx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x48], si
mov r8d, 9
lea rdx, str.piclesoft
lea rcx, [rsp + 0x48]
call fcn.140002b50
nop
lea r8, [rsp + 0x48]
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140014680
nop
mov rdx, rax
mov rcx, rbx
call fcn.1400046d0
nop
cmp qword [rbp - 0x78], 8
jb 0x1400149f1
mov rcx, qword [rsp + 0x70]
call fcn.14002747c
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], rsi
mov word [rsp + 0x70], si
cmp qword [rsp + 0x60], 8
jb 0x140014a14
mov rcx, qword [rsp + 0x48]
call fcn.14002747c
mov dword [rsp + 0x28], 0x18
mov dword [rsp + 0x38], esi
lea rax, [rsp + 0x28]
test rax, rax
je 0x140014a43
xor r9d, r9d
lea r8, [rsp + 0x30]
lea edx, [r9 + 1]
lea rcx, str.D:_D_OICI_GA___BG__D_OICI_GA___AN__A_OICI_GRGWGX___AU__A_OICI_GA___BA_
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
cmp qword [rbx + 0x18], 8
jb 0x140014a4f
mov rcx, qword [rbx]
jmp 0x140014a52
mov rcx, rbx
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp qword [rbx + 0x18], 8
jb 0x140014a67
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140014a81
and eax, 0x10
je 0x140014a81
mov eax, 1
jmp 0x140014a83
xor eax, eax
mov rcx, qword [rbp + 0xfa0]
xor rcx, rsp
call fcn.1400274a0
lea r11, [rsp + 0x10b0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140015430
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x140065ec0]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
mov rbx, rcx
mov dword [rcx + 8], esi
mov qword [rcx], rsi
cmp dword [rcx + 0xc], esi
jne 0x1400154a9
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x1400154a6
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400154a6
lea r8, [rbx + 8]
lea rdx, [rbx + 4]
mov rcx, rbx
call rax
mov word [rbx + 0xa], si
mov esi, 1
mov dword [rbx + 0xc], esi
cmp dword [rbx + 0xc], 0
jne 0x1400154ee
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rbx + 0xc], eax
cmp dword [rbx + 0xc], 0
mov eax, dword [rsp + 0x54]
mov dword [rbx], eax
mov eax, dword [rsp + 0x58]
mov dword [rbx + 4], eax
mov eax, dword [rsp + 0x5c]
mov dword [rbx + 8], eax
je 0x1400155a3
mov ecx, dword [rbx]
sub ecx, 4
je 0x140015586
dec ecx
je 0x14001555c
dec ecx
je 0x140015520
cmp ecx, 4
jne 0x1400155a3
cmp dword [rbx + 4], 0
jne 0x1400155a3
mov dword [rbx + 0x10], 0x10
jmp 0x1400155a3
mov eax, dword [rbx + 4]
test eax, eax
je 0x140015553
cmp eax, 1
je 0x14001554a
jbe 0x1400155a3
cmp eax, 3
jbe 0x140015541
cmp eax, 4
jne 0x1400155a3
mov dword [rbx + 0x10], 0xf
jmp 0x1400155a3
mov dword [rbx + 0x10], 0xe
jmp 0x1400155a3
mov dword [rbx + 0x10], 0xd
jmp 0x1400155a3
mov dword [rbx + 0x10], 0xa
jmp 0x1400155a3
mov ecx, dword [rbx + 4]
test ecx, ecx
je 0x14001557d
dec ecx
je 0x140015574
dec ecx
jne 0x1400155a3
mov dword [rbx + 0x10], 7
jmp 0x1400155a3
mov dword [rbx + 0x10], 6
jmp 0x1400155a3
mov dword [rbx + 0x10], 5
jmp 0x1400155a3
mov eax, dword [rbx + 4]
cmp eax, 0xa
je 0x14001559c
cmp eax, 0x5a
jne 0x1400155a3
mov dword [rbx + 0x10], 4
jmp 0x1400155a3
mov dword [rbx + 0x10], 3
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400274a0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140019a20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
lea rsi, [0x140000000]
mov ecx, ebx
nop dword [rax]
movsx rax, byte [rcx + rsi + 0x54cd0]
add rcx, 6
movzx eax, byte [rax + rdi - 1]
mov byte [rcx + rsi + 0x6d94a], al
movsx rax, byte [rcx + rsi + 0x54ccb]
movzx eax, byte [rax + rdi - 1]
mov byte [rcx + rsi + 0x6d94b], al
movsx rax, byte [rcx + rsi + 0x54ccc]
movzx eax, byte [rax + rdi - 1]
mov byte [rcx + rsi + 0x6d94c], al
movsx rax, byte [rcx + rsi + 0x54ccd]
movzx eax, byte [rax + rdi - 1]
mov byte [rcx + rsi + 0x6d94d], al
movsx rax, byte [rcx + rsi + 0x54cce]
movzx eax, byte [rax + rdi - 1]
mov byte [rcx + rsi + 0x6d94e], al
movsx rax, byte [rcx + rsi + 0x54ccf]
movzx eax, byte [rax + rdi - 1]
mov byte [rcx + rsi + 0x6d94f], al
cmp rcx, 0x30
jl 0x140019a40
mov rax, qword [0x14006d950]
lea r9, [0x140073a90]
mov r8, rbx
mov qword [0x140073a90], rax
mov rax, qword [0x14006d958]
sub rdx, r9
mov qword [0x140073a98], rax
mov rax, qword [0x14006d960]
mov qword [0x140073aa0], rax
mov rax, qword [0x14006d968]
mov qword [0x140073aa8], rax
mov rax, qword [0x14006d970]
mov qword [0x140073ab0], rax
mov rax, qword [0x14006d978]
mov qword [0x140073ab8], rax
nop dword [rax]
lea rcx, [r8 + r9]
add r8, 6
movzx eax, byte [rdx + rcx]
xor byte [rcx], al
movzx eax, byte [rdx + rcx + 1]
xor byte [rcx + 1], al
movzx eax, byte [rdx + rcx + 2]
xor byte [rcx + 2], al
movzx eax, byte [rdx + rcx + 3]
xor byte [rcx + 3], al
movzx eax, byte [rdx + rcx + 4]
xor byte [rcx + 4], al
movzx eax, byte [rcx + rdx + 5]
xor byte [rcx + 5], al
cmp r8, 0x30
jl 0x140019b30
mov rcx, rdi
call fcn.140019c20
nop word [rax + rax]
movsx rax, byte [rbx + rsi + 0x54d00]
add rbx, 4
movzx eax, byte [rax + rdi - 1]
mov byte [rbx + rsi + 0x6d94c], al
movsx rax, byte [rbx + rsi + 0x54cfd]
movzx eax, byte [rax + rdi - 1]
mov byte [rbx + rsi + 0x6d94d], al
movsx rax, byte [rbx + rsi + 0x54cfe]
movzx eax, byte [rax + rdi - 1]
mov byte [rbx + rsi + 0x6d94e], al
movsx rax, byte [rbx + rsi + 0x54cff]
movzx eax, byte [rax + rdi - 1]
mov byte [rbx + rsi + 0x6d94f], al
cmp rbx, 0x20
jl 0x140019b80
mov rax, qword [0x14006d950]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov qword [rdi], rax
mov rax, qword [0x14006d958]
mov qword [rdi + 8], rax
mov rax, qword [0x14006d960]
mov qword [rdi + 0x10], rax
mov rax, qword [0x14006d968]
mov qword [rdi + 0x18], rax
add rsp, 0x20
pop rdi
ret
Function at 0x140019c20
Capabilities:
Encrypt data using des

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor r11d, r11d
lea r10, [rcx + 2]
lea r9, [0x140073a91]
lea ebx, [r11 + 8]
lea rdi, [0x140054da0]
nop word [rax + rax]
movzx eax, byte [r9]
movzx ecx, byte [r9 + 1]
movzx edx, byte [r9 - 1]
add al, al
add dl, dl
add r10, 4
add dl, byte [r9 + 4]
add cl, al
add r9, 6
add cl, cl
movsx r8, dl
add cl, byte [r9 - 4]
add r8, r11
add r11, 4
add cl, cl
shl r8, 4
add cl, byte [r9 - 3]
movsx rax, cl
add r8, rax
movzx eax, byte [r8 + rdi]
and al, 1
mov byte [r10 - 6], al
movzx eax, byte [r8 + rdi]
sar al, 1
and al, 1
mov byte [r10 - 5], al
movzx eax, byte [r8 + rdi]
sar al, 2
and al, 1
mov byte [r10 - 4], al
movzx eax, byte [r8 + rdi]
sar al, 3
and al, 1
dec rbx
mov byte [r10 - 3], al
jne 0x140019c50
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x14001e1b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x130
mov rax, qword [0x140065ec0]
xor rax, rsp
mov qword [rsp + 0x120], rax
movsxd rax, dword [rcx + 0x3c]
mov rdi, rcx
mov r11, rdx
mov ecx, dword [rax + rcx + 0x88]
mov eax, dword [rax + rdi + 0x8c]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x30], rcx
add rcx, rdi
mov eax, dword [rcx + 0x24]
mov ebp, dword [rcx + 0x1c]
mov r10d, dword [rcx + 0x20]
mov ebx, dword [rcx + 0x18]
mov esi, dword [rcx + 0x10]
add rax, rdi
add rbp, rdi
add r10, rdi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rcx
test edx, 0xffff0000
je 0x14001e26c
xor r9d, r9d
test ebx, ebx
jle 0x14001e26c
nop word [rax + rax]
mov eax, dword [r10]
mov r8, r11
add rax, rdi
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14001e253
inc rax
test ecx, ecx
jne 0x14001e240
test edx, edx
je 0x14001e34f
inc r9d
add r10, 4
cmp r9d, ebx
jl 0x14001e230
mov rcx, qword [rsp + 0x38]
cmp r11d, esi
jb 0x14001e369
mov eax, dword [rcx + 0x14]
lea ecx, [rax + rsi - 1]
cmp r11d, ecx
ja 0x14001e369
sub r11d, esi
mov ebx, dword [rbp + r11*4]
mov ecx, dword [rsp + 0x30]
add rbx, rdi
lea rax, [rcx + rdi]
cmp rbx, rax
jb 0x14001e364
mov eax, dword [rsp + 0x20]
add rax, rcx
add rax, rdi
cmp rbx, rax
ja 0x14001e364
xor edx, edx
lea rcx, [rsp + 0x41]
mov byte [rsp + 0x40], 0
lea r8d, [rdx + 0x63]
call fcn.14002a2d0
xor edx, edx
lea rcx, [rsp + 0xb1]
lea r8d, [rdx + 0x63]
mov byte [rsp + 0xb0], 0
call fcn.14002a2d0
lea rcx, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0x40]
mov edx, 0x2e
call fcn.14002b9ac
test rax, rax
je 0x14001e364
lea rdx, [rax + 1]
lea rcx, [rsp + 0xb0]
mov byte [rax], 0
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str..dll
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14001e364
lea rdx, [rsp + 0xb0]
mov rcx, rax
call fcn.14001e1b0
jmp 0x14001e36b
mov rcx, qword [rsp + 0x28]
movsxd rax, r9d
movzx ecx, word [rcx + rax*2]
mov ebx, dword [rbp + rcx*4]
jmp 0x14001e28d
mov rax, rbx
jmp 0x14001e36b
xor eax, eax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1400274a0
mov rbx, qword [rsp + 0x160]
add rsp, 0x130
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001f1e0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp dword [0x140073680], 0
jne 0x14001f1fc
call fcn.14001ea70
mov dword [0x140073680], 1
mov rax, qword [0x1400730b0]
test rax, rax
jne 0x14001f221
lea rcx, str.ws2_32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1400730b0], rax
test rax, rax
je 0x14001f261
lea rdx, str.connect
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400730b0]
lea rdx, str.send
mov qword [0x14006eec8], rax
mov qword [0x14006eed0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006eed8], rax
mov qword [0x14006eee0], rax
mov rax, qword [0x1400730b8]
test rax, rax
jne 0x14001f286
lea rcx, str.odbc32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1400730b8], rax
test rax, rax
je 0x14001f2a4
lea rdx, str.SQLDrivers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400732e8], rax
mov qword [0x1400732f0], rax
mov rax, qword [0x1400730c0]
test rax, rax
jne 0x14001f2c9
lea rcx, str.dbnetlib.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1400730c0], rax
test rax, rax
je 0x14001f309
lea rdx, str.ConnectionObjectSize
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400730c0]
lea rdx, str.ConnectionOpen
mov qword [0x14006eee8], rax
mov qword [0x1400732f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006eef0], rax
mov qword [0x140073300], rax
call fcn.14001f360
mov rax, qword [0x1400730d0]
test rax, rax
jne 0x14001f333
lea rcx, [0x140056748]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x1400730d0], rax
test rax, rax
je 0x14001f351
lea rdx, [0x140056e08]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006ef20], rax
mov qword [0x14006ef28], rax
add rsp, 0x28
ret
Function at 0x14001f400
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400730e8]
test rax, rax
jne 0x14001f42d
lea rcx, str.wininet.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1400730e8], rax
test rax, rax
je 0x14001f525
cmp qword [0x14006ef40], 0
jne 0x14001f525
lea rdx, str.InternetReadFileExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400730e8]
lea rdx, str.InternetReadFile
mov qword [0x14006ef40], rax
mov qword [0x14006ef48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400730e8]
lea rdx, str.InternetOpenUrlW
mov qword [0x14006ef50], rax
mov qword [0x14006ef58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400730e8]
lea rdx, str.HttpOpenRequestW
mov qword [0x14006ef60], rax
mov qword [0x14006ef68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400730e8]
lea rdx, str.InternetCloseHandle
mov qword [0x14006ef70], rax
mov qword [0x14006ef78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400730e8]
lea rdx, str.InternetQueryDataAvailable
mov qword [0x14006ef80], rax
mov qword [0x14006ef88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400730e8]
lea rdx, str.InternetOpenW
mov qword [0x14006ef90], rax
mov qword [0x14006ef98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006efa0], rax
mov qword [0x14006efa8], rax
add rsp, 0x28
ret

Function at 0x14001f6a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r10, qword [rcx + rdx*8]
mov r13, r8
lea rbx, [r8*8]
mov rbp, rdx
mov edx, 8
mov r12, r9
mov rdi, rcx
mov dword [rsp + 0x40], 0
mov rsi, qword [r10 + rbx]
shl r13, 6
lea r9, [rsp + 0x40]
lea r8d, [rdx - 4]
lea rcx, [r10 + r13]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r11, qword [rdi + rbp*8]
lea r9, [rsp + 0x40]
mov qword [rbx + r11], r12
mov rcx, qword [rdi + rbp*8]
mov r8d, dword [rsp + 0x40]
add rcx, r13
mov edx, 8
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x14001ff20
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x160
mov rax, qword [0x140065ec0]
mov qword [rsp + 0x150], rax
lea rdx, [0x140065640]
lea rcx, [rsp + 0x20]
mov r8d, 0x12c
call fcn.14001fff0
mov rdx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r12, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, 0xe73d110a
lea rax, [rsp + 0x20]
mov ecx, 0x4b
xor rdx, rbx
xor r12, rbx
xor dword [rax], ebx
add rax, 4
dec rcx
jne 0x14001ff77
lea rcx, [rsp + 0x20]
xor rdx, rbx
call rdx
test rax, rax
mov rsi, rax
je 0x14001ffc4
xor r12, rbx
lea rdi, [rsp + 0x34]
mov ebp, 0xe
lea rbx, [0x1400655c8]
mov rdx, rdi
mov rcx, rsi
call r12
add rdi, 0x14
mov qword [rbx], rax
add rbx, 8
dec rbp
jne 0x14001ffa8
lea eax, [rbp + 1]
mov rcx, qword [rsp + 0x150]
call fcn.1400274a0
add rsp, 0x160
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret