joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c830e
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rbp, r9
mov rbx, r8
mov r14, rdx
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0xd0]
lea r15, [rsp + 0x4a]
lea r12, [rsp + 0x5a]
mov r13, qword [rdx + 0x10]
mov edi, 0x7fffffff
cmp rax, rdi
cmovb rdi, rax
mov rsi, qword [rdx + 0x18]
mov rax, qword [rdx + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x60], rsi
lea rcx, [rsp + 0x40]
mov rdx, r13
mov r8, rbx
call fcn.1400c80dd
mov al, byte [rsp + 0x49]
cmp al, 3
je 0x1400c8485
mov rcx, qword [rsp + 0x40]
cmp al, 2
je 0x1400c8493
mov dl, byte [rsp + 0x48]
movzx r8d, word [r15 + 4]
mov word [r12 + 4], r8w
mov r8d, dword [r15]
mov dword [r12], r8d
mov qword [rsp + 0x50], rcx
mov byte [rsp + 0x58], dl
mov byte [rsp + 0x59], al
cmp rsi, 0xffffffffffffffff
je 0x1400c84d7
mov rcx, rsi
mov rdx, rbp
mov r8d, edi
xor r9d, r9d
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
jne 0x1400c84a5
call fcn.1400b791e
mov rsi, rax
mov rcx, rax
call fcn.140041ad6
cmp al, 0xd
jne 0x1400c845a
cmp qword [rsp + 0x38], 0
je 0x1400c845a
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
lock inc qword [rdx]
jle 0x1400c84d7
mov rdi, r13
mov r13, r14
mov r14, r15
mov r15, rbx
mov rbx, rbp
add rcx, 0x10
mov r8, qword [rax + 0x10]
mov r9b, byte [rax + 0x18]
call fcn.14005f8b5
mov rbp, rax
xor ecx, ecx
call fcn.14005eb7b
test rbp, rbp
je 0x1400c8446
mov ecx, 1
mov rdx, rsi
call fcn.14005f9be
mov rsi, rbp
mov rbp, rbx
mov rbx, r15
mov r15, r14
mov r14, r13
mov r13, rdi
mov rdi, qword [rsp + 0x30]
mov rcx, rsi
call fcn.1400c4189
cmp al, 0xd
jne 0x1400c84b6
mov rcx, r14
lea rdx, [rsp + 0x50]
call fcn.1400c7ea9
mov rcx, rsi
call fcn.1400626a5
mov rsi, qword [rsp + 0x60]
jmp 0x1400c8365
mov rax, qword [rsp + 0x28]
mov qword [rax], 2
jmp 0x1400c84c6
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
mov qword [rax + 8], rcx
jmp 0x1400c84c6
cdqe
mov rcx, qword [rsp + 0x28]
and qword [rcx], 0
mov qword [rcx + 8], rax
jmp 0x1400c84c6
mov rax, qword [rsp + 0x28]
mov qword [rax], 1
mov qword [rax + 8], rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2

Function at 0x1400dbe90
Capabilities:
Get system information on windows

Disassembly:
push rbp
mov rbp, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x50
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov qword [0x1401081c0], rax
cmp rax, 0xf
jbe 0x1400dbecd
lea rcx, [0x1401ab260]
mov edx, 0x10
call fcn.1400db6a0
xor eax, eax
leave
ret
call fcn.1400db9f0
nop word cs:[rax + rax]
nop dword [rax]
sub rsp, 0x28
call qword [sym.imp.kernel32.dll_VirtualLock]
cmp eax, 1
sbb eax, eax
add rsp, 0x28
ret
Function at 0x1400e1880
Capabilities:
Encode data using xor

Disassembly:
test rcx, rcx
je 0x1400e1a28
push rbp
mov rbp, rsp
push r14
push r13
push r12
push rdi
mov rdi, rdx
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x820
test rdx, rdx
jne 0x1400e18b8
lea rsp, [rbp - 0x30]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret
mov r14, qword [rdx]
lea rsi, [rsp + 0x20]
mov r12, rcx
mov r8d, 0x400
mov eax, dword [rdx + 0x20]
mov rcx, rsi
mov rdx, qword [r14 + 8]
mov r13, rax
shl rax, 0xa
lea rdx, [rdx + rax - 0x400]
call sub.msvcrt.dll_memcpy
mov r9d, dword [rdi + 0x24]
cmp r9d, 1
jbe 0x1400e1a29
lea r8d, [r13 + r13 - 1]
mov ecx, 1
lea rbx, [rsp + 0x420]
mov r10, qword [r14 + 8]
mov eax, r8d
add ecx, 1
shl rax, 0xa
lea rdx, [r10 + rax]
lea rax, [r10 + rax + 8]
cmp rsi, rax
mov rax, rsi
je 0x1400e1a10
nop word [rax + rax]
movdqu xmm0, xmmword [rdx]
add rax, 0x10
pxor xmm0, xmmword [rax - 0x10]
add rdx, 0x10
movups xmmword [rax - 0x10], xmm0
cmp rax, rbx
jne 0x1400e1930
add r8d, r13d
cmp ecx, r9d
jne 0x1400e1907
mov r8d, 0x400
mov rdx, rsi
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov edx, dword [r12 + 8]
mov r9d, 0x400
mov r8, rbx
mov rcx, qword [r12]
call fcn.1400e41a0
mov edx, 0x400
mov rcx, rsi
call fcn.1400dbc20
mov edx, 0x400
mov rcx, rbx
call fcn.1400dbc20
test byte [r12 + 0x5c], 4
je 0x1400e19c9
mov rax, qword [rdi]
test rax, rax
je 0x1400e19b4
mov edx, dword [rdi + 0x18]
mov rcx, qword [rax + 8]
shl rdx, 0xa
call fcn.1400dbc20
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400e19cd
mov edx, dword [rdi + 0x1c]
shl rdx, 3
call fcn.1400dbc20
mov rcx, qword [rdi + 8]
call sub.msvcrt.dll_free
mov rbx, qword [rdi]
mov qword [rdi + 8], 0
test rbx, rbx
je 0x1400e19ef
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400e19ef
call sub.msvcrt.dll_free
mov rcx, rbx
call sub.msvcrt.dll_free
mov qword [rdi], 0
lea rsp, [rbp - 0x30]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret
mov r10, qword [rdx]
add rdx, 8
xor qword [rax], r10
add rax, 8
cmp rbx, rax
jne 0x1400e1a10
jmp 0x1400e194a
ret
lea rbx, [rsp + 0x420]
jmp 0x1400e1952
Function at 0x1400ee230
Capabilities:
Hash data using sha512

Disassembly:
push rbp
lea eax, [rdx - 1]
mov rbp, rsp
push rdi
and rsp, 0xfffffffffffffff0
sub rsp, 0x60
cmp al, 0x3f
ja 0x1400ee2bb
movdqu xmm0, xmmword [0x140190e20]
mov byte [rsp + 0x20], dl
mov eax, 0x101
mov r8, rcx
lea rdx, [rcx + 0x40]
mov word [rsp + 0x22], ax
xor eax, eax
movups xmmword [rcx + 0x10], xmm0
movdqu xmm0, xmmword [0x140190e30]
mov rdi, rdx
mov byte [rsp + 0x21], 0
movups xmmword [rcx + 0x20], xmm0
movdqu xmm0, xmmword [0x140190e40]
mov dword [rsp + 0x24], 0
movups xmmword [rcx + 0x30], xmm0
mov ecx, 0x25
movdqu xmm0, xmmword [0x140190e10]
rep stosq qword [rdi], rax
mov qword [rsp + 0x28], 0
pxor xmm0, xmmword [rsp + 0x20]
mov byte [rdi], 0
movups xmmword [r8], xmm0
mov rdi, qword [rbp - 8]
leave
ret
call fcn.1400db9f0

Function at 0x1400ee2c0
Capabilities:
Hash data using sha512

Disassembly:
push rbp
lea eax, [rdx - 1]
mov rbp, rsp
push rdi
and rsp, 0xfffffffffffffff0
sub rsp, 0x60
cmp al, 0x3f
ja 0x1400ee38b
mov r10, rcx
mov byte [rsp + 0x20], dl
mov qword [rsp + 0x21], 0x10100
mov qword [rsp + 0x29], 0
test r8, r8
je 0x1400ee370
movdqu xmm1, xmmword [r8]
movups xmmword [rsp + 0x40], xmm1
test r9, r9
je 0x1400ee380
movdqu xmm2, xmmword [r9]
movups xmmword [rsp + 0x50], xmm2
movdqu xmm0, xmmword [0x140190e20]
lea rdx, [r10 + 0x40]
xor eax, eax
mov ecx, 0x25
mov rdi, rdx
movups xmmword [r10 + 0x10], xmm0
movdqu xmm0, xmmword [0x140190e10]
pxor xmm0, xmmword [rsp + 0x20]
rep stosq qword [rdi], rax
mov byte [rdi], 0
movups xmmword [r10], xmm0
movdqu xmm0, xmmword [0x140190e30]
pxor xmm0, xmmword [rsp + 0x40]
movups xmmword [r10 + 0x20], xmm0
movdqu xmm0, xmmword [0x140190e40]
pxor xmm0, xmmword [rsp + 0x50]
movups xmmword [r10 + 0x30], xmm0
mov rdi, qword [rbp - 8]
leave
ret
pxor xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
test r9, r9
jne 0x1400ee305
nop
pxor xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
jmp 0x1400ee30f
call fcn.1400db9f0
Function at 0x1400ee4e0
Capabilities:
Hash data using sha512

Disassembly:
push rbp
movzx eax, dl
mov r10, rcx
sub edx, 1
mov rbp, rsp
push r12
mov ecx, r9d
push rdi
mov ah, cl
push rsi
and rsp, 0xfffffffffffffff0
sub rsp, 0xe0
cmp dl, 0x3f
ja 0x1400ee631
lea edx, [r9 - 1]
cmp dl, 0x3f
ja 0x1400ee631
mov rsi, r8
test r8, r8
je 0x1400ee631
movdqu xmm0, xmmword [0x140190e20]
mov word [rsp + 0x20], ax
lea rdx, [r10 + 0x40]
mov eax, 0x101
mov word [rsp + 0x22], ax
mov ecx, 0x25
xor eax, eax
mov rdi, rdx
movups xmmword [r10 + 0x10], xmm0
movdqu xmm0, xmmword [0x140190e30]
movzx r9d, r9b
lea r12, [rsp + 0x60]
mov dword [rsp + 0x24], 0
movups xmmword [r10 + 0x20], xmm0
movdqu xmm0, xmmword [0x140190e40]
mov qword [rsp + 0x28], 0
movups xmmword [r10 + 0x30], xmm0
movdqu xmm0, xmmword [0x140190e10]
pxor xmm0, xmmword [rsp + 0x20]
rep stosq qword [rdi], rax
mov ecx, 0x10
mov byte [rdi], 0
mov rdi, r12
rep stosq qword [rdi], rax
movups xmmword [r10], xmm0
mov rdi, r12
cmp r9d, 8
jb 0x1400ee5b7
mov rcx, r9
shr rcx, 3
rep movsq qword [rdi], qword [rsi]
xor eax, eax
test r9b, 4
jne 0x1400ee620
test r9b, 2
jne 0x1400ee608
and r9d, 1
jne 0x1400ee5f8
mov rdx, r12
mov rcx, r10
mov r8d, pe_nt_image_headers64
call fcn.1400ee390
mov rcx, r12
mov edx, pe_nt_image_headers64
call fcn.1400dbc20
lea rsp, [rbp - 0x18]
xor eax, eax
pop rsi
pop rdi
pop r12
pop rbp
ret
movzx edx, byte [rsi + rax]
mov byte [rdi + rax], dl
jmp 0x1400ee5cb
movzx edx, word [rsi + rax]
mov word [rdi + rax], dx
add rax, 2
and r9d, 1
je 0x1400ee5cb
jmp 0x1400ee5f8
mov eax, dword [rsi]
mov dword [rdi], eax
mov eax, 4
test r9b, 2
je 0x1400ee5c5
jmp 0x1400ee608
call fcn.1400db9f0
nop word cs:[rax + rax]
Function at 0x140106b60
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140107900
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140107900
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140106bd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1401ab2e4]
mov rbx, rcx
test esi, esi
jle 0x140106d00
mov rax, qword [0x1401ab2e8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140106c1b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140106ca5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140106c00
mov rcx, rbx
call fcn.140107620
mov rdi, rax
test rax, rax
je 0x140106d22
mov rax, qword [0x1401ab2e8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140107760
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1401ab2e8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140106d07
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140106c9e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140106cb0
add dword [0x1401ab2e4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1401ab2e8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
jne 0x140106c9e
call qword [sym.imp.kernel32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140106b60
nop dword [rax]
xor esi, esi
jmp 0x140106c28
mov rax, qword [0x1401ab2e8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140106b60
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140106b60
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140107290
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1401ab340]
mov rcx, r12
call qword [sym.imp.kernel32.dll_EnterCriticalSection]
mov rbx, qword [0x1401ab320]
test rbx, rbx
je 0x1401072ec
mov rbp, qword [sym.imp.kernel32.dll_TlsGetValue]
mov rdi, qword [sym.imp.kernel32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1401072e3
test rsi, rsi
je 0x1401072e3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1401072c8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.kernel32.dll_LeaveCriticalSection]
Function at 0x140107620
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140199410]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140107640
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140107648
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140107640
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14010769d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140107694
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140107640
add rax, 0x28
cmp rax, r9
jne 0x140107680
xor eax, eax
ret

Function at 0x1401076a0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140199410]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1401076bf
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1401076c8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1401076bf
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140107760
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140199410]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14010777f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140107788
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x14000118c
Capabilities:
Find process by pid

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx], 0x85b3e12
mov rdi, rcx
jne 0x140001251
movsxd rax, dword [rcx + 4]
test eax, eax
je 0x140001251
and qword [r11 + 8], 0
lea rdx, [r11 + 8]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140001251
call fcn.140001268
mov rcx, qword [rsp + 0x40]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdx, qword [rdi + 8]
mov rcx, rbx
mov rsi, qword [rdi + 0x18]
call fcn.1400014b4
test rax, rax
je 0x140001251
mov ecx, eax
mov edx, 0x1000
and ecx, 0xfff
sub edx, ecx
mov rcx, qword [rdi + 0x10]
cmp edx, esi
cmovl esi, edx
and qword [rsp + 0x48], 0
cmp byte [rdi + 0x20], 0
movsxd r8, esi
je 0x140001234
mov rdx, rcx
lea r9, [rsp + 0x48]
mov rcx, rax
call fcn.140001694
jmp 0x14000124d
lea rdx, [rsp + 0x48]
mov r9d, 1
mov qword [rsp + 0x20], rdx
mov rdx, rax
call qword [sym.imp.ntoskrnl.exe_MmCopyMemory]
xor eax, eax
jmp 0x140001256
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140daf000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x140daf00a
jmp 0x140db100f
jmp fcn.140a140b0
Function at 0x14002ae80
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [str.___t_]
lea r14, str.___t_
cmp rcx, r14
je 0x14002aec7
test byte [rcx + 0x1c], 4
je 0x14002aec7
cmp byte [rcx + 0x19], 5
jb 0x14002aec7
mov rcx, qword [rcx + 0x10]
lea r8, [0x140082b80]
mov edx, 0x14
call fcn.140001010
lea rcx, [0x14009a0f0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rbx + 8]
mov rcx, qword [rbx]
mov qword [rax], rcx
mov qword [rcx + 8], rax
and qword [rbx], 0
and qword [rbx + 8], 0
mov eax, dword [rbx + 0x18]
test eax, eax
jne 0x14002af0c
cmp dword [rbx + 0x2c], eax
jne case.default.0x14002b08d
lea rcx, [0x14009a008]
call fcn.14003388c
jmp case.default.0x14002b08d
cmp eax, 2
jne 0x14002af7b
mov rcx, qword [rbx + 0x38]
cmp rcx, 0xffffffffffffffff
je case.default.0x14002b08d
call qword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
jne case.default.0x14002b08d
mov rax, qword [str.___t_]
cmp rax, r14
je case.default.0x14002b08d
test byte [rax + 0x1c], 4
je case.default.0x14002b08d
cmp byte [rax + 0x19], 2
jb case.default.0x14002b08d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.___t_]
lea r8, [0x140082b80]
mov r9d, eax
mov edx, 0x15
mov rcx, qword [rcx + 0x10]
call fcn.140001030
jmp case.default.0x14002b08d
cmp eax, 3
jne case.default.0x14002b08d
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14002afcf
mov rax, qword [str.___t_]
cmp rax, r14
je 0x14002afcf
test byte [rax + 0x1c], 4
je 0x14002afcf
cmp byte [rax + 0x19], 2
jb 0x14002afcf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.___t_]
lea r8, [0x140082b80]
mov r9d, eax
mov edx, 0x16
mov rcx, qword [rcx + 0x10]
call fcn.140001030
cmp dword [rbx + 0x660], 0
je 0x14002b02a
cmp dword [rbx + 0x65c], 0
je 0x14002b033
lea rcx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14002b02a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.___t_]
cmp rcx, r14
je 0x14002b02a
test byte [rcx + 0x1c], 4
je 0x14002b02a
cmp byte [rcx + 0x19], 2
jb 0x14002b02a
mov rcx, qword [rcx + 0x10]
lea r9, [rbx + 0x40]
mov edx, 0x17
mov dword [rsp + 0x20], eax
lea r8, [0x140082b80]
call fcn.140001250
cmp dword [rbx + 0x65c], 0
jne case.default.0x14002b08d
cmp qword [rbx + 0x668], 0
je case.default.0x14002b08d
lea rcx, [0x14009a180]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbx + 0x668]
mov edx, 1
mov r9d, edx
mov r8d, edx
call fcn.14003b73c
lea rcx, [0x14009a180]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rbx
call fcn.14006264c
lea rcx, [0x14009a0f0]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop r14
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
invalid
lahf
test byte [rcx], 0xf
clc
int3
leave
not dword [rbp + 0x31]
sti
fist word [rbp + 0x5db0dffb]
cli
mov ebp, esp
movsd dword [rdi], dword [rsi]
invalid
ret
Function at 0x10007510
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x10015150], rbx
je 0x10007566
cmp rax, rbx
jne 0x10007559
mov edi, 1
jmp 0x10007566
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10007540
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x1000757b
lea ecx, [rax + 0x1e]
call sub.MSVCR80.dll__amsg_exit
jmp 0x100075ba
mov eax, dword [0x10015148]
test eax, eax
jne 0x100075b0
mov dword [0x10015148], 1
lea rdx, [0x100014d0]
lea rcx, [0x100014b8]
call sub.MSVCR80.dll__initterm_e
test eax, eax
je 0x100075ba
mov eax, 0xff
jmp 0x10007714
mov dword [0x10014314], 1
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x100075e2
lea rdx, [0x100014b0]
lea rcx, [0x10001470]
call sub.MSVCR80.dll__initterm
mov dword [0x10015148], 2
test edi, edi
jne 0x100075ef
xor eax, eax
xchg qword [0x10015150], rax
cmp qword [0x10015168], 0
je 0x10007618
lea rcx, [0x10015168]
call fcn.10007b90
test eax, eax
je 0x10007618
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x10015168]
mov rax, qword [sym.imp.MSVCR80.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
nop
nop
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x100076aa
test cl, cl
je 0x10007640
test edi, edi
jne 0x100076aa
movzx eax, byte [rbx]
test al, al
je 0x10007656
cmp al, 0x20
ja 0x10007656
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007640
test byte [rsp + 0x6c], 1
je 0x10007665
movzx r9d, word [rsp + 0x70]
jmp 0x1000766b
mov r9d, 0xa
mov r8, rbx
xor edx, edx
lea rcx, [0x10000000]
call fcn.10005300
mov dword [0x10014310], eax
cmp dword [0x100142f4], 0
jne 0x10007693
mov ecx, eax
call qword [sym.imp.MSVCR80.dll_exit]
cmp dword [0x10014314], 0
jne 0x100076a8
call qword [sym.imp.MSVCR80.dll__cexit]
mov eax, dword [0x10014310]
jmp 0x1000770d
cmp cl, 0x22
jne 0x100076bc
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
movzx ecx, cl
call qword [sym.imp.MSVCR80.dll__ismbblead]
test eax, eax
je 0x100076d2
add rbx, 1
mov qword [rsp + 0x28], rbx
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007630
jmp 0x10007714
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.10175000
add rsp, 0x28
jmp 0x10007510
Function at 0x1400017f0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1f0
mov rax, qword [0x140135558]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov ecx, dword [0x14013d5a0]
mov rax, qword gs:[0x58]
mov edx, Ordinal_26
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x14013bd98], eax
jg 0x14000185a
lea rax, [0x14013bd00]
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1400b9890
mov rbx, qword [rsp + 0x200]
add rsp, 0x1f0
pop rdi
ret
lea rcx, [0x14013bd98]
call fcn.1400b9f40
cmp dword [0x14013bd98], 0xffffffff
jne 0x140001832
lea rbx, [0x14013bd08]
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400b9b24
xor edi, edi
mov qword [rax + 8], rdi
mov qword [0x14013bd08], rax
mov qword [rax], rbx
mov qword [0x14013bd30], rdi
mov edx, 0x102
lea rcx, [0x14013bd38]
call fcn.1400b6720
mov dword [0x14013bd88], edi
mov ecx, 0x201
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
call fcn.140048f90
call fcn.140046500
mov qword [0x14013bd00], rax
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [0x14013bd88], eax
lea r8d, [rdi + 0x10]
lea rbx, [0x14013bd00]
mov qword [rsp + 0x20], rbx
lea r9, [0x140002270]
lea rdx, [rdi - 1]
mov rcx, qword [0x14013bd00]
call fcn.140047c40
mov qword [0x14013bd90], rax
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x34], 0x2710
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1400451c0
lea rcx, [0x1400f4290]
call fcn.1400b9da0
nop
lea rcx, [0x14013bd98]
call fcn.1400b9ee0
mov rax, rbx
jmp 0x140001839

Function at 0x140005290
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rsi
sub rsp, 0x60
mov rbx, rcx
xor r9d, r9d
lea r8, [rsp + 0x78]
xor edx, edx
lea rsi, [0x14013bde0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
test eax, eax
je 0x14000536f
cmp dword [rsp + 0x78], 0
je 0x14000534a
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], 4
mov ecx, 1
call fcn.1400b9b24
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400145f0]
xor edx, edx
xor ecx, ecx
call fcn.1400c2ed8
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000535c
cmp dword [rsp + 0x38], 0
je 0x140005375
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.1400b633c
test eax, eax
jne 0x140005380
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitOnceComplete]
test eax, eax
je 0x140005388
mov qword [0x14013bde8], rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rsi
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call fcn.1400b6cbc
nop
call fcn.1400c11dc
nop
mov ecx, 1
call fcn.1400b6cbc
int3
mov ecx, eax
call fcn.1400b6c80
nop
call fcn.1400b7a20
int3