joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140081e04
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set current directory
Set file attributes

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
lea rbp, [rax - 0x1a8]
sub rsp, 0x288
mov rcx, rdx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov sil, bl
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140081eb0
lea rdx, [0x1400ac2f0]
lea rcx, [rsp + 0x5c]
call fcn.140027cf4
test eax, eax
je 0x140081e9e
lea rdx, [0x1400d17b0]
lea rcx, [rsp + 0x5c]
call fcn.140027cf4
test eax, eax
je 0x140081e9e
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x5c]
mov edx, eax
mov eax, dword [rbp + 0x1c8]
or edx, dword [rbp + 0x1c0]
not eax
and edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x140081ec9
mov sil, 1
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140081e45
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp + 0x1d0], bl
jne 0x140081ed9
mov al, sil
jmp 0x140081f96
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x140081f96
lea rdx, [rsp + 0x30]
lea rcx, [0x1400d17a8]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140081f89
mov rsi, qword [rbp + 0x1b8]
test byte [rsp + 0x30], 0x10
je 0x140081f73
lea rdx, [0x1400ac2f0]
lea rcx, [rsp + 0x5c]
call fcn.140027cf4
test eax, eax
je 0x140081f73
lea rdx, [0x1400d17b0]
lea rcx, [rsp + 0x5c]
call fcn.140027cf4
test eax, eax
je 0x140081f73
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov al, byte [rbp + 0x1d0]
mov r9d, dword [rbp + 0x1c8]
mov r8d, dword [rbp + 0x1c0]
mov rcx, qword [rbp + 0x1b0]
mov rdx, rsi
mov byte [rsp + 0x20], al
call fcn.140081e04
test al, al
je 0x140081f8b
lea rcx, [0x1400d17b0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140081eff
mov bl, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
add rsp, 0x288
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140081fa4
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x288
mov rcx, rdx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov ebp, r9d
mov sil, bl
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140082039
lea rdx, [0x1400ac2f0]
lea rcx, [rsp + 0x5c]
call fcn.140027cf4
test eax, eax
je 0x140082027
lea rdx, [0x1400d17b0]
lea rcx, [rsp + 0x5c]
call fcn.140027cf4
test eax, eax
je 0x140082027
mov rdx, qword [rsp + 0x2c0]
lea rcx, [rsp + 0x5c]
mov r8d, ebp
call fcn.140074d04
test al, al
je 0x140082057
mov sil, 1
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140081fe1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov bpl, byte [rsp + 0x2d0]
test bpl, bpl
jne 0x140082067
mov al, sil
jmp 0x140082122
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x140082122
lea rdx, [rsp + 0x30]
lea rcx, [0x1400d17a8]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140082115
mov esi, dword [rsp + 0x2c8]
test byte [rsp + 0x30], 0x10
je 0x1400820ff
lea rdx, [0x1400ac2f0]
lea rcx, [rsp + 0x5c]
call fcn.140027cf4
test eax, eax
je 0x1400820ff
lea rdx, [0x1400d17b0]
lea rcx, [rsp + 0x5c]
call fcn.140027cf4
test eax, eax
je 0x1400820ff
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov r8, qword [rsp + 0x2c0]
mov rdx, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x2b0]
mov r9d, esi
mov byte [rsp + 0x20], bpl
call fcn.140081fa4
test al, al
je 0x140082117
lea rcx, [0x1400d17b0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14008208d
mov bl, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
add rsp, 0x288
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140085144
Capabilities:
Connect to http server

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov sil, r9b
mov rdi, rdx
mov rbx, rcx
test r8b, r8b
je 0x140085173
mov r8b, r9b
call fcn.14008527c
jmp 0x140085267
mov ebp, dword [rcx + 0x90]
mov rcx, qword [rdx + 0x60]
mov eax, dword [rdx + 0xe0]
and qword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
mov r9, qword [rdx + 0x40]
movzx r8d, word [rdx + 0xe8]
mov rdx, qword [rdx + 0x20]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.WININET.dll_InternetConnectW]
mov qword [rbx], rax
test rax, rax
jne 0x1400851d2
lea edx, [rax + 0x15]
xor r9d, r9d
mov r8d, 0xdeadbeef
mov rcx, rbx
call fcn.1400863ec
jmp 0x140085267
mov rdx, qword [rdi + 0xc0]
and qword [rsp + 0x20], 0
mov r9d, ebp
mov r8d, 0x80000000
mov rcx, rax
call qword [sym.imp.WININET.dll_FtpOpenFileW]
mov rdi, rax
test rax, rax
jne 0x140085207
xor r9d, r9d
lea edx, [rax + 0x16]
mov r8d, 0xdeadbeef
jmp 0x14008524d
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.WININET.dll_FtpGetFileSize]
mov ecx, dword [rsp + 0x60]
shl rcx, 0x20
mov eax, eax
or rcx, rax
mov qword [rbx + 0x18], rcx
test sil, sil
je 0x140085245
cmp byte [rbx + 0x48], 0
mov rdx, rdi
mov rcx, rbx
je 0x14008523e
call fcn.1400862a4
jmp 0x140085255
call fcn.1400861bc
jmp 0x140085255
xor r8d, r8d
mov r9b, 1
xor edx, edx
mov rcx, rbx
call fcn.1400863ec
mov bl, al
test rdi, rdi
je 0x140085265
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140085554
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
cmp dword [rdx + 0xe4], 4
mov r14d, dword [rcx + 0x90]
mov r12b, r9b
mov r15b, r8b
mov rsi, rdx
mov rbx, rcx
jne 0x14008558c
bts r14d, 0x17
mov eax, dword [rdx + 0xe0]
mov r10, qword [rdx + 0x60]
mov r9, qword [rdx + 0x40]
movzx r8d, word [rdx + 0xe8]
mov rcx, qword [rcx + 8]
mov rdx, qword [rdx + 0x20]
xor r13d, r13d
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r10
call qword [sym.imp.WININET.dll_InternetConnectW]
mov qword [rbx], rax
test rax, rax
jne 0x1400855e7
lea edx, [rax + 0xb]
xor r9d, r9d
mov r8d, 0xdeadbeef
mov rcx, rbx
call fcn.1400863ec
jmp 0x140085728
mov r8, qword [rsi + 0xc0]
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], r14d
xor r9d, r9d
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.WININET.dll_HttpOpenRequestW]
mov rdi, rax
test rax, rax
jne 0x140085620
lea edx, [rax + 0xc]
jmp 0x140085705
test r15b, r15b
je 0x140085633
mov r8, rsi
mov rdx, rax
mov rcx, rbx
call fcn.140086434
bt r14d, 0xc
jae 0x140085672
mov r14d, 4
lea r9, [rbp + 0x48]
lea r8, [rbp + 0x40]
lea esi, [r14 + 0x1b]
mov rcx, rdi
mov dword [rbp + 0x48], r14d
mov edx, esi
call qword [sym.imp.WININET.dll_InternetQueryOptionW]
bts dword [rbp + 0x40], 8
lea r8, [rbp + 0x40]
mov r9d, r14d
mov edx, esi
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetSetOptionW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], r13d
call qword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x140085700
mov rdx, rdi
call fcn.140085504
cmp eax, 0xc8
jne 0x140085700
lea rax, [rbp + 0x40]
lea r9, [rbp + 0x48]
lea r8, [rbp - 0x20]
mov edx, 5
mov rcx, rdi
mov dword [rbp + 0x40], r13d
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x48], reloc.OLEAUT32.dll_RegisterActiveObject
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
lea rcx, [rbp - 0x20]
mov word [rbp - 2], r13w
call fcn.140027d3c
mov rcx, rbx
mov qword [rbx + 0x18], rax
test r12b, r12b
je 0x1400856f6
mov rdx, rdi
cmp byte [rbx + 0x48], r13b
je 0x1400856ef
call fcn.1400862a4
jmp 0x140085716
call fcn.1400861bc
jmp 0x140085716
xor r8d, r8d
mov r9b, 1
xor edx, edx
jmp 0x140085711
mov edx, reloc.WSOCK32.dll_listen
xor r9d, r9d
mov r8d, 0xdeadbeef
mov rcx, rbx
call fcn.1400863ec
mov bl, al
test rdi, rdi
je 0x140085726
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, bl
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400862a4
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov r15, rdx
mov rbx, rcx
lea rdx, [rbp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
mov dword [rbp + 0x40], 1
mov qword [rbp + 0x48], 1
call qword [sym.imp.WININET.dll_InternetQueryDataAvailable]
mov rax, qword [rbp + 0x48]
mov ecx, 0x400
test rax, rax
cmove rax, rcx
cmp dword [rbp + 0x40], 0
mov qword [rbp + 0x48], rax
je 0x1400863a5
test rax, rax
jne 0x140086306
xor edi, edi
jmp 0x140086315
mov rcx, rax
call fcn.14002698c
mov rdi, rax
mov rax, qword [rbp + 0x48]
lea r9, [rbp + 0x40]
mov r8d, eax
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400863b3
mov ecx, dword [rbp + 0x40]
test ecx, ecx
je 0x14008639d
mov esi, ecx
test rdi, rdi
je 0x14008638a
test ecx, ecx
je 0x14008638a
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
lea rdx, [rbp - 0x10]
lea rcx, [rbx + 0x70]
call fcn.1400867d0
xor ecx, ecx
call fcn.140026a34
mov rax, qword [rbx + 0x78]
mov rcx, qword [rbx + 0x80]
mov rcx, qword [rax + rcx*8 - 8]
mov qword [rcx], rdi
mov rcx, qword [rbx + 0x80]
mov rax, qword [rbx + 0x78]
mov rcx, qword [rax + rcx*8 - 8]
mov qword [rcx + 8], rsi
mov ecx, dword [rbp + 0x40]
mov eax, ecx
add qword [rbx + 0x10], rax
test ecx, ecx
je 0x1400863a5
mov rax, qword [rbp + 0x48]
jmp 0x1400862fd
mov rcx, rdi
call fcn.140026a34
cmp qword [rbx + 0x10], 0
jne 0x1400863cb
mov edx, SafeArrayDestroyDescriptor
jmp 0x1400863c0
mov rcx, rdi
call fcn.140026a34
mov edx, reloc.OLEAUT32.dll_RegisterActiveObject
xor r9d, r9d
mov r8d, 0xdeadbeef
jmp 0x1400863d3
xor r8d, r8d
mov r9b, 1
xor edx, edx
mov rcx, rbx
call fcn.1400863ec
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008656c
Capabilities:
Parse url

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rbx, rdx
xor edx, edx
mov rsi, r8
lea r8d, [rdx + 0x60]
lea rcx, [rbp - 0x31]
call fcn.1400272c0
mov r14d, 1
mov rcx, rbx
mov dword [rbp - 9], r14d
mov dword [rbp - 0x19], r14d
mov dword [rbp - 0x29], r14d
mov dword [rbp + 0x27], r14d
mov dword [rbp + 0x17], r14d
mov dword [rbp + 7], r14d
mov dword [rbp - 0x39], 0xf0
call fcn.140027098
lea r9, [rbp - 0x39]
xor r8d, r8d
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x1400866d0
mov r9d, dword [rbp - 0x29]
mov rdx, qword [rbp - 0x31]
xor r8d, r8d
mov rcx, rsi
call fcn.14001e8a8
mov r9d, dword [rbp - 0x19]
mov rdx, qword [rbp - 0x21]
lea rcx, [rsi + 0x20]
xor r8d, r8d
call fcn.14001e8a8
mov r9d, dword [rbp - 9]
mov rdx, qword [rbp - 0x11]
lea rcx, [rsi + 0x40]
xor r8d, r8d
call fcn.14001e8a8
mov r9d, dword [rbp + 7]
mov rdx, qword [rbp - 1]
lea rcx, [rsi + 0x60]
xor r8d, r8d
call fcn.14001e8a8
mov r9d, dword [rbp + 0x17]
mov rdx, qword [rbp + 0xf]
lea rdi, [rsi + 0x80]
xor r8d, r8d
mov rcx, rdi
call fcn.14001e8a8
mov r9d, dword [rbp + 0x27]
mov rdx, qword [rbp + 0x1f]
lea rbx, [rsi + 0xa0]
xor r8d, r8d
mov rcx, rbx
call fcn.14001e8a8
lea rdx, [rbp + 0x37]
mov r8, rbx
mov rcx, rdi
call fcn.140065e50
lea rcx, [rsi + 0xc0]
mov rdx, rax
call fcn.14001f504
lea rcx, [rbp + 0x37]
call fcn.14001c5f8
mov ecx, dword [rbp - 0x25]
movzx eax, word [rbp - 0x15]
mov dword [rsi + 0xe4], ecx
mov word [rsi + 0xe8], ax
dec ecx
je 0x1400866c6
dec ecx
je 0x1400866ba
mov dword [rsi + 0xe0], 3
jmp 0x1400866cd
mov dword [rsi + 0xe0], 2
jmp 0x1400866cd
mov dword [rsi + 0xe0], r14d
mov al, r14b
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x14008c694
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
mov esi, dword [rsp + 0x30]
mov ebp, r9d
mov eax, r9d
shl eax, 2
mov edi, r8d
or r10d, 0xffffffff
imul ebp, dword [rsp + 0x30]
movsxd rbx, eax
shl ebp, 2
add rdi, rdx
add rbx, rdx
mov r11, rdx
mov r9, rdx
shl esi, 2
lea r14, [0x1400cde90]
movzx eax, byte [r11 + 2]
movzx ecx, r10b
shr r10d, 8
xor rcx, rax
movzx eax, byte [r11 + 1]
mov edx, dword [r14 + rcx*4]
xor edx, r10d
movzx ecx, dl
shr edx, 8
xor rcx, rax
movzx eax, byte [r11]
add r11, rbp
mov r8d, dword [r14 + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
xor rcx, rax
mov r10d, dword [r14 + rcx*4]
xor r10d, r8d
cmp r11, rdi
jb 0x14008c730
mov eax, esi
add r9, rax
mov r11, r9
cmp r9, rbx
jb 0x14008c6de
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
xorps xmm0, xmm0
mov rdi, qword [rsp + 0x28]
not r10d
mov eax, r10d
cvtsi2sd xmm0, rax
pop r14
ret
Function at 0x14008c75c
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov eax, dword [r8 + 8]
mov rbx, r8
mov r8d, dword [r8]
mov r10d, dword [rbx + 0xc]
mov r11d, dword [rbx + 4]
cmp eax, r8d
setl dil
cmp r10d, r11d
setl r14b
test dil, dil
je 0x14008c7a8
mov dword [rbx], eax
mov dword [rbx + 8], r8d
test r14b, r14b
je 0x14008c7b5
mov dword [rbx + 4], r10d
mov dword [rbx + 0xc], r11d
mov r9, rdx
mov edx, dword [rcx + 0x1d0]
lea r8, [rbp + 0x67]
call fcn.140087d04
mov rax, qword [rbp + 0x67]
mov ecx, dword [rbp + 0x6b]
add dword [rbx + 8], eax
add dword [rbx + 0xc], ecx
add dword [rbx], eax
add dword [rbx + 4], ecx
mov r15d, dword [rbx + 8]
mov esi, dword [rbx + 0xc]
sub r15d, dword [rbx]
sub esi, dword [rbx + 4]
mov eax, 1
xor ecx, ecx
add r15d, eax
add esi, eax
call qword [sym.imp.USER32.dll_GetDC]
mov r8d, esi
mov edx, r15d
mov rcx, rax
mov r13, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rcx, r13
mov qword [rbp + 0x77], rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rdx, qword [rbp + 0x77]
mov rcx, rax
mov r12, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov ecx, esi
mov qword [rbp - 0x19], rax
test r14b, r14b
je 0x14008c834
neg ecx
mov eax, r15d
test dil, dil
je 0x14008c83e
neg eax
test r14b, r14b
je 0x14008c849
mov r8d, dword [rbx + 0xc]
jmp 0x14008c84d
mov r8d, dword [rbx + 4]
test dil, dil
je 0x14008c857
mov edx, dword [rbx + 8]
jmp 0x14008c859
mov edx, dword [rbx]
mov dword [rsp + 0x50], 0xcc0020
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], edx
mov r9d, r15d
xor edx, edx
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], esi
call qword [sym.imp.GDI32.dll_StretchBlt]
mov r14, qword [rbp + 0x77]
mov eax, esi
mov dword [rbp - 0xd], r15d
neg eax
xor r15d, r15d
xor r9d, r9d
mov dword [rbp - 9], eax
lea rax, [rbp - 0x11]
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r14
mov rcx, r12
mov dword [rbp - 0x11], SafeArrayCreateEx
mov qword [rbp - 5], 0x200001
mov qword [rsp + 0x20], r15
call qword [sym.imp.GDI32.dll_GetDIBits]
mov eax, dword [rbp + 3]
mov rcx, qword [rbp + 0x7f]
mov dword [rcx], eax
mov ecx, eax
call fcn.14002698c
mov dword [rsp + 0x30], r15d
mov r9d, esi
mov rdi, rax
lea rax, [rbp - 0x11]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, r14
mov rcx, r12
mov qword [rsp + 0x20], rdi
call qword [sym.imp.GDI32.dll_GetDIBits]
mov rdx, qword [rbp - 0x19]
mov rcx, r12
mov ebx, eax
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
test ebx, ebx
je 0x14008c93f
mov rax, rdi
jmp 0x14008c949
mov rcx, rdi
call fcn.140026a34
xor eax, eax
mov rbx, qword [rsp + 0xe8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008d614
Capabilities:
Get socket status

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x30
and dword [r8], 0
mov qword [r8 + 8], rdx
inc dword [r8]
mov r14, rdx
mov eax, 0x10624dd3
mov rbx, rcx
xor ecx, ecx
mov rdi, r8
imul r9d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [rsp + 0x50], edx
imul eax, edx, 0x3e8
sub r9d, eax
imul eax, r9d, 0x3e8
xor r9d, r9d
mov dword [rsp + 0x54], eax
lea rax, [r11 + 0x18]
mov qword [r11 - 0x18], rax
cmp byte [rsp + 0x60], cl
je 0x14008d67e
xor edx, edx
jmp 0x14008d684
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.WSOCK32.dll_select]
mov esi, eax
test eax, eax
jne 0x14008d6b2
cmp byte [rsp + 0x60], al
je 0x14008d70a
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rbx, rcx
lea rcx, [rbx + 8]
call fcn.1400051b0
mov dword [rax + 0x1c], 0x274c
jmp 0x14008d6fd
jle 0x14008d6df
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.WSOCK32.dll___WSAFDIsSet]
test eax, eax
jne 0x14008d70a
lea esi, [rax - 2]
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rbx, rcx
lea rcx, [rbx + 8]
call fcn.1400051b0
mov dword [rax + 0x1c], esi
jmp 0x14008d6fd
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov rcx, qword [rbx]
movsxd rdx, dword [rcx + 4]
mov edi, eax
add rbx, rdx
lea rcx, [rbx + 8]
call fcn.1400051b0
mov dword [rax + 0x1c], edi
lea rcx, [rbx + 8]
call fcn.1400051b0
mov byte [rax + 0x20], 0
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
mov eax, esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop r14
ret
Function at 0x14009875c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x160]
sub rsp, 0x260
lea rax, [rsp + 0x58]
mov ebx, edx
lea r9, [rbp + 0x190]
mov qword [rsp + 0x38], rax
xor eax, eax
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rax
mov rsi, rcx
mov dword [rbp + 0x190], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x1400988ba
mov edi, ebx
or edi, 0x20019
lea rax, [rbp + 0x198]
lea rdx, [rsp + 0x60]
mov r9d, edi
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400988d4
mov rcx, qword [rbp + 0x198]
mov edx, ebx
call fcn.14009875c
mov rcx, qword [rbp + 0x198]
mov bl, al
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x1400988d4
and qword [rsp + 0x40], 0
and qword [rsp + 0x50], 0
lea rcx, [rsp + 0x40]
call fcn.140098548
test al, al
je 0x140098851
lea rcx, [rsp + 0x40]
call fcn.140097120
mov ebx, dword [rbp + 0x188]
lea rdx, [rsp + 0x60]
mov r8d, ebx
xor r9d, r9d
mov rcx, rsi
call rax
jmp 0x140098865
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, dword [rbp + 0x188]
lea rcx, [rsp + 0x40]
test eax, eax
jne 0x1400988cf
call fcn.140097108
lea rax, [rsp + 0x58]
lea r9, [rbp + 0x190]
mov qword [rsp + 0x38], rax
xor eax, eax
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x190], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x1400987c8
mov al, 1
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret
call fcn.140097108
xor al, al
jmp 0x1400988bc
Function at 0x1400a5edc
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x50
mov rbx, rdx
xor edx, edx
lea rbp, [0x1400e81b0]
lea r8d, [rdx + 0x68]
mov rcx, rbp
call fcn.1400272c0
xor edx, edx
lea rdi, [0x1400e8218]
lea r8d, [rdx + 0x18]
mov rcx, rdi
call fcn.1400272c0
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rbp
xor edi, edi
mov eax, 1
xor r9d, r9d
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
mov dword [rsp + 0x28], reloc.OLEAUT32.dll_RegisterActiveObject
mov dword [0x1400e81b0], 0x68
mov dword [0x1400e81ec], eax
mov word [0x1400e81f0], ax
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400a5f78
mov rcx, qword [0x1400e8218]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1400a6430
Capabilities:
Get file size
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
mov qword [r11 + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor r12d, r12d
mov r14, r9
mov rax, r8
mov rsi, rdx
cmp word [r8], r12w
je 0x1400a65b7
mov qword [r11 - 0x68], r12
mov dword [r11 - 0x70], r12d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400a6498
xor eax, eax
jmp 0x1400a65f2
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, 2
mov edx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r15, rax
test rax, rax
jne 0x1400a64c5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400a6491
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea r9, [rbp + 0x30]
mov r8d, ebx
mov rcx, rdi
mov rdx, rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1400a6491
lea r8, [rbp - 0x28]
mov edx, 1
mov rcx, r15
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov rcx, qword [rbp - 0x28]
lea rax, [rbp - 0x30]
lea r9, [0x1400af950]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x30], r12
call qword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400a6491
mov rax, qword [rcx]
lea rdx, [rbp + 0x40]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, qword [rbp + 0x40]
lea r8, [rbp - 0x20]
mov edx, reloc.OLEAUT32.dll_RegisterActiveObject
call qword [sym.imp.GDI32.dll_GetObjectW]
mov rcx, qword [rbp + 0x50]
cmp dword [r14], r12d
jne 0x1400a6589
cmp dword [rcx], r12d
jne 0x1400a6589
mov eax, dword [rbp - 0x1c]
mov dword [r14], eax
mov eax, dword [rbp - 0x18]
mov dword [rcx], eax
mov r9d, dword [rcx]
mov r8d, dword [r14]
mov rcx, qword [rbp + 0x40]
xor edx, edx
mov dword [rsp + 0x20], 0x2000
call qword [sym.imp.USER32.dll_CopyImage]
mov rcx, qword [rbp - 0x30]
mov qword [rbp + 0x40], rax
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov r9, qword [rbp + 0x40]
jmp 0x1400a65be
mov r9, r12
mov qword [rbp + 0x40], r12
mov rcx, qword [rsi + 0xc0]
test rcx, rcx
je 0x1400a65d4
call qword [sym.imp.GDI32.dll_DeleteObject]
mov r9, qword [rbp + 0x40]
mov rbx, qword [rsi]
xor r8d, r8d
mov edx, 0x172
mov rcx, rbx
mov qword [rsi + 0xc0], r9
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret