joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e8a0
Capabilities:
Encrypt data using rc4 prga
Identify system language via api

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1400c5518]
xor rax, rsp
mov qword [rsp + 0xc0], rax
cmp word [0x140249224], 0
mov edi, edx
mov rsi, rcx
mov r14d, 0x3ff
je 0x14001e983
lea rax, [rsp + 0x40]
mov dword [rsp + 0x34], 0x40
mov qword [rsp + 0x38], rax
lea r9, [0x14001e860]
mov eax, edx
xor ebx, ebx
shr eax, 4
xor ecx, ecx
inc ax
mov dword [rsp + 0x30], ebx
movzx r8d, ax
lea rax, [rsp + 0x30]
lea edx, [rbx + 6]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14001e983
movzx r9d, word [0x140249224]
lea rdx, [rsp + 0x40]
mov r8d, eax
nop dword [rax + rax]
movzx ecx, word [rdx]
cmp r9w, cx
jne 0x14001e94e
movzx ebx, cx
jmp 0x14001e962
test bx, bx
jne 0x14001e962
movzx eax, cx
xor ax, r9w
test r14w, ax
cmove bx, cx
add rdx, 2
sub r8, 1
jne 0x14001e940
test bx, bx
je 0x14001e983
movzx r8d, bx
mov edx, edi
mov rcx, rsi
call fcn.14001ea30
test al, al
jne 0x14001ea00
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
cmp ax, word [0x140249224]
movzx ebx, ax
mov ebp, 0x400
je 0x14001e9c7
movzx r8d, ax
mov edx, edi
mov rcx, rsi
call fcn.14001ea30
test al, al
jne 0x14001ea00
cmp bx, bp
jb 0x14001e9c7
and bx, r14w
mov edx, edi
movzx r8d, bx
mov rcx, rsi
call fcn.14001ea30
test al, al
jne 0x14001ea00
mov r8d, ebp
mov edx, edi
mov rcx, rsi
call fcn.14001ea30
test al, al
jne 0x14001ea00
mov r8d, 0x800
mov edx, edi
mov rcx, rsi
call fcn.14001ea30
test al, al
jne 0x14001ea00
mov r8d, 0x409
mov edx, edi
mov rcx, rsi
call fcn.14001ea30
test al, al
je 0x14001ea02
mov al, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140067810
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x14001ea30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
movzx r9d, r8w
shr edx, 4
mov rdi, rcx
inc dx
xor ecx, ecx
movzx r8d, dx
and ebx, 0xf
mov edx, 6
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x14001eabd
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14001eabd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x14001eabd
test ebx, ebx
je 0x14001eaa0
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [rax]
lea rax, [rax + rcx*2]
lea rax, [rax + 2]
add ebx, 0xffffffff
jne 0x14001ea90
movzx r8d, word [rax]
lea rdx, [rax + 2]
mov rcx, rdi
call fcn.140021660
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret
Function at 0x140020480
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x268
mov rax, qword [0x1400c5518]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov edi, r9d
mov r14, r8
mov rbp, rdx
mov rbx, rcx
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
mov word [rsp + 0x50], r15w
mov r8, rcx
mov edx, 0x100
lea rcx, [rsp + 0x50]
call fcn.1400209d0
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1400204f4
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140020860
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x140020619
mov edx, edi
mov ecx, 0x20019
call fcn.1400203d0
mov rsi, rax
test rax, rax
je 0x140020619
xor bl, bl
mov dword [rsp + 0x30], r15d
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
cmovne rdx, rcx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140020610
cmp dword [rsp + 0x34], 1
jne 0x140020610
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140020610
mov ecx, eax
shr rcx, 1
inc rcx
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140067ec4
mov rdi, rax
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
cmovne rdx, rcx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400205fd
mov eax, dword [rsp + 0x30]
shr rax, 1
mov word [rdi + rax*2], r15w
mov r8, rdi
mov rdx, qword [r14]
mov rcx, rbp
call fcn.140020a70
test rax, rax
jne 0x1400205fb
cmp word [rdi], ax
je 0x1400205fb
mov rcx, rdi
call fcn.140020b30
inc rax
mov qword [r14], rax
jmp 0x1400205fd
mov bl, 1
mov rcx, rdi
call fcn.1400676f4
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14002061b
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14002062b
call fcn.140020b20
nop
movzx eax, bl
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140067810
add rsp, 0x268
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140020650
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x1400c5518]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov esi, r8d
mov rbx, rdx
mov rdi, rcx
xor r14d, r14d
mov qword [rbp + 0x140], r14
mov qword [rbp + 0x148], r14
mov word [rbp + 0x150], r14w
mov r8, rcx
mov edx, 0x100
lea rcx, [rbp + 0x150]
call fcn.1400209d0
mov qword [rbp + 0x140], rax
test rax, rax
jne 0x1400206d6
lea rdx, [rbp + 0x140]
mov rcx, rdi
call fcn.140020860
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0x140]
test rax, rax
je 0x1400207bd
mov edx, esi
mov ecx, 0x20006
call fcn.1400203d0
mov rdi, rax
test rax, rax
je 0x1400207bd
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r14
mov word [rsp + 0x40], r14w
mov r8, rbx
mov edx, 0x100
lea rcx, [rsp + 0x40]
call fcn.1400209d0
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x140020737
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140020860
mov qword [rsp + 0x38], rax
jmp 0x14002073c
mov rax, qword [rsp + 0x38]
lea rcx, [rsp + 0x40]
test rax, rax
cmovne rcx, rax
lea rdx, [rbp + 0x150]
mov rax, qword [rbp + 0x148]
test rax, rax
cmovne rdx, rax
mov eax, dword [rsp + 0x30]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete bl
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400207ab
call fcn.140020b20
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r14
mov word [rsp + 0x40], r14w
jmp 0x1400207bf
xor bl, bl
mov rcx, qword [rbp + 0x148]
test rcx, rcx
je 0x1400207d1
call fcn.140020b20
nop
movzx eax, bl
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.140067810
add rsp, 0x460
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140021270
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1400c5518]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov edi, edx
mov rbx, rcx
test rcx, rcx
je 0x1400212cf
test edx, edx
je 0x1400212cf
mov byte [rcx], 0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1400212cf
mov edx, edi
lea r8, [rsp + 0x30]
mov rcx, rbx
call fcn.140020a70
mov al, 1
jmp 0x1400212d1
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140067810
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
Function at 0x140021300
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xb0
mov rax, qword [0x1400c5518]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movzx edi, cl
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x1400213cf
lea rdx, str.GetPhysicallyInstalledSystemMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], 0
test rax, rax
je 0x140021372
lea rcx, [rsp + 0x20]
call rax
test eax, eax
je 0x140021372
mov rax, qword [rsp + 0x20]
shl rax, 0xa
jmp 0x14002142d
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov dword [rsp + 0x30], 0x40
mov qword [rsp + 0x64], rcx
xorps xmm0, xmm0
mov dword [rsp + 0x6c], ecx
movups xmmword [rsp + 0x34], xmm0
movups xmmword [rsp + 0x44], xmm0
movups xmmword [rsp + 0x54], xmm0
test rax, rax
je 0x1400213cf
lea rcx, [rsp + 0x30]
call rax
test eax, eax
je 0x1400213cf
test dil, dil
je 0x1400213c8
mov rcx, qword [rsp + 0x38]
call fcn.140021550
jmp 0x14002142d
mov rax, qword [rsp + 0x38]
jmp 0x14002142d
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x38
xor eax, eax
lea rcx, [rsp + 0x70]
movups xmmword [rsp + 0x74], xmm0
mov dword [rsp + 0xa4], eax
movups xmmword [rsp + 0x84], xmm0
movups xmmword [rsp + 0x94], xmm0
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov edx, 0xffffffff
movabs rcx, 0x100000001
cmp qword [rsp + 0x78], rdx
cmovne rcx, qword [rsp + 0x78]
test dil, dil
je 0x14002142a
call fcn.140021550
mov rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140067810
mov rbx, qword [rsp + 0xc0]
add rsp, 0xb0
pop rdi
ret

Function at 0x140021450
Capabilities:
Create process on windows

Disassembly:
push rbx
mov eax, 0x100f0
call fcn.140067870
sub rsp, rax
mov rax, qword [0x1400c5518]
xor rax, rsp
mov qword [rsp + 0x100e0], rax
mov r8, rcx
mov edx, 0x8000
lea rcx, [rsp + 0xe0]
call fcn.1400209d0
xorps xmm0, xmm0
mov dword [rsp + 0x70], WSAGetLastError
xor eax, eax
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor ecx, ecx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0xb8], xmm0
movups xmmword [rsp + 0xc8], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
test eax, eax
je 0x140021524
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 1
sete al
mov rcx, qword [rsp + 0x100e0]
xor rcx, rsp
call fcn.140067810
add rsp, 0x100f0
pop rbx
ret
Function at 0x1400216d0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x970]
sub rsp, 0xa70
mov rax, qword [0x1400c5518]
xor rax, rsp
mov qword [rbp + 0x960], rax
mov qword [0x140249280], rcx
mov qword [rsp + 0x20], 8
mov dword [rsp + 0x24], 0xff
lea rcx, [rsp + 0x20]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov dword [rsp + 0x24], 4
lea rcx, [rsp + 0x20]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov dword [0x140249288], eax
mov dword [rsp + 0x24], 0x8000
lea rcx, [rsp + 0x20]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov dword [0x14024928c], eax
lea rcx, [rbp + 0x40]
call fcn.140013e30
xor r15d, r15d
mov dword [rsp + 0x28], r15d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x28]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r14d, r15d
lea esi, [r15 + 1]
test rax, rax
je 0x14002181f
lea rdi, [rax + 8]
cmp esi, dword [rsp + 0x28]
jge 0x14002181f
mov rbx, qword [rdi]
cmp word [rbx], 0
je 0x14002181f
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r15
mov byte [rsp + 0x40], 0
mov r8, rbx
mov edx, 0x100
lea rcx, [rsp + 0x40]
call fcn.140020a70
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x1400217e4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140020910
mov qword [rsp + 0x38], rax
jmp 0x1400217e9
mov rax, qword [rsp + 0x38]
lea rcx, [rsp + 0x40]
test rax, rax
cmovne rcx, rax
lea r8, [rbp + 0x40]
mov edx, r14d
call fcn.140003d10
mov r14d, eax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140021814
call fcn.140020b20
nop
inc esi
add rdi, 8
jmp 0x140021792
lea rcx, [rbp + 0x40]
call fcn.140002760
mov ebx, eax
lea rcx, [rbp + 0x40]
call fcn.140014030
mov eax, ebx
mov rcx, qword [rbp + 0x960]
xor rcx, rsp
call fcn.140067810
lea r11, [rsp + 0xa70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400236e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, r8
mov rcx, qword [rcx]
mov rsi, rdx
cmp dword [rcx + 8], 3
jne 0x14002372a
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x14002371a
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rcx + 0x10]
mov edx, 1
mov rcx, rsi
call rax
jmp 0x140023776
mov rax, qword [rbx + 0x10]
test rax, rax
jne 0x140023763
mov rcx, qword [rcx + 0x10]
lea rdx, [0x140098dec]
call fcn.1400754f0
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x140023763
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, rax
mov r8, rdi
mov edx, 1
mov rcx, rsi
call fcn.14006e980
mov rdi, rax
test rax, rax
jne 0x140023799
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140023790
call fcn.14006e4d8
mov qword [rbx + 0x10], rdi
mov rax, qword [rbx]
mov rcx, qword [rax]
mov qword [rbx], rcx
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400237f0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x1400c5518]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
cmp dword [0x140249290], 0
jne 0x1400238c3
lea rax, [fcn.14006f290]
mov dword [0x140249290], 1
mov qword [fcn.14006f290], rax
lea rax, [fcn.14006f27c]
mov qword [fcn.14006f27c], rax
lea rax, [fcn.14007454c]
mov qword [str.LE_a_], rax
lea rax, case.0x14002c2b9.0
mov qword [str.h3_b_], rax
lea rax, [case.0x14002c2b9.1]
mov qword [case.0x14002c2b9.1], rax
lea rax, [case.0x14002c2b9.2]
mov qword [str.Ta_a_], rax
call fcn.14002e670
test eax, eax
je 0x1400238d1
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400238d1
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x1400238eb
shr ax, 8
cmp al, 2
jne 0x1400238eb
call fcn.14002c5d0
test eax, eax
jne 0x1400238d1
call fcn.140011b70
test eax, eax
jne 0x1400238d1
mov dword [0x140249294], 3
call fcn.140038b20
lea rcx, [rsp + 0x20]
call fcn.140030000
test eax, eax
je 0x1400238f3
xor eax, eax
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140067810
add rsp, 0x1e8
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x1400238d1
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140067810
add rsp, 0x1e8
ret
Function at 0x140023a60
Capabilities:
Initialize winsock library

Disassembly:
mov dl, 1
jmp 0x140023cb0
push rbx
sub rsp, 0x1d0
mov rax, qword [0x1400c5518]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov eax, dword [0x140249290]
mov ebx, ecx
mov r8d, eax
inc eax
mov dword [0x140249290], eax
test r8d, r8d
jne 0x140023dbf
test dl, dl
je 0x140023d3f
lea rax, [fcn.14006f290]
mov qword [fcn.14006f290], rax
lea rax, [fcn.14006f27c]
mov qword [fcn.14006f27c], rax
lea rax, [fcn.14007454c]
mov qword [str.LE_a_], rax
lea rax, case.0x14002c2b9.0
mov qword [str.h3_b_], rax
lea rax, [case.0x14002c2b9.1]
mov qword [case.0x14002c2b9.1], rax
lea rax, [case.0x14002c2b9.2]
mov qword [str.Ta_a_], rax
test bl, 1
je 0x140023d4d
call fcn.14002e670
test eax, eax
je 0x140023d89
test bl, 2
je 0x140023d80
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140023d89
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x140023d90
shr ax, 8
cmp al, 2
jne 0x140023d90
call fcn.14002c5d0
test eax, eax
jne 0x140023d89
call fcn.140011b70
test eax, eax
je 0x140023d9d
mov eax, 2
jmp 0x140023dc1
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
jmp 0x140023dc1
mov eax, dword [0x1402492f8]
test bl, 4
mov ecx, 1
mov dword [0x140249294], ebx
cmovne eax, ecx
mov dword [0x1402492f8], eax
call fcn.140038b20
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140067810
add rsp, 0x1d0
pop rbx
ret

Function at 0x140023cb0
Capabilities:
Initialize winsock library

Disassembly:
mov dl, 1
jmp 0x140023cb0
push rbx
sub rsp, 0x1d0
mov rax, qword [0x1400c5518]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov eax, dword [0x140249290]
mov ebx, ecx
mov r8d, eax
inc eax
mov dword [0x140249290], eax
test r8d, r8d
jne 0x140023dbf
test dl, dl
je 0x140023d3f
lea rax, [fcn.14006f290]
mov qword [fcn.14006f290], rax
lea rax, [fcn.14006f27c]
mov qword [fcn.14006f27c], rax
lea rax, [fcn.14007454c]
mov qword [str.LE_a_], rax
lea rax, case.0x14002c2b9.0
mov qword [str.h3_b_], rax
lea rax, [case.0x14002c2b9.1]
mov qword [case.0x14002c2b9.1], rax
lea rax, [case.0x14002c2b9.2]
mov qword [str.Ta_a_], rax
test bl, 1
je 0x140023d4d
call fcn.14002e670
test eax, eax
je 0x140023d89
test bl, 2
je 0x140023d80
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140023d89
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x140023d90
shr ax, 8
cmp al, 2
jne 0x140023d90
call fcn.14002c5d0
test eax, eax
jne 0x140023d89
call fcn.140011b70
test eax, eax
je 0x140023d9d
mov eax, 2
jmp 0x140023dc1
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
jmp 0x140023dc1
mov eax, dword [0x1402492f8]
test bl, 4
mov ecx, 1
mov dword [0x140249294], ebx
cmovne eax, ecx
mov dword [0x1402492f8], eax
call fcn.140038b20
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140067810
add rsp, 0x1d0
pop rbx
ret
Function at 0x1400254f0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xe0
mov rax, qword [0x1400c5518]
xor rax, rsp
mov qword [rsp + 0xd0], rax
cmp byte [rcx + 0x5d8], 0
mov r14, r9
mov rax, qword [rsp + 0x130]
mov rbp, r8
mov esi, edx
mov rdi, rcx
je 0x140025622
test rax, rax
je 0x140025622
mov rdx, qword [rax + 0xd8]
test rdx, rdx
je 0x140025622
mov ecx, esi
lea r9, str.Data
sub ecx, 1
je 0x14002557b
sub ecx, 1
je 0x14002556b
sub ecx, 1
je 0x140025582
cmp ecx, 1
je 0x140025572
jmp 0x140025622
lea r9, str.Header
lea rax, [0x14009eac8]
jmp 0x140025589
lea r9, str.Header
lea rax, str.from
mov qword [rsp + 0x28], rdx
lea r8, str.__s__s__s_
mov edx, 0xa0
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x30]
call fcn.140026480
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400255b5
mov r10, qword [rdi + 0x310]
test r10, r10
je 0x1400255ec
mov rax, qword [rdi + 0x260]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call r10
test eax, eax
je 0x140025622
jmp 0x140025632
mov r9, qword [rdi + 0x258]
lea rcx, [0x14009e9f0]
mov edx, 2
lea r8d, [rdx - 1]
call fcn.14007418c
mov r9, qword [rdi + 0x258]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call fcn.14007418c
mov r9, r14
mov r8, rbp
mov edx, esi
mov rcx, rdi
call fcn.140025fa0
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140067810
add rsp, 0xe0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140025920
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x14002595b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x38
mov edx, 0x51
cmp eax, 0x2733
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140025cd0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
mov r15, r8
mov rcx, qword [rcx + 0x240]
mov eax, 0x238
cmp rdx, rcx
mov r8d, 0x240
mov ebx, 0x280
mov r14, r9
cmove eax, r8d
mov rbp, qword [rax + rdi]
mov eax, 0x2a0
cmove ebx, eax
mov rax, qword [rdi + 0x598]
add rbx, rdi
xor r12d, r12d
mov rsi, qword [rbx + 8]
sub rsi, qword [rbx + 0x10]
test byte [rax + 0x7c], 3
je 0x140025de6
cmp rdx, rcx
mov eax, 0x260
mov r8d, 0x268
lea rcx, [0x1400259a0]
cmove eax, r8d
cmp qword [rax + rdi], rcx
jne 0x140025de6
cmp qword [rbx], r12
je 0x140025d6d
test rsi, rsi
je 0x140025de6
mov rdx, 0xffffffffffffffff
xor r9d, r9d
mov r8, rdx
mov rcx, rbp
call fcn.140036eb0
cmp eax, 0xffffffff
je 0x140025de6
test al, 1
je 0x140025de6
mov rax, qword [rbx]
test rax, rax
jne 0x140025dbf
mov rax, qword [rdi]
mov ecx, dword [rax + 0x598]
add ecx, ecx
movsxd rcx, ecx
mov qword [rbx + 8], rcx
call qword [fcn.14006f290]
mov rsi, qword [rbx + 8]
mov qword [rbx], rax
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
test rax, rax
je 0x140025de2
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rax
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x140025de6
add qword [rbx + 0x10], rcx
jmp 0x140025de6
mov qword [rbx + 8], r12
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
movsxd rsi, eax
cmp rsi, 0xffffffffffffffff
jne 0x140025e49
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x140025e1d
mov rcx, qword [rsp + 0x60]
lea eax, [rsi + 0x52]
mov qword [rcx], r12
jmp 0x140025e54
mov edx, ebx
mov rcx, rdi
call fcn.140024720
mov rcx, qword [rdi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.140025650
mov rax, qword [rdi]
mov dword [rax + 0x4b1c], ebx
mov eax, 0x37
jmp 0x140025e4c
mov eax, r12d
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140025fa0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r10, qword [rcx + 0x310]
mov rdi, r9
mov rsi, r8
mov rbx, rcx
test r10, r10
je 0x140025fe3
mov rax, qword [rcx + 0x260]
mov qword [rsp + 0x20], rax
call r10
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp edx, 2
ja 0x140026026
mov r9, qword [rbx + 0x258]
movsxd rcx, edx
lea rdx, [0x14009e9f0]
lea rcx, [rcx + rcx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call fcn.14007418c
mov r9, qword [rbx + 0x258]
mov r8d, 1
mov rdx, rdi
mov rcx, rsi
call fcn.14007418c
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14002d530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [rcx + 4], 2
mov rax, rdx
je 0x14002d53c
xor eax, eax
ret
mov rdx, qword [rcx + 0x20]
mov r9, r8
add rdx, 4
mov r8, rax
mov ecx, 2
jmp fcn.140043f00

Function at 0x14002e9a0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov rcx, rdx
mov rdx, r8
jmp 0x140044090
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov qword [rsp + 0x50], 0
mov rdi, rcx
mov dword [rsp + 0x20], 0xf0000040
xor edx, edx
lea rcx, [rsp + 0x50]
mov r9d, 1
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400440ec
mov rcx, qword [rsp + 0x50]
mov r8, rdi
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x50]
xor edx, edx
test eax, eax
jne 0x1400440fc
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1400418a0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call fcn.1400839b8
cdqe
add rsp, 0x28
ret