joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006a040
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, qword [rcx]
mov r11, rcx
movsxd r10, edx
mov r9, qword [rax + 0x1f8]
mov r8d, dword [r9 + r10*4 + 0xc08]
sub r8d, 1
je 0x14006a0d0
sub r8d, 1
je 0x14006a0a1
cmp r8d, 1
jne 0x14006a0e7
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x14006a0c5
cmp ecx, r8d
jne 0x14006a0e7
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], 2
mov r8d, edx
mov dword [r9 + r10*4 + 0x1008], eax
mov edx, 0xfd
mov rcx, r11
jmp fcn.14006a0f0
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x14006a0c5
cmp ecx, 1
jne 0x14006a0e7
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], eax
mov dword [r9 + r10*4 + 0x1008], eax
ret
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], eax
ret
xor eax, eax
mov r8d, edx
mov edx, VarUI2FromI4
mov dword [r9 + r10*4 + 0xc08], eax
jmp fcn.14006a0f0
ret

Function at 0x14006a0f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx]
mov edi, r8d
mov esi, edx
mov byte [rax + 0x10], VarUI2FromI4
xor r9d, r9d
mov byte [rax + 0x11], sil
mov rbx, rcx
mov byte [rax + 0x12], dil
mov rcx, qword [rcx + 0x238]
lea rdx, [rax + 0x10]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14006a14f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.140048860
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, esi
call fcn.1400698f0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14006a300
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x14006a4ae
push rbp
push rdi
push r14
sub rsp, 0x30
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
mov rdi, qword [rbp + 0x1f8]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x14006a349
mov byte [rsi], 0xff
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x14006a357
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x14006a365
mov byte [rax], Ordinal_33
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x58], ax
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [rbx]
movzx r8d, ax
mov word [rsp + 0x50], ax
cmp rcx, rbx
jae 0x14006a39f
mov byte [rcx], r15b
inc qword [rbx]
mov rdx, qword [rbx]
mov r15, qword [rsp + 0x20]
cmp rdx, rbx
jae 0x14006a3b6
movzx ecx, byte [rsp + 0x59]
mov byte [rdx], cl
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x14006a3c4
mov byte [rax], r8b
inc qword [rbx]
mov rcx, qword [rbx]
cmp rcx, rbx
jae 0x14006a3d6
movzx eax, byte [rsp + 0x51]
mov byte [rcx], al
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x14006a3e4
mov byte [rax], 0xff
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x14006a3f2
mov byte [rax], 0xf0
inc qword [rbx]
mov rax, qword [rbx]
lea r8, [rdi + 0x1cba]
mov r9, rax
mov qword [rdi + 0x1ec0], rax
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.140069a30
mov rcx, qword [r14 + 0x238]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
test eax, eax
jns 0x14006a45a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.140048860
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.14006a180
mov rcx, qword [r14 + 0x238]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14006a4a6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.140048860
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret

Function at 0x14006a4b0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
mov rax, qword [rcx]
mov rbx, rcx
movsxd r11, edx
mov r9, qword [rax + 0x1f8]
cmp r8d, 1
jne 0x14006a50e
mov r8d, dword [r9 + r11*4 + 8]
test r8d, r8d
je 0x14006a4f7
sub r8d, 2
je 0x14006a522
cmp r8d, 1
jne 0x14006a555
cmp dword [r9 + r11*4 + 0x408], 0
jne 0x14006a555
mov dword [r9 + r11*4 + 0x408], 1
pop rbx
ret
mov edx, 0xfb
mov dword [r9 + r11*4 + 8], 2
mov r8d, r11d
pop rbx
jmp fcn.14006a0f0
mov ecx, dword [r9 + r11*4 + 8]
sub ecx, 1
je 0x14006a53b
sub ecx, 1
je 0x14006a4de
cmp ecx, 1
jne 0x14006a555
cmp dword [r9 + r11*4 + 0x408], 1
jne 0x14006a555
mov dword [r9 + r11*4 + 0x408], 0
pop rbx
ret
mov edx, 0xfc
mov dword [r9 + r11*4 + 8], 3
mov rcx, rbx
mov r8d, r11d
pop rbx
jmp fcn.14006a0f0
pop rbx
ret
Function at 0x14006a560
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
mov rax, qword [rcx]
mov rbx, rcx
movsxd r11, edx
mov r9, qword [rax + 0x1f8]
cmp r8d, 1
jne 0x14006a5c8
mov r8d, dword [r9 + r11*4 + 0xc08]
test r8d, r8d
je 0x14006a5ae
sub r8d, 2
je 0x14006a5df
cmp r8d, 1
jne 0x14006a615
cmp dword [r9 + r11*4 + 0x1008], 0
jne 0x14006a615
mov dword [r9 + r11*4 + 0x1008], 1
pop rbx
ret
mov edx, 0xfd
mov dword [r9 + r11*4 + 0xc08], 2
mov r8d, r11d
pop rbx
jmp fcn.14006a0f0
mov ecx, dword [r9 + r11*4 + 0xc08]
sub ecx, 1
je 0x14006a5f8
sub ecx, 1
je 0x14006a595
cmp ecx, 1
jne 0x14006a615
cmp dword [r9 + r11*4 + 0x1008], 1
jne 0x14006a615
mov dword [r9 + r11*4 + 0x1008], 0
pop rbx
ret
mov edx, VarUI2FromI4
mov dword [r9 + r11*4 + 0xc08], 3
mov rcx, rbx
mov r8d, r11d
pop rbx
jmp fcn.14006a0f0
pop rbx
ret
Function at 0x14006b7b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x14017af60]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0x748]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
lea rsi, [rbx + 0x168]
mov rdx, qword [rsi]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x14006b854
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call fcn.1400ac270
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r9d, dword [rbx + 0x154]
cmp r9d, 4
jge 0x14006b8a3
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.140048860
mov dword [rbx + 0xc], 7
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14007c530
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rcx, rsi
call fcn.14006b2f0
movzx r8d, ax
mov dword [rbx + 0xc], r8d
sub r8d, 3
je 0x14006b932
sub r8d, 1
je 0x14006b9a1
sub r8d, 1
je 0x14006b90a
cmp r8d, 1
je 0x14006b8ea
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x14012e9c8]
call fcn.140048860
jmp 0x14006b9a1
mov rdx, qword [rsi]
lea r8d, [r9 - 2]
add rdx, 2
mov rcx, rbx
call fcn.14006b500
test eax, eax
je 0x14006b9a1
jmp 0x14006b879
mov rcx, rsi
call fcn.14006b2d0
movzx r8d, ax
lea rdx, [0x140130c4c]
mov dword [rbx + 8], r8d
mov rcx, rdi
mov r8, qword [rsi]
add r8, 4
call fcn.140048960
jmp 0x14006b9a1
cmp r9d, 4
jle 0x14006b9a1
mov rcx, rsi
call fcn.14006b2d0
movzx ecx, word [rbx + 0x48]
inc ecx
cmp cx, ax
jne 0x14006b9a1
mov r8, qword [rsi]
lea eax, [r9 - 4]
movsxd r9, eax
add r8, 4
mov edx, 1
mov rcx, r14
call fcn.140048730
mov esi, eax
test eax, eax
je 0x14006b980
mov edx, 5
mov rcx, rbx
call fcn.14006c250
mov eax, esi
jmp 0x14006b879
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.140056190
mov rcx, r14
call fcn.1400564c0
test eax, eax
je 0x14006b877
mov edx, 5
mov rcx, rbx
call fcn.14006c250
mov eax, Ordinal_46
jmp 0x14006b879
Function at 0x14006fa80
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x14017af60]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.1400ec6d8
mov byte [rsp + 0x20], 0
test rax, rax
je 0x14006fae6
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x14006fae6
lea rcx, [rsp + 0x20]
call qword [case.0x14003ec86.0]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14007c530
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14007c530
add rsp, 0x148
ret
jmp 0x14006fa80

Function at 0x14006fb00
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x14017af60]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.1400ec6d8
mov byte [rsp + 0x20], 0
test rax, rax
je 0x14006fae6
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x14006fae6
lea rcx, [rsp + 0x20]
call qword [case.0x14003ec86.0]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14007c530
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14007c530
add rsp, 0x148
ret
jmp 0x14006fa80

Function at 0x140078840
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbp, r8
mov rsi, rdx
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rdx + rbx], 0
jne 0x140078860
test rbx, rbx
je 0x14007887a
lea rcx, [rbx + rbx]
call qword [fcn.1400e193c]
jmp 0x140078887
lea rcx, [0x14012d6a0]
call qword [case.0x14003ec86.0]
mov rdi, rax
test rax, rax
jne 0x140078897
lea eax, [rdi + 0x1b]
jmp 0x140078953
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140078970
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140078940
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8002
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140078933
mov rcx, qword [rsp + 0x30]
lea r8d, [rbx + rbx]
xor r9d, r9d
mov dword [rsp + 0x68], reloc.WS2_32.dll_recv
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x68]
mov r8, rbp
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, rdi
mov dword [rbp + 0x10], eax
mov byte [rbp + 0x14], al
call qword [fcn.1400e1934]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400789a0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14017af60]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, r8
mov dword [rsp + 0x40], 8
mov rbx, rdx
mov dword [rsp + 0x20], 0xf0000000
mov rdi, rcx
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140078a71
xor eax, eax
lea rdx, [rsp + 0x64]
mov qword [rsp + 0x58], rax
mov rcx, rsi
mov qword [rsp + 0x60], rax
mov word [rsp + 0x58], 0x208
mov dword [rsp + 0x5c], 0x6601
mov dword [rsp + 0x60], 8
mov dword [rsp + 0x68], eax
call fcn.140078af0
lea rcx, [rsp + 0x64]
mov edx, 8
call fcn.14007b250
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x20], 0
lea r8d, [r9 + 0x14]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x140078a75
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
jmp 0x140078abf
mov rax, qword [rdi]
xor r9d, r9d
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov qword [rbx], rax
xor edx, edx
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14007c530
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14007b320
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [fcn.1400e193c]
mov rdi, rax
test rax, rax
jne 0x14007b362
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x14007b3a5
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov ebp, dword [rbx + 0x20]
mov rcx, qword [rdi + 8]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x14007b402
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x14007b3c0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x14007b443
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14013cafa]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14013cafb]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x14007b410
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400ea4e8
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1400ea220
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400ea220
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400ea220
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400ea220
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400ea220
cmp dword [rcx + 0x84], 0xe
jbe 0x1400ea220
cmp dword [rcx + 0xf8], esi
je 0x1400ea220
mov ecx, r14d
call fcn.1400ea3f0
mov ecx, 2
call fcn.1400f8990
nop
cmp byte [0x14017e2d0], 0
jne 0x1400ea2ea
mov r15d, 1
mov eax, r15d
xchg dword [0x14017e2c4], eax
test ebx, ebx
jne 0x1400ea293
mov rdi, qword [0x14017af60]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14017e2c8]
cmp rcx, rax
je 0x1400ea28a
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [0x14012cb80]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14017e620]
jmp 0x1400ea29f
cmp ebx, r15d
jne 0x1400ea2a5
lea rcx, [0x14017e638]
call fcn.1400f35d8
nop
test ebx, ebx
jne 0x1400ea2bc
lea rdx, [0x14012ce90]
lea rcx, [0x14012ce70]
call fcn.1400f3c20
lea rdx, [0x14012cea0]
lea rcx, [0x14012ce98]
call fcn.1400f3c20
movzx eax, byte [0x14017e2d0]
test esi, esi
cmove eax, r15d
mov byte [0x14017e2d0], al
jmp 0x1400ea2ea
mov ecx, 2
call fcn.1400f89e4
test esi, esi
jne 0x1400ea301
mov ecx, r14d
call fcn.1400ea31c
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400ea1b0
Function at 0x140104648
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140104270
call fcn.1400e49e8
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
call fcn.1400e460c
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140104258
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140104258
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1401042a2
lock or dword [rax + 0x14], 0x10
jmp 0x140104258
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1401042bf
mov rcx, qword [rbp + 0x10]
call fcn.140104cb0
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140100e98
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1400f63d8
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140104316
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140104258
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140104382
mov rcx, qword [rbp + 0x10]
call fcn.140100e98
cmp eax, 0xffffffff
je 0x140104369
mov rcx, qword [rbp + 0x10]
call fcn.140100e98
cmp eax, 0xfffffffe
je 0x140104369
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140100e98
movsxd rdi, eax
lea rsi, [0x14017ef20]
mov rcx, rbx
sar rdi, 6
call fcn.140100e98
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x140104370
lea rax, [0x14017b4a0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140104382
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1401043b8
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1401043b4
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1401043b4
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x14010425b
jmp 0x140104228
Function at 0x140104650
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140104422
call fcn.1400e49e8
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
call fcn.1400e460c
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140104404
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140104404
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x140104454
lock or dword [rax + 0x14], 0x10
jmp 0x140104404
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140104471
mov rcx, qword [rbp + 0x20]
call fcn.140104cb0
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x140104486
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x14010448c
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.140100e98
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1400f63d8
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x1401044df
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x140104404
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14010454b
mov rcx, qword [rbp + 0x20]
call fcn.140100e98
cmp eax, 0xffffffff
je 0x140104532
mov rcx, qword [rbp + 0x20]
call fcn.140100e98
cmp eax, 0xfffffffe
je 0x140104532
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.140100e98
movsxd rdi, eax
lea r15, [0x14017ef20]
mov rcx, rbx
sar rdi, 6
call fcn.140100e98
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x140104539
lea rax, [0x14017b4a0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14010454b
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x140104581
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x14010457d
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x14010457d
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x14010459f
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x1401045aa
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x140104409
jmp 0x1401043d0
Function at 0x14010b984
Capabilities:
Create thread
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r8d
mov r14, rdx
mov rbx, rcx
call fcn.140103b3c
mov bpl, al
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor edi, edi
test eax, eax
je 0x14010b9d7
test rbx, rbx
je 0x14010b9c8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bpl, bpl
je 0x14010b9d7
mov edi, 4
jmp 0x14010ba80
call fcn.1401038e4
test al, al
jne 0x14010b9f4
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb edi, edi
neg edi
add edi, 3
jmp 0x14010ba80
test bpl, bpl
je 0x14010ba57
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
lea r8, [0x14010b828]
mov dword [rsp + 0x20], edi
xor edx, edx
mov qword [rsp + 0x30], r14
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14010ba80
xor r8d, r8d
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rcx, rbx
test eax, eax
je 0x14010ba51
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14010ba80
mov edi, dword [rsp + 0x44]
jmp 0x14010ba49
call fcn.140103a68
test al, al
jne 0x14010ba68
bts esi, 0x15
xor ecx, ecx
jmp 0x14010ba70
call fcn.1401039a0
mov rcx, rax
mov r9d, esi
mov r8, r14
mov rdx, rbx
call fcn.14010371c
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret