joyce8/EMBER2024-capa huggingface dataset:
Function at 0x503a40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x503b8e
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x006f3650]
call fcn.004d2980
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x00503ba0]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00404ea0
xorps xmm15, xmm15
mov r14, qword [0x0077cf80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x503b52
mov rdx, qword [rsp + 0x28]
nop dword [rax + rax]
cmp rdx, rcx
jb 0x503b88
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x503b7d
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
and rcx, rdi
mov rdi, qword [rsp + 0x38]
lea rax, [rdi + rcx]
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call fcn.00473080
call fcn.00473000
nop
call fcn.00470ce0
jmp fcn.00503a40
Function at 0x512700
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5127ba
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00404ea0
xorps xmm15, xmm15
mov r14, qword [0x0077cf80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x51278d
xor eax, eax
lea rbx, [0x005a8cff]
mov ecx, 1
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
lea r8, [0x005a8d16]
mov r9d, 2
mov r10, qword [rsp + 0x68]
mov r11, qword [rsp + 0x70]
call fcn.0045a180
add rsp, 0x48
pop rbp
ret
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x005dbb28]
mov esi, 1
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x70]
call fcn.0045a0c0
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00470ce0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00512700

Function at 0x5214a0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x5214b8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x5214b8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x5214c0
xor eax, eax
ret
cmp rbx, 3
je 0x5214cc
cmp rbx, 4
jne 0x5214f9
cmp al, 0x2c
ja 0x5214e6
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x5214f6
cmp al, 0x24
je 0x5214f6
nop dword [rax]
cmp al, 0x26
jae 0x5214f6
jmp 0x5214f9
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x5214f6
cmp al, 0x5b
je 0x5214f6
cmp al, 0x5d
jne 0x5214f9
xor eax, eax
ret
cmp al, 0x2f
ja 0x521532
nop dword [rax]
cmp al, 0x26
ja 0x521511
cmp al, 0x24
je 0x521551
cmp al, 0x26
je 0x521551
jmp 0x5215cb
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x521551
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x5215c8
cmp al, 0x2f
je 0x521551
jmp 0x5215cb
cmp al, 0x3d
ja 0x521549
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x521551
nop
cmp al, 0x3d
je 0x521551
jmp 0x5215cb
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x5215c0
cmp rbx, 2
jg 0x521587
cmp rbx, 1
je 0x521581
nop dword [rax]
cmp rbx, 2
jne 0x5215cb
cmp al, 0x2f
je 0x521572
cmp al, 0x3b
je 0x521572
cmp al, 0x2c
jne 0x521579
mov ecx, 1
jmp 0x52157e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x5215aa
cmp al, 0x40
je 0x521599
cmp al, 0x2f
je 0x521599
cmp al, 0x3f
jne 0x5215a2
mov ecx, 1
nop
jmp 0x5215a7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x5215b9
cmp rbx, 7
jne 0x5215cb
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x5215c8
cmp al, 0x7e
jne 0x5215cb
xor eax, eax
ret
cmp rbx, 7
jne 0x5215e1
cmp al, 0x21
je 0x5215dd
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x5215e1
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x14000197e
Capabilities:
Parse pe header

Disassembly:
jmp 0x14017d23c
xor r8d, r8d
xor edx, edx
jmp 0x14017cf2c

Function at 0x140001b81
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
jmp 0x1400709d0
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
mov eax, 4
imul rax, rax, 0
movsx ecx, byte [rsp + 0x10]
mov rdx, qword [rsp + 8]
mov eax, dword [rdx + rax]
xor eax, ecx
and eax, 0xff
cdqe
lea rcx, [0x1401da760]
mov edx, 4
imul rdx, rdx, 0
mov r8, qword [rsp + 8]
mov edx, dword [r8 + rdx]
shr edx, 8
mov eax, dword [rcx + rax*4]
xor eax, edx
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 8]
mov dword [rdx + rcx], eax
mov eax, 4
imul rax, rax, 1
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 8]
mov ecx, dword [rdx + rcx]
and ecx, 0xff
mov rdx, qword [rsp + 8]
add ecx, dword [rdx + rax]
mov eax, ecx
mov ecx, 4
imul rcx, rcx, 1
mov rdx, qword [rsp + 8]
mov dword [rdx + rcx], eax
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
imul eax, dword [rcx + rax], 0x8088405
inc eax
mov ecx, 4
imul rcx, rcx, 1
mov rdx, qword [rsp + 8]
mov dword [rdx + rcx], eax
mov eax, 4
imul rax, rax, 2
mov ecx, 4
imul rcx, rcx, 1
mov rdx, qword [rsp + 8]
mov ecx, dword [rdx + rcx]
shr ecx, 0x18
mov rdx, qword [rsp + 8]
mov eax, dword [rdx + rax]
xor eax, ecx
and eax, 0xff
mov eax, eax
lea rcx, [0x1401da760]
mov edx, 4
imul rdx, rdx, 2
mov r8, qword [rsp + 8]
mov edx, dword [r8 + rdx]
shr edx, 8
mov eax, dword [rcx + rax*4]
xor eax, edx
mov ecx, 4
imul rcx, rcx, 2
mov rdx, qword [rsp + 8]
mov dword [rdx + rcx], eax
ret
Function at 0x140001feb
Capabilities:
Create directory

Disassembly:
jmp 0x14008a290
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [0x14023c868]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xc0]
add rax, 0x80
mov rcx, rax
call fcn.140001b63
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x14008a2fc
mov rax, qword [rsp + 0xc0]
add rax, 0x80
mov rcx, rax
call fcn.140001b63
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x14008a43b
mov rax, qword [rsp + 0xc0]
add rax, 0x80
lea r8, [0x1401dd2ec]
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.140007478
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea r8, [0x1401dd2e0]
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x68]
call fcn.1400085c1
nop
lea rcx, [rsp + 0x88]
call fcn.14000274d
lea rcx, [rsp + 0x68]
call fcn.140001b63
mov rdx, rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_char_const____ptr64____ptr64]
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QFile::constructor_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov edx, 1
mov rcx, qword [rsp + 0x58]
call fcn.140007a90
mov edx, dword [rax]
lea rcx, [rsp + 0x30]
call qword [sym.imp.Qt5Core.dll_public_virtual:_bool___cdecl_QFile::open_class_QFlags_enum_QIODevice::OpenModeFlag_____ptr64]
mov r8d, 0x110
mov rdx, qword [rsp + 0xc8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_long_long___int64____cdecl_QIODevice::read_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc0]
add rcx, 0x20
mov rdx, rax
call fcn.1400014c9
lea rcx, [rsp + 0x30]
call qword [sym.imp.Qt5Core.dll_public_virtual:_void___cdecl_QFileDevice::close_void____ptr64]
cmp qword [rsp + 0x60], 0x110
jne 0x14008a406
mov byte [rsp + 0x20], 1
jmp 0x14008a40b
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x21], al
lea rcx, [rsp + 0x30]
call qword [sym.imp.Qt5Core.dll_public_virtual:_void___cdecl_QFile::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x68]
call fcn.14000274d
movzx eax, byte [rsp + 0x21]
jmp 0x14008a43d
xor al, al
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140004de0
add rsp, 0xb8
ret
Function at 0x1400025d6
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1400a53e0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x1400a5408
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x1400a5452
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x1400a53fd
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret
Function at 0x140003634
Capabilities:
Create directory

Disassembly:
jmp 0x14008b570
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x14023c868]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0xb0]
add rax, 0x60
mov rcx, rax
call fcn.140001b63
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x14008b5d3
mov rax, qword [rsp + 0xb0]
add rax, 0x60
mov rcx, rax
call fcn.140001b63
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rax, qword [rsp + 0xb0]
add rax, 0x60
lea r8, [0x1401dd390]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140007478
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea r8, [0x1401dd388]
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.1400085c1
nop
lea rcx, [rsp + 0x70]
call fcn.14000274d
lea rcx, [rsp + 0x50]
call fcn.140001b63
mov rdx, rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_char_const____ptr64____ptr64]
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QFile::constructor_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov r8d, reloc.WS2_32.dll_recv
mov edx, 2
lea rcx, [rsp + 0x38]
call fcn.1400089cc
mov edx, dword [rax]
lea rcx, [rsp + 0x28]
call qword [sym.imp.Qt5Core.dll_public_virtual:_bool___cdecl_QFile::open_class_QFlags_enum_QIODevice::OpenModeFlag_____ptr64]
movzx eax, al
test eax, eax
jne 0x14008b6a7
lea rcx, [rsp + 0x28]
call qword [sym.imp.Qt5Core.dll_public_virtual:_void___cdecl_QFile::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x50]
call fcn.14000274d
nop
mov rcx, qword [rsp + 0xb8]
call fcn.14000274d
jmp 0x14008b6f2
mov rcx, qword [rsp + 0xb8]
call fcn.140001b63
mov rdx, rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_long_long___int64____cdecl_QIODevice::write_char_const____ptr64____ptr64]
lea rcx, [rsp + 0x28]
call qword [sym.imp.Qt5Core.dll_public_virtual:_void___cdecl_QFileDevice::close_void____ptr64]
nop
lea rcx, [rsp + 0x28]
call qword [sym.imp.Qt5Core.dll_public_virtual:_void___cdecl_QFile::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x50]
call fcn.14000274d
nop
mov rcx, qword [rsp + 0xb8]
call fcn.14000274d
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140004de0
add rsp, 0xa8
ret

Function at 0x140003cc9
Capabilities:
Get geographical location

Disassembly:
jmp 0x1400f95d8
sub rsp, 0x28
and dword [rsp + 0x30], 0
call fcn.140005af6
mov r9d, 2
lea r8, [rsp + 0x30]
mov rcx, qword [rax + 0x28]
lea edx, [r9 + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
sub ecx, 0x30
je 0x1400f9625
sub ecx, 1
je 0x1400f961e
cmp ecx, 1
je 0x1400f9617
xor eax, eax
jmp 0x1400f962a
mov eax, 3
jmp 0x1400f962a
mov eax, 1
jmp 0x1400f962a
mov eax, 2
add rsp, 0x28
ret
Function at 0x140003fc6
Capabilities:
Get common file path

Disassembly:
jmp 0x140073720
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
jne 0x14007374e
mov rax, qword [rsp + 0x50]
cmp dword [rax + 8], 0xffffffff
je 0x140073758
mov eax, 0x1000000
jmp 0x140073868
mov rax, qword [rsp + 0x50]
add rax, 0x250
mov rdx, rax
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rax, qword [rsp + 0x50]
add rax, 0x250
mov rcx, rax
call fcn.140001839
mov rcx, qword [rsp + 0x50]
movzx eax, word [rcx + rax*2 + 0x24e]
mov word [rsp + 0x24], ax
movzx eax, word [rsp + 0x24]
cmp eax, 0x5c
je 0x1400737c4
movzx eax, word [rsp + 0x24]
cmp eax, 0x2f
je 0x1400737c4
mov rax, qword [rsp + 0x50]
add rax, 0x250
lea rdx, [0x1401d89b0]
mov rcx, rax
call fcn.140003d0a
cmp dword [rsp + 0x68], 1
jne 0x140073817
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0xffffffff
je 0x1400737f6
mov dword [rsp + 0x28], 1
jmp 0x1400737fe
mov dword [rsp + 0x28], 0
movzx eax, byte [rsp + 0x28]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140073817
mov eax, 0x2000000
jmp 0x140073868
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x68]
mov edx, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call fcn.14000408e
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140073842
mov eax, dword [rsp + 0x30]
jmp 0x140073868
mov rcx, qword [rsp + 0x38]
call fcn.140005114
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
jne 0x140073866
mov eax, 0x200
jmp 0x140073868
xor eax, eax
add rsp, 0x48
ret

Function at 0x14000402a
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140085c90
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x288
mov rax, qword [0x14023c868]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x30], 0x238
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x140085cdd
mov byte [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x140085cf5
mov byte [rsp + 0x20], 0
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x298], eax
jne 0x140085d07
mov byte [rsp + 0x20], 1
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140085cf5
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140004de0
add rsp, 0x288
ret
Function at 0x140004066
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1401b08c0
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x14023c868]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, qword [rsp + 0xa0]
lea r10, [0x140242d98]
xor r11d, r11d
lea rdi, [0x1401d72be]
test r9, r9
mov rax, rdx
mov r12, rdx
cmovne r10, r9
test rdx, rdx
lea ebp, [r11 + 1]
cmovne rdi, rdx
mov r15d, ebp
cmovne r15, r8
neg rax
sbb r14, r14
and r14, rcx
test r15, r15
jne 0x1401b0930
mov rax, 0xfffffffffffffffe
jmp 0x1401b0a7d
cmp word [r10 + 6], r11w
jne 0x1401b099f
movzx r9d, byte [rdi]
inc rdi
test r9b, r9b
js 0x1401b095a
test r14, r14
je 0x1401b094b
mov dword [r14], r9d
test r9b, r9b
setne r11b
mov rax, r11
jmp 0x1401b0a7d
mov al, r9b
and al, 0xe0
cmp al, 0xc0
jne 0x1401b0968
mov r8b, 2
jmp 0x1401b0986
mov al, r9b
and al, 0xf0
cmp al, 0xe0
jne 0x1401b0976
mov r8b, 3
jmp 0x1401b0986
mov al, r9b
and al, 0xf8
cmp al, 0xf0
jne 0x1401b0a72
mov r8b, 4
movzx eax, r8b
mov ecx, 7
sub ecx, eax
mov edx, ebp
shl edx, cl
mov bl, r8b
sub edx, ebp
and edx, r9d
jmp 0x1401b09c8
mov r8b, byte [r10 + 4]
mov edx, dword [r10]
mov bl, byte [r10 + 6]
lea eax, [r8 - 2]
cmp al, 2
ja 0x1401b0a72
cmp bl, bpl
jb 0x1401b0a72
cmp bl, r8b
jae 0x1401b0a72
movzx ebp, bl
cmp rbp, r15
mov r9d, ebp
cmovae r9, r15
jmp 0x1401b09f5
movzx ecx, byte [rdi]
inc rdi
mov al, cl
and al, 0xc0
cmp al, 0x80
jne 0x1401b0a72
mov eax, edx
and ecx, 0x3f
shl eax, 6
mov edx, ecx
or edx, eax
mov rax, rdi
sub rax, r12
cmp rax, r9
jb 0x1401b09d7
cmp r9, rbp
jae 0x1401b0a21
movzx eax, r8b
sub bl, r9b
mov word [r10 + 4], ax
movzx eax, bl
mov word [r10 + 6], ax
mov dword [r10], edx
jmp 0x1401b0924
lea eax, [rdx - 0xd800]
cmp eax, 0x7ff
jbe 0x1401b0a72
cmp edx, 0x110000
jae 0x1401b0a72
movzx eax, r8b
mov dword [rsp + 0x20], 0x80
mov dword [rsp + 0x24], 0x800
mov dword [rsp + 0x28], 0x10000
cmp edx, dword [rsp + rax*4 + 0x18]
jb 0x1401b0a72
test r14, r14
je 0x1401b0a60
mov dword [r14], edx
neg edx
mov rdx, r10
sbb rcx, rcx
and rcx, rbp
call fcn.1400087a6
jmp 0x1401b0a7d
mov rdx, rsi
mov rcx, r10
call fcn.140009aca
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140004de0
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140004110
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x1400fa998
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x1400faa25
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x1400faa25
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400faa25
sub r8, rdx
movzx edx, word [rcx + 0x14]
add rdx, 0x18
add rdx, rcx
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x1400faa0c
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1400faa06
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x1400faa0e
add rdx, 0x28
jmp 0x1400fa9eb
xor edx, edx
test rdx, rdx
jne 0x1400faa17
xor al, al
jmp 0x1400faa2b
cmp dword [rdx + 0x24], 0
jge 0x1400faa21
xor al, al
jmp 0x1400faa2b
mov al, 1
jmp 0x1400faa2b
xor al, al
jmp 0x1400faa2b
add rsp, 0x18
ret
Function at 0x14000420a
Capabilities:
Act as tcp client
Connect tcp socket
Connect udp socket
Initialize winsock library
Resolve dns

Disassembly:
jmp 0x1400fcae0
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x1e0
mov rax, qword [0x14023c868]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x20], rcx
movzx ebp, r8w
cmp byte [0x140241368], 0
mov rsi, rdx
mov rbx, rcx
jne 0x1400fcb2e
mov ecx, 0x101
mov byte [0x140241368], 1
lea rdx, [rsp + 0x30]
call sub.WS2_32.dll_WSAStartup
xor r8d, r8d
mov qword [rbx + 0x10], 0
mov r15d, 2
mov ecx, r15d
lea edx, [r8 + 1]
call sub.WS2_32.dll_socket
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400fcbfb
mov rcx, rsi
mov qword [rbx], rax
call sub.WS2_32.dll_gethostbyname
test rax, rax
je 0x1400fcbfb
mov qword [rsp + 0x28], 0
movzx ecx, bp
mov word [rsp + 0x20], r15w
mov rax, qword [rax + 0x18]
mov rdx, qword [rax]
mov eax, dword [rdx]
mov dword [rsp + 0x24], eax
call sub.WS2_32.dll_htons
mov ecx, dword [rsp + 0x24]
mov word [rsp + 0x22], ax
mov byte [rbx + 0x20], 0
call sub.WS2_32.dll_inet_ntoa
mov rcx, rax
test rax, rax
je 0x1400fcbbf
mov rdx, rbx
sub rdx, rax
movzx eax, byte [rcx]
mov byte [rdx + rcx + 0x20], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400fcbb0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
je 0x1400fcbfb
mov ecx, 0x1000
mov dword [rbx + 8], 0
call fcn.140005c90
mov qword [rbx + 0x10], rax
test rax, rax
je 0x1400fcc02
mov qword [rbx + 0x18], 0x1000
jmp 0x1400fcc02
mov dword [rbx + 8], 0xffffffff
cmp byte [0x140241368], 0
jne 0x1400fcc21
mov ecx, 0x101
mov byte [0x140241368], 1
lea rdx, [rsp + 0x30]
call sub.WS2_32.dll_WSAStartup
mov rax, rbx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140004de0
add rsp, 0x1e0
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140004949
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14013c1d0
mov rax, rcx
neg rcx
test rax, 7
je 0x14013c1ed
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x14013c248
test al, 7
jne 0x14013c1e0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x14013c201
mov rdx, qword [rax - 8]
test dl, dl
je 0x14013c272
test dh, dh
je 0x14013c26c
shr rdx, 0x10
test dl, dl
je 0x14013c266
test dh, dh
je 0x14013c260
shr rdx, 0x10
test dl, dl
je 0x14013c25a
test dh, dh
je 0x14013c254
shr edx, 0x10
test dl, dl
je 0x14013c24e
test dh, dh
jne 0x14013c201
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x140004999
Capabilities:
Enumerate files on windows

Disassembly:
jmp 0x14008ae30
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x208
mov rax, qword [0x14023c868]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0x210]
add rax, 0x40
lea r8, str..json
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.140007478
nop
lea rcx, [rsp + 0x30]
call fcn.140004214
nop
lea rcx, [rsp + 0x88]
call fcn.140001b63
lea rdx, [rsp + 0xb0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0xdc]
lea rcx, [rsp + 0x48]
call fcn.140004a3e
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.140003ce7
nop
lea rcx, [rsp + 0x48]
call fcn.14000274d
mov byte [rsp + 0x20], 0
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x14008aefd
mov byte [rsp + 0x21], 1
jmp 0x14008af02
mov byte [rsp + 0x21], 0
movzx eax, byte [rsp + 0x21]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x14008af6f
lea rdx, [rsp + 0xdc]
lea rcx, [rsp + 0x68]
call fcn.140004a3e
nop
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.140003ce7
nop
lea rcx, [rsp + 0x68]
call fcn.14000274d
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x14008af5f
mov byte [rsp + 0x22], 1
jmp 0x14008af64
mov byte [rsp + 0x22], 0
movzx eax, byte [rsp + 0x22]
mov byte [rsp + 0x20], al
jmp 0x14008af0b
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x218]
call fcn.140008acb
mov eax, dword [rsp + 0x24]
or eax, 1
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x30]
call fcn.140008c1f
nop
lea rcx, [rsp + 0x88]
call fcn.14000274d
mov rax, qword [rsp + 0x218]
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.140004de0
add rsp, 0x208
ret
Function at 0x1400049a3
Capabilities:
Query environment variable

Disassembly:
jmp 0x14019db84
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14019dc0b
mov rsi, rbx
cmp word [rax], bp
je 0x14019dbca
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14019dbb4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14019dbb0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140001087
mov rdi, rax
test rax, rax
je 0x14019dbf8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140004e21
mov rbp, rdi
xor ecx, ecx
call fcn.1400013c5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140004a2a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x140123e00
sub rsp, 0x28
cmp qword [rcx + 0x60], 0
je 0x140123e41
mov qword [rsp + 0x20], rbx
mov dl, 0xa
lea rbx, [rcx + 0x28]
mov rcx, qword [rcx + 8]
call fcn.140006f91
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x140123e2c
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp fcn.140005ea2
add rsp, 0x28
ret