joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400933c8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14009344c
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x14009344c
dec r8
sub rdx, 1
jne 0x140093432
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400dd5a0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1400dd5cd
xor al, al
jmp 0x1400dd72f
mov rax, qword [0x1400fd6b0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1400fd6b8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1400fd6c0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1400fd6c8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1400fd6d0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1400fd6d8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1400fd6e0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1400fd6e8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1400fd6f0]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1400dd721
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1400dd679
mov r11d, 2
jmp 0x1400dd69d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1400dd693
mov r11d, 1
jmp 0x1400dd69d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x1400dd745
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1400dd6e2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1400dd6fa
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1400dd70a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1400dd718
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x1400dd660
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1400dd72a
Function at 0x140002110
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rsi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov rdi, rcx
movabs rbp, 0x9e3779b185ebca87
movabs r15, 0x27d4eb2f165667c5
movabs r14, 0xc2b2ae3d27d4eb4f
movabs r12, 0x7a1435883d4d519d
cmp rsi, 0x20
jb 0x14000220b
mov rcx, qword [rcx + 8]
mov r8, qword [rdi + 0x18]
mov r9, qword [rdi + 0x20]
mov rax, r8
mov rdx, qword [rdi + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rdx
rol rax, 7
add r10, rax
mov rax, rcx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rcx, r14
imul rdx, r14
imul r8, r14
imul r9, r14
rol rcx, 0x1f
imul rcx, rbp
rol rdx, 0x1f
xor r10, rcx
rol r8, 0x1f
imul r10, rbp
imul rdx, rbp
imul r8, rbp
sub r10, r12
rol r9, 0x1f
xor r10, rdx
imul r10, rbp
imul r9, rbp
sub r10, r12
xor r10, r8
imul r10, rbp
sub r10, r12
xor r10, r9
imul r10, rbp
add rax, r10
add rax, rsi
jmp 0x140002213
lea rax, [rsi + r15]
add rax, qword [rcx + 0x18]
lea rdx, [rdi + 0x30]
cmp rdx, rbx
ja 0x14000224a
nop dword [rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, r14
add r11, 8
rol rcx, 0x1f
imul rcx, rbp
xor rax, rcx
rol rax, 0x1b
imul rax, rbp
sub rax, r12
cmp rdx, rbx
jbe 0x140002220
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x140002275
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rbp
xor rax, rcx
rol rax, 0x17
imul rax, r14
add rax, r8
cmp r11, rbx
jae 0x14000229b
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r15
xor rax, rcx
rol rax, 0xb
imul rax, rbp
cmp r11, rbx
jb 0x140002280
mov rbx, qword [rsp + 0x20]
mov rcx, rax
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
shr rcx, 0x21
xor rcx, rax
imul rcx, r14
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
pop r12
ret
Function at 0x14000a320
Capabilities:
Encode data using xor
Get file size
Hash data with crc32
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x70
xor esi, esi
mov qword [rax + 8], rbp
mov qword [rax - 0x48], rsi
lea rcx, [0x14002ad10]
mov dword [rax - 0x50], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rax - 0x58], 3
lea r8d, [rsi + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov ebx, 0xffffffff
cmp rax, 0xffffffffffffffff
jne 0x14000a38c
mov bpl, 1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
jmp 0x14000a448
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, ebx
jne 0x14000a3c5
mov qword [rsp + 0x60], 0xffffffffffffffff
mov bpl, 1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
jmp 0x14000a448
xor r9d, r9d
mov eax, eax
mov qword [rsp + 0x28], rsi
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x20], esi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
test rax, rax
jne 0x14000a408
mov bpl, 1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x50]
jmp 0x14000a448
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rcx, r14
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
jne 0x14000a445
mov bpl, 1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000a448
xor bpl, bpl
test bpl, bpl
mov rbp, qword [rsp + 0x80]
je 0x14000a45c
xor eax, eax
jmp 0x14000a53d
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14000a514
mov r8, rsi
mov r9d, eax
nop
movzx eax, byte [r8]
lea r8, [r8 + 1]
xor ebx, eax
mov eax, ebx
and al, 1
neg al
sbb ecx, ecx
shr ebx, 1
and ecx, 0xedb88320
xor ecx, ebx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb ebx, ebx
shr ecx, 1
and ebx, 0xedb88320
xor ebx, ecx
sub r9, 1
jne 0x14000a470
not ebx
mov eax, 1
test ebx, ebx
mov rcx, rsi
cmove ebx, eax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14000a610
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140029008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a655
xor al, al
jmp 0x14000a6a2
cmp word [rbx], 0
je 0x14000a66d
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a660
cmp word [rsp + 0x30], 0
je 0x14000a69b
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a6c3
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a680
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000b670
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000d8d0
int3
Function at 0x14000ad80
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2030
call fcn.14001c320
sub rsp, rax
mov rax, qword [0x140029008]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r11d, dword [0x14002d510]
lea rsi, [0x14002f540]
mov rdi, rcx
test r11d, r11d
jne 0x14000adf3
lea rdx, str._HOME_
lea rcx, [rsp + 0x20]
call fcn.14000a6d0
test al, al
je 0x14000aedf
lea rcx, [rsp + 0x20]
call fcn.140011298
movsxd r11, dword [0x14002d510]
mov qword [rsi + r11*8], rax
inc r11d
mov dword [0x14002d510], r11d
xor r9d, r9d
test r11d, r11d
jle 0x14000ae34
mov r10, rsi
nop
mov r8, qword [r10]
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000ae24
add rax, 2
test ecx, ecx
jne 0x14000ae10
test edx, edx
je 0x14000ae57
inc r9d
add r10, 8
cmp r9d, r11d
jl 0x14000ae00
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14000ae40
cmp rax, 2
jne 0x14000ae5b
cmp word [rdi + 2], 0x3a
jne 0x14000ae5b
mov al, 1
jmp 0x14000aebe
xor edx, edx
mov qword [rsp + 0x2048], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x14000ae88
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000ae88
mov bl, 1
jmp 0x14000ae8c
test bl, bl
je 0x14000aeb3
cmp dword [0x14002d510], 0x400
jge 0x14000aeb3
mov rcx, rdi
call fcn.140011298
movsxd rdx, dword [0x14002d510]
mov qword [rsi + rdx*8], rax
inc edx
mov dword [0x14002d510], edx
movzx eax, bl
mov rbx, qword [rsp + 0x2048]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.14000b670
mov rsi, qword [rsp + 0x2050]
add rsp, 0x2030
pop rdi
ret
lea rcx, str._HOME_
call fcn.14000abd0
int3

Function at 0x14000b000
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x14002d518]
test rcx, rcx
je 0x14000b040
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000b02e
mov rcx, qword [0x14002d518]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002d518]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x28
ret
Function at 0x14000bf44
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000bf8e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000bf8e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000bf8e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000bf8e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000bf8e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000bf90
xor al, al
add rsp, 0x28
ret

Function at 0x14000d8c4
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14000d757
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000d757
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000d757
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000d757
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000d757
cmp dword [rcx + 0x84], 0xe
jbe 0x14000d757
cmp dword [rcx + 0xf8], 0
je 0x14000d757
mov ecx, ebx
call fcn.14000d7f8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14000d5e8
cmp dword [rbp + 0x20], 0
je 0x14000d7a4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000d7ac
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000d6f0
Function at 0x14001c260
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001c288
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001c288
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14022d7e8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14022d918
Function at 0x140dde430
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140dde43d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140dde44d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140dde435
lea eax, [rcx + 1]
jmp 0x140dde45b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140dde46e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140dde454
sub eax, 3
jb 0x140dde48e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140dde4dd
sar eax, 1
movsxd rbp, eax
jb 0x140dde4c4
jmp 0x140dde49c
add ebx, ebx
jne 0x140dde49a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140dde4c4
inc ecx
add ebx, ebx
jne 0x140dde4aa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140dde4c4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140dde4bd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140dde4ac
add ecx, 2
jmp 0x140dde4c9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140dde3f2
jmp 0x140dde43d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0xdce000]
mov eax, dword [rdi]
or eax, eax
je 0x140dde53d
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xdde4ec]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140dde4ed
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140dde537
mov qword [rbx], rax
add rbx, 8
jmp 0x140dde50d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140dde581
cmp al, 0xef
ja 0x140dde569
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140dde549
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140dde558
mov eax, dword [rdi]
add rdi, 4
jmp 0x140dde558
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140dde600], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140dde600
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140dde5f0
sub rsp, 0xffffffffffffff80
jmp 0x1400014e0
Function at 0x140003410
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140003432
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x1400034ac
mov rdi, r14
mov rcx, rbx
call fcn.1400048e0
test rax, rax
jle 0x140003484
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.140067420
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000349c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x1400034a4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140003446
sub r14, rdi
jmp 0x14000358f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400034c3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400034c5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400034f7
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140067420
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000358c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140003532
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000356d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400725e4
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14000358c
cmp rbp, rax
ja 0x140003540
test rbp, rbp
je 0x14000358c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400725e4
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140010600
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400106e2
call fcn.140026d70
test al, al
jne 0x1400106e2
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x140010632
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.140030a10
test rax, rax
je 0x140010677
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.140030a10
mov rsi, rax
test rax, rax
je 0x140010677
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x1400106ab
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.140022fe0
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x140010690
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14001f700
Capabilities:
Get common file path
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x1400c6738]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
test cl, 2
je 0x14001f766
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14001f749
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x14001f743
shr ax, 8
cmp al, 2
je 0x14001f766
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140065560
add rsp, 0x1e8
ret
call fcn.140053110
test eax, eax
jne 0x14001f980
mov qword [rsp + 0x200], rsi
lea rcx, str.kernel32
mov qword [rsp + 0x208], rdi
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x14001f7a6
mov qword [0x1400c79e8], rsi
jmp 0x14001f93d
mov qword [rsp + 0x1f0], rbx
lea rdx, [0x14009e408]
mov rcx, rdi
mov qword [rsp + 0x1f8], rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rbx, str.iphlpapi.dll
mov rbp, rax
mov rcx, rbx
lea rdx, [0x14009e418]
call fcn.140075bac
test rax, rax
je 0x14001f80a
mov rcx, rbx
test rbp, rbp
je 0x14001f7fc
xor edx, edx
lea r8d, [rdx + 8]
call rbp
mov rsi, rax
jmp 0x14001f8fc
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
jmp 0x14001f8fc
test rbp, rbp
je 0x14001f839
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001f839
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call rbp
mov rsi, rax
jmp 0x14001f8fc
xor edx, edx
mov qword [rsp + 0x1e0], r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r14d, eax
test eax, eax
je 0x14001f8f4
lea ecx, [rax + 1]
lea rcx, [rcx*2 + 0x18]
call qword [str.t._a_]
mov rdi, rax
test rax, rax
je 0x14001f8eb
mov edx, r14d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14001f8eb
mov rcx, 0xffffffffffffffff
mov rax, rcx
nop dword [rax]
cmp word [rdi + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14001f890
mov dword [rdi + rax*2], 0x5c
cmp word [rdi + rcx*2 + 2], si
lea rcx, [rcx + 1]
jne 0x14001f8a2
lea rdx, [rcx + rcx]
sub rdx, rbx
add rdx, rdi
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rdx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x14001f8c0
mov rcx, rdi
test rbp, rbp
je 0x14001f8e2
xor edx, edx
lea r8d, [rdx + 8]
call rbp
jmp 0x14001f8e8
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
mov rcx, rdi
call qword [fcn.1400721c0]
mov r14, qword [rsp + 0x1e0]
mov rbp, qword [rsp + 0x1f8]
mov rbx, qword [rsp + 0x1f0]
mov qword [0x1400c79e8], rsi
test rsi, rsi
je 0x14001f93d
lea rdx, str.if_nametoindex
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400c79e0]
test rax, rax
cmovne rcx, rax
mov qword [0x1400c79e0], rcx
xor edx, edx
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.140052cc0
test al, al
lea rcx, [0x1400c90f8]
setne byte [0x1400c90f0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rdi, qword [rsp + 0x208]
xor eax, eax
mov rsi, qword [rsp + 0x200]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140065560
add rsp, 0x1e8
ret
Function at 0x140027b50
Capabilities:
Convert ip address from string

Disassembly:
cmp qword [rsp + 0x28], 0
mov qword [r9], 0
jge 0x140027b65
mov eax, 0xfffffffe
ret
mov qword [rsp + 0x28], r9
mov r9b, 1
jmp fcn.1400275e0
Function at 0x1400311a0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
movaps xmmword [rsp + 0x50], xmm6
lea rcx, [rsp + 0x30]
mov rdi, rdx
call fcn.1400109f0
mov rcx, rbx
movups xmm6, xmmword [rax]
call fcn.1400304b0
mov rcx, rdi
mov rsi, rax
call fcn.1400304b0
mov r8d, 1
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140031250
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.1400109f0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
call fcn.140010a80
cmp rax, 0x3e8
ja 0x140031281
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140031200
test rsi, rsi
je 0x14003125d
mov rcx, rsi
call fcn.1400721c0
test rbx, rbx
je 0x14003126a
mov rcx, rbx
call fcn.1400721c0
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
test rsi, rsi
je 0x14003128e
mov rcx, rsi
call fcn.1400721c0
test rbx, rbx
je 0x14003129b
mov rcx, rbx
call fcn.1400721c0
mov eax, 1
jmp 0x14003126c