joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cb760
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
lea rcx, [rdx + 0xf0]
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x20]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
mov al, 0xbd
add eax, 0x74c08500
invalid
movabs r12, 0x8000000000000000
jmp 0x1400cb7fa
mov rbx, qword [rsp + 0x20]

Function at 0x1400d9540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x128
mov rsi, rdx
mov r15, qword [rcx + 0xc0]
test r15, r15
je 0x1400d956c
lock inc qword [r15]
jle 0x1400d9d81
cmp byte [rsi + 0x68], 0
je 0x1400d9606
mov rax, qword [rsi + 0x30]
mov rdx, qword [rsi + 0x10]
mov qword [rsp + 0x80], rdx
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x90], rax
movups xmm0, xmmword [rsi + 0x38]
movups xmmword [rsp + 0x98], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rsp + 0xa8], xmm0
mov rax, qword [rsi + 0x28]
mov qword [rsp + 0xb8], rax
mov byte [rsp + 0x110], 0
mov rax, qword [rcx + 0xc8]
mov rdx, qword [rcx + 0xd0]
lea r8, [rsp + 0x70]
mov rcx, rax
call fcn.14006b0a0
movzx ebp, byte [rsi + 0x69]
test bpl, bpl
je 0x1400d96c9
mov rdi, r8
mov qword [rsp + 0x30], rcx
movups xmm0, xmmword [rsi + 0x48]
movups xmm1, xmmword [rsi + 0x58]
movups xmmword [rsp + 0x98], xmm1
movups xmmword [rsp + 0x88], xmm0
movups xmm0, xmmword [rsi + 0x30]

Function at 0x1400de8e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x1400de905
cmp rax, rcx
je 0x1400de90b
cmp rdx, 4
jae 0x1400de90f
xor eax, eax
xor r8d, r8d
jmp 0x1400de9a0
pop rbp
jmp fcn.1400194d0
xor eax, eax
pop rbp
ret
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x140127780]
movdqa xmm3, xmmword [0x140127790]
pxor xmm1, xmm1
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x1400de930
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x1400de9b7
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1400de9a0
pop rbp
ret

Function at 0x1400e5630
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
lea rsi, str.127.0.0.1:34254could_not_resolve_to_any_addresses
invalid
add byte [rax - 0x77], cl
je 0x1400e5672
xor byte [rax - 0x39], cl
and al, 0x38
sldt word [rax]
invalid

Function at 0x1400e69f0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd0
lea rbp, [rsp + 0x80]
lea ebp, [rsp + 0x80]
Function at 0x1400ebe70
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.1400ec2b0
mov rax, qword [rbp - 0x60]
movabs rdi, 0x8000000000000000
cmp rax, rdi
jne 0x1400ebec6
lea rcx, [rbp - 0x58]
call fcn.1400e6600
mov qword [rsi], rdi
jmp 0x1400ec117
mov qword [rbp + 0x3f8], rsi
mov qword [rbp + 0x3f0], rax
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x400], rax
mov qword [rbp + 0x408], 0
mov qword [rbp + 0x410], 2
mov qword [rbp + 0x418], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r14d, r14d
cmp r8, 0x201
jae 0x1400ebf50
jmp 0x1400ebf3f

Function at 0x1400eeb10
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
invalid
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x10]
call fcn.1400ec2b0
mov rax, qword [rbp - 0x10]
Function at 0x1400f1250
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x1e8
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov rdi, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov word [rbp + 0x166], ax
mov rax, qword [0x140197268]
cmp rax, 3
jne 0x1400f1442
lea rax, [rbp + 0x166]
mov qword [rbp + 0x150], rax
cmp rdi, 0x17f
ja 0x1400f1468
lea rbx, [rbp - 0x60]
mov rcx, rbx
mov r8, rdi
call fcn.14011a210
mov byte [rbp + rdi - 0x60], 0
lea rax, [rdi + 1]
cmp rdi, 0xe
ja 0x1400f12e8
xor edx, edx
nop word [rax + rax]
cmp byte [rbp + rdx - 0x60], 0
je 0x1400f13a4
inc rdx
cmp rax, rdx
jne 0x1400f12d0
jmp 0x1400f140d
lea rcx, [rbp - 0x59]
and rcx, 0xfffffffffffffff8
sub rcx, rbx
je 0x1400f131e
xor edx, edx
nop word [rax + rax]
cmp byte [rbp + rdx - 0x60], 0
je 0x1400f13a4
inc rdx
cmp rcx, rdx
jne 0x1400f1300
lea rdx, [rdi - 0xf]
cmp rcx, rdx
jbe 0x1400f1322
jmp 0x1400f136e
lea rdx, [rdi - 0xf]
movdqa xmm0, xmmword [0x140127770]
movabs r8, 0x8080808080808080
add byte [rax - 0x7f7f7f80], 0x66
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rbp + rcx - 0x60]
movdqa xmm2, xmm1
outsd dx, dword [rsi]
shl dword [rsi + 0xf], 1
invalid
shl byte [rsi + 0xf], 1
pandn mm1, mm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r9, xmm2
test r9, r8
jne 0x1400f136e
add rcx, 0x10
cmp rcx, rdx
jbe 0x1400f1340
sub rax, rcx
je 0x1400f140d
invalid
lea r8, [rcx + rbp]
add r8, 0xffffffffffffffa0
xor edx, edx
nop word cs:[rax + rax]
cmp byte [r8 + rdx], 0
je 0x1400f13a1
inc rdx
cmp rax, rdx
jne 0x1400f1390
jmp 0x1400f140d
add rdx, rcx
cmp rdx, rdi
jne 0x1400f140d
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x120], xmm0
movdqa xmmword [rbp + 0x140], xmm0
movdqa xmmword [rbp + 0x130], xmm0
mov dword [rbp + 0x128], 1
mov qword [rbp + 0x158], 0
lea rcx, [rbp - 0x60]
lea r8, [rbp + 0x120]
lea r9, [rbp + 0x158]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1400f1421
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1400f1439
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1400f147a
mov rax, qword [rbp + 0x158]
movzx ecx, word [rbp + 0x166]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
jmp 0x1400f147a
mov rbx, rdx
call fcn.1401250b0
mov rdx, rbx
lea rax, [rbp + 0x166]
mov qword [rbp + 0x150], rax
cmp rdi, 0x17f
jbe 0x1400f12a7
lea r9, [rbp + 0x150]
mov rcx, rsi
mov r8, rdi
call fcn.140125120
nop
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400f1da0
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x140197310]
mov edx, 0x10
xor ecx, ecx
call fcn.1400f22a0
test rax, rax
je 0x1400f1e99
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400f1f50]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
mov ecx, eax
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.14011ad40
ud2
Function at 0x1400f8ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r14, qword [rcx]
test r14, r14
je 0x1400f9112
mov rdi, rdx
mov rsi, rcx
mov eax, dword [0x140197314]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x120]
test eax, eax
je 0x1400f8f28
cmp eax, 1
je 0x1400f8f55
xor r15d, r15d
mov bpl, 1
mov rax, qword [r14 + 0x30]
test al, 2
je 0x1400f8fb6
jmp 0x1400f90ce
mov eax, dword [0x140197314]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xd0]
lea rdx, [0x1400ff160]
call fcn.1400e77d0
mov byte [rbx + 0x120], 1
mov eax, dword [0x140197314]
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx + rax*8]
movzx eax, byte [rcx + 0x11c]
movzx r15d, byte [rcx + 0x11d]
mov ecx, r15d
test al, al
je 0x1400f8f8b
test r15b, r15b
je 0x1400f90ba
lea ecx, [r15 - 1]
mov edx, dword [0x140197314]
mov r8, qword gs:[0x58]
mov rdx, qword [r8 + rdx*8]
mov byte [rdx + 0x11d], cl
test al, al
sete bpl
mov rax, qword [r14 + 0x30]
test al, 2
jne 0x1400f90ce
mov bl, 1
test al, 4
jne 0x1400f90ff
test al, 1
je 0x1400f9002
mov rax, qword [r14 + 0x28]
cmp rax, qword [rdi + 8]
jne 0x1400f8fd7
mov rax, qword [r14 + 0x20]
cmp rax, qword [rdi]
je 0x1400f9037
mov rax, qword [r14 + 0x30]
nop dword [rax + rax]
mov rcx, rax
and rcx, 0xfffffffffffffffe
lock cmpxchg qword [r14 + 0x30], rcx
jne 0x1400f8fe0
test al, 2
jne 0x1400f90c8
mov rax, qword [r14 + 0x20]
mov rcx, qword [r14 + 0x28]
call qword [rax + 0x18]
mov rax, qword [rdi]
mov rcx, qword [rdi + 8]
call qword [rax]
mov qword [r14 + 0x20], rax
mov qword [r14 + 0x28], rdx
mov rax, qword [r14 + 0x30]
nop word [rax + rax]
mov rcx, rax
or rcx, 1
lock cmpxchg qword [r14 + 0x30], rcx
jne 0x1400f9020
test al, 2
jne 0x1400f90ce
mov bl, 2
test bpl, bpl
jne 0x1400f90ff
mov eax, dword [0x140197314]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x120]
cmp eax, 2
je 0x1400f910e
cmp eax, 1
je 0x1400f9097
mov eax, dword [0x140197314]
mov rcx, qword gs:[0x58]
mov rsi, qword [rcx + rax*8]
lea rcx, [rsi + 0xd0]
lea rdx, [0x1400ff160]
call fcn.1400e77d0
mov byte [rsi + 0x120], 1
mov eax, dword [0x140197314]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov byte [rax + 0x11c], 1
mov byte [rax + 0x11d], r15b
jmp 0x1400f90ff
mov rax, qword [rdi]
mov rcx, qword [rdi + 8]
call qword [rax + 0x10]
mov bl, 2
jmp 0x1400f90ff
lock or qword [r14 + 0x30], 1
movzx eax, byte [r14 + 0x38]
mov byte [r14 + 0x38], 0
xor al, 1
mov bl, 1
test al, al
jne 0x1400f90ff
mov rax, qword [rsi]
test rax, rax
je 0x1400f90f6
lock dec qword [rax]
jne 0x1400f90f6
mov rcx, qword [rsi]
call fcn.1400cbf00
mov qword [rsi], 0
xor ebx, ebx
mov eax, ebx
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov ebx, eax
jmp 0x1400f90ff
lea rax, [0x1401600e8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rdx, str.C:UsersDONY.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_synconeshot.rscalled_after_complete
lea rcx, [rsp + 0x28]
call fcn.14011c2b0
int3
Function at 0x140107700
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, r8
mov r14, rdx
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x20], rax
cmp rax, 0xffffffffffffffff
je 0x1401078c1
cwde
add dword [rax], eax
invalid
mov r15, qword [rcx + 0x10]
mov rdi, qword [rcx + 0x20]
mov rdx, qword [rcx + 0x10]
lea rcx, [rsp + 0x28]
mov r8, r14
xor r9d, r9d
call fcn.1400ff600
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x1401078e8
cmp al, 2
jne 0x14010799e
mov r12, qword [rsp + 0x28]
jmp 0x140107926

Function at 0x1401079d0
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov qword [rsp + 0x30], r8
mov rsi, rdx
mov rbx, qword [rcx + 0x18]
cmp rbx, 0xffffffffffffffff
je 0x140107b6f
mov r14, qword [rcx + 0x10]
mov r12, qword [rcx + 0x20]
cmp r9, 0x7fffffff
mov r15d, 0x7fffffff
cmovb r15, r9
jmp 0x140107a47
mov rcx, qword [0x140197260]
xor edx, edx
mov r8, rbp
call qword [sym.imp.kernel32.dll_HeapFree]
dec r13
mov rcx, qword [0x140197260]
xor edx, edx
mov r8, r13
call qword [sym.imp.kernel32.dll_HeapFree]
lea rcx, [rsp + 0x20]
mov rdx, r14
mov r8, rsi
mov r9b, 1
call fcn.1400ff600
movzx eax, byte [rsp + 0x29]
cmp al, 3
je 0x140107b8c
mov rbp, qword [rsp + 0x20]
cmp al, 2
je 0x140107ba6
movzx edi, byte [rsp + 0x28]
mov rcx, rbx
mov rdx, qword [rsp + 0x30]
mov r8d, r15d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x140107bb0
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov r13d, eax
shl r13, 0x20
or r13, 2
mov rcx, r13
call fcn.14004f7f0
cmp al, 0xd
jne 0x140107ae6
test r12, r12
je 0x140107ae6
mov rcx, qword [r12]
mov rdx, qword [r12 + 8]
lock inc qword [rdx]
jle 0x140107bc9
add rcx, 0x10
mov r8, qword [r12 + 0x10]
movzx r9d, byte [r12 + 0x18]
call fcn.14004f580
test rax, rax
cmovne r13, rax
mov rcx, r13
call fcn.1400c76a0
cmp al, 0xd
jne 0x140107b9f
movzx ecx, dil
and ebp, 0x23
mov rax, qword [r14 + 0x90]
xor rbp, 0x2f
shl ecx, 0x10
nop dword [rax + rax]
mov edx, eax
shr edx, 0x10
cmp dil, dl
jne 0x140107b2c
mov edx, ebp
and edx, eax
or rdx, rcx
lock cmpxchg qword [r14 + 0x90], rdx
jne 0x140107b10
mov eax, r13d
and eax, 3
cmp eax, 1
jne 0x140107a47
mov rbp, qword [r13 - 1]
mov rdi, qword [r13 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x140107b50
mov rcx, rbp
call rax
cmp qword [rdi + 8], 0
je 0x140107a32
cmp qword [rdi + 0x10], 0x11
jb 0x140107a20
mov rbp, qword [rbp - 8]
jmp 0x140107a20
mov rdx, qword [rcx + 0x10]
lea rcx, [rsp + 0x20]
mov r8, rsi
mov r9b, 1
call fcn.1400ff600
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x140107b96
mov eax, 2
mov r13, rbp
jmp 0x140107bb5
cmp al, 2
jne 0x140107bcb
mov r13, qword [rsp + 0x20]
mov eax, 1
jmp 0x140107bb5
mov eax, 1
mov r13, rbp
jmp 0x140107bb5
movsxd r13, eax
xor eax, eax
mov rdx, r13
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
lea rcx, [0x140162220]
call fcn.14011c7e0
int3

Function at 0x14010db90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsp
Function at 0x140117254
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14011729e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14011729e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14011729e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14011729e
cmp dword [rcx + 0x84], 0xe
jbe 0x14011729e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401172a0
xor al, al
add rsp, 0x28
ret

Function at 0x140119ff0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14011a018
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14011a018
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140120da0
Capabilities:
Link many functions at runtime

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rcx, [0x140150765]
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x140120df2
mov rdi, rax
lea rdx, [0x140150786]
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140120df2
mov rsi, rax
lea rdx, [0x140150794]
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140120df2
mov r14, rax
xor edi, edi
jmp 0x140120e76
lea rcx, [0x140150720]
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x140120ede
mov rsi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140120ede
mov rbx, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rsi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140120ede
mov rdi, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rsi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140120ede
mov rsi, rax
lea rcx, [rsp + 0x20]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
jne 0x140120ede
mov r14, qword [rsp + 0x20]
movzx eax, byte [0x140197310]
mov edx, 0x18
xor ecx, ecx
call fcn.1400f22a0
test rax, rax
je 0x140120ee3
mov rbx, rax
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], r14
xor eax, eax
lock cmpxchg qword [0x1401971c0], rbx
je 0x140120ed1
mov rsi, rax
cmp qword [rbx], 0
je 0x140120ebc
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [0x140197260]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140120f00
mov ecx, 8
mov edx, 0x18
call fcn.14011ad40
int3
Function at 0x140125120
Capabilities:
Resolve dns

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov r14, r8
inc r14
sete r13b
je 0x140125348
js 0x140125354
mov rdi, r9
mov rbx, r8
mov r15, rdx
mov rsi, rcx
movzx eax, byte [0x140197310]
xor ecx, ecx
mov rdx, r14
call fcn.1400f22a0
test rax, rax
je 0x140125359
mov r12, rax
mov rcx, rax
mov rdx, r15
mov r8, rbx
call fcn.14011a210
cmp rbx, 0x10
jae 0x1401251b8
test rbx, rbx
je 0x14012525f
xor eax, eax
nop word cs:[rax + rax]
cmp byte [r15 + rax], 0
je 0x1401252c7
inc rax
cmp rbx, rax
jne 0x1401251a0
jmp 0x14012525f
lea rax, [r15 + 7]
and rax, 0xfffffffffffffff8
sub rax, r15
jne 0x140125210
lea rcx, [rbx - 0x10]
xor eax, eax
movdqa xmm0, xmmword [0x140127770]
movabs rdx, 0x8080808080808080
nop dword [rax]
movdqu xmm1, xmmword [r15 + rax]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r8, xmm2
test r8, rdx
jne 0x14012523c
add rax, 0x10
cmp rax, rcx
jbe 0x1401251e0
jmp 0x14012523c
cmp rax, rbx
cmovae rax, rbx
xor ecx, ecx
nop dword [rax]
cmp byte [r15 + rcx], 0
je 0x1401252c7
inc rcx
cmp rax, rcx
jne 0x140125220
lea rcx, [rbx - 0x10]
cmp rax, rcx
jbe 0x1401251cb
cmp rax, rbx
je 0x14012525f
nop word cs:[rax + rax]
cmp byte [r15 + rax], 0
je 0x1401252c7
inc rax
cmp rbx, rax
jne 0x140125250
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], rbx
lea rcx, [rbp - 0x30]
call fcn.1400064b0
mov rbx, rax
mov r14, rdx
pxor xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x28], 1
mov qword [rbp], 0
lea r8, [rbp - 0x30]
mov r9, rbp
mov rcx, rax
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x140125301
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x140125315
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
test r13b, r13b
jne 0x140125336
mov rcx, qword [0x140197260]
xor edx, edx
mov r8, r12
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [rdi]
mov rax, qword [rbp]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rbx], 0
test r14, r14
je 0x140125336
mov rcx, qword [0x140197260]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.library_alloc_src_ffic_str.rs
call fcn.14011c7e0
call fcn.140006380
mov ecx, 1
mov rdx, r14
call fcn.14011ad20
int3
Function at 0x1400308b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x20
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x1400308d4
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
je 0x140030962
mov rdi, r15
mov qword [rsp + 0x40], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140030930
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x140030930
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.140134d20
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14003094d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140030955
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x1400308f1
mov rbp, qword [rsp + 0x40]
sub r15, rdi
jmp 0x140030a40
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x140030979
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14003097b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400309ad
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.140134d20
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140030a3d
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400309e8
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x140030a1e
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.140112cf0
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x140030a3d
cmp rsi, rax
ja 0x1400309f1
test rsi, rsi
je 0x140030a3d
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.140112cf0
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x48]
mov rax, r15
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
Function at 0x140036bd0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140036c95
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x140036c95
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x140036cae
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx + 0x10]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx]
cmp rcx, rax
je 0x140036c85
cmp byte [rcx], 0x5c
jne 0x140036c7e
lea rdx, [rcx + 1]
cmp rdx, rax
je 0x140036c7e
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x140036c6c
movzx eax, byte [rdx]
sub al, 0x28
cmp al, 1
jbe 0x140036c7b
test r8b, 0x10
jne 0x140036c7e
movzx eax, byte [rdx]
sub al, 0x7b
test al, 0xfd
jne 0x140036c7e
mov rcx, rdx
lea rax, [rcx + 1]
mov qword [rbx], rax
mov rcx, rbx
call fcn.140039e90
test edi, edi
jne 0x140036bf0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.140038450
int3
Function at 0x14003a820
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x14003a854
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x14003a840
ret

Function at 0x14003ea70
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14003eb2a
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x14003eb2a
mov rdx, qword [rdi + 0x10]
mov ecx, 2
mov qword [rsp + 0x30], rbx
inc rdx
lea rbx, [rdi + 0x10]
mov qword [rsp + 0x38], rsi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
jne 0x14003ead5
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_CloseClipboard]
cmp qword [rdi + 0x18], 0xf
jbe 0x14003eadf
mov rdi, qword [rdi]
mov rbx, qword [rbx]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea r8, [rbx + 1]
mov rdx, rdi
mov rcx, rax
call fcn.140134d20
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rsi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14003f270
Capabilities:
Initialize winhttp library

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
mov qword [rcx], rax
xor r9d, r9d
lea rcx, str.ALG_1.0
mov dword [rsp + 0x20], eax
xor r8d, r8d
mov edx, 4
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rbx], rax
mov rax, rbx
add rsp, 0x30
pop rbx
ret