joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011780
Capabilities:
Create thread
Initialize winsock library

Disassembly:
jmp 0x14001be00
push rbp
push rdi
sub rsp, 0x3d8
lea rbp, [rsp + 0x30]
mov rdi, rsp
mov ecx, 0xf6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14003ad50]
xor rax, rbp
mov qword [rbp + 0x398], rax
mov qword [rbp + 0x1c8], 0
mov qword [rbp + 0x1e8], 0
mov qword [rbp + 0x208], 0
mov dword [0x14003b108], 0
lea rdx, [rbp + 0x10]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea rcx, [0x14003b0b0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.14001ad60
test eax, eax
jne 0x14001be88
jmp 0x14001bff4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov qword [0x14003b0a8], rax
cmp qword [0x14003b0a8], 0
jne 0x14001beb8
jmp 0x14001bff4
call fcn.14001aee0
mov qword [0x14003b0d8], 0
lea rax, [0x14003b0d8]
mov qword [0x14003b0e0], rax
xor eax, eax
test eax, eax
jne 0x14001bebd
mov qword [0x14003b0e8], 0
lea rax, [0x14003b0e8]
mov qword [0x14003b0f0], rax
xor eax, eax
test eax, eax
jne 0x14001bedc
mov qword [0x14003b0f8], 0
lea rax, [0x14003b0f8]
mov qword [0x14003b100], rax
xor eax, eax
test eax, eax
jne 0x14001befb
lea rcx, [0x14003b0d8]
call fcn.14001afa0
test eax, eax
jne 0x14001bf34
jmp 0x14001bff4
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001b480]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x1c8], rax
cmp qword [rbp + 0x1c8], 0xffffffffffffffff
jne 0x14001bf74
jmp 0x14001bff4
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001b710]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x1e8], rax
cmp qword [rbp + 0x1e8], 0xffffffffffffffff
jne 0x14001bfae
jmp 0x14001bff4
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, qword [0x14003b0a8]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0xffffffff
call fcn.14001a390
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, [0x14003b0b0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
cmp qword [0x14003b0a8], 0
je 0x14001c018
mov rcx, qword [0x14003b0a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbp + 0x1c8], 0
je 0x14001c02f
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbp + 0x1e8], 0
je 0x14001c046
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rcx, [rbp - 0x30]
lea rdx, [0x140032e40]
call fcn.14001141f
mov rcx, qword [rbp + 0x398]
xor rcx, rbp
call fcn.140011974
lea rsp, [rbp + 0x3a8]
pop rdi
pop rbp
ret
Function at 0x14001180c
Capabilities:
Enumerate network shares

Disassembly:
jmp 0x14001aa60
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x248
lea rbp, [rsp + 0x40]
mov rdi, rsp
mov ecx, 0x92
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x268]
mov rax, qword [0x14003ad50]
xor rax, rbp
mov qword [rbp + 0x1f8], rax
mov qword [rbp + 0x28], 0
mov dword [rbp + 0x44], 0
mov dword [rbp + 0x64], 0
mov dword [rbp + 0x84], 0
lea rax, [rbp + 0x84]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x44]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp + 0x28]
mov edx, 1
mov rcx, qword [rbp + 0x220]
call fcn.140011afa
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x14001ac8f
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0xa8], rax
mov dword [rbp + 0xc4], 1
jmp 0x14001ab2b
mov eax, dword [rbp + 0xc4]
inc eax
mov dword [rbp + 0xc4], eax
mov eax, dword [rbp + 0x44]
cmp dword [rbp + 0xc4], eax
ja 0x14001ac86
mov rax, qword [rbp + 0xa8]
cmp dword [rax + 8], 0
je 0x14001ab6b
mov rax, qword [rbp + 0xa8]
cmp dword [rax + 8], 0x80000000
je 0x14001ab6b
mov rax, qword [rbp + 0xa8]
cmp dword [rax + 8], 0x40000000
jne 0x14001ac6f
mov ecx, 0x7d10
call fcn.140011050
mov qword [rbp + 0xe8], rax
cmp qword [rbp + 0xe8], 0
je 0x14001ac6f
lea rdx, [0x140033908]
lea rcx, [rbp + 0x1c4]
call fcn.14001185c
mov rcx, rax
call fcn.1400111db
mov rcx, qword [rbp + 0xe8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rax, qword [rbp + 0xe8]
mov rdx, qword [rbp + 0x220]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x140033910]
lea rcx, [rbp + 0x1e4]
call fcn.14001114f
mov rcx, rax
call fcn.140011082
mov rcx, qword [rbp + 0xe8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rax, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xa8]
mov rdx, qword [rcx]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rax, qword [rbp + 0xe8]
mov qword [rax + 0x7d00], 0
mov rax, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0x228]
mov rcx, qword [rcx + 8]
mov qword [rax + 0x7d08], rcx
mov rax, qword [rbp + 0x228]
mov rax, qword [rax + 8]
mov rcx, qword [rbp + 0xe8]
mov qword [rax], rcx
mov rax, qword [rbp + 0xe8]
add rax, 0x7d00
mov rcx, qword [rbp + 0x228]
mov qword [rcx + 8], rax
xor eax, eax
test eax, eax
jne 0x14001ac11
mov rax, qword [rbp + 0xa8]
add rax, 0x18
mov qword [rbp + 0xa8], rax
jmp 0x14001ab1d
mov rcx, qword [rbp + 0x28]
call fcn.1400113c0
cmp dword [rbp + 4], 0xea
je 0x14001aac0
lea rcx, [rbp - 0x40]
lea rdx, [0x140032f90]
call fcn.14001141f
mov rcx, qword [rbp + 0x1f8]
xor rcx, rbp
call fcn.140011974
lea rsp, [rbp + 0x208]
pop rdi
pop rbp
ret
Function at 0x1400118ac
Capabilities:
Get disk information

Disassembly:
jmp 0x140014ff0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x7a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov dword [rbp + 4], 0
mov dword [rbp + 0x24], 0
mov dword [rbp + 0x44], 0
mov rax, qword [rbp + 0x1e0]
mov qword [rax], 0
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x1e0]
mov qword [rcx + 8], rax
xor eax, eax
test eax, eax
jne 0x14001502f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov eax, eax
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x140015073
xor eax, eax
jmp 0x1400151db
mov rax, qword [rbp + 0x68]
lea rax, [rax + rax + 2]
mov rcx, rax
call fcn.140011050
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jne 0x14001509c
xor eax, eax
jmp 0x1400151db
mov rdx, qword [rbp + 0x88]
mov ecx, dword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0xa8], rax
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1400151cc
mov ecx, gethostname
call fcn.14001121c
mov qword [rbp + 0x1a8], rax
cmp qword [rbp + 0x1a8], 0
je 0x140015104
mov rcx, qword [rbp + 0x1a8]
call fcn.1400114ba
mov qword [rbp + 0x1b8], rax
jmp 0x14001510f
mov qword [rbp + 0x1b8], 0
mov rax, qword [rbp + 0x1b8]
mov qword [rbp + 0xc8], rax
cmp qword [rbp + 0xc8], 0
jne 0x14001513a
mov rcx, qword [rbp + 0x88]
call fcn.14001107d
xor eax, eax
jmp 0x1400151db
mov rax, qword [rbp + 0xc8]
mov rdx, qword [rbp + 0xa8]
mov rcx, rax
call fcn.140011a19
mov rax, qword [rbp + 0xc8]
mov qword [rax + 0x28], 0
mov rax, qword [rbp + 0xc8]
mov rcx, qword [rbp + 0x1e0]
mov rcx, qword [rcx + 8]
mov qword [rax + 0x30], rcx
mov rax, qword [rbp + 0x1e0]
mov rax, qword [rax + 8]
mov rcx, qword [rbp + 0xc8]
mov qword [rax], rcx
mov rax, qword [rbp + 0xc8]
add rax, 0x28
mov rcx, qword [rbp + 0x1e0]
mov qword [rcx + 8], rax
xor eax, eax
test eax, eax
jne 0x140015150
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 4]
inc eax
cdqe
mov rcx, qword [rbp + 0xa8]
lea rax, [rcx + rax*2]
mov qword [rbp + 0xa8], rax
jmp 0x1400150ba
mov rcx, qword [rbp + 0x88]
call fcn.14001107d
mov eax, dword [rbp + 0x24]
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x140011acd
Capabilities:
Clear file content
Encrypt or decrypt via wincrypt

Disassembly:
jmp 0x140017de0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x30]
mov rdi, rsp
mov ecx, 0x66
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1b8]
mov rax, qword [0x14003ad50]
xor rax, rbp
mov qword [rbp + 0x158], rax
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
mov dword [rbp + 0x44], 0
mov rcx, qword [rbp + 0x180]
call fcn.1400189d0
test eax, eax
jne 0x140017e57
xor eax, eax
jmp 0x14001800d
mov dword [rbp + 0x64], 0x20c
mov rax, qword [rbp + 0x180]
add rax, 0x8c
lea rcx, [rbp + 0x64]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x140017e9c
xor eax, eax
jmp 0x14001800d
mov rax, qword [rbp + 0x180]
add rax, 0x8c
mov rcx, qword [rbp + 0x180]
add rcx, 0x20
mov r8d, 0x20
mov rdx, rax
call fcn.140011212
mov rax, qword [rbp + 0x180]
add rax, 0xac
mov rcx, qword [rbp + 0x180]
add rcx, 0x40
mov r8d, 8
mov rdx, rax
call fcn.140011212
mov rax, qword [rbp + 0x180]
add rax, 0x20
mov rcx, qword [rbp + 0x180]
add rcx, 0x4c
mov r9d, 0x40
mov r8d, pe_nt_image_headers64
mov rdx, rax
call fcn.14001173f
mov rax, qword [rbp + 0x180]
add rax, 0x40
mov rcx, qword [rbp + 0x180]
add rcx, 0x4c
mov rdx, rax
call fcn.14001123a
mov rax, qword [rbp + 0x180]
movzx eax, byte [rax + 0x48]
cmp eax, 0x24
jne 0x140017f5f
mov r8, qword [rbp + 0x190]
mov rdx, qword [rbp + 0x188]
mov rcx, qword [rbp + 0x180]
call fcn.1400180e0
mov dword [rbp + 0x44], eax
jmp 0x140017fc9
mov rax, qword [rbp + 0x180]
movzx eax, byte [rax + 0x48]
cmp eax, 0x25
jne 0x140017f9c
mov rax, qword [rbp + 0x180]
movzx eax, byte [rax + 0x49]
mov r9d, eax
mov r8, qword [rbp + 0x190]
mov rdx, qword [rbp + 0x188]
mov rcx, qword [rbp + 0x180]
call fcn.1400185b0
mov dword [rbp + 0x44], eax
jmp 0x140017fc9
mov rax, qword [rbp + 0x180]
movzx eax, byte [rax + 0x48]
cmp eax, 0x26
jne 0x140017fc9
mov r8, qword [rbp + 0x190]
mov rdx, qword [rbp + 0x188]
mov rcx, qword [rbp + 0x180]
call fcn.140018350
mov dword [rbp + 0x44], eax
mov qword [rbp + 0x88], 0xfffffffffffffdea
mov r9d, 2
xor r8d, r8d
mov rdx, qword [rbp + 0x88]
mov rax, qword [rbp + 0x180]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001800a
mov rax, qword [rbp + 0x180]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [rbp + 0x44]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_bind
call fcn.14001141f
mov rax, rdi
mov rcx, qword [rbp + 0x158]
xor rcx, rbp
call fcn.140011974
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x1400180e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1f8
lea rbp, [rsp + 0x30]
mov rdi, rsp
mov ecx, 0x7e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x218]
mov rax, qword [0x14003ad50]
xor rax, rbp
mov qword [rbp + 0x1b8], rax
mov dword [rbp + 4], 0
mov dword [rbp + 0x24], 0
mov dword [rbp + 0x44], 0
mov dword [rbp + 0x64], 0
mov qword [rbp + 0x88], 0
mov rax, qword [rbp + 0x1e0]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
cmp qword [rbp + 0x88], rax
jge 0x140018299
mov rax, qword [rbp + 0x88]
mov rcx, qword [rbp + 0xa8]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0xe8], rax
cmp qword [rbp + 0xe8], 0x500000
jle 0x1400181a6
mov dword [rbp + 0x1b4], 0x500000
jmp 0x1400181b2
mov eax, dword [rbp + 0xe8]
mov dword [rbp + 0x1b4], eax
mov eax, dword [rbp + 0x1b4]
mov dword [rbp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x44]
mov rdx, qword [rbp + 0x1e8]
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1400181f3
cmp dword [rbp + 0x24], 0
jne 0x1400181f8
jmp 0x140018299
mov eax, dword [rbp + 0x24]
mov rcx, qword [rbp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov eax, dword [rbp + 0x24]
mov dword [rbp + 0x64], eax
mov rax, qword [rbp + 0x1e0]
add rax, 0x4c
mov r9d, dword [rbp + 0x24]
mov r8, qword [rbp + 0x1e8]
mov rdx, qword [rbp + 0x1e8]
mov rcx, rax
call fcn.140011451
mov eax, dword [rbp + 0x24]
neg rax
mov qword [rbp + 0xc8], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp + 0xc8]
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x14001826e
jmp 0x140018299
mov r8d, dword [rbp + 0x64]
mov rdx, qword [rbp + 0x1e8]
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rax + 8]
call fcn.140018d60
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x140018294
jmp 0x140018299
jmp 0x14001815e
mov eax, 1
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_bind
call fcn.14001141f
mov eax, edi
mov rcx, qword [rbp + 0x1b8]
xor rcx, rbp
call fcn.140011974
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x140018350
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1f8
lea rbp, [rsp + 0x30]
mov rdi, rsp
mov ecx, 0x7e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x218]
mov rax, qword [0x14003ad50]
xor rax, rbp
mov qword [rbp + 0x1b8], rax
mov dword [rbp + 4], 0
mov dword [rbp + 0x24], 0
mov dword [rbp + 0x44], 0
mov dword [rbp + 0x64], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0xa8], 0x100000
mov rax, qword [rbp + 0xa8]
cmp qword [rbp + 0x88], rax
jge 0x140018502
mov rax, qword [rbp + 0x88]
mov rcx, qword [rbp + 0xa8]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0xe8], rax
cmp qword [rbp + 0xe8], 0x500000
jle 0x14001840f
mov dword [rbp + 0x1b4], 0x500000
jmp 0x14001841b
mov eax, dword [rbp + 0xe8]
mov dword [rbp + 0x1b4], eax
mov eax, dword [rbp + 0x1b4]
mov dword [rbp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x44]
mov rdx, qword [rbp + 0x1e8]
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x14001845c
cmp dword [rbp + 0x24], 0
jne 0x140018461
jmp 0x140018502
mov eax, dword [rbp + 0x24]
mov rcx, qword [rbp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov eax, dword [rbp + 0x24]
mov dword [rbp + 0x64], eax
mov rax, qword [rbp + 0x1e0]
add rax, 0x4c
mov r9d, dword [rbp + 0x24]
mov r8, qword [rbp + 0x1e8]
mov rdx, qword [rbp + 0x1e8]
mov rcx, rax
call fcn.140011451
mov eax, dword [rbp + 0x24]
neg rax
mov qword [rbp + 0xc8], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp + 0xc8]
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1400184d7
jmp 0x140018502
mov r8d, dword [rbp + 0x64]
mov rdx, qword [rbp + 0x1e8]
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rax + 8]
call fcn.140018d60
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x1400184fd
jmp 0x140018502
jmp 0x1400183c7
mov eax, 1
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_bind
call fcn.14001141f
mov eax, edi
mov rcx, qword [rbp + 0x1b8]
xor rcx, rbp
call fcn.140011974
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x1400189d0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x40]
mov rdi, rsp
mov ecx, 0x52
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14003ad50]
xor rax, rbp
mov qword [rbp + 0xf8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rax, qword [rbp + 0x120]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rbp + 0x120]
mov qword [rcx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x120]
cmp qword [rax + 8], 0xffffffffffffffff
jne 0x140018a65
xor eax, eax
jmp 0x140018ada
lea rdx, [rbp + 0x28]
mov rax, qword [rbp + 0x120]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140018a8f
cmp qword [rbp + 0x28], 0
je 0x140018a8f
cmp qword [rbp + 0x28], 0x216
jge 0x140018a9f
mov rcx, qword [rbp + 0x120]
call fcn.140011a87
xor eax, eax
jmp 0x140018ada
mov rcx, qword [rbp + 0x120]
call fcn.140018b60
test eax, eax
jne 0x140018abf
mov rcx, qword [rbp + 0x120]
call fcn.140011a87
xor eax, eax
jmp 0x140018ada
mov rax, qword [rbp + 0x120]
mov rcx, qword [rbp + 0x120]
mov rcx, qword [rcx + 0x18]
mov qword [rax + 0x10], rcx
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140032880]
call fcn.14001141f
mov rax, rdi
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.140011974
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x140018b60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x30]
mov rdi, rsp
mov ecx, 0x62
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1a8]
mov rax, qword [0x14003ad50]
xor rax, rbp
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x48], 0xfffffffffffffdea
mov r9d, 2
xor r8d, r8d
mov rdx, qword [rbp + 0x48]
mov rax, qword [rbp + 0x170]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x140018bcc
xor eax, eax
jmp 0x140018cc4
mov rax, qword [rbp + 0x170]
add rax, 0x8c
mov qword [rsp + 0x20], 0
lea r9, [rbp + 4]
mov r8d, 0x20c
mov rdx, rax
mov rax, qword [rbp + 0x170]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
je 0x140018c12
cmp dword [rbp + 4], 0x20c
je 0x140018c19
xor eax, eax
jmp 0x140018cc4
mov qword [rsp + 0x20], 0
lea r9, [rbp + 4]
mov r8d, 0xa
lea rdx, [rbp + 0x68]
mov rax, qword [rbp + 0x170]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
je 0x140018c50
cmp dword [rbp + 4], 0xa
je 0x140018c54
xor eax, eax
jmp 0x140018cc4
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x170]
movzx eax, byte [rbp + rax + 0x68]
mov byte [rcx + 0x48], al
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x170]
movzx eax, byte [rbp + rax + 0x68]
mov byte [rcx + 0x49], al
lea rax, [rbp + 0x6a]
mov rcx, qword [rbp + 0x170]
add rcx, 0x18
mov r8d, 8
mov rdx, rax
call fcn.140011212
mov qword [rbp + 0x48], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x48]
mov rax, qword [rbp + 0x170]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.14001141f
mov rax, rdi
mov rcx, qword [rbp + 0x148]
xor rcx, rbp
call fcn.140011974
lea rsp, [rbp + 0x158]
pop rdi
pop rbp
ret
Function at 0x140018d60
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x30]
mov rdi, rsp
mov ecx, 0x5e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x198]
mov rax, qword [0x14003ad50]
xor rax, rbp
mov qword [rbp + 0x138], rax
mov dword [rbp + 4], 0
mov dword [rbp + 0x24], 0
mov eax, dword [rbp + 0x170]
mov dword [rbp + 0x44], eax
mov dword [rbp + 0x64], 0
mov eax, dword [rbp + 0x170]
cmp dword [rbp + 4], eax
je 0x140018e36
mov eax, dword [rbp + 0x64]
mov rcx, qword [rbp + 0x168]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x44]
mov rdx, rax
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140018e09
cmp dword [rbp + 0x24], 0
jne 0x140018e0d
xor eax, eax
jmp 0x140018e3b
mov eax, dword [rbp + 0x24]
mov ecx, dword [rbp + 0x64]
add ecx, eax
mov eax, ecx
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x24]
mov ecx, dword [rbp + 4]
add ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 0x24]
mov ecx, dword [rbp + 0x44]
sub ecx, eax
mov eax, ecx
mov dword [rbp + 0x44], eax
jmp 0x140018dc3
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140032900]
call fcn.14001141f
mov rax, rdi
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.140011974
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret

Function at 0x14001a5c0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x30]
mov rdi, rsp
mov ecx, 0x56
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x178]
mov rax, qword [0x14003ad50]
xor rax, rbp
mov qword [rbp + 0x118], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x7010
mov edx, 0xffff
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x14001a62b
xor eax, eax
jmp 0x14001a673
mov dword [rbp + 0x44], 4
lea rax, [rbp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x24]
mov r8d, 0x700c
mov edx, 0xffff
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.WS2_32.dll_getsockopt]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x14001a664
xor eax, eax
jmp 0x14001a673
cmp dword [rbp + 0x24], 0xffffffff
jne 0x14001a66e
xor eax, eax
jmp 0x14001a673
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_bind
call fcn.14001141f
mov rax, rdi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.140011974
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x14001aee0
Capabilities:
Get hostname
Resolve dns

Disassembly:
push rbp
push rdi
sub rsp, 0x228
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x8a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14003ad50]
xor rax, rbp
mov qword [rbp + 0x1f8], rax
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x10]
call qword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x14001af27
xor eax, eax
jmp 0x14001af48
lea rcx, [rbp + 0x10]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [0x14003b098], rax
cmp qword [0x14003b098], 0
jne 0x14001af46
xor eax, eax
jmp 0x14001af48
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_bind
call fcn.14001141f
mov rax, rdi
mov rcx, qword [rbp + 0x1f8]
xor rcx, rbp
call fcn.140011974
lea rsp, [rbp + 0x208]
pop rdi
pop rbp
ret

Function at 0x1400273c0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x298
lea rbp, [rsp + 0x30]
mov rdi, rsp
mov ecx, 0xa6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2b8]
lea rdx, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
lea rcx, [rbp + 0xe8]
call fcn.140011177
mov rcx, rax
call fcn.14001132a
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
mov r8, rax
xor edx, edx
mov rcx, qword [rbp + 0x280]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x140027438
mov eax, 1
jmp 0x140027512
lea rdx, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
lea rcx, [rbp + 0x138]
call fcn.14001127b
mov rcx, rax
call fcn.1400114d8
mov dword [rsp + 0x20], 0xf0000008
mov r9d, 0x18
mov r8, rax
xor edx, edx
mov rcx, qword [rbp + 0x280]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x140027486
mov eax, 1
jmp 0x140027512
lea rdx, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
lea rcx, [rbp + 0x190]
call fcn.1400113ac
mov rcx, rax
call fcn.1400113f2
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
mov r8, rax
xor edx, edx
mov rcx, qword [rbp + 0x280]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1400274d1
mov eax, 1
jmp 0x140027512
lea rdx, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
lea rcx, [rbp + 0x200]
call fcn.140011988
mov rcx, rax
call fcn.14001157d
mov dword [rsp + 0x20], 0xf0000008
mov r9d, 0x18
mov r8, rax
xor edx, edx
mov rcx, qword [rbp + 0x280]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0x268]
pop rdi
pop rbp
ret