joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14013b81c
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x14017b0c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r12, rcx
test rcx, rcx
je 0x14013b9cb
mov r8, qword [0x14017c760]
test r8, r8
jne 0x14013b9af
mov rax, qword gs:[0x60]
xor ebx, ebx
mov esi, 0xff447f32
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r14, qword [rax]
mov rdx, r14
movups xmm0, xmmword [rdx + 0x58]
movd eax, xmm0
sub ax, 8
test ebx, ebx
je 0x14013b8c6
psrldq xmm0, 8
mov r8d, 0x811c9dc5
movzx eax, ax
movq rcx, xmm0
shr rax, 1
lea r9, [rcx + rax*2]
jmp 0x14013b8b8
movsx eax, byte [rcx]
xor eax, r8d
imul r8d, eax, 0x1000193
add rcx, 2
cmp rcx, r9
jne 0x14013b8a7
cmp r8d, ebx
jne 0x14013b98f
mov r10, qword [rdx + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rax, qword [rax + r10 + 0x88]
mov r9d, eax
add r9, r10
shr rax, 0x20
cmp r9, r10
je 0x14013b98f
mov r8d, dword [r9 + 0x18]
test r8d, r8d
je 0x14013b98f
mov r15d, dword [r9 + 0x20]
dec r8d
mov edi, 0x811c9dc5
lea rcx, [r15 + r8*4]
mov r11d, dword [rcx + r10]
add r11, r10
jmp 0x14013b91a
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
mov cl, byte [r11]
inc r11
test cl, cl
jne 0x14013b90f
cmp edi, esi
je 0x14013b92f
test r8d, r8d
jne 0x14013b8fa
jmp 0x14013b98f
mov edx, dword [r9 + 0x24]
add rdx, r10
movzx r8d, word [rdx + r8*2]
mov edx, dword [r9 + 0x1c]
add rdx, r10
mov r8d, dword [rdx + r8*4]
add r8, r10
cmp r8, r9
jbe 0x14013b9a8
lea rcx, [rax + r9]
cmp r8, rcx
jae 0x14013b9a8
mov ebx, 0x811c9dc5
mov esi, ebx
jmp 0x14013b96e
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
inc r8
mov al, byte [r8]
cmp al, 0x2e
jne 0x14013b960
jmp 0x14013b982
movsx eax, al
xor eax, esi
imul esi, eax, 0x1000193
inc r8
mov al, byte [r8]
test al, al
jne 0x14013b977
mov rdx, qword [r14]
mov rax, qword [rdx]
mov rdx, rax
cmp rax, r14
je 0x14013b9a5
cmp qword [rax + 0x30], 0
jne 0x14013b87b
xor r8d, r8d
mov qword [0x14017c760], r8
lea rdx, [rsp + 0x20]
mov rcx, r12
call r8
test eax, eax
je 0x14013b9cb
cmp dword [rsp + 0x20], 0x103
sete al
jmp 0x14013b9cd
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140158250
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140140390
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x14017c768]
test rax, rax
jne 0x1401405aa
xor r9d, r9d
mov dword [rsp + 0x28], r9d
mov r10d, 0xc1d5565c
mov dword [rsp + 0x24], r10d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov r8, qword [rcx]
mov qword [rsp + 0x48], r8
mov r15, r8
mov qword [rsp + 0x50], r8
mov rax, r8
mov r12d, 0x811c9dc5
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rsp + 0x58], xmm0
movd eax, xmm0
sub ax, 8
mov word [rsp + 0x58], ax
test r9d, r9d
je 0x140140442
mov rcx, qword [rsp + 0x60]
movzx eax, ax
shr rax, 1
lea r11, [rcx + rax*2]
mov edx, r12d
mov qword [rsp + 0x38], rcx
cmp rcx, r11
je 0x140140439
movsx eax, byte [rcx]
xor eax, edx
imul edx, eax, 0x1000193
add rcx, 2
jmp 0x14014041e
cmp edx, r9d
jne 0x140140582
mov rdi, qword [r8 + 0x30]
mov qword [rsp + 0x68], rdi
movsxd rax, dword [rdi + 0x3c]
mov rax, qword [rax + rdi + 0x88]
mov qword [rsp + 0xb8], rax
mov ebx, eax
add rbx, rdi
mov qword [rsp + 0x70], rbx
shr rax, 0x20
mov dword [rsp + 0x78], eax
cmp rbx, rdi
je 0x140140582
mov r11d, dword [rbx + 0x18]
mov dword [rsp + 0x20], r11d
mov ecx, r11d
dec r11d
mov dword [rsp + 0x20], r11d
test ecx, ecx
je 0x140140582
mov edx, dword [rbx + 0x20]
add rdx, rdi
mov edx, dword [rdx + r11*4]
add rdx, rdi
mov qword [rsp + 0x40], rdx
mov esi, r12d
movsx ecx, byte [rdx]
inc rdx
mov qword [rsp + 0x40], rdx
test cl, cl
jne 0x140140575
cmp esi, r10d
jne 0x140140570
mov edx, dword [rbx + 0x1c]
add rdx, rdi
mov ecx, dword [rbx + 0x24]
add rcx, rdi
movzx ecx, word [rcx + r11*2]
mov r8d, dword [rdx + rcx*4]
add r8, rdi
cmp r8, rbx
jbe 0x1401405a0
lea rcx, [rbx + rax]
cmp r8, rcx
jae 0x1401405a0
mov r9d, r12d
mov dword [rsp + 0xb0], r12d
mov r10d, r12d
mov dword [rsp + 0xb4], r12d
mov ecx, r12d
mov qword [rsp + 0x30], r8
cmp byte [r8], 0x2e
je 0x140140536
movsx eax, byte [r8]
xor eax, ecx
imul r9d, eax, 0x1000193
mov dword [rsp + 0xb0], r9d
inc r8
mov ecx, r9d
jmp 0x14014050e
inc r8
mov qword [rsp + 0x30], r8
cmp byte [r8], 0
je 0x14014055c
movsx eax, byte [r8]
xor eax, r10d
imul r10d, eax, 0x1000193
mov dword [rsp + 0xb4], r10d
jmp 0x140140536
mov dword [rsp + 0x24], r10d
mov dword [rsp + 0x28], r9d
mov r8, qword [r15]
mov qword [rsp + 0x48], r8
jmp 0x140140582
jmp 0x140140483
xor ecx, esi
imul esi, ecx, 0x1000193
jmp 0x1401404ab
mov r8, qword [r8]
mov rax, r8
mov qword [rsp + 0x48], r8
cmp r8, r15
je 0x14014059d
cmp qword [r8 + 0x30], 0
jne 0x1401403f1
xor r8d, r8d
mov qword [0x14017c768], r8
mov rax, r8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x40010005
call rax
mov al, 1
jmp 0x1401405bf
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140155444
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r13d, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebx, ebx
mov rdi, rax
movsxd rcx, dword [rax + 0x3c]
mov esi, dword [rcx + rax + 0x88]
add rsi, rax
mov r14d, dword [rsi + 0x1c]
mov r12d, dword [rsi + 0x20]
add r14, rax
mov r15d, dword [rsi + 0x24]
add r12, rax
add r15, rax
cmp dword [rsi + 0x14], ebx
jbe 0x1401554ae
mov ecx, dword [r12 + rbx*4]
add rcx, rdi
call fcn.1401554dc
cmp eax, r13d
je 0x1401554cd
inc ebx
cmp ebx, dword [rsi + 0x14]
jb 0x140155496
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movzx eax, word [r15 + rbx*2]
mov eax, dword [r14 + rax*4]
add rax, rdi
jmp 0x1401554b0
Function at 0x140159218
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140159262
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140159262
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140159262
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140159262
cmp dword [rcx + 0x84], 0xe
jbe 0x140159262
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140159264
xor al, al
add rsp, 0x28
ret

Function at 0x140159474
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1401594ae
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1401594b3
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1401594fc
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1401594fc
dec r8
sub rdx, 1
jne 0x1401594e2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x14008a8b5
Capabilities:
Get mac address on windows

Disassembly:
jmp 0x140092dd0
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x1401fa247]
call fcn.14008cd09
mov dword [rbp + 0x24], 0x2c0
mov eax, dword [rbp + 0x24]
mov ecx, eax
call fcn.14008b40e
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140092e38
mov ecx, 2
call fcn.14008d182
lea rdx, str.Error_allocating_memory_n
mov rcx, rax
call fcn.14008c4bc
xor eax, eax
jmp 0x140092fde
lea rdx, [rbp + 0x24]
mov rcx, qword [rbp + 8]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x140092e89
mov rcx, qword [rbp + 8]
call fcn.14008a5fe
mov eax, dword [rbp + 0x24]
mov ecx, eax
call fcn.14008b40e
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140092e89
mov ecx, 2
call fcn.14008d182
lea rdx, str.Error_allocating_memory_n
mov rcx, rax
call fcn.14008c4bc
xor eax, eax
jmp 0x140092fde
lea rdx, [rbp + 0x24]
mov rcx, qword [rbp + 8]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x140092fd3
mov rax, qword [rbp + 8]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x140092fd3
mov rax, qword [rbp + 0x48]
cmp dword [rax + 0x194], 0
jbe 0x140092fc3
mov ecx, send
call fcn.14008b40e
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x140092f01
mov ecx, 2
call fcn.14008d182
lea rdx, str.Error_allocating_memory_n
mov rcx, rax
call fcn.14008c4bc
mov rcx, qword [rbp + 8]
call fcn.14008a5fe
xor eax, eax
jmp 0x140092fde
mov eax, 1
imul rax, rax, 5
mov rcx, qword [rbp + 0x48]
movzx eax, byte [rcx + rax + 0x198]
mov ecx, 1
imul rcx, rcx, 4
mov rdx, qword [rbp + 0x48]
movzx ecx, byte [rdx + rcx + 0x198]
mov edx, 1
imul rdx, rdx, 3
mov r8, qword [rbp + 0x48]
movzx edx, byte [r8 + rdx + 0x198]
mov r8d, 1
imul r8, r8, 2
mov r9, qword [rbp + 0x48]
movzx r8d, byte [r9 + r8 + 0x198]
mov r9d, 1
imul r9, r9, 1
mov r10, qword [rbp + 0x48]
movzx r9d, byte [r10 + r9 + 0x198]
mov r10d, 1
imul r10, r10, 0
mov r11, qword [rbp + 0x48]
movzx r10d, byte [r11 + r10 + 0x198]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r9d
mov r9d, r10d
lea r8, str._02X:_02X:_02X:_02X:_02X:_02X
mov edx, send
mov rcx, qword [rbp + 0x68]
call fcn.14008b9fe
mov rcx, qword [rbp + 8]
call fcn.14008a5fe
mov rax, qword [rbp + 0x68]
jmp 0x140092fde
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov qword [rbp + 0x48], rax
jmp 0x140092ea7
mov rcx, qword [rbp + 8]
call fcn.14008a5fe
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x1401abdb0]
call fcn.14008c214
mov rax, rdi
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x14008ab99
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1400bfef0
mov rax, rcx
neg rcx
test rax, 7
je 0x1400bff0d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1400bff68
test al, 7
jne 0x1400bff00
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1400bff21
mov rdx, qword [rax - 8]
test dl, dl
je 0x1400bff92
test dh, dh
je 0x1400bff8c
shr rdx, 0x10
test dl, dl
je 0x1400bff86
test dh, dh
je 0x1400bff80
shr rdx, 0x10
test dl, dl
je 0x1400bff7a
test dh, dh
je 0x1400bff74
shr edx, 0x10
test dl, dl
je 0x1400bff6e
test dh, dh
jne 0x1400bff21
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x14008af72
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400b0920
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400b02a0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400b095f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1401fb020]
jmp 0x1400b0969
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x14008b102
Capabilities:
Query environment variable

Disassembly:
jmp 0x140174990
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1401747c0
lea rcx, [rsp + 0x40]
call fcn.140174940
movzx eax, al
test eax, eax
jne 0x1401749d8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1401747f0
mov rax, qword [rsp + 0x70]
jmp 0x140174ba9
lea rcx, [rsp + 0x40]
call fcn.140174910
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1401748b0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.140174910
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.14008bde6
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x140174a7e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1401747f0
mov rax, qword [rsp + 0x80]
jmp 0x140174ba9
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.14008ae4b
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14008acde
lea rcx, [rsp + 0x48]
call fcn.14008a892
movzx eax, al
test eax, eax
jne 0x140174ae5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.14008991f
lea rcx, [rsp + 0x40]
call fcn.1401747f0
mov rax, qword [rsp + 0x88]
jmp 0x140174ba9
lea rcx, [rsp + 0x48]
call fcn.14008b49a
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.140174910
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.14008bde6
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x140174b7b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.14008991f
lea rcx, [rsp + 0x40]
call fcn.1401747f0
mov rax, qword [rsp + 0xa0]
jmp 0x140174ba9
lea rcx, [rsp + 0x48]
call fcn.14008acbb
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.14008991f
lea rcx, [rsp + 0x40]
call fcn.1401747f0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x14008b116
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1400b0850
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1400b0220
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400b0891
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1401fb020]
jmp 0x1400b0897
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x14008b1a7
Capabilities:
Get geographical location

Disassembly:
jmp 0x14015fc90
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.14015ebc0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14015fcf7
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1401fb030]
jmp 0x14015fd19
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.14008a829
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x14008b1bb
Capabilities:
Terminate process

Disassembly:
jmp 0x140094b20
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14008b440
Capabilities:
Print debug messages

Disassembly:
jmp 0x140192ca0
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x140192cc6
jmp 0x140192d43
mov rcx, qword [rbp + 0x30]
call fcn.14008ab99
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x140192cdf
jmp 0x140192d43
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x140192cfc
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140089a8c
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.140089f78
test eax, eax
jne 0x140192d43
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.14008adba
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x14008b6ed
Capabilities:
Create process on windows

Disassembly:
jmp 0x1401597f0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x128
lea rcx, [rsp + 0xe8]
call fcn.14008a6c1
lea rcx, [rsp + 0xb8]
call fcn.14008a6c1
lea rcx, [rsp + 0x88]
call fcn.14008a6c1
call fcn.14008b0a3
mov r8d, eax
lea rdx, [rsp + 0xe8]
mov rcx, qword [rsp + 0x130]
call fcn.14008a45a
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140159892
mov dword [rsp + 0x54], 0
lea rcx, [rsp + 0x88]
call fcn.14008aa95
lea rcx, [rsp + 0xb8]
call fcn.14008aa95
lea rcx, [rsp + 0xe8]
call fcn.14008aa95
mov eax, dword [rsp + 0x54]
jmp 0x140159a38
call fcn.14008b0a3
mov r8d, eax
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x138]
call fcn.14008a45a
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x1401598f2
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0x88]
call fcn.14008aa95
lea rcx, [rsp + 0xb8]
call fcn.14008aa95
lea rcx, [rsp + 0xe8]
call fcn.14008aa95
mov eax, dword [rsp + 0x5c]
jmp 0x140159a38
mov qword [rsp + 0x70], 0
cmp qword [rsp + 0x168], 0
je 0x140159978
call fcn.14008b0a3
mov r8d, eax
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x168]
call fcn.14008a45a
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x140159966
mov dword [rsp + 0x64], 0
lea rcx, [rsp + 0x88]
call fcn.14008aa95
lea rcx, [rsp + 0xb8]
call fcn.14008aa95
lea rcx, [rsp + 0xe8]
call fcn.14008aa95
mov eax, dword [rsp + 0x64]
jmp 0x140159a38
lea rcx, [rsp + 0x88]
call fcn.14008a626
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0xb8]
call fcn.14008a626
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0xe8]
call fcn.14008a626
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x158]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x148]
mov r8, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x88]
call fcn.14008aa95
lea rcx, [rsp + 0xb8]
call fcn.14008aa95
lea rcx, [rsp + 0xe8]
call fcn.14008aa95
mov eax, dword [rsp + 0x68]
add rsp, 0x128
ret
Function at 0x14008b891
Capabilities:
Get memory capacity

Disassembly:
jmp 0x140093090
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x1401fa247]
call fcn.14008cd09
mov dword [rbp + 0x10], 0x40
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, socket
call fcn.14008b40e
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x140093116
mov ecx, 2
call fcn.14008d182
lea rdx, str.Memory_allocation_failed_n
mov rcx, rax
call fcn.14008c4bc
mov ecx, 1
call fcn.140089465
mov r8, qword [rbp + 0x18]
lea rdx, str._llu
mov rcx, qword [rbp + 0x68]
call fcn.14008c886
mov rax, qword [rbp + 0x68]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1401abd30]
call fcn.14008c214
mov rax, rdi
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.14008adba
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret

Function at 0x14008b9db
Capabilities:
Parse pe header

Disassembly:
jmp 0x140097220
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140097240
xor al, al
jmp 0x1400972c1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140097253
xor al, al
jmp 0x1400972c1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14009727d
xor al, al
jmp 0x1400972c1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140097291
xor al, al
jmp 0x1400972c1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400972a3
xor al, al
jmp 0x1400972c1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400972bf
xor al, al
jmp 0x1400972c1
mov al, 1
add rsp, 0x38
ret
Function at 0x14008bb57
Capabilities:
Get common file path

Disassembly:
jmp 0x1401800e0
push rdi
sub rsp, 0x270
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rdx, [rsp + 0x50]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x104
ja 0x140180139
lea rcx, [rsp + 0x50]
call fcn.14017fed0
jmp 0x14018020c
mov eax, dword [rsp + 0x30]
inc eax
mov eax, eax
mov dword [rsp + 0x20], 0x25
lea r9, [0x1401d0500]
mov r8d, 2
mov edx, 2
mov ecx, eax
call fcn.14008d1ff
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14008a6f8
lea rcx, [rsp + 0x38]
call fcn.14008cc64
test rax, rax
jne 0x1401801a1
call fcn.14008a65d
mov dword [rax], recv
mov dword [rsp + 0x40], 0
lea rcx, [rsp + 0x38]
call fcn.14008c075
mov eax, dword [rsp + 0x40]
jmp 0x14018020c
lea rcx, [rsp + 0x38]
call fcn.14008cc64
mov ecx, dword [rsp + 0x30]
inc ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1401801e8
call fcn.14008a65d
mov dword [rax], recv
mov dword [rsp + 0x48], 0
lea rcx, [rsp + 0x38]
call fcn.14008c075
mov eax, dword [rsp + 0x48]
jmp 0x14018020c
lea rcx, [rsp + 0x38]
call fcn.14008cc64
mov rcx, rax
call fcn.14017fed0
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x38]
call fcn.14008c075
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14008adba
add rsp, 0x270
pop rdi
ret
Function at 0x14008bfad
Capabilities:
Terminate process

Disassembly:
jmp 0x14014e850
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14014e87e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.14008c89a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14008c90d
Capabilities:
Print debug messages

Disassembly:
jmp 0x14016d650
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret

Function at 0x14008c912
Capabilities:
Get system information on windows

Disassembly:
jmp 0x140092b60
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, socket
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x1401fa247]
call fcn.14008cd09
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rbp + 8]
cmp eax, 9
jne 0x140092baa
lea rax, [0x1401abe50]
jmp 0x140092bd9
movzx eax, word [rbp + 8]
cmp eax, 5
jne 0x140092bbe
lea rax, [0x1401abe54]
jmp 0x140092bd9
movzx eax, word [rbp + 8]
cmp eax, 6
jne 0x140092bd2
lea rax, str.IA64
jmp 0x140092bd9
lea rax, [0x1401abe60]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1401abcb0]
call fcn.14008c214
mov rax, rdi
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret