joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e8dd0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x007f1918]
cmp byte [rax + 0x159], 0
jne 0x6e8e70
cmp qword [0x007f1950], 0
jne 0x6e8e16
call sub.kernel32.dll_GetCurrentThreadId_1
mov ecx, 3
mov rdx, qword [0x007d9a48]
xor r8, r8
mov r9d, eax
call sub.user32.dll_SetWindowsHookExW
mov qword [0x007f1950], rax
cmp qword [0x007f1948], 0
jne 0x6e8e36
xor ecx, ecx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_CreateEventW
mov qword [0x007f1948], rax
cmp qword [0x007f1958], 0
jne 0x6e8e70
xor ecx, ecx
mov edx, 0x3e8
mov r8, qword [0x007d9a40]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread_1
mov qword [0x007f1958], rax
add rsp, 0x48
ret

Function at 0x6ea0a0
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
mov rax, qword [rbx + 0x2d0]
test rax, rax
je 0x6ea181
cmp dword [rbx + 0x128], 0
jne 0x6ea177
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], dl
lea rcx, [0x006e9f90]
lea rdx, [rbp + 0x40]
call sub.user32.dll_EnumWindows
mov rax, qword [rbx + 0x120]
cmp dword [rax + 0x10], 0
je 0x6ea177
mov rcx, qword [rbp + 0x40]
mov edx, 3
call sub.user32.dll_GetWindow
mov qword [rbp + 0x40], rax
mov rcx, qword [rbp + 0x40]
mov edx, 0xffffffec
call fcn.00424060
test rax, 8
je 0x6ea125
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rax, qword [rbx + 0x120]
mov esi, dword [rax + 0x10]
sub esi, 1
test esi, esi
jl 0x6ea176
mov rcx, qword [rbx + 0x120]
mov edx, esi
call fcn.005032a0
mov rcx, rax
mov rdx, qword [rbp + 0x40]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x213
call sub.user32.dll_SetWindowPos
sub esi, 1
cmp esi, 0xffffffff
jne 0x6ea136
nop
lea rax, [rbx + 0x128]
add dword [rax], 1
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6ea550
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rsp
mov rbx, rcx
mov esi, edx
mov rax, qword [0x007f1918]
cmp qword [rax + 0x2d0], 0
je 0x6ea729
test sil, sil
jne 0x6ea648
cmp dword [rbx + 0x138], 0
jne 0x6ea639
mov rcx, rbx
call fcn.006ee9f0
lea rcx, [0x006ea3f0]
mov rdx, rax
call sub.user32.dll_EnumWindows
cmp qword [rbx + 0xa8], 0
je 0x6ea5fb
mov rax, qword [0x007f1918]
cmp byte [rax + 0x193], 0
je 0x6ea5fb
mov rax, qword [rbx + 0x1a0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
test rax, rax
je 0x6ea5d5
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6ea5fa
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
xor edx, edx
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6ea5dd
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6ea638
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.005032a0
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6ea60c
nop
lea rax, [rbx + 0x138]
add dword [rax], 1
jmp 0x6ea729
cmp dword [rbx + 0x138], 0
jle 0x6ea729
lea rax, [rbx + 0x138]
sub dword [rax], 1
cmp dword [rbx + 0x138], 0
jne 0x6ea729
cmp qword [rbx + 0xa8], 0
je 0x6ea6c8
mov rax, qword [0x007f1918]
cmp byte [rax + 0x193], 0
je 0x6ea6c8
mov rax, qword [rbx + 0x1a0]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x6ea69e
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6ea6c7
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
mov edx, 5
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6ea6a6
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6ea705
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.005032a0
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6ea6d9
nop
mov rax, qword [rbx + 0x130]
mov rcx, rax
mov rsi, qword [rax]
call qword [rsi + 0x10]
lea rcx, [rbx + 0x1a0]
mov rdx, qword [0x006d47c0]
call fcn.00414cf0
lea rsp, [rbp + 0x38]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x6eb8c0
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x220
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [rbx + 0x158], 0
je 0x6eb92d
cmp byte [rbx + 0x193], 0
jne 0x6eb92d
mov rcx, qword [rbx + 0x2d0]
lea rdx, [rbp + 0x20]
mov r8d, pe_nt_image_headers64
call sub.user32.dll_GetWindowTextW
mov rcx, rsi
lea rdx, [rbp + 0x20]
mov r8d, eax
call fcn.00411620
xor eax, eax
mov rcx, qword [rsi]
test rcx, rcx
je 0x6eb918
mov eax, dword [rcx - 4]
test eax, eax
jne 0x6eb93c
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.00411990
jmp 0x6eb93c
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.00411990
mov rax, rsi
lea rsp, [rbp + 0x220]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6f7a40
Capabilities:
Hide graphical window

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
cmp qword [rbx + 0xc0], 0
jne 0x6f7af3
mov rcx, qword [rbx + 0x10]
call fcn.005db1d0
mov rcx, qword [0x005f59b8]
mov dl, 1
mov r8, rax
call fcn.005d2570
mov qword [rbx + 0xc0], rax
mov rsi, qword [rbx + 0xc0]
mov rcx, rsi
xor edx, edx
call fcn.00605ff0
lea rax, [rsi + 0x4b8]
mov qword [rax + 8], rbx
lea rcx, [0x006f70b0]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xc0]
call fcn.005db1d0
mov rsi, rax
mov ecx, 3
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor edx, edx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xc0]
call fcn.005db1d0
mov rcx, rax
xor edx, edx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xe0], 0
jne 0x6f7b9c
mov rcx, qword [rbx + 0x10]
call fcn.005db1d0
mov rcx, qword [0x005f59b8]
mov dl, 1
mov r8, rax
call fcn.005d2570
mov qword [rbx + 0xe0], rax
mov rsi, qword [rbx + 0xe0]
mov rcx, rsi
mov dl, 1
call fcn.00605ff0
lea rax, [rsi + 0x4b8]
mov qword [rax + 8], rbx
lea rcx, [0x006f7110]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xe0]
call fcn.005db1d0
mov rsi, rax
mov ecx, 2
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor edx, edx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xe0]
call fcn.005db1d0
mov rcx, rax
xor edx, edx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xd0], 0
jne 0x6f7c36
mov rcx, qword [rbx + 0x10]
call fcn.005db1d0
mov rcx, qword [0x005f7e88]
mov dl, 1
mov r8, rax
call fcn.005d2570
mov qword [rbx + 0xd0], rax
mov rax, qword [rbx + 0xd0]
mov byte [rax + 0x488], 1
mov rcx, qword [rbx + 0xd0]
call fcn.005db1d0
mov rsi, rax
mov ecx, 2
call sub.user32.dll_GetSystemMetrics
mov edi, eax
mov ecx, 3
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor edx, edx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xd0]
call fcn.005db1d0
mov rcx, rax
xor edx, edx
call sub.user32.dll_ShowWindow
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
Function at 0x72bf70
Capabilities:
Hash data with crc32

Disassembly:
xor ecx, ecx
lea rdx, [0x007f1a00]
mov eax, ecx
mov r8d, 8
mov r9d, eax
and r9d, 1
test r9b, r9b
je 0x72bf99
shr eax, 1
xor eax, 0xedb88320
jmp 0x72bf9c
shr eax, 1
sub r8d, 1
test r8d, r8d
jne 0x72bf82
nop
mov dword [rdx], eax
add ecx, 1
add rdx, 4
cmp ecx, 0x100
jne 0x72bf79
nop
mov byte [0x007f1e00], 1
ret

Function at 0x72bfc0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rdx
mov esi, r8d
mov edi, ecx
cmp byte [0x007f1e00], 0
jne 0x72bfdd
call fcn.0072bf70
xor ecx, ecx
mov edx, esi
sub edx, 1
mov eax, ecx
cmp eax, edx
jg 0x72c023
sub edx, ecx
add edx, 1
lea rcx, [0x007f1a00]
movsxd r8, eax
movzx r8, byte [rbx + r8]
mov r9d, edi
xor r9d, r8d
and r9d, 0xff
mov r9d, r9d
shr edi, 8
mov ecx, dword [rcx + r9*4]
xor ecx, edi
mov edi, ecx
add eax, 1
sub edx, 1
test edx, edx
jne 0x72bfef
nop
mov eax, edi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x7556e0
Capabilities:
Initialize winsock library

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x38], 0
nop
mov cx, 0x101
lea rdx, [0x007f1e38]
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x755761
lea rcx, [rbp + 0x38]
mov edx, ebx
xor r8, r8
call fcn.0043eff0
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], 0x11
mov dword [rbp + 0x50], ebx
mov byte [rbp + 0x58], 0
lea rax, [0x007557a4]
mov qword [rbp + 0x60], rax
mov byte [rbp + 0x68], 0x11
mov rcx, qword [0x007532c0]
mov dl, 1
mov r8, qword [0x007e52a8]
lea r9, [rbp + 0x40]
mov dword [rsp + 0x20], 2
call fcn.00441210
mov rcx, rax
call fcn.00410490
nop
lea rcx, [rbp + 0x38]
call fcn.00411360
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret

Function at 0x756280
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x30
mov rbp, rsp
mov rbx, rcx
xor esi, esi
xor eax, eax
movzx rcx, byte [rbx + 0x40]
cmp cl, byte [0x007562f0]
je 0x7562ac
mov esi, 0x401
mov rcx, rbx
call fcn.00756470
mov rcx, qword [rbx + 8]
mov rdx, rax
mov r8d, esi
movzx r9, byte [rbx + 0x40]
call sub.wsock32.dll_WSAAsyncSelect
movzx rax, byte [rbx + 0x40]
cmp al, byte [0x007562f0]
jne 0x7562e7
mov dword [rbp + 0x2c], 0
mov rcx, qword [rbx + 8]
mov edx, 0x8004667e
lea r8, [rbp + 0x2c]
call sub.wsock32.dll_ioctlsocket
lea rsp, [rbp + 0x30]
pop rbx
pop rsi
pop rbp
ret

Function at 0x7563c0
Capabilities:
Connect socket

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, rbx
call fcn.00756280
mov rcx, rbx
or edx, 0xffffffff
call fcn.0040e5b0
mov rsi, rax
mov rcx, rbx
mov rdx, rbx
mov r8b, 1
call rsi
mov rcx, qword [rbx + 8]
lea rdx, [rbx + 0x30]
mov r8d, 0x10
call sub.wsock32.dll_connect
mov ecx, eax
lea rdx, [0x00756454]
call fcn.007555e0
mov byte [rbx + 0x41], 0
movzx rax, byte [rbx + 0x40]
test al, 0x10
jne 0x75643e
cmp qword [rbx + 8], 0xffffffffffffffff
setne al
mov byte [rbx + 0x10], al
mov rcx, rbx
or edx, 0xffffffff
call fcn.0040e5b0
mov rsi, rax
mov rcx, rbx
mov rdx, rbx
mov r8b, 2
call rsi
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x756a00
Capabilities:
Resolve dns

Disassembly:
push rbp
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], 0
nop
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x20]
xor r8, r8
call fcn.004122d0
mov rcx, qword [rbp + 0x28]
call fcn.004121e0
mov rcx, rax
call sub.wsock32.dll_gethostbyname
mov rbx, rax
lea rcx, [rbp + 0x38]
mov edx, 4
xor r8, r8
call fcn.0040c500
test rbx, rbx
je 0x756a77
mov rax, qword [rbx + 0x18]
mov rax, qword [rax]
movzx rcx, byte [rax]
mov byte [rbp + 0x38], cl
movzx rcx, byte [rax + 1]
mov byte [rbp + 0x39], cl
movzx rcx, byte [rax + 2]
mov byte [rbp + 0x3a], cl
movzx rax, byte [rax + 3]
mov byte [rbp + 0x3b], al
mov eax, dword [rbp + 0x38]
mov dword [rbp + 0x3c], eax
nop
lea rcx, [rbp + 0x28]
call fcn.004113b0
mov eax, dword [rbp + 0x3c]
lea rsp, [rbp + 0x48]
pop rbx
pop rbp
ret
Function at 0x7572e0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rbx
mov byte [rsp - 0x58], 0
mov byte [rsp - 0x1058], 0
sub rsp, 0x1058
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x1070], rcx
mov rcx, qword [rbp + 0x1070]
call fcn.00756030
nop
mov byte [rbp + 0x104f], 0
mov rax, qword [rbp + 0x1070]
cmp qword [rax + 0x18], 0
je 0x7574ba
mov rax, qword [rbp + 0x1070]
cmp qword [rax + 8], 0xffffffffffffffff
je 0x7574c9
mov rax, qword [rbp + 0x1070]
cmp byte [rax + 0x10], 0
je 0x7574c9
mov rax, qword [rbp + 0x1070]
mov rcx, qword [rax + 0x18]
call fcn.0050ac80
mov dword [rbp + 0x48], eax
mov rax, qword [rbp + 0x1070]
mov rax, qword [rax + 0x18]
mov rcx, rax
lea rdx, [rbp + 0x4f]
mov r8d, 0x1000
mov rax, qword [rax]
call qword [rax + 0x18]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
jle 0x7574aa
mov rax, qword [rbp + 0x1070]
mov rcx, qword [rax + 8]
lea rdx, [rbp + 0x4f]
mov r8d, dword [rbp + 0x44]
xor r9, r9
call sub.wsock32.dll_send
mov dword [rbp + 0x40], eax
cmp dword [rbp + 0x40], 0xffffffff
jne 0x75744b
call sub.wsock32.dll_WSAGetLastError
mov dword [rbp + 0x3c], eax
cmp dword [rbp + 0x3c], 0x2733
je 0x757435
mov rcx, qword [rbp + 0x1070]
mov dx, 0xfffe
call fcn.0040e5b0
mov rbx, rax
mov rcx, qword [rbp + 0x1070]
lea esi, [rax + 0x10]
add byte [rax], al
mov rax, qword [rbp + 0x1070]
mov rcx, qword [rax + 0x18]
movsxd rdx, dword [rbp + 0x48]
call fcn.0050aca0
jmp 0x7574b2
mov eax, dword [rbp + 0x44]
cmp eax, dword [rbp + 0x40]
jle 0x757471
mov rax, qword [rbp + 0x1070]
mov rcx, qword [rax + 0x18]
mov edx, dword [rbp + 0x48]
add edx, dword [rbp + 0x40]
movsxd rdx, edx
call fcn.0050aca0
jmp 0x75734d
mov rax, qword [rbp + 0x1070]
mov rcx, qword [rax + 0x18]
call fcn.0050ac80
mov rbx, rax
mov rax, qword [rbp + 0x1070]
mov rax, qword [rax + 0x18]
mov rcx, rax
mov rax, qword [rax]
call qword [rax]
cmp rbx, rax
jne 0x75734d
mov rcx, rbp
call fcn.00757270
jmp 0x7574b2
mov rcx, rbp
call fcn.00757270
xor ecx, ecx
mov rdx, qword [rbp + 0x28]
call fcn.007574f0
Function at 0x757560
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rbx
sub rsp, 0x88
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x68], rbp
mov qword [rbp + 0xa0], rcx
mov qword [rbp + 0xa8], rdx
mov dword [rbp + 0xb0], r8d
nop
mov rcx, qword [rbp + 0xa0]
call fcn.00756030
nop
mov dword [rbp + 0x7c], 0
mov rax, qword [rbp + 0xa0]
cmp byte [rax + 0x10], 0
je 0x7576b1
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rax + 8]
mov rdx, qword [rbp + 0xa8]
mov r8d, dword [rbp + 0xb0]
xor r9, r9
call sub.wsock32.dll_send
mov dword [rbp + 0x7c], eax
cmp dword [rbp + 0x7c], 0xffffffff
jne 0x7576a2
call sub.wsock32.dll_WSAGetLastError
mov dword [rbp + 0x78], eax
cmp dword [rbp + 0x78], 0x2733
je 0x7576a2
mov rcx, qword [rbp + 0xa0]
mov dx, 0xfffe
call fcn.0040e5b0
mov rbx, rax
mov rcx, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0xa0]
mov r8b, 1
lea r9, [rbp + 0x78]
call rbx
mov rcx, qword [rbp + 0xa0]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rax + 8]
mov rax, qword [rbp + 0xa0]
mov rbx, qword [rax]
call qword [rbx + 0x10]
cmp dword [rbp + 0x78], 0
je 0x7576a2
lea rcx, [rbp + 0x30]
mov edx, dword [rbp + 0x78]
xor r8, r8
call fcn.0043eff0
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x38], rax
mov byte [rbp + 0x40], 0x11
mov eax, dword [rbp + 0x78]
mov dword [rbp + 0x48], eax
mov byte [rbp + 0x50], 0
lea rax, [0x00757724]
mov qword [rbp + 0x58], rax
mov byte [rbp + 0x60], 0x11
mov rcx, qword [0x007532c0]
mov dl, 1
mov r8, qword [0x007e52a8]
lea r9, [rbp + 0x38]
mov dword [rsp + 0x20], 2
call fcn.00441210
mov rcx, rax
call fcn.00410490
nop
mov rcx, qword [rbp + 0xa0]
call fcn.00756050
jmp 0x7576be
xor ecx, ecx
mov rdx, qword [rbp + 0x68]
call fcn.007576e0
jmp 0x7576bf
nop
lea rcx, [rbp + 0x30]
call fcn.00411360
mov eax, dword [rbp + 0x7c]
lea rsp, [rbp + 0x88]
pop rbx
pop rbp
ret
Function at 0x7577a0
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push rbp
push rbx
sub rsp, 0x88
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x68], rbp
mov qword [rbp + 0xa0], rcx
mov qword [rbp + 0xa8], rdx
mov dword [rbp + 0xb0], r8d
nop
mov rcx, qword [rbp + 0xa0]
call fcn.00756030
nop
mov dword [rbp + 0x7c], 0
cmp dword [rbp + 0xb0], 0xffffffff
jne 0x757817
mov rax, qword [rbp + 0xa0]
cmp byte [rax + 0x10], 0
je 0x757817
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rax + 8]
mov edx, 0x4004667f
lea r8, [rbp + 0x7c]
call sub.wsock32.dll_ioctlsocket
jmp 0x75794f
mov rax, qword [rbp + 0xa0]
cmp byte [rax + 0x10], 0
je 0x75795e
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rax + 8]
mov edx, 0x4004667f
lea r8, [rbp + 0x74]
call sub.wsock32.dll_ioctlsocket
test eax, eax
jne 0x757860
cmp dword [rbp + 0x74], 0
jle 0x757860
mov eax, dword [rbp + 0x74]
cmp eax, dword [rbp + 0xb0]
jge 0x757860
mov eax, dword [rbp + 0x74]
mov dword [rbp + 0xb0], eax
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rax + 8]
mov rdx, qword [rbp + 0xa8]
mov r8d, dword [rbp + 0xb0]
xor r9, r9
call sub.wsock32.dll_recv
mov dword [rbp + 0x7c], eax
cmp dword [rbp + 0x7c], 0xffffffff
jne 0x75794f
call sub.wsock32.dll_WSAGetLastError
mov dword [rbp + 0x78], eax
cmp dword [rbp + 0x78], 0x2733
je 0x75794f
mov rcx, qword [rbp + 0xa0]
mov dx, 0xfffe
call fcn.0040e5b0
mov rbx, rax
mov rcx, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0xa0]
mov r8b, 2
lea r9, [rbp + 0x78]
call rbx
mov rcx, qword [rbp + 0xa0]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rax + 8]
mov rax, qword [rbp + 0xa0]
mov rbx, qword [rax]
call qword [rbx + 0x10]
cmp dword [rbp + 0x78], 0
je 0x75794f
lea rcx, [rbp + 0x30]
mov edx, dword [rbp + 0x78]
xor r8, r8
call fcn.0043eff0
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x38], rax
mov byte [rbp + 0x40], 0x11
mov eax, dword [rbp + 0x78]
mov dword [rbp + 0x48], eax
mov byte [rbp + 0x50], 0
lea rax, [0x007579d4]
mov qword [rbp + 0x58], rax
mov byte [rbp + 0x60], 0x11
mov rcx, qword [0x007532c0]
mov dl, 1
mov r8, qword [0x007e52a8]
lea r9, [rbp + 0x38]
mov dword [rsp + 0x20], 2
call fcn.00441210
mov rcx, rax
call fcn.00410490
nop
mov rcx, qword [rbp + 0xa0]
call fcn.00756050
jmp 0x75796b
xor ecx, ecx
mov rdx, qword [rbp + 0x68]
call fcn.00757990
jmp 0x75796c
nop
lea rcx, [rbp + 0x30]
call fcn.00411360
mov eax, dword [rbp + 0x7c]
lea rsp, [rbp + 0x88]
pop rbx
pop rbp
ret
Function at 0x764470
Capabilities:
Create thread

Disassembly:
push rbp
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rax, qword [0x007e4608]
mov rcx, qword [rax]
call fcn.00773290
xor ecx, ecx
xor edx, edx
lea r8, [0x00763c50]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rbp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread_1
mov eax, ebx
lea rsp, [rbp + 0x48]
pop rbx
pop rbp
ret

Function at 0x770e30
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
sub rsp, 0x2a8
mov rbp, rsp
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x2c0], rcx
mov rcx, qword [rbp + 0x2c0]
call fcn.004114f0
nop
xor eax, eax
mov dword [rbp + 0x24], eax
mov ecx, 2
xor edx, edx
call fcn.0075a5a0
mov rbx, rax
mov dword [rbp + 0x68], 0x238
mov rcx, rbx
lea rdx, [rbp + 0x68]
call fcn.0075a5d0
jmp 0x770f76
lea rcx, [rbp + 0x48]
lea rdx, [rbp + 0x94]
mov r8d, 0x104
call fcn.004128c0
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x48]
call fcn.00438e70
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
call fcn.00436070
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x2c0]
call fcn.00436070
mov rcx, qword [rbp + 0x58]
mov rdx, qword [rbp + 0x40]
call fcn.00412e10
test eax, eax
je 0x770f4c
lea rcx, [rbp + 0x30]
lea rdx, [rbp + 0x94]
mov r8d, 0x104
call fcn.004128c0
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
call fcn.00436070
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x2c0]
call fcn.00436070
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x28]
call fcn.00412e10
test eax, eax
jne 0x770f6a
mov ecx, 1
xor edx, edx
mov r8d, dword [rbp + 0x70]
call sub.kernel32.dll_OpenProcess
mov rcx, rax
xor edx, edx
call sub.kernel32.dll_TerminateProcess
mov dword [rbp + 0x24], eax
mov rcx, rbx
lea rdx, [rbp + 0x68]
call fcn.0075a600
test eax, eax
jne 0x770eb5
mov rcx, rbx
call sub.kernel32.dll_CloseHandle_1
nop
lea rcx, [rbp + 0x28]
mov edx, 7
call fcn.00411440
lea rcx, [rbp + 0x2c0]
call fcn.00411360
mov eax, dword [rbp + 0x24]
lea rsp, [rbp + 0x2a8]
pop rbx
pop rbp
ret

Function at 0x7711b0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, edx
call sub.user32.dll_GetKeyState
test ax, 0x80
setg al
add rsp, 0x28
ret

Function at 0x773610
Capabilities:
Delete file

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x88], rdx
mov rcx, qword [rbp + 0x88]
call fcn.004114f0
nop
mov qword [rbp + 0x38], 0
mov dword [rbp + 0x40], 3
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x88]
lea r8, [0x007736d4]
call fcn.00412c00
mov rcx, qword [rbp + 0x28]
call fcn.004127c0
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], 0
mov word [rbp + 0x58], 0x10
lea rcx, [rbp + 0x38]
call sub.shell32.dll_SHFileOperationW
nop
lea rcx, [rbp + 0x28]
call fcn.00411360
lea rcx, [rbp + 0x88]
call fcn.00411360
lea rsp, [rbp + 0x70]
pop rbp
ret
Function at 0x773ed0
Capabilities:
Create thread

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov byte [rbp + 0x3e], dl
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x60], 0
nop
movzx rax, byte [rbp + 0x3e]
test al, al
jne 0x773f96
mov rax, qword [0x007e4cd8]
mov rcx, qword [rax]
lea rdx, [rbp + 0x48]
call fcn.00767d20
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x48]
call fcn.00438e70
lea rcx, [rbp + 0x60]
lea rdx, [rbp + 0x50]
lea r8, [0x0077401c]
xor r9, r9
call fcn.00448b50
lea rcx, [rbp + 0x58]
mov edx, 3
mov rax, qword [0x007e4948]
mov rax, qword [rax]
mov r8, qword [rax + 0x770]
mov r9, qword [rbp + 0x50]
lea rax, [0x00774034]
mov qword [rsp + 0x20], rax
call fcn.00412d30
mov rcx, qword [rbp + 0x58]
call fcn.004127c0
lea rcx, [rbp + 0x40]
mov rdx, rax
call fcn.00412860
mov rcx, qword [rbp + 0x40]
call fcn.00438a00
mov rax, qword [0x007e4cd8]
mov rax, qword [rax]
mov rax, qword [rax + 0x710]
mov rax, qword [rax + 0x48]
cmp byte [rax + 0x78], 0
jne 0x773fd5
xor ecx, ecx
xor edx, edx
lea r8, [0x00773e80]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rbp + 0x6c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread_1
nop
lea rcx, [rbp + 0x40]
mov edx, 5
call fcn.00411440
movzx rax, byte [rbp + 0x3f]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x778190
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], r8
mov dword [rbp + 0x34], r9d
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x48], 0
nop
mov esi, dword [rbp + 0x34]
mov rcx, qword [rbp + 0x20]
call fcn.00411360
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x28]
call fcn.00418d10
xor eax, eax
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x7781de
mov eax, dword [rcx - 4]
xor ecx, ecx
mov edx, eax
sub edx, 1
mov ebx, ecx
cmp ebx, edx
jg 0x77822d
sub edx, ecx
add edx, 1
movsxd rax, ebx
mov rcx, qword [rbp + 0x48]
lea rcx, [rcx + rax]
movzx r8d, si
shr r8d, 8
xor byte [rcx], r8b
mov rcx, qword [rbp + 0x48]
movzx ax, byte [rcx + rax]
add ax, si
imul ax, word [rbp + 0x90]
add ax, word [rbp + 0x98]
mov esi, eax
add ebx, 1
sub edx, 1
test edx, edx
jne 0x7781f0
nop
xor eax, eax
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x77823c
mov eax, dword [rcx - 4]
xor ecx, ecx
mov esi, eax
sub esi, 1
mov ebx, ecx
cmp ebx, esi
jg 0x778281
sub esi, ecx
add esi, 1
lea rcx, [rbp + 0x38]
mov rax, qword [rbp + 0x48]
movsxd rdx, ebx
movzx rdx, byte [rax + rdx]
mov r8d, 2
call fcn.00437750
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x38]
call fcn.00412b30
add ebx, 1
sub esi, 1
test esi, esi
jne 0x77824e
nop
nop
lea rcx, [rbp + 0x38]
call fcn.00411360
lea rcx, [rbp + 0x48]
call fcn.004113b0
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret