joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140161a7d
Capabilities:
Write file on windows

Disassembly:
jmp 0x14034aef0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14057d30d]
call fcn.140168477
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14034af48
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14034b05a
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14034aff3
cmp qword [rbp + 0x28], 0
jle 0x14034aff3
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14034af91
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140167d97
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x14034b049
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14034b049
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140161c3f
Capabilities:
Check processdebugport

Disassembly:
jmp 0x1403048f0
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14054a080]
xor rax, rbp
mov qword [rbp + 0xd8], rax
lea rcx, [0x14057d425]
call fcn.140168477
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rbp + 8]
mov edx, 7
mov rcx, rax
call fcn.140166f1e
nop
cmp qword [rbp + 8], 0
je 0x140304968
mov dword [rbp + 0xd4], 1
jmp 0x140304972
mov dword [rbp + 0xd4], 0
mov eax, dword [rbp + 0xd4]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.14016710d
mov eax, edi
mov rcx, qword [rbp + 0xd8]
xor rcx, rbp
call fcn.140164822
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140161c80
Capabilities:
Check processdebugflags

Disassembly:
jmp 0x140304710
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14054a080]
xor rax, rbp
mov qword [rbp + 0xd8], rax
lea rcx, [0x14057d425]
call fcn.140168477
nop
mov dword [rbp + 4], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 4]
mov edx, Ordinal_35
mov rcx, rax
call fcn.140166f1e
nop
cmp dword [rbp + 4], 0
jne 0x14030478e
mov dword [rbp + 0xd4], 1
jmp 0x140304798
mov dword [rbp + 0xd4], 0
mov eax, dword [rbp + 0xd4]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.14016710d
mov eax, edi
mov rcx, qword [rbp + 0xd8]
xor rcx, rbp
call fcn.140164822
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x140162063
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140379970
cmp byte [rcx + 0x47], 0
je 0x140379993
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140379980
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x14016225c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140379940
cmp byte [rcx + 0x44], 0
je 0x140379963
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x140379950
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x140162310
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x1403021c0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x14057d3df]
call fcn.140168477
nop
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x270
jne 0x1403021fe
mov rcx, qword [rbp + 0x100]
call fcn.140162662
nop
jmp 0x14030221a
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x4e0
jb 0x14030221a
mov rcx, qword [rbp + 0x100]
call fcn.14016493f
nop
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
mov rcx, qword [rbp + 0x100]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rbp + 0xd4], eax
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
inc eax
mov rcx, qword [rbp + 0x100]
mov dword [rcx], eax
mov eax, dword [rbp + 0xd4]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 0xb
mov rcx, qword [rbp + 0x100]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 0x12
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x140162333
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14036d810
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x14036d844
mov eax, esi
lea ecx, [rax + 0x7e]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x14036d830
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140164485
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14036d869
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140168cf1
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14036d8e3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14036d8de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14036d8de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140167054
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14016252c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140379690
cmp byte [rcx + 0x136], 0
je 0x1403796b8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x1403796a0
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x1401625ae
Capabilities:
Set socket configuration

Disassembly:
jmp 0x1403cffc0
sub rsp, 0x28
xor eax, eax
lea r8, [rsp + 0x38]
test edx, edx
mov edx, 0x8004667e
setne al
mov dword [rsp + 0x38], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret

Function at 0x1401626c1
Capabilities:
Create thread

Disassembly:
jmp 0x1402cbb00
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, reloc.WLDAP32.dll_Ordinal_22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14054a080]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14057d3b5]
call fcn.140168477
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140163210
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.1401649da
nop
lea rax, [0x140165be1]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.140165e93
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x1402cbbdc
lea rcx, [rbp + 8]
call fcn.140164192
nop
jmp 0x1402cbbf5
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.140162969
nop
lea rcx, [rbp + 8]
call fcn.140163fa3
nop
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.14016710d
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.140164822
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x140162bc1
Capabilities:
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
jmp 0x14040b890
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
mov rbx, rcx
mov rdx, rdi
mov rcx, rsi
call fcn.14040bb30
lea r8, [rbx + 7]
mov rcx, rsi
lea rdx, [rdi + 8]
call fcn.14040bb30
lea r8, [rbx + 0xe]
mov rcx, rsi
lea rdx, [rdi + 0x10]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14040bb30
Function at 0x140162d3d
Capabilities:
Execute command

Disassembly:
jmp 0x140307750
push rbp
push rdi
sub rsp, 0x298
lea rbp, [rsp + 0x20]
lea rcx, [0x14057d42f]
call fcn.140168477
nop
mov ecx, 2
call fcn.140163355
nop
lea rdx, [rbp + 0x124]
lea rcx, [rbp + 0x104]
call fcn.1402f9c20
mov rdx, rax
lea rcx, [rbp + 0xe4]
call fcn.140167f13
nop
lea rdx, [rbp + 0x168]
lea rcx, [rbp + 0x144]
call fcn.1402fcff0
mov rcx, rax
call fcn.14016330f
mov qword [rbp + 0x258], rax
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp + 0x194]
call fcn.1402fbc60
mov rcx, rax
call fcn.140167581
mov qword [rbp + 0x260], rax
mov r9d, 4
mov r8, qword [rbp + 0x258]
mov rdx, qword [rbp + 0x260]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 6
jne 0x140307830
xor ecx, ecx
call fcn.140163355
nop
lea rdx, [rbp + 0x228]
lea rcx, [rbp + 0x204]
call fcn.1402fe1d0
mov rcx, rax
call fcn.140165574
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rsp, [rbp + 0x278]
pop rdi
pop rbp
ret
Function at 0x140162ed7
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14036d340
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x14036d374
mov eax, esi
lea ecx, [rax + 0x7e]
xor byte [r8 + rax], cl
inc rax
cmp rax, 5
jb 0x14036d360
mov byte [r8 + 6], sil
add r8, 5
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140164485
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14036d399
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140168cf1
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14036d413
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14036d40e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14036d40e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140167054
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140162ef5
Capabilities:
Get common file path

Disassembly:
jmp 0x140365990
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x468]
mov rax, qword [0x14054a080]
xor rax, rbp
mov qword [rbp + 0x410], rax
mov dword [rbp + 0x3f4], 0
lea rcx, reloc.WS2_32.dll_accept
call fcn.140168477
nop
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rdx, [rbp + 0x10]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [rbp + 0x234], eax
cmp dword [rbp + 0x234], 0
je 0x140365a1e
cmp dword [rbp + 0x234], 0x105
jbe 0x140365a78
lea rdx, str.____Failed_to_get_temp_path
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140164c23
mov qword [rbp + 0x408], rax
lea rdx, [0x1401648cc]
mov rcx, qword [rbp + 0x408]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rdx, [0x1404f2b10]
mov rcx, qword [rbp + 0x440]
call fcn.1401636cf
mov eax, dword [rbp + 0x3f4]
or eax, 1
mov dword [rbp + 0x3f4], eax
mov rax, qword [rbp + 0x440]
jmp 0x140365aeb
lea rcx, [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
movzx eax, word [rbp + rax*2 + 0xe]
cmp eax, 0x5c
jne 0x140365ac5
lea rcx, [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
lea rax, [rax + rax - 2]
mov qword [rbp + 0x3d8], rax
cmp qword [rbp + 0x3d8], 0x20a
jae 0x140365ab1
jmp 0x140365ab7
call fcn.140166483
nop
xor eax, eax
mov rcx, qword [rbp + 0x3d8]
mov word [rbp + rcx + 0x10], ax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x440]
call fcn.1401636cf
mov eax, dword [rbp + 0x3f4]
or eax, 1
mov dword [rbp + 0x3f4], eax
mov rax, qword [rbp + 0x440]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_accept
call fcn.14016710d
mov rax, rdi
mov rcx, qword [rbp + 0x410]
xor rcx, rbp
call fcn.140164822
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret
Function at 0x140163350
Capabilities:
Move file

Disassembly:
jmp 0x1403d4cb0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rdi, rcx
movaps xmmword [rsp + 0x50], xmm6
lea rcx, [rsp + 0x30]
mov rbx, rdx
call fcn.14016794b
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
movups xmm6, xmmword [rax]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x1403d4d40
nop dword [rax + rax]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.14016794b
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
call fcn.140168c74
cmp rax, 0x3e8
ja 0x1403d4d52
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x1403d4cf0
xor eax, eax
mov rbx, qword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
mov rbx, qword [rsp + 0x70]
mov eax, 1
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret

Function at 0x140163585
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14037c7c0
sub rsp, 0xa8
xor eax, eax
cmp byte [0x140554700], al
jne 0x14037c871
movdqa xmm0, xmmword [0x1404f89e0]
movdqa xmm1, xmmword [0x1404f90e0]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [0x1404f8840]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x1404f8940]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm1, xmmword [0x1404f8c40]
movdqa xmmword [rsp + 0x80], xmm0
movdqa xmmword [rsp + 0x70], xmm1
mov dword [rsp + 0x90], 0x100bca0
nop dword [rax]
lea ecx, [rax + 0x7e]
xor byte [rsp + rax + 0x40], cl
inc rax
cmp rax, 0x52
jb 0x14037c830
lea r9, [rsp + 0xb0]
mov byte [rsp + 0x93], 0
lea r8, [rsp + 0x92]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140164485
lea rcx, [rsp + 0x20]
call fcn.140168d0f
add rsp, 0xa8
ret
Function at 0x1401636de
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x140365810
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rcx, reloc.WS2_32.dll_accept
call fcn.140168477
nop
mov rcx, qword [rbp + 0x180]
call fcn.14016440d
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x188]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x188]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
movzx eax, word [rax + 0x14]
mov rcx, qword [rbp + 0x28]
lea rax, [rcx + rax + 0x18]
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x64], 0
jmp 0x14036588c
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
mov rax, qword [rbp + 0x28]
movzx eax, word [rax + 6]
cmp dword [rbp + 0x64], eax
jae 0x140365934
mov eax, dword [rbp + 0x64]
imul rax, rax, 0x28
mov rcx, qword [rbp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov r8, qword [rbp + 8]
mov rdx, qword [rbp + 0x180]
mov rcx, rax
call fcn.140163b75
test eax, eax
jne 0x14036592f
mov rax, qword [rbp + 0x88]
mov rcx, rax
call fcn.14016440d
cmp qword [rbp + 8], rax
jne 0x14036592f
mov rax, qword [rbp + 0x88]
cmp dword [rax + 0xc], 0
jne 0x1403658f9
xor eax, eax
jmp 0x140365936
cmp qword [rbp + 0x190], 0
je 0x140365916
mov rax, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x88]
mov ecx, dword [rcx + 8]
mov dword [rax], ecx
mov rax, qword [rbp + 0x88]
mov eax, dword [rax + 0xc]
mov rcx, qword [rbp + 0x188]
add rcx, rax
mov rax, rcx
jmp 0x140365936
jmp 0x140365884
xor eax, eax
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x140163b98
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14036dd30
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x14036dd64
mov eax, esi
lea ecx, [rax + 0x7e]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x14036dd50
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140164485
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14036dd89
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140168cf1
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14036de03
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14036ddfe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14036ddfe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140167054
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140163cbf
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x14040f6c0
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14040f74d
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x14040f74d
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14040f74d
sub r8, rdx
movzx edx, word [rcx + 0x14]
add rdx, 0x18
add rdx, rcx
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x14040f734
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14040f72e
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x14040f736
add rdx, 0x28
jmp 0x14040f713
xor edx, edx
test rdx, rdx
jne 0x14040f73f
xor al, al
jmp 0x14040f753
cmp dword [rdx + 0x24], 0
jge 0x14040f749
xor al, al
jmp 0x14040f753
mov al, 1
jmp 0x14040f753
xor al, al
jmp 0x14040f753
add rsp, 0x18
ret
Function at 0x140163ebd
Capabilities:
Query environment variable

Disassembly:
jmp 0x1403d9ef0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 1
mov edx, ebx
xor ecx, ecx
xor ebp, ebp
call qword [0x14054a020]
mov rdi, rax
test rax, rax
je 0x1403d9f6d
nop word [rax + rax]
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
mov rbp, rdi
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
je 0x1403d9f98
cmp ebx, esi
je 0x1403d9f98
cmp ebx, 0x8000
ja 0x1403d9f98
cmp ebx, esi
jb 0x1403d9f93
mov edx, ebx
mov rcx, rdi
call qword [0x14054a020]
mov rdi, rax
test rax, rax
jne 0x1403d9f30
mov rcx, rbp
call qword [fcn.1401638cd]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rdi
jmp 0x1403d9f78
mov rcx, rdi
jmp 0x1403d9f70
Function at 0x140164160
Capabilities:
Check for debugger via api

Disassembly:
jmp 0x140316480
push rbp
push rdi
sub rsp, 0x1c8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, Ordinal_60
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14054a080]
xor rax, rbp
mov qword [rbp + 0x198], rax
lea rcx, [0x14057d422]
call fcn.140168477
nop
mov qword [rbp + 8], 0xffffffffffffffff
mov dword [rbp + 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbp + 8], rax
lea rdx, [rbp + 0x24]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
nop
cmp dword [rbp + 0x24], 0
je 0x140316547
mov byte [0x140553728], 1
mov dword [rbp + 0x124], 0
lea rdx, [rbp + 0x124]
lea rcx, [rbp + 0x104]
call fcn.140166816
nop
mov dword [rbp + 0x164], 0
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x144]
call fcn.140162536
nop
lea rcx, [rbp + 0x184]
call fcn.140166ff0
nop
mov dword [0], 0xdead
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_accept
call fcn.14016710d
mov rcx, qword [rbp + 0x198]
xor rcx, rbp
call fcn.140164822
lea rsp, [rbp + 0x1a8]
pop rdi
pop rbp
ret