joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005d660
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 4
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x38], eax
mov rdi, qword [rsp + 0x70]
xor eax, eax
mov rcx, qword [rsp + 0x78]
rep stosb byte [rdi], al
mov dword [rsp + 0x20], 0xf0000040
mov r9d, dword [rsp + 0x80]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14005d6da
jmp 0x14005d7b2
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x14005d705
jmp 0x14005d78a
xor r9d, r9d
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x14005d723
jmp 0x14005d78a
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
mov edx, 4
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x14005d74b
jmp 0x14005d78a
mov eax, dword [rsp + 0x30]
cmp qword [rsp + 0x78], rax
jae 0x14005d758
jmp 0x14005d78a
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
mov r8, qword [rsp + 0x70]
mov edx, 2
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x14005d780
jmp 0x14005d78a
xor eax, eax
test eax, eax
jne 0x14005d6da
cmp qword [rsp + 0x40], 0
je 0x14005d79d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp qword [rsp + 0x48], 0
je 0x14005d7b2
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
add rsp, 0x50
pop rdi
ret

Function at 0x14005d860
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x28], 0x8000
mov eax, dword [rsp + 0x20]
mov edx, eax
mov rcx, qword [rsp + 0x30]
call qword [str.l_b_b_]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14005d8af
mov rcx, qword [rsp + 0x30]
call qword [str._b_b_]
xor eax, eax
jmp 0x14005d91a
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14005d8f5
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x20], eax
je 0x14005d8f5
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x20], eax
jbe 0x14005d904
mov rcx, qword [rsp + 0x30]
call qword [str._b_b_]
xor eax, eax
jmp 0x14005d91a
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x20], eax
jae 0x14005d915
mov rax, qword [rsp + 0x30]
jmp 0x14005d91a
jmp 0x14005d882
add rsp, 0x48
ret
Function at 0x140066d20
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
cmp dword [rsp + 0x48], 0
je 0x140066d3e
mov dword [rsp + 0x20], 1
jmp 0x140066d46
mov dword [rsp + 0x20], 0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x38
ret

Function at 0x140069e30
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xa8
mov rax, qword [0x1400d8c68]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x30], 0x3e8
lea rcx, [rsp + 0x60]
call fcn.140043200
lea rcx, [rsp + 0x80]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0xc0]
call fcn.140096468
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0xc8]
call fcn.140096468
mov qword [rsp + 0x28], rax
mov r8d, 1
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x140069f01
cmp qword [rsp + 0x20], 0
je 0x140069ed5
mov rcx, qword [rsp + 0x20]
call fcn.14008087c
mov qword [rsp + 0x20], 0
xor eax, eax
test eax, eax
jne 0x140069eba
cmp qword [rsp + 0x28], 0
je 0x140069ef6
mov rcx, qword [rsp + 0x28]
call fcn.14008087c
mov qword [rsp + 0x28], 0
xor eax, eax
test eax, eax
jne 0x140069edb
jmp 0x140069fb8
lea rax, [rsp + 0x40]
lea rcx, [rsp + 0x80]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x70]
call fcn.140043200
lea rcx, [rsp + 0x50]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400432e0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jl 0x140069f5f
movsxd rax, dword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jle 0x140069fa8
cmp qword [rsp + 0x20], 0
je 0x140069f7a
mov rcx, qword [rsp + 0x20]
call fcn.14008087c
mov qword [rsp + 0x20], 0
xor eax, eax
test eax, eax
jne 0x140069f5f
cmp qword [rsp + 0x28], 0
je 0x140069f9b
mov rcx, qword [rsp + 0x28]
call fcn.14008087c
mov qword [rsp + 0x28], 0
xor eax, eax
test eax, eax
jne 0x140069f80
mov eax, 1
jmp 0x140069fba
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140069ea0
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14007a650
add rsp, 0xa8
pop rdi
pop rsi
ret
Function at 0x140078640
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140078695
mov rax, qword [rsp + 0x40]
add rax, 8
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
xor eax, eax
add rsp, 0x38
ret

Function at 0x1400786b0
Capabilities:
Hash data via wincrypt

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
add rsp, 0x28
ret

Function at 0x140093b74
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400939a0

Function at 0x14009be3c
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x14009be19
call fcn.14008084c
mov dword [rax], socket
call fcn.1400806fc
or eax, 0xffffffff
jmp 0x14009be36
sub dword [rcx + 0x10], 1
jns 0x14009be28
add rsp, 0x28
jmp fcn.14009b870
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x14009bdf8

Function at 0x1400a31b0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400a31d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400807dc
or eax, 0xffffffff
jmp 0x1400a31d2
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400ab470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov esi, r9d
mov r14, r8
mov r15, rcx
xor ebx, ebx
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x1400ab51a
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x72657551
mov rcx, rax
mov dword [rbp - 0x14], 0x656a624f
mov word [rbp - 7], 0x79
mov word [rbp - 0x1c], 0x5379
mov dword [rbp - 0x10], 0x65537463
mov word [rbp - 0x19], 0x7672
mov dword [rbp - 0xc], 0x69727563
mov byte [rbp - 0x1a], 0x65
mov word [rbp - 0x16], 0x6563
mov byte [rbp - 8], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x17], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400ab512
mov rax, qword [rbp + 0x40]
lea edx, [rbx + 4]
mov r9d, esi
mov qword [rsp + 0x20], rax
mov r8, r14
mov rcx, r15
call r10
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rbp
ret

Function at 0x1400ab540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov word [rsp + 0x2d], reloc.WS2_32.dll_WSASetLastError
mov dword [rsp + 0x24], 0x65636f72
mov dword [rsp + 0x28], 0x65487373
mov dword [rsp + 0x20], 0x50746547
mov byte [rsp + 0x2c], 0x61
call fcn.140003ad0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400ab587
call rax
add rsp, 0x38
ret
add rsp, 0x38
ret

Function at 0x1400ab600
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rsi, r9
mov rbp, r8
mov r14, rcx
mov ebx, 1
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x1400ab69f
lea rdx, [rsp + 0x20]
mov word [rsp + 0x23], 0x6547
mov rcx, rax
mov dword [rsp + 0x26], 0x5379654b
mov word [rsp + 0x20], 0x6552
mov word [rsp + 0x2a], 0x6365
mov word [rsp + 0x30], 0x79
mov word [rsp + 0x2d], 0x6972
mov byte [rsp + 0x2c], 0x75
mov byte [rsp + 0x25], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x22], 0x67
mov byte [rsp + 0x2f], reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400ab697
mov r9, rsi
lea edx, [rbx + 3]
mov r8, rbp
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400ab6c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbp, rcx
xor ebx, ebx
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x1400ab73b
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x29], 0x416563
mov rcx, rax
mov dword [rsp + 0x21], 0x536e6570
mov word [rsp + 0x26], 0x7672
mov byte [rsp + 0x25], 0x65
mov byte [rsp + 0x20], 0x4f
mov byte [rsp + 0x28], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400ab733
mov r8d, 0x60000
mov rdx, rsi
mov rcx, rbp
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400ab270
mov rbp, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400ab760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
xor ebx, ebx
call fcn.140009720
mov rdi, rax
test rax, rax
je 0x1400ab7c9
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x26], 0x7845656c
mov rcx, rax
mov dword [rsp + 0x2a], 0x73747369
mov word [rsp + 0x2e], 0x41
mov dword [rsp + 0x20], 0x68746150
mov word [rsp + 0x24], 0x6946
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400ab7c1
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400ab8f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov ebx, 0x80004005
call fcn.1400b11a0
mov rdi, rax
test rax, rax
je 0x1400ab962
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x21], 0x6572436f
mov rcx, rax
mov word [rsp + 0x28], 0x7547
mov word [rsp + 0x2b], 0x64
mov word [rsp + 0x26], 0x6574
mov byte [rsp + 0x25], 0x61
mov byte [rsp + 0x20], 0x43
mov byte [rsp + 0x2a], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400ab95a
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400ab980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x1400aba09
lea rdx, [rbp - 0x20]
mov word [rbp - 0xf], 0x536f
mov rcx, rax
mov dword [rbp - 0x14], 0x64695367
mov dword [rbp - 0x18], 0x6e697274
mov dword [rbp - 0xd], 0x416469
mov dword [rbp - 0x1c], 0x53747265
mov word [rbp - 0x1f], 0x6e6f
mov byte [rbp - 0x10], 0x54
mov byte [rbp - 0x1d], 0x76
mov byte [rbp - 0x20], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400aba01
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x1400aba30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov r15, rdx
mov r12, rcx
xor ebx, ebx
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x1400abad9
lea rdx, [rbp - 0x20]
mov word [rbp - 0x11], 0x6972
mov rcx, rax
mov dword [rbp - 0xb], 0x6c636144
mov dword [rbp - 0x16], 0x73654479
mov word [rbp - 0xe], 0x6f74
mov dword [rbp - 0x1d], 0x75636553
mov byte [rbp - 0x12], 0x63
mov byte [rbp - 7], bl
mov word [rbp - 0x19], 0x6972
mov byte [rbp - 0xf], reloc.WS2_32.dll_WSASetLastError
mov word [rbp - 0x20], 0x6547
mov byte [rbp - 0xc], WSAStartup
mov byte [rbp - 0x17], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x1e], reloc.WS2_32.dll_WSACleanup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400abad1
mov r9, rsi
mov r8, r14
mov rdx, r15
mov rcx, r12
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x1400abb90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov dword [rsp + 0x28], 0x6c694665
mov word [rsp + 0x2c], 0x4e65
mov dword [rsp + 0x20], 0x4d746547
mov dword [rsp + 0x24], 0x6c75646f
mov dword [rsp + 0x2f], 0x41656d
mov byte [rsp + 0x2e], 0x61
call fcn.140003ad0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400abbf0
mov r8d, 0x104
mov rdx, rbx
xor ecx, ecx
call rax
add rsp, 0x40
pop rbx
ret
add rsp, 0x40
pop rbx
ret

Function at 0x1400abc00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x80
mov rsi, r8
mov rbp, rdx
mov r14, rcx
xor ebx, ebx
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x1400abcde
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x61], 0x74616572
mov rcx, rax
mov dword [rsp + 0x6c], 0x55734173
mov dword [rsp + 0x67], 0x65636f72
mov dword [rsp + 0x71], 0x417265
mov byte [rsp + 0x60], 0x43
mov word [rsp + 0x65], 0x5065
mov byte [rsp + 0x6b], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x70], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400abcd6
mov rax, qword [rsp + 0xe0]
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov r8, rsi
mov rax, qword [rsp + 0xd8]
mov rdx, rbp
mov qword [rsp + 0x48], rax
mov rcx, r14
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call r10
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400abd00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call fcn.1400b11a0
mov rbx, rax
test rax, rax
je 0x1400abd62
lea rdx, [rsp + 0x20]
mov word [rsp + 0x28], 0x466d
mov rcx, rax
mov dword [rsp + 0x20], 0x61546f43
mov dword [rsp + 0x2a], 0x656572
mov word [rsp + 0x25], 0x4d6b
mov byte [rsp + 0x27], 0x65
mov byte [rsp + 0x24], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400abd5a
mov rcx, rdi
call rax
mov rcx, rbx
call fcn.1400ab270
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400abd70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rsi, r9
mov rbp, r8
mov r14, rcx
xor ebx, ebx
call fcn.1400b1250
mov rdi, rax
test rax, rax
je 0x1400abdf5
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2b], 0x416575
mov rcx, rax
mov dword [rsp + 0x20], 0x51726556
mov dword [rsp + 0x26], 0x61567972
mov word [rsp + 0x24], 0x6575
mov byte [rsp + 0x2a], WSASetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400abded
mov r9, rsi
lea rdx, [0x1400c7bf0]
mov r8, rbp
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1400abe20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x1400abeb5
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1a], 0x5374
mov rcx, rax
mov dword [rbp - 0x14], 0x69727453
mov word [rbp - 0xb], 0x41
mov word [rbp - 0x1f], 0x6e6f
mov dword [rbp - 0x10], 0x6953676e
mov byte [rbp - 0xc], 0x64
mov word [rbp - 0x17], 0x5464
mov word [rbp - 0x1c], 0x7265
mov byte [rbp - 0x15], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 0x20], 0x43
mov byte [rbp - 0x1d], 0x76
mov byte [rbp - 0x18], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400abead
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x1400abee0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rsi, r9
mov ebp, r8d
mov r14d, edx
mov r15, rcx
xor ebx, ebx
call fcn.1400b1250
mov rdi, rax
test rax, rax
je 0x1400abf72
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x21], 0x69467465
mov rcx, rax
mov dword [rsp + 0x26], 0x72655665
mov dword [rsp + 0x30], 0x416f66
mov dword [rsp + 0x2b], 0x496e6f69
mov byte [rsp + 0x20], 0x47
mov byte [rsp + 0x2f], WSASetLastError
mov byte [rsp + 0x25], WSASetLastError
mov byte [rsp + 0x2a], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400abf6a
mov r9, rsi
mov r8d, ebp
mov edx, r14d
mov rcx, r15
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1400ac770
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
call fcn.1400a7450
test eax, eax
js 0x1400ac9d4
mov ecx, dword [rbx + 0xf0]
lea eax, [rcx*4]
movsxd r9, eax
test eax, eax
jle 0x1400ac803
lea r8, [rbx + 8]
xor r10d, r10d
lea r8, [r8 + r9*4]
lea rax, [rbx + 8]
nop dword [rax]
mov edx, dword [rax - 8]
add r10, 4
mov ecx, dword [r8 - 8]
lea r8, [r8 - 0x10]
mov dword [rax - 8], ecx
lea rax, [rax + 0x10]
mov ecx, dword [r8 + 0xc]
sub r9, 4
mov dword [r8 + 8], edx
mov edx, dword [rax - 0x14]
mov dword [rax - 0x14], ecx
mov ecx, dword [r8 + 0x10]
mov dword [r8 + 0xc], edx
mov edx, dword [rax - 0x10]
mov dword [rax - 0x10], ecx
mov ecx, dword [r8 + 0x14]
mov dword [r8 + 0x10], edx
mov edx, dword [rax - 0xc]
mov dword [rax - 0xc], ecx
mov dword [r8 + 0x14], edx
cmp r10, r9
jl 0x1400ac7b0
mov ecx, dword [rbx + 0xf0]
mov r11d, 1
cmp ecx, r11d
jle 0x1400ac9d2
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 4]
lea rdi, [0x140000000]
nop dword [rax]
nop word [rax + rax]
mov r9d, dword [r10 + 0x10]
lea r10, [r10 + 0x10]
mov edx, dword [r10 - 4]
inc r11d
movzx eax, byte [r10 - 3]
movzx ecx, byte [rdi + rax*4 + 0xc4500]
mov eax, edx
shr rax, 0x18
mov r8d, dword [rdi + rcx*4 + 0xc3900]
movzx eax, byte [rdi + rax*4 + 0xc4500]
xor r8d, dword [rdi + rax*4 + 0xc4100]
movzx eax, dl
movzx ecx, byte [rdi + rax*4 + 0xc4500]
movzx eax, byte [r10 - 2]
xor r8d, dword [rdi + rcx*4 + 0xc3500]
movzx ecx, byte [rdi + rax*4 + 0xc4500]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0xc3d00]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10 - 4], r8d
movzx edx, byte [rdi + rcx*4 + 0xc4500]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0xc3d00]
movzx eax, byte [rdi + rcx*4 + 0xc4500]
xor r8d, dword [rdi + rax*4 + 0xc3900]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0xc4500]
movzx eax, r9b
mov r9d, dword [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0xc4100]
movzx ecx, byte [rdi + rax*4 + 0xc4500]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0xc3500]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10], r8d
movzx edx, byte [rdi + rcx*4 + 0xc4500]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0xc3d00]
movzx eax, byte [rdi + rcx*4 + 0xc4500]
xor r8d, dword [rdi + rax*4 + 0xc3900]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0xc4500]
movzx eax, r9b
mov r9d, dword [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0xc4100]
movzx ecx, byte [rdi + rax*4 + 0xc4500]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0xc3500]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10 + 4], r8d
movzx edx, byte [rdi + rcx*4 + 0xc4500]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0xc3d00]
movzx eax, byte [rdi + rcx*4 + 0xc4500]
xor r8d, dword [rdi + rax*4 + 0xc3900]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0xc4500]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0xc4100]
movzx ecx, byte [rdi + rax*4 + 0xc4500]
xor r8d, dword [rdi + rcx*4 + 0xc3500]
mov dword [r10 + 8], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x1400ac830
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400ae460
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], 0
call fcn.1400b1c30
mov rcx, rax
lea r8, [rsp + 0x50]
mov edx, 0x20
call fcn.140009a40
test eax, eax
je 0x1400ae4d0
lea r8, [rsp + 0x58]
lea rdx, str.SeDebugPrivilege
call fcn.1400b1600
test eax, eax
je 0x1400ae4c6
mov rax, qword [rsp + 0x58]
lea r8, [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
call fcn.1400b16b0
mov rcx, qword [rsp + 0x50]
call fcn.14000a150
add rsp, 0x48
ret