joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015200
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x88
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0x1000
mov byte [rsp + 0x50], 0x68
mov byte [rsp + 0x51], 0
mov byte [rsp + 0x52], 0
mov byte [rsp + 0x53], 0
mov byte [rsp + 0x54], 0
mov byte [rsp + 0x55], 0x68
mov byte [rsp + 0x56], 0
mov byte [rsp + 0x57], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x59], 0
mov byte [rsp + 0x5a], 0x6a
mov byte [rsp + 0x5b], 0
mov byte [rsp + 0x5c], 0x6a
mov byte [rsp + 0x5d], 0
mov byte [rsp + 0x5e], 0xe8
mov byte [rsp + 0x5f], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x61], 0
mov byte [rsp + 0x62], 0
mov byte [rsp + 0x63], 0xba
mov byte [rsp + 0x64], 0
mov byte [rsp + 0x65], 0
mov byte [rsp + 0x66], 0
mov byte [rsp + 0x67], 0
mov byte [rsp + 0x68], 0xc7
mov byte [rsp + 0x69], 2
mov byte [rsp + 0x6a], 0x7e
mov byte [rsp + 0x6b], 0x1e
mov byte [rsp + 0x6c], 0x37
mov byte [rsp + 0x6d], 0xc0
mov byte [rsp + 0x6e], 0xba
mov byte [rsp + 0x6f], 0
mov byte [rsp + 0x70], 0
mov byte [rsp + 0x71], 0
mov byte [rsp + 0x72], 0
mov byte [rsp + 0x73], 0x89
mov byte [rsp + 0x74], 2
mov byte [rsp + 0x75], 0xc2
mov byte [rsp + 0x76], 4
mov byte [rsp + 0x77], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x1000
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x140015430
mov rax, qword [rsp + 0x40]
add rax, 0x200
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0xa8]
movzx ecx, word [rcx]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0xa8]
movzx ecx, word [rcx + 2]
mov word [rax + 2], cx
mov rax, qword [rsp + 0x40]
add rax, 0x210
mov rcx, qword [rsp + 0x38]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0xa8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 4]
mov rdx, qword [rsp + 0xa8]
mov edi, ecx
mov rsi, qword [rdx + 8]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x50]
mov rdi, qword [rsp + 0x40]
mov rsi, rax
mov ecx, 0x28
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x40]
add rax, 0x5e0
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 1], eax
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x38]
mov dword [rax + 6], ecx
mov rax, qword [rsp + 0x40]
add rax, 0xf
mov rcx, qword [rsp + 0xa0]
sub rcx, rax
mov rax, rcx
sub rax, 4
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 0xf], eax
mov rax, qword [rsp + 0x40]
add rax, 0x5e8
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 0x14], eax
mov rax, qword [rsp + 0x40]
add rax, 0x5ec
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 0x1f], eax
mov rax, qword [rsp + 0x40]
jmp 0x140015432
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140001860
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x140018380
Capabilities:
Inspect section memory permissions

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
sub rsp, 0x18
mov dword [rsp], 1
mov eax, dword [rsp + 0x20]
and eax, 0x2000000
test eax, eax
je 0x1400183ac
mov dword [rsp], 1
jmp 0x140018476
mov eax, dword [rsp + 0x20]
and eax, 0x20000000
test eax, eax
je 0x140018443
mov eax, dword [rsp + 0x20]
and eax, 0x80000000
test eax, eax
je 0x1400183ee
movzx eax, byte [rsp + 0x28]
test eax, eax
je 0x1400183dd
mov dword [rsp + 4], 4
jmp 0x1400183e5
mov dword [rsp + 4], 0x40
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x140018441
mov eax, dword [rsp + 0x20]
and eax, 0x40000000
test eax, eax
je 0x14001841f
movzx eax, byte [rsp + 0x28]
test eax, eax
je 0x14001840e
mov dword [rsp + 8], 2
jmp 0x140018416
mov dword [rsp + 8], 0x20
mov eax, dword [rsp + 8]
mov dword [rsp], eax
jmp 0x140018441
movzx eax, byte [rsp + 0x28]
test eax, eax
je 0x140018432
mov dword [rsp + 0xc], 2
jmp 0x14001843a
mov dword [rsp + 0xc], 0x10
mov eax, dword [rsp + 0xc]
mov dword [rsp], eax
jmp 0x140018476
mov eax, dword [rsp + 0x20]
and eax, 0x80000000
test eax, eax
je 0x140018459
mov dword [rsp], 4
jmp 0x140018476
mov eax, dword [rsp + 0x20]
and eax, 0x40000000
test eax, eax
je 0x14001846f
mov dword [rsp], 2
jmp 0x140018476
mov dword [rsp], 1
mov eax, dword [rsp]
add rsp, 0x18
ret
Function at 0x140018480
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400185ec
mov dword [rsp + 0x58], 0
lea r9, [rsp + 0x58]
mov r8w, 0xa
mov dl, 1
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_RtlImageDirectoryEntryToData]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400185ea
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x140018512
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x38], rax
jmp 0x14001851f
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1400185ea
mov rax, qword [rsp + 0x80]
shr rax, 0x20
mov ecx, dword [rsp + 0x80]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
lea rcx, [rsp + 0x5c]
call qword [sym.imp.ntoskrnl.exe_RtlRandomEx]
mov eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x1400185b2
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x140018596
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x40], rax
jmp 0x1400185a3
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
jmp 0x1400185ea
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x1400185d2
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x48], rax
jmp 0x1400185df
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x50]
mov dword [rax], ecx
jmp 0x1400185f4
mov dword [rsp + 0x28], 0xc000007b
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140001860
add rsp, 0x78
ret
Function at 0x14001c910
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 0x18], r8
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
sub rsp, 0x48
movzx eax, byte [rsp + 0x58]
test eax, eax
je 0x14001c93e
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
jmp 0x14001ca15
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14001ca13
mov rax, qword [rsp + 0x28]
add rax, 0x108
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x10b
jne 0x14001c98a
mov rax, qword [rsp + 0x28]
add rax, 0xf8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
jmp 0x14001c9a4
mov rax, qword [rsp + 0x20]
add rax, 0x28
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 6]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x20], rax
jae 0x14001ca13
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x50], eax
jb 0x14001ca11
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x20]
add eax, dword [rcx + 8]
cmp dword [rsp + 0x50], eax
jae 0x14001ca11
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x14]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx + 0xc]
mov edx, dword [rsp + 0x50]
sub edx, ecx
mov ecx, edx
mov ecx, ecx
add rax, rcx
jmp 0x14001ca15
jmp 0x14001c996
xor eax, eax
add rsp, 0x48
ret
Function at 0x14001d060
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x38], 0
cmp qword [0x140011df0], 0
je 0x14001d0cc
cmp qword [rsp + 0x80], 0
je 0x14001d0c0
mov rax, qword [rsp + 0x80]
mov ecx, dword [0x140011df8]
mov dword [rax], ecx
mov rax, qword [0x140011df0]
jmp 0x14001d299
lea rdx, [0x14001ecb0]
lea rcx, [rsp + 0x50]
call fcn.14000b4e0
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14001d0fc
xor eax, eax
jmp 0x14001d299
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0xb
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x48], 0
jne 0x14001d140
lea r9, [0x14001ecd0]
lea r8, [0x14001ece0]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
xor eax, eax
jmp 0x14001d299
mov eax, dword [rsp + 0x48]
mov r8d, 0x4b555341
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool2]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov rdi, qword [rsp + 0x28]
xor eax, eax
mov rcx, qword [rsp + 0x40]
rep stosb byte [rdi], al
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x28]
mov ecx, 0xb
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jl 0x14001d27a
mov rax, qword [rsp + 0x28]
add rax, 8
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0
jmp 0x14001d1be
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
cmp dword [rsp + 0x20], eax
jae 0x14001d27a
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx + rax + 0x10]
cmp qword [rsp + 0x38], rax
jb 0x14001d275
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov ecx, dword [rsp + 0x20]
imul rcx, rcx, 0x128
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x18]
mov rdx, qword [rsp + 0x30]
add rcx, qword [rdx + rax + 0x10]
mov rax, rcx
cmp qword [rsp + 0x38], rax
jae 0x14001d275
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx + rax + 0x10]
mov qword [0x140011df0], rax
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x18]
mov dword [0x140011df8], eax
cmp qword [rsp + 0x80], 0
je 0x14001d273
mov rax, qword [rsp + 0x80]
mov ecx, dword [0x140011df8]
mov dword [rax], ecx
jmp 0x14001d27a
jmp 0x14001d1b4
cmp qword [rsp + 0x28], 0
je 0x14001d292
mov edx, 0x4b555341
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [0x140011df0]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140001860
add rsp, 0x70
pop rdi
ret
Function at 0x14001d3a0
Capabilities:
Access pe header

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor ecx, ecx
call fcn.14001d060
mov qword [rsp + 0x40], rax
cmp qword [0x140011e00], 0
je 0x14001d3db
mov rax, qword [0x140011e00]
jmp 0x14001d53d
cmp qword [rsp + 0x40], 0
jne 0x14001d3ea
xor eax, eax
jmp 0x14001d53d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
add rax, 0x108
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x14001d424
mov rax, qword [rsp + 0x30]
add rax, 0x28
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x48]
movzx eax, word [rax + 6]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x30], rax
jae 0x14001d53b
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x24]
and eax, 0x8000000
test eax, eax
je 0x14001d536
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x24]
and eax, 0x20000000
test eax, eax
je 0x14001d536
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x24]
and eax, 0x2000000
test eax, eax
jne 0x14001d536
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x54494e49
je 0x14001d536
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x45474150
je 0x14001d536
mov qword [rsp + 0x58], 0
lea rax, [rsp + 0x60]
lea rcx, [0x14001ed20]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x40]
add rdx, rcx
mov rcx, rdx
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
mov r9, rcx
mov r8d, 0xf
mov dl, 0xcc
lea rcx, [rsp + 0x60]
call fcn.14000c1f0
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jl 0x14001d536
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 3]
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + rax + 7]
mov qword [0x140011e00], rax
mov rax, qword [0x140011e00]
jmp 0x14001d53d
jmp 0x14001d416
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140001860
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x140004c10
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x1d8
mov rax, qword [0x14007bec0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rax, qword [rsp + 0x1e0]
mov byte [rax], 0
lea rdx, [rsp + 0x20]
mov cx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140004c57
mov rax, qword [rsp + 0x1e0]
mov byte [rax], 1
mov rax, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14005a070
add rsp, 0x1d8
ret

Function at 0x14000c8b0
Capabilities:
Execute command
Persist via windows service
Set registry value

Disassembly:
sub rsp, 0x98
mov rax, qword [0x14007bec0]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, [0x140060ab0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14000c92c
lea rdx, str.Failed_to_open_registry_key.
lea rcx, [rsp + 0x38]
call fcn.140004350
nop
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.1400581e0
nop
lea rcx, [rsp + 0x38]
call fcn.140005240
nop
xor al, al
jmp 0x14000c9bb
mov dword [rsp + 0x80], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableDynamicUpdate
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rsp + 0x30], 0
je 0x14000c9ac
lea rdx, str.Failed_to_set_registry_value..
lea rcx, [rsp + 0x58]
call fcn.140004350
nop
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.1400581e0
nop
lea rcx, [rsp + 0x58]
call fcn.140005240
nop
xor al, al
jmp 0x14000c9bb
lea rcx, str.netsh_interface_ipv4_set_global_neighborcachelimit0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov al, 1
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14005a070
add rsp, 0x98
ret
Function at 0x14000cab0
Capabilities:
Get local ipv4 addresses

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov rax, qword [0x14007bec0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x88], 0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov ecx, 2
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
mov edx, 8
lea rcx, [rsp + 0x90]
call fcn.140008da0
mov eax, dword [rsp + 0x88]
mov edx, eax
lea rcx, [rsp + 0x90]
call fcn.14000b960
nop
lea rcx, [rsp + 0x90]
call fcn.1400028e0
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x20], rcx
mov r9, rax
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov ecx, 2
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
test eax, eax
jne 0x14000cc1a
lea rcx, [rsp + 0x90]
call fcn.1400028e0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14000cc18
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14000cc05
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
add rax, 4
mov r9d, reloc.WS2_32.dll_shutdown
lea r8, [rsp + 0x98]
mov rdx, rax
mov ecx, 2
call sub.WS2_32.dll_inet_ntop
nop
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x48]
call fcn.140004350
nop
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xd0]
call fcn.14000eb10
nop
lea rcx, [rsp + 0x48]
call fcn.140005240
nop
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 8]
mov qword [rsp + 0x30], rax
jmp 0x14000cb89
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
jmp 0x14000cb6f
jmp 0x14000cc44
lea rdx, str.Failed_to_get_adapter_addresses.
lea rcx, [rsp + 0x68]
call fcn.140004350
nop
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.1400581e0
nop
lea rcx, [rsp + 0x68]
call fcn.140005240
nop
lea rcx, [rsp + 0x90]
call fcn.14000c310
nop
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14005a070
add rsp, 0xc8
ret

Function at 0x14001d9b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x14007bec0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.140008da0
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140022340
nop
lea rax, [0x14001a7a0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.1400028e0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x14001da54
lea rcx, [rsp + 0x40]
call fcn.140049830
nop
jmp 0x14001da6b
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.14002a580
nop
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14005a070
add rsp, 0x58
ret
Function at 0x14002cf30
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x1a8
mov rax, qword [0x14007bec0]
xor rax, rsp
mov qword [rsp + 0x198], rax
lea rdx, str.action
lea rcx, [rsp + 0x50]
call fcn.140004350
nop
xor r9d, r9d
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x178]
mov rcx, qword [rsp + 0x1b8]
call fcn.140043240
nop
lea rcx, [rsp + 0x50]
call fcn.140005240
nop
lea rdx, [0x140062dc0]
lea rcx, [rsp + 0x70]
call fcn.140004350
nop
xor r9d, r9d
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x158]
mov rcx, qword [rsp + 0x1b8]
call fcn.140043240
nop
lea rcx, [rsp + 0x70]
call fcn.140005240
nop
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x158]
call int.140005e50
movzx eax, al
test eax, eax
je 0x14002d20e
mov edx, 0x18
lea rcx, [rsp + 0x140]
call fcn.140008da0
lea rdx, str..sys
lea rcx, [rsp + 0x90]
call fcn.140004350
nop
lea r9, [rsp + 0x90]
lea r8, [rsp + 0x178]
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x140]
call fcn.140006740
nop
lea rcx, [rsp + 0x90]
call fcn.140005240
nop
lea rcx, [rsp + 0x140]
call fcn.14000a2d0
cmp rax, 0x2800
jbe 0x14002d0af
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x140]
mov rcx, qword [rsp + 0x28]
call fcn.140027ca0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.14004f8b0
nop
call fcn.1400585d0
movzx eax, al
test eax, eax
jne 0x14002d0ad
lea rdx, str._nFailed_To_Restart_WmiPrvSE.exe_nManually_Taskkill_In_Taskmanager_
lea rcx, [0x140084528]
call fcn.140030050
nop
jmp 0x14002d0c3
lea rdx, str._nSkipped_loading_Driver_
lea rcx, [0x140084528]
call fcn.140030050
nop
mov edx, 0x18
lea rcx, [rsp + 0x128]
call fcn.140008da0
lea rdx, str..dll
lea rcx, [rsp + 0xb0]
call fcn.140004350
nop
lea r9, [rsp + 0xb0]
lea r8, [rsp + 0x178]
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x128]
call fcn.140006740
nop
lea rcx, [rsp + 0xb0]
call fcn.140005240
nop
lea rcx, [rsp + 0x128]
call fcn.14000a2d0
cmp rax, 0x2800
jbe 0x14002d18b
lea rcx, [rsp + 0x120]
call fcn.140058360
nop
lea rax, [rsp + 0x108]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x128]
mov rcx, qword [rsp + 0x38]
call fcn.140027ca0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x120]
mov dword [rsp + 0x20], eax
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x20]
call fcn.140030ae0
nop
jmp 0x14002d19f
lea rdx, str._nSkipped_loading_Module_
lea rcx, [0x140084528]
call fcn.140030050
nop
lea rdx, str._nWould_You_Like_To_Clean_
lea rcx, [0x140084528]
call fcn.140030050
lea rcx, [0x140084528]
call fcn.140008cf0
mov r9d, 0x24
lea r8, str.Bootstrapper
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 6
jne 0x14002d1e7
call fcn.14000d7f0
nop
mov ecx, 0x539
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str.Invalid_License_
lea rcx, [rsp + 0xd0]
call fcn.140004350
nop
mov dl, 1
lea rcx, [rsp + 0xd0]
call fcn.1400581e0
nop
lea rcx, [rsp + 0xd0]
call fcn.140005240
nop
lea rcx, [rsp + 0x158]
call fcn.140005240
nop
lea rcx, [rsp + 0x178]
call fcn.140005240
nop
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.14005a070
add rsp, 0x1a8
ret
Function at 0x14002da50
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x18]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
mov rdx, qword [rsp + 0x40]
mov rdx, qword [rdx + 8]
mov r8, qword [rsp + 0x40]
mov r8, qword [r8]
mov qword [rsp + 0x20], r8
mov r9d, dword [rax]
mov r8d, dword [rcx]
mov rdx, qword [rdx]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_recv]
add rsp, 0x38
ret

Function at 0x14002daa0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rax, qword [rax]
inc rax
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 8]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_select]
add rsp, 0x38
ret

Function at 0x14002daf0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rax, qword [rax]
inc rax
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov rcx, qword [rsp + 0x40]
mov r8, qword [rcx + 8]
xor edx, edx
mov ecx, eax
call qword [sym.imp.WS2_32.dll_select]
add rsp, 0x38
ret

Function at 0x14002db30
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x18]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
mov rdx, qword [rsp + 0x40]
mov rdx, qword [rdx + 8]
mov r8, qword [rsp + 0x40]
mov r8, qword [r8]
mov qword [rsp + 0x20], r8
mov r9d, dword [rax]
mov r8d, dword [rcx]
mov rdx, qword [rdx]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_send]
add rsp, 0x38
ret