joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140092e70
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x1b8]
add rdx, 0x470
mov rbx, rcx
cmp dword [rax + 0x10], 0
je 0x140092ec1
cmp qword [rdx + 0x90], 0
je 0x140092ec1
xor r9d, r9d
lea r8, str.REST__d
call fcn.1400a66e0
mov r8d, eax
test eax, eax
jne 0x140092ecb
lea edx, [rax + 0x1a]
mov rcx, rbx
call fcn.140091290
mov eax, r8d
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp fcn.140092b90
add rsp, 0x20
pop rbx
ret

Function at 0x140093170
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x1b8]
mov rbx, rcx
cmp dword [rax + 0x10], 1
jne 0x1400931c0
mov r9, qword [rdx + 0x500]
test r9, r9
je 0x1400931c0
lea r8, str.SIZE__s
add rdx, 0x470
call fcn.1400a66e0
mov r8d, eax
test eax, eax
jne 0x1400931ca
lea edx, [rax + 0x17]
mov rcx, rbx
call fcn.140091290
mov eax, r8d
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp fcn.140092e70
add rsp, 0x20
pop rbx
ret

Function at 0x140093420
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0xaec], 0
mov r10, rcx
mov r11, qword [rcx + 0x18]
je 0x14009347c
cmp qword [r11 + 0x500], 0
je 0x14009347c
movzx edx, byte [rcx + 0xadb]
mov rcx, r11
call fcn.1400916a0
test eax, eax
je 0x14009347c
mov rax, qword [r10 + 0x1b8]
mov r9d, reloc.WS2_32.dll_send
mov rdx, r11
mov rcx, r10
mov dword [rax + 0x10], 1
movzx r8d, byte [r10 + 0xadb]
add rsp, 0x28
jmp fcn.140091600
mov rdx, r11
mov rcx, r10
add rsp, 0x28
jmp fcn.140093170

Function at 0x140093490
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx + 0x18]
lea eax, [rdx - 0xc8]
xor edi, edi
mov esi, r8d
mov rbx, rcx
cmp eax, 0x64
jb 0x1400934cc
lea rdx, str.Couldnt_set_desired_mode
call fcn.140078340
lea eax, [rdi + 0x11]
jmp 0x140093524
cmp edx, 0xc8
je 0x1400934e3
mov r8d, edx
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200_n
call fcn.140078430
cmp esi, 0x13
jne 0x1400934f5
mov rdx, rbp
mov rcx, rbx
call fcn.140093170
jmp 0x140093520
cmp esi, 0x14
jne 0x140093504
mov rcx, rbx
call fcn.140092130
jmp 0x140093520
cmp esi, 0x15
jne 0x140093513
mov rcx, rbx
call fcn.140093160
jmp 0x140093520
cmp esi, 0x16
jne 0x140093522
mov rcx, rbx
call fcn.140093370
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140099a80
Capabilities:
Send data
Send data on socket

Disassembly:
mov r9, qword [rcx + 0x1b8]
mov r11, rcx
movsxd r10, edx
mov r8d, dword [r9 + r10*4 + 8]
sub r8d, 1
je 0x140099b01
sub r8d, 1
je 0x140099ad8
cmp r8d, 1
jne 0x140099b15
mov ecx, dword [r9 + r10*4 + 0x408]
test ecx, ecx
je 0x140099af9
cmp ecx, r8d
jne 0x140099b15
xor eax, eax
mov dword [r9 + r10*4 + 8], 2
mov r8d, edx
mov dword [r9 + r10*4 + 0x408], eax
mov edx, 0xfb
mov rcx, r11
jmp fcn.140099ca0
mov ecx, dword [r9 + r10*4 + 0x408]
test ecx, ecx
je 0x140099af9
cmp ecx, 1
jne 0x140099b15
xor eax, eax
mov dword [r9 + r10*4 + 8], eax
mov dword [r9 + r10*4 + 0x408], eax
ret
xor eax, eax
mov dword [r9 + r10*4 + 8], eax
ret
xor eax, eax
mov r8d, edx
mov edx, 0xfc
mov dword [r9 + r10*4 + 8], eax
jmp fcn.140099ca0
ret

Function at 0x140099b20
Capabilities:
Send data
Send data on socket

Disassembly:
mov r9, qword [rcx + 0x1b8]
mov r11, rcx
movsxd r10, edx
mov r8d, dword [r9 + r10*4 + 0xc08]
test r8d, r8d
je 0x140099bc4
sub r8d, 2
je 0x140099b7d
cmp r8d, 1
jne 0x140099bb6
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x140099b70
cmp ecx, r8d
jne 0x140099bb6
mov dword [r9 + r10*4 + 0xc08], r8d
mov dword [r9 + r10*4 + 0x1008], 0
ret
mov dword [r9 + r10*4 + 0xc08], 0
ret
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x140099bb7
cmp ecx, 1
jne 0x140099bb6
mov dword [r9 + r10*4 + 0xc08], 3
mov rcx, r11
mov dword [r9 + r10*4 + 0x1008], 0
mov r8d, edx
mov edx, 0xfe
jmp fcn.140099ca0
ret
mov dword [r9 + r10*4 + 0xc08], 1
ret
cmp dword [r9 + r10*4 + 0x1408], 1
jne 0x140099ba9
mov r8d, edx
mov dword [r9 + r10*4 + 0xc08], 1
mov edx, 0xfd
jmp fcn.140099ca0

Function at 0x140099bf0
Capabilities:
Send data
Send data on socket

Disassembly:
mov r9, qword [rcx + 0x1b8]
mov r11, rcx
movsxd r10, edx
mov r8d, dword [r9 + r10*4 + 0xc08]
sub r8d, 1
je 0x140099c7d
sub r8d, 1
je 0x140099c4e
cmp r8d, 1
jne 0x140099c94
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x140099c72
cmp ecx, r8d
jne 0x140099c94
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], 2
mov r8d, edx
mov dword [r9 + r10*4 + 0x1008], eax
mov edx, 0xfd
mov rcx, r11
jmp fcn.140099ca0
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x140099c72
cmp ecx, 1
jne 0x140099c94
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], eax
mov dword [r9 + r10*4 + 0x1008], eax
ret
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], eax
ret
xor eax, eax
mov r8d, edx
mov edx, 0xfe
mov dword [r9 + r10*4 + 0xc08], eax
jmp fcn.140099ca0
ret
Function at 0x140099ca0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov byte [rsp + 0x38], 0xff
mov rcx, qword [rcx + 0x18]
mov edi, r8d
mov esi, edx
mov byte [rsp + 0x3a], dil
xor r9d, r9d
mov byte [rsp + 0x39], sil
lea rdx, [rsp + 0x38]
mov rcx, qword [rcx + 0x1f0]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140099cff
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbx
mov r8d, eax
call fcn.140078340
mov r9d, edi
lea rdx, str.SENT
mov r8d, esi
mov rcx, rbx
call fcn.140099480
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14009a050
Capabilities:
Send data
Send data on socket

Disassembly:
mov r10, qword [rcx + 0x1b8]
movsxd r11, edx
mov r9d, dword [r10 + r11*4 + 8]
cmp r8d, 1
jne 0x14009a0a3
test r9d, r9d
je 0x14009a08d
sub r9d, 2
je 0x14009a0b5
cmp r9d, r8d
jne 0x14009a0e3
cmp dword [r10 + r11*4 + 0x408], 0
jne 0x14009a0e3
mov dword [r10 + r11*4 + 0x408], 1
ret
mov r8d, edx
mov dword [r10 + r11*4 + 8], 2
mov edx, 0xfb
jmp fcn.140099ca0
sub r9d, 1
je 0x14009a0cd
sub r9d, 1
je 0x14009a075
cmp r9d, 1
jne 0x14009a0e3
cmp dword [r10 + r11*4 + 0x408], 1
jne 0x14009a0e3
mov dword [r10 + r11*4 + 0x408], 0
ret
mov r8d, edx
mov dword [r10 + r11*4 + 8], 3
mov edx, 0xfc
jmp fcn.140099ca0
ret

Function at 0x14009a0f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov r10, qword [rcx + 0x1b8]
movsxd r11, edx
mov r9d, dword [r10 + r11*4 + 0xc08]
cmp r8d, 1
jne 0x14009a149
test r9d, r9d
je 0x14009a130
sub r9d, 2
je 0x14009a15b
cmp r9d, r8d
jne 0x14009a18c
cmp dword [r10 + r11*4 + 0x1008], 0
jne 0x14009a18c
mov dword [r10 + r11*4 + 0x1008], 1
ret
mov r8d, edx
mov dword [r10 + r11*4 + 0xc08], 2
mov edx, 0xfd
jmp fcn.140099ca0
sub r9d, 1
je 0x14009a173
sub r9d, 1
je 0x14009a118
cmp r9d, 1
jne 0x14009a18c
cmp dword [r10 + r11*4 + 0x1008], 1
jne 0x14009a18c
mov dword [r10 + r11*4 + 0x1008], 0
ret
mov r8d, edx
mov dword [r10 + r11*4 + 0xc08], 3
mov edx, 0xfe
jmp fcn.140099ca0
ret
Function at 0x14009b300
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x14017d010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rax, qword [rcx + 0x18]
mov rsi, rcx
xor r9d, r9d
mov rdi, qword [rax + 0x470]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], pe_nt_image_headers64
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r8d, dword [rdi + 0x154]
lea r14, [rdi + 0x160]
mov rdx, qword [r14]
add r8d, 4
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rdi + 0x148], 0
mov dword [rdi + 0x14c], eax
jne 0x14009b399
movsxd r8, dword [rsp + 0x30]
lea rcx, [rdi + 0xc8]
lea rdx, [rsp + 0x40]
call fcn.1400abbd0
mov eax, dword [rsp + 0x30]
mov dword [rdi + 0x148], eax
mov r9d, dword [rdi + 0x14c]
mov qword [rsp + 0xf8], rbx
mov qword [rsp + 0x100], rbp
cmp r9d, 4
jge 0x14009b3fa
lea rdx, str.Received_too_short_packet
mov rcx, rsi
call fcn.140078340
mov dword [rdi + 0xc], 7
xor eax, eax
mov rbp, qword [rsp + 0x100]
mov rbx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140064e40
add rsp, 0xd0
pop r14
pop rdi
pop rsi
ret
mov rcx, r14
call fcn.14009ae20
movzx r8d, ax
mov dword [rdi + 0xc], r8d
sub r8d, 3
je 0x14009b4a9
sub r8d, 1
je 0x14009b51b
sub r8d, 1
je 0x14009b465
cmp r8d, 1
je 0x14009b445
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rsi
lea rdx, [0x140168804]
call fcn.140078340
jmp 0x14009b51b
mov rdx, qword [r14]
lea r8d, [r9 - 2]
add rdx, 2
mov rcx, rdi
call fcn.14009b040
test eax, eax
je 0x14009b51b
jmp 0x14009b3ce
mov rbp, qword [r14]
lea eax, [r9 - 4]
mov rcx, r14
movsxd rbx, eax
call fcn.14009ae00
movzx r9d, ax
lea rcx, [rbp + 4]
mov rdx, rbx
mov dword [rdi + 8], r9d
call fcn.14009bf40
cmp rax, rbx
jae 0x14009b51b
lea r8, [rbp + 4]
mov rcx, rsi
lea rdx, str.TFTP_error:__s_n
call fcn.140078430
jmp 0x14009b51b
cmp r9d, 4
jle 0x14009b51b
mov rcx, r14
call fcn.14009ae00
movzx ecx, word [rdi + 0x15c]
inc ecx
cmp cx, ax
jne 0x14009b51b
mov r8, qword [r14]
lea eax, [r9 - 4]
movsxd r9, eax
add r8, 4
mov edx, 1
mov rcx, rsi
call fcn.140078260
mov ebx, eax
test eax, eax
je 0x14009b4fa
mov edx, 5
mov rcx, rdi
call fcn.14009be30
mov eax, ebx
jmp 0x14009b3ce
mov eax, dword [rdi + 0x14c]
mov rcx, rsi
sub eax, 4
cdqe
add qword [rsi + 0x100], rax
mov rdx, qword [rsi + 0x100]
call fcn.140084c90
mov rcx, rsi
call fcn.140084f20
test eax, eax
je 0x14009b3cc
mov edx, 5
mov rcx, rdi
call fcn.14009be30
mov eax, Ordinal_46
jmp 0x14009b3ce
Function at 0x14009d490
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 1
mov edx, ebx
xor ecx, ecx
xor ebp, ebp
call qword [fcn.1400bc3d0]
mov rdi, rax
test rax, rax
je 0x14009d50d
nop word [rax + rax]
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
mov rbp, rdi
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
je 0x14009d538
cmp ebx, esi
je 0x14009d538
cmp ebx, 0x8000
ja 0x14009d538
cmp ebx, esi
jb 0x14009d533
mov edx, ebx
mov rcx, rdi
call qword [fcn.1400bc3d0]
mov rdi, rax
test rax, rax
jne 0x14009d4d0
mov rcx, rbp
call qword [fcn.1400b6af4]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rdi
jmp 0x14009d518
mov rcx, rdi
jmp 0x14009d510
jmp 0x14009d490

Function at 0x14009d540
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 1
mov edx, ebx
xor ecx, ecx
xor ebp, ebp
call qword [fcn.1400bc3d0]
mov rdi, rax
test rax, rax
je 0x14009d50d
nop word [rax + rax]
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
mov rbp, rdi
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
je 0x14009d538
cmp ebx, esi
je 0x14009d538
cmp ebx, 0x8000
ja 0x14009d538
cmp ebx, esi
jb 0x14009d533
mov edx, ebx
mov rcx, rdi
call qword [fcn.1400bc3d0]
mov rdi, rax
test rax, rax
jne 0x14009d4d0
mov rcx, rbp
call qword [fcn.1400b6af4]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rdi
jmp 0x14009d518
mov rcx, rdi
jmp 0x14009d510
jmp 0x14009d490
Function at 0x1400a8d80
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14017d010]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, r8
mov dword [rsp + 0x40], 8
mov rbx, rdx
mov dword [rsp + 0x20], 0xf0000040
mov rdi, rcx
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400a8e4c
mov qword [rsp + 0xa0], rbp
lea rdx, [rsp + 0x64]
xor ebp, ebp
mov dword [rsp + 0x58], 0x208
mov rcx, rsi
mov qword [rsp + 0x64], rbp
mov dword [rsp + 0x5c], 0x6601
mov dword [rsp + 0x60], 8
call fcn.1400a8ec0
lea rcx, [rsp + 0x64]
lea edx, [rbp + 8]
call fcn.1400aa4a0
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r8d, [rbp + 0x14]
xor r9d, r9d
mov dword [rsp + 0x20], ebp
lea rdx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov rbp, qword [rsp + 0xa0]
test eax, eax
jne 0x1400a8e50
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
jmp 0x1400a8e9a
mov rax, qword [rdi]
xor r9d, r9d
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov qword [rbx], rax
xor edx, edx
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140064e40
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400a9470
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [fcn.1400bc28c]
mov rdi, rax
test rax, rax
jne 0x1400a94b2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400a94f9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400a9552
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400a9510
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400a9593
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400eabb8]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400eabb9]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400a9560
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1400bd658
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400bd484

Function at 0x1400c91b0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400c91d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400c1170
or eax, 0xffffffff
jmp 0x1400c91d2
xor eax, eax
add rsp, 0x28
ret
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x140c21058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140c211df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140c21089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c2106f
add dl, dl
jne 0x140c21096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c210f6
xor eax, eax
add dl, dl
jne 0x140c210a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c211ad
add dl, dl
jne 0x140c210b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c210c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c210d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c210dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140c210ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140c2107e
mov eax, 1
add dl, dl
jne 0x140c21106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c21113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c210fb
sub eax, ebx
mov ebx, 1
jne 0x140c2114c
mov ecx, 1
add dl, dl
jne 0x140c2112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c2113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c21123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c2107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140c21168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c21175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c2115d
cmp eax, 0x7d00
jae 0x140c2119b
cmp eax, 0x500
jb 0x140c21196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c2107e
cmp eax, 0x7f
ja 0x140c2119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c2107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140c211d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140c2107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400111e5
Capabilities:
Terminate process

Disassembly:
jmp 0x140012d10
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001125d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
jmp 0x1400117a0
push rbp
push rsi
push rdi
sub rsp, 0x500
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xd8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001d008]
xor rax, rbp
mov qword [rbp + 0x4d8], rax
lea rcx, [0x14002209f]
call fcn.140011361
lea rax, [rbp + 0x10]
lea rcx, [0x140019c30]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2f5
rep movsb byte [rdi], byte [rsi]
mov dword [rbp + 0x324], 0
jmp 0x140011810
mov eax, dword [rbp + 0x324]
inc eax
mov dword [rbp + 0x324], eax
movsxd rax, dword [rbp + 0x324]
cmp rax, 0x2f5
jae 0x14001183d
movsxd rax, dword [rbp + 0x324]
movzx eax, byte [rbp + rax + 0x10]
xor eax, 0xcb
movsxd rcx, dword [rbp + 0x324]
mov byte [rbp + rcx + 0x10], al
jmp 0x140011802
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x2f5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x348], rax
mov r8d, 0x2f5
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x348]
call fcn.1400111a9
call qword [rbp + 0x348]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140019c00]
call fcn.1400112f8
mov eax, edi
mov rcx, qword [rbp + 0x4d8]
xor rcx, rbp
call fcn.1400111a4
lea rsp, [rbp + 0x4e0]
pop rdi
pop rsi
pop rbp
ret

Function at 0x140011267
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014060
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014080
xor al, al
jmp 0x140014101
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014093
xor al, al
jmp 0x140014101
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400140bd
xor al, al
jmp 0x140014101
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400140d1
xor al, al
jmp 0x140014101
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400140e3
xor al, al
jmp 0x140014101
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400140ff
xor al, al
jmp 0x140014101
mov al, 1
add rsp, 0x38
ret
Function at 0x140049910
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14004991d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14004992d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140049915
lea eax, [rcx + 1]
jmp 0x14004993b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14004994e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140049934
sub eax, 3
jb 0x14004996e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400499bd
sar eax, 1
movsxd rbp, eax
jb 0x1400499a4
jmp 0x14004997c
add ebx, ebx
jne 0x14004997a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400499a4
inc ecx
add ebx, ebx
jne 0x14004998a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400499a4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14004999d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14004998c
add ecx, 2
jmp 0x1400499a9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1400498d2
jmp 0x14004991d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2a600
mov dl, 0xe
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140049a09
cmp rsi, rcx
jae 0x140049a11
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400499f0
cmp al, 0x8f
ja 0x1400499f0
cmp byte [rsi - 2], 0xf
je 0x1400499f6
sub al, 0xe8
cmp al, 1
ja 0x1400499da
cmp rsi, rcx
jae 0x140049a11
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400499e0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140049a11
lodsb al, byte [rsi]
jmp 0x1400499f0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x47000]
mov eax, dword [rdi]
or eax, eax
je 0x140049a6e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x491e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140049a1e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140049a68
mov qword [rbx], rax
add rbx, 8
jmp 0x140049a3e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140049aa8
cmp al, 0xef
ja 0x140049a9a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140049a7a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140049a89
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140049afc
sub rsp, 0xffffffffffffff80
jmp 0x1400089e0
Function at 0x1400032f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movss xmm0, dword [r8]
xorps xmm1, xmm1
ucomiss xmm0, xmm1
jp 0x14000330c
jne 0x14000330c
movss xmm0, dword [r8 + 4]
ucomiss xmm0, xmm1
jp 0x14000330c
je 0x14000332a
mov rax, qword [0x14010ae20]
movsd xmm0, qword [r8]
movsd qword [rax + 0x1af4], xmm0
mov dword [rax + 0x1acc], 4
comiss xmm3, xmm1
jb 0x140003348
mov rax, qword [0x14010ae20]
movss dword [rax + 0x1b28], xmm3
mov dword [rax + 0x1ae0], 1
mov r8d, dword [rsp + 0x28]
jmp fcn.140003354