joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401d4e7c
Capabilities:
Get socket status

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x688
mov rax, qword [0x140310170]
xor rax, rsp
mov qword [rsp + 0x670], rax
mov rax, qword [rsp + 0x690]
cmp qword [rax + 0x68], 0
je 0x1401d4f8d
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x460], 0
mov dword [rsp + 0x250], 0
mov dword [rsp + 0x40], 0
xor edx, edx
mov eax, dword [rsp + 0x698]
mov ecx, 0x3e8
div ecx
mov dword [rsp + 0x38], eax
xor edx, edx
mov eax, dword [rsp + 0x698]
mov ecx, 0x3e8
div ecx
mov eax, edx
imul eax, eax, 0x3e8
mov dword [rsp + 0x3c], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x250]
lea rdx, [rsp + 0x460]
mov rax, qword [rsp + 0x690]
mov rcx, qword [rax + 0x68]
call fcn.140056f10
cmp dword [rsp + 0x30], 0xffffffff
jne 0x1401d4f4d
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x1401d4f8f
mov eax, dword [rsp + 0x30]
inc eax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x250]
lea rdx, [rsp + 0x460]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_select]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jge 0x1401d4f89
xor al, al
jmp 0x1401d4f8f
mov al, 1
jmp 0x1401d4f8f
xor al, al
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.1401ef4e0
add rsp, 0x688
ret

Function at 0x1401d7e40
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
add rax, 0x48
mov rcx, rax
call fcn.1401b3068
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 3
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rsp + 0x60]
mov qword [rcx + 0x40], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x40], 0xffffffffffffffff
jne 0x1401d7eaa
xor al, al
jmp 0x1401d7f24
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1401d7ecf
xor al, al
jmp 0x1401d7f24
cmp qword [rsp + 0x40], 0x1400000
jb 0x1401d7f08
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1401d7f08
xor al, al
jmp 0x1401d7f24
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov al, 1
add rsp, 0x58
ret
Function at 0x1401d7fe4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x78], 0xc800000
jb 0x1401d7ffe
jmp 0x1401d8077
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x50]
add rax, 0x68
mov rcx, rax
call fcn.1401d7914
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x50]
add rcx, 0x68
call fcn.1401d7900
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
mov r8d, ecx
mov rdx, rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [rsp + 0x50]
add rax, 0x68
mov rcx, rax
call fcn.1401d78e8
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx + 0x78]
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x78], rax
add rsp, 0x48
ret
Function at 0x1401e7ef0
Capabilities:
Get common file path
Query environment variable

Disassembly:
sub rsp, 0x268
mov rax, qword [0x140310170]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x28], 0
mov edx, 0x105
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x1401e7faf
lea r8, str._SYSTEMROOT__system32
mov edx, 0x105
lea rcx, [rsp + 0x140]
call fcn.1401e8ea8
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x1401e7f6e
mov r8d, dword [rsp + 0x20]
lea rdx, str.LoadUpdateProviderFunctions:_StringCchCopyA_failed:_0x_x_n
mov ecx, 4
call fcn.1401e8b2c
jmp 0x1401e805e
mov r8d, 0x105
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x1401e7faf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.LoadUpdateProviderFunctions:_Unable_to_expand_environment_string:__d_n
mov ecx, 4
call fcn.1401e8b2c
jmp 0x1401e805e
lea r8, [0x140265c08]
mov edx, 0x105
lea rcx, [rsp + 0x30]
call fcn.1401e8de8
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x1401e7fea
mov r8d, dword [rsp + 0x20]
lea rdx, str.LoadUpdateProviderFunctions:_StringCchCatA_failed:_0x_x_n
mov ecx, 4
call fcn.1401e8b2c
jmp 0x1401e805e
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1401e8025
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [rsp + 0x30]
lea rdx, str.LoadUpdateProviderFunctions:_Unable_to_load__s:__d_n
mov ecx, 4
call fcn.1401e8b2c
jmp 0x1401e805e
lea rdx, str.WSCUpdateProvider
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140367f40], rax
lea rdx, str.WSCUpdateProvider32
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140367f48], rax
mov rax, qword [rsp + 0x28]
jmp 0x1401e807c
cmp qword [rsp + 0x28], 0
je 0x1401e807a
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x28], 0
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1401ef4e0
add rsp, 0x268
ret
Function at 0x1401eba68
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x288
mov rax, qword [0x140310170]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rax, qword [rsp + 0x298]
mov dword [rax], 0
mov rax, qword [rsp + 0x290]
mov dword [rax + 0xa24], 0x103
mov rax, qword [rsp + 0x290]
add rax, 0xa24
mov rcx, qword [rsp + 0x290]
add rcx, 0x614
mov rdx, qword [rsp + 0x290]
add rdx, 0x14
mov qword [rsp + 0x48], rdx
mov r9, qword [rsp + 0x298]
mov r8, rax
mov rdx, rcx
mov rax, qword [rsp + 0x48]
mov rcx, rax
call sub.WS2_32.dll_WSCGetProviderPath
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0xffffffff
jne 0x1401ebb09
jmp 0x1401ebcd0
mov rax, qword [rsp + 0x290]
add rax, 0x81c
mov rcx, qword [rsp + 0x290]
add rcx, 0x614
mov r8d, 0x103
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x1401ebb97
cmp dword [rsp + 0x40], 0x103
jg 0x1401ebb97
mov rax, qword [rsp + 0x290]
add rax, 0x81c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, qword [rsp + 0x290]
mov qword [rcx + 0xc38], rax
mov rax, qword [rsp + 0x290]
cmp qword [rax + 0xc38], 0
jne 0x1401ebb92
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1401ebcd0
jmp 0x1401ebc82
cmp dword [rsp + 0x40], 0
jne 0x1401ebc82
mov rax, qword [rsp + 0x290]
add rax, 0x614
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x104
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x290]
mov r9d, dword [rcx + 0xa24]
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x1401ebc0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1401ebcd0
mov r8d, 0x103
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x1401ebc39
cmp dword [rsp + 0x40], 0x103
jle 0x1401ebc49
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1401ebcd0
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x290]
mov qword [rcx + 0xc38], rax
mov rax, qword [rsp + 0x290]
cmp qword [rax + 0xc38], 0
jne 0x1401ebc82
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1401ebcd0
lea rdx, str.WSPStartup
mov rax, qword [rsp + 0x290]
mov rcx, qword [rax + 0xc38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x290]
mov qword [rcx + 0xa28], rax
mov rax, qword [rsp + 0x290]
cmp qword [rax + 0xa28], 0
jne 0x1401ebcc9
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1401ebcd0
mov eax, 1
jmp 0x1401ebcef
mov rax, qword [rsp + 0x298]
cmp dword [rax], 0
jne 0x1401ebced
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x298]
mov dword [rcx], eax
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1401ef4e0
add rsp, 0x288
ret
Function at 0x1401f307c
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1401f308f
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1401f36f4
lea rdx, [0x14030d2a8]
lea rcx, [rsp + 0x20]
call fcn.14020ff80
int3

Function at 0x1401fddbc
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x140368f00]
xor edx, edx
jmp fcn.1401f307c

Function at 0x1401fe7ac
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x140368f00]
jmp fcn.1401f307c

Function at 0x140221d90
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140221af4
Function at 0x1402301c4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140230064
call fcn.1402197a8
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.1402122a4
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14023004c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x14023004c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x140230096
lock or dword [rax + 0x14], 0x10
jmp 0x14023004c
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1402300b3
mov rcx, qword [rbp + 0x10]
call fcn.140238fb0
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14022ae24
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.14022fa9c
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x14023010a
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x14023004c
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140230176
mov rcx, qword [rbp + 0x10]
call fcn.14022ae24
cmp eax, 0xffffffff
je 0x14023015d
mov rcx, qword [rbp + 0x10]
call fcn.14022ae24
cmp eax, 0xfffffffe
je 0x14023015d
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14022ae24
movsxd rdi, eax
lea rsi, [0x140369600]
mov rcx, rbx
sar rdi, 6
call fcn.14022ae24
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x140230164
lea rax, [0x140319890]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140230176
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1402301ac
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1402301a8
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1402301a8
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x14023004f
jmp 0x14023001c
Function at 0x14023b070
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x140310170]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov ebx, r9d
mov ebp, r8d
mov rsi, rdx
mov rdi, rcx
test r9d, r9d
je 0x14023b10a
mov qword [rsp + 0x48], rcx
lea r8, [rsp + 0x30]
mov dword [rsp + 0x40], 1
cmp ebx, 0xffffffff
jne 0x14023b0be
xor r8d, r8d
jmp 0x14023b0e7
mov eax, 0x10624dd3
mov ecx, ebx
imul ebx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3e8
mov dword [rsp + 0x30], edx
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [rsp + 0x34], eax
mov qword [rsp + 0x20], r8
lea ecx, [rdi + 1]
lea r8, [rsp + 0x40]
xor r9d, r9d
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jns 0x14023b108
or eax, 0xffffffff
jmp 0x14023b15d
je 0x14023b14f
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14023b153
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x14023b141
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x14023b141
mov eax, 0xfffffffe
jmp 0x14023b15d
test ebx, ebx
je 0x14023b14f
mov ecx, 0x30d40
call fcn.14023b190
xor eax, eax
jmp 0x14023b15d
test eax, eax
mov ecx, 0xfffffffd
cmove eax, ecx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1401ef4e0
mov rbx, qword [rsp + 0x298]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret
jmp 0x14023b070

Function at 0x14023b180
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x140310170]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov ebx, r9d
mov ebp, r8d
mov rsi, rdx
mov rdi, rcx
test r9d, r9d
je 0x14023b10a
mov qword [rsp + 0x48], rcx
lea r8, [rsp + 0x30]
mov dword [rsp + 0x40], 1
cmp ebx, 0xffffffff
jne 0x14023b0be
xor r8d, r8d
jmp 0x14023b0e7
mov eax, 0x10624dd3
mov ecx, ebx
imul ebx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3e8
mov dword [rsp + 0x30], edx
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [rsp + 0x34], eax
mov qword [rsp + 0x20], r8
lea ecx, [rdi + 1]
lea r8, [rsp + 0x40]
xor r9d, r9d
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jns 0x14023b108
or eax, 0xffffffff
jmp 0x14023b15d
je 0x14023b14f
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14023b153
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x14023b141
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x14023b141
mov eax, 0xfffffffe
jmp 0x14023b15d
test ebx, ebx
je 0x14023b14f
mov ecx, 0x30d40
call fcn.14023b190
xor eax, eax
jmp 0x14023b15d
test eax, eax
mov ecx, 0xfffffffd
cmove eax, ecx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1401ef4e0
mov rbx, qword [rsp + 0x298]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret
jmp 0x14023b070
Function at 0x14023c7c0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x14036b358], 0
lea rbx, [0x14036b360]
je 0x14023c7e9
mov ecx, dword [0x14036b354]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
cmovne rbx, rax
cmp byte [rbx + 0x3ff], 0
mov rax, rbx
je 0x14023c7fc
mov byte [rbx + 0x3ff], 0
add rsp, 0x20
pop rbx
ret
Function at 0x14000100f
Capabilities:
Enumerate files on windows

Disassembly:
jmp 0x140001110
push rdi
sub rsp, 0x360
mov rdi, rsp
mov ecx, 0xd8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov qword [rsp + 0x158], 0x104
mov dword [rsp + 0x2d0], 0
mov byte [rsp + 0x2e4], 0x54
mov byte [rsp + 0x2e5], 0x45
mov byte [rsp + 0x2e6], 0x4d
mov byte [rsp + 0x2e7], 0x50
mov byte [rsp + 0x2e8], 0
mov byte [rsp + 0x304], 0x5c
mov byte [rsp + 0x305], 0x5c
mov byte [rsp + 0x306], 0x2a
mov byte [rsp + 0x307], 0
lea r8, [rsp + 0x2e4]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x158]
call fcn.140001014
lea rdx, [rsp + 0x304]
lea rcx, [rsp + 0x30]
call fcn.14000100a
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x2c8], rax
cmp qword [rsp + 0x2c8], 0xffffffffffffffff
jne 0x14000120b
mov eax, 1
jmp 0x1400012dd
mov eax, dword [rsp + 0x180]
and eax, 0x10
test eax, eax
je 0x14000121b
jmp 0x14000122b
mov eax, dword [rsp + 0x2d0]
inc eax
mov dword [rsp + 0x2d0], eax
lea rdx, [rsp + 0x180]
mov rcx, qword [rsp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14000120b
mov rcx, qword [rsp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [rsp + 0x2d0], 0x1e
jge 0x140001266
mov eax, 1
jmp 0x1400012dd
mov byte [rsp + 0x328], 0x57
mov byte [rsp + 0x329], 0x69
mov byte [rsp + 0x32a], 0x6e
mov byte [rsp + 0x32b], 0x68
mov byte [rsp + 0x32c], 0x74
mov byte [rsp + 0x32d], 0x74
mov byte [rsp + 0x32e], 0x70
mov byte [rsp + 0x32f], 0x2e
mov byte [rsp + 0x330], 0x64
mov byte [rsp + 0x331], 0x6c
mov byte [rsp + 0x332], 0x6c
mov byte [rsp + 0x333], 0
lea rcx, [rsp + 0x328]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14001d300], rax
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140015cd0]
call fcn.140002250
mov rax, rdi
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.140002230
add rsp, 0x360
pop rdi
ret
Function at 0x140001110
Capabilities:
Contain obfuscated stackstrings
Enumerate files on windows

Disassembly:
jmp 0x140001110
push rdi
sub rsp, 0x360
mov rdi, rsp
mov ecx, 0xd8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov qword [rsp + 0x158], 0x104
mov dword [rsp + 0x2d0], 0
mov byte [rsp + 0x2e4], 0x54
mov byte [rsp + 0x2e5], 0x45
mov byte [rsp + 0x2e6], 0x4d
mov byte [rsp + 0x2e7], 0x50
mov byte [rsp + 0x2e8], 0
mov byte [rsp + 0x304], 0x5c
mov byte [rsp + 0x305], 0x5c
mov byte [rsp + 0x306], 0x2a
mov byte [rsp + 0x307], 0
lea r8, [rsp + 0x2e4]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x158]
call fcn.140001014
lea rdx, [rsp + 0x304]
lea rcx, [rsp + 0x30]
call fcn.14000100a
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x2c8], rax
cmp qword [rsp + 0x2c8], 0xffffffffffffffff
jne 0x14000120b
mov eax, 1
jmp 0x1400012dd
mov eax, dword [rsp + 0x180]
and eax, 0x10
test eax, eax
je 0x14000121b
jmp 0x14000122b
mov eax, dword [rsp + 0x2d0]
inc eax
mov dword [rsp + 0x2d0], eax
lea rdx, [rsp + 0x180]
mov rcx, qword [rsp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14000120b
mov rcx, qword [rsp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [rsp + 0x2d0], 0x1e
jge 0x140001266
mov eax, 1
jmp 0x1400012dd
mov byte [rsp + 0x328], 0x57
mov byte [rsp + 0x329], 0x69
mov byte [rsp + 0x32a], 0x6e
mov byte [rsp + 0x32b], 0x68
mov byte [rsp + 0x32c], 0x74
mov byte [rsp + 0x32d], 0x74
mov byte [rsp + 0x32e], 0x70
mov byte [rsp + 0x32f], 0x2e
mov byte [rsp + 0x330], 0x64
mov byte [rsp + 0x331], 0x6c
mov byte [rsp + 0x332], 0x6c
mov byte [rsp + 0x333], 0
lea rcx, [rsp + 0x328]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14001d300], rax
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140015cd0]
call fcn.140002250
mov rax, rdi
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.140002230
add rsp, 0x360
pop rdi
ret
Function at 0x14000321f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [section..data]
jne 0x14000224a
rol rcx, 0x10
test cx, 0xffff
jne 0x140002246
repz ret
ror rcx, 0x10
jmp 0x140003178
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14001d3e0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14001d4d8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400031fd
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14001d3e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000321f
mov rax, qword [rsp + 0x88]
mov qword [0x14001d4d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14001d478], rax
mov rax, qword [0x14001d4d8]
mov qword [0x14001d350], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14001d460], rax
mov dword [0x14001d340], 0xc0000409
mov dword [0x14001d344], 1
mov rax, qword [section..data]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14001c008]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14001d3d8], eax
mov ecx, 1
call fcn.1400060c8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140016450]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14001d3d8], 0
jne 0x1400032a6
mov ecx, 1
call fcn.1400060c8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x140004064
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140003ed4
Function at 0x140008c84
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140005bdc
xor ebx, ebx
cmp qword [0x14001e308], rbx
mov rdi, rax
jne 0x140008d97
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140008e6e
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008e6e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14001e308], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14001e310], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14001e318], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14001e328], rax
test rax, rax
je 0x140008d8e
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14001e320], rax
jmp 0x140008d9e
mov rax, qword [0x14001e320]
jmp 0x140008da5
mov rax, qword [0x14001e320]
mov r11, qword [0x14001e328]
cmp rax, rdi
je 0x140008e0c
cmp r11, rdi
je 0x140008e0c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14001e328]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140008e0c
test rax, rax
je 0x140008e0c
call rsi
test rax, rax
je 0x140008e06
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140008e06
test byte [rsp + 0x40], 1
jne 0x140008e0c
bts ebp, 0x15
jmp 0x140008e4c
mov rcx, qword [0x14001e310]
cmp rcx, rdi
je 0x140008e4c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140008e4c
call rax
mov rbx, rax
test rax, rax
je 0x140008e4c
mov rcx, qword [0x14001e318]
cmp rcx, rdi
je 0x140008e4c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140008e4c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14001e308]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140008e6e
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140008e70
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140002230
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret