joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005fef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x5e4c
lea r8, [0x140172180]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xd]
mov dword [rsp + 0x20], 0x5e295e27
mov dword [rsp + 0x24], 0x5e225e3e
mov dword [rsp + 0x28], 0x5e205e29
mov dword [rsp + 0x2c], 0x5e7e5e7f
mov dword [rsp + 0x30], 0x5e285e62
mov dword [rsp + 0x34], 0x5e205e20
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.140016520
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400efba0
add rsp, 0x130
pop rbp
ret

Function at 0x140060140
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x80
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x30], 0
call fcn.14005fff0
mov dword [rsp + 0x68], 0
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x14005fd60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
mov rcx, rdi
call fcn.14005f270
mov dword [rsp + 0x30], 1
mov rax, qword [rdi]
test rax, rax
je 0x140060206
cmp qword [rax], 0
je 0x140060206
lea rbx, [0x140170ba8]
mov qword [rsp + 0x38], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rdx, rdi
call fcn.140060470
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rdi
jmp 0x140060233
lea rax, str.wtf__cannot_create_the_thread
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.1400eefd4
lea rdx, [0x1401fe0e0]
lea rcx, [rsp + 0x50]
call fcn.1400ef340
nop
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400efba0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
Function at 0x140069670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
mov rdi, rdx
mov r10, rcx
test r9d, r9d
je 0x14006973a
movzx r11d, byte [rcx]
mov qword [rsp + 0x10], rbx
sub rdi, r8
mov ebx, r9d
movzx eax, r11b
inc eax
and eax, 0x800000ff
jge 0x1400696a6
dec eax
or eax, 0xffffff00
inc eax
movzx r9d, al
mov byte [r10], al
movzx eax, byte [r10 + 1]
movzx ecx, byte [r9 + r10 + 2]
add ecx, eax
and ecx, 0x800000ff
jge 0x1400696cc
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [r10 + 1], cl
movzx edx, byte [r9 + r10 + 2]
movzx eax, cl
movzx ecx, byte [rax + r10 + 2]
mov byte [r9 + r10 + 2], cl
movzx eax, byte [r10 + 1]
mov byte [rax + r10 + 2], dl
movzx eax, byte [r10 + 1]
movzx r11d, byte [r10]
movzx ecx, byte [rax + r10 + 2]
movzx eax, byte [r11 + r10 + 2]
add ecx, eax
and ecx, 0x800000ff
jge 0x140069717
dec ecx
or ecx, 0xffffff00
inc ecx
movsxd rax, ecx
inc r8
movzx ecx, byte [rax + r10 + 2]
xor cl, byte [rdi + r8 - 1]
mov byte [r8 - 1], cl
dec rbx
jne 0x140069690
mov rbx, qword [rsp + 0x10]
pop rdi
ret

Function at 0x140069ef0
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x3a8]
sub rsp, 0x4a8
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov r14, r9
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x70]
call fcn.140069a00
nop
xor r15d, r15d
mov ebx, r15d
or rsi, 0xffffffffffffffff
mov dword [rsp + 0x68], 0x400
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x68]
lea r8, [rbp - 0x70]
mov edx, ebx
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14006a031
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r15
mov word [rsp + 0x40], r15w
cmp word [rbp - 0x70], ax
jne 0x140069fb9
mov r8, r15
jmp 0x140069fcb
lea rax, [rbp - 0x70]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x140069fc0
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.14003ca90
nop
mov rcx, qword [r14 + 0x18]
test rcx, rcx
je 0x14006a02b
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + select]
test al, al
sete dil
cmp qword [rsp + 0x58], 8
jb 0x14006a006
mov rcx, qword [rsp + 0x40]
call fcn.1400ed78c
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r15
mov word [rsp + 0x40], r15w
test dil, dil
jne 0x14006a026
inc ebx
jmp 0x140069f4f
xor dil, dil
jmp 0x14006a034
call fcn.1400cbb78
nop
mov dil, 1
mov rbx, qword [rsp + 0x78]
test rbx, rbx
je 0x14006a05b
lock dec dword [rbx + 8]
jne 0x14006a05b
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock dec dword [rbx + 0xc]
jne 0x14006a05b
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + ioctlsocket]
movzx eax, dil
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.1400efba0
add rsp, 0x4a8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14006a150
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x860
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rbx, r8
mov rsi, qword [rsp + 0x8a0]
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov r9d, 0x20019
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.140069a00
nop
cmp qword [rbx + 0x18], 8
jb 0x14006a1ae
mov rbx, qword [rbx]
mov dword [rsp + 0x38], 0x7fe
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
or rdi, 0xffffffffffffffff
test eax, eax
jne 0x14006a267
mov eax, dword [rsp + 0x3c]
dec eax
cmp eax, 1
jbe 0x14006a1fd
lea ebx, [rdi + 0xe]
jmp 0x14006a267
xor ebx, ebx
mov ecx, dword [rsp + 0x38]
test ecx, ecx
je 0x14006a21f
test cl, 1
jne 0x14006a218
mov eax, ecx
shr rax, 1
cmp word [rsp + rax*2 + 0x4e], bx
je 0x14006a224
mov ebx, 0xd
jmp 0x14006a267
mov word [rsp + 0x50], bx
shr ecx, 1
mov eax, ecx
add rax, rax
cmp rax, 0x800
jae 0x14006a29f
mov word [rsp + rax + 0x50], bx
cmp word [rsp + 0x50], bx
jne 0x14006a244
mov r8, rbx
jmp 0x14006a25a
lea rax, [rsp + 0x50]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x14006a250
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14003ca90
test ebx, ebx
sete sil
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x14006a299
mov eax, edi
lock xadd dword [rbx + 8], eax
dec eax
jne 0x14006a299
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock dec dword [rbx + 0xc]
jne 0x14006a299
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + ioctlsocket]
movzx eax, sil
jmp 0x14006a2a5
call fcn.1400f008c
nop
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1400efba0
add rsp, 0x860
pop rdi
pop rsi
pop rbx
ret

Function at 0x14006a400
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r10, r8
mov r9, rcx
test rcx, rcx
jne 0x14006a419
mov eax, 0x57
add rsp, 0x38
ret
or rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14006a420
lea ecx, [rax*2 + 2]
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r9
mov r9d, 1
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret
Function at 0x14006ae70
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x90
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rsp + 0x80], rax
call fcn.14006b100
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rsi
mov word [rsp + 0x30], si
or rbx, 0xffffffffffffffff
cmp word [rax], si
jne 0x14006aecf
mov r8d, esi
jmp 0x14006aedc
mov r8, rbx
inc r8
cmp word [rax + r8*2], si
jne 0x14006aed2
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14003ca90
nop
call fcn.14006b000
mov rdx, rax
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14002f7c0
nop
cmp qword [rax + 0x18], 8
jb 0x14006af0c
mov rax, qword [rax]
lea r8, [rsp + 0x78]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edi, eax
cmp qword [rsp + 0x68], 8
jb 0x14006af35
mov rcx, qword [rsp + 0x50]
call fcn.1400ed78c
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rsi
mov word [rsp + 0x50], si
cmp qword [rsp + 0x48], 8
jb 0x14006af5a
mov rcx, qword [rsp + 0x30]
call fcn.1400ed78c
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rsi
mov word [rsp + 0x30], si
test edi, edi
jne 0x14006afd2
mov rdi, qword [rsp + 0x78]
call fcn.14006b2f0
mov rsi, rax
call fcn.14006b200
mov rdx, rax
test rax, rax
je 0x14006afd2
nop dword [rax + rax]
lea rbx, [rbx + 1]
cmp word [rax + rbx*2], 0
jne 0x14006af90
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14006afd2
mov rcx, qword [rsp + 0x78]
call fcn.140073760
mov al, 1
jmp 0x14006afd4
xor al, al
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400efba0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14006b7a0
Capabilities:
Delete registry key

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rsp + 0x120], rbx
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14, rdx
xor dil, dil
xor r15d, r15d
mov qword [rbp + 0x17], r15
mov qword [rbp + 0x1f], r15
mov qword [rbp + 0x1f], 7
mov qword [rbp + 0x17], r15
mov word [rbp + 7], r15w
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp - 1], 7
mov qword [rbp - 9], r15
mov word [rbp - 0x19], r15w
mov rdx, rcx
lea rcx, [rbp - 0x69]
call fcn.14006b3e0
mov rbx, rax
lea rsi, [rax + 0x20]
lea rax, [rbp + 7]
cmp rax, rsi
je 0x14006b856
cmp qword [rbp + 0x1f], 8
jb 0x14006b839
mov rcx, qword [rbp + 7]
call fcn.1400ed78c
mov qword [rbp + 0x1f], 7
mov qword [rbp + 0x17], r15
mov word [rbp + 7], r15w
mov rdx, rsi
lea rcx, [rbp + 7]
call fcn.14003cc30
lea rax, [rbp - 0x19]
cmp rax, rbx
je 0x14006b88d
cmp qword [rbp - 1], 8
jb 0x14006b86f
mov rcx, qword [rbp - 0x19]
call fcn.1400ed78c
mov qword [rbp - 1], 7
mov qword [rbp - 9], r15
mov word [rbp - 0x19], r15w
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.14003cc30
nop
lea rax, [rbp - 0x49]
mov qword [rbp - 0x79], rax
cmp qword [rbp - 0x31], 8
jb 0x14006b8a5
mov rcx, qword [rbp - 0x49]
call fcn.1400ed78c
mov qword [rbp - 0x31], 7
mov qword [rbp - 0x39], r15
mov word [rbp - 0x49], r15w
lea rax, [rbp - 0x69]
mov qword [rbp - 0x79], rax
cmp qword [rbp - 0x51], 8
jb 0x14006b8ce
mov rcx, qword [rbp - 0x69]
call fcn.1400ed78c
mov qword [rbp - 0x51], 7
mov qword [rbp - 0x59], r15
mov word [rbp - 0x69], r15w
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rdx, qword [rbp + 7]
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006b92a
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rdx, qword [rbp - 0x19]
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
sete dil
mov rcx, qword [rbp - 0x21]
call fcn.140073760
nop
cmp qword [rbp - 1], 8
jb 0x14006b944
mov rcx, qword [rbp - 0x19]
call fcn.1400ed78c
mov qword [rbp - 1], 7
mov qword [rbp - 9], r15
mov word [rbp - 0x19], r15w
cmp qword [rbp + 0x1f], 8
jb 0x14006b965
mov rcx, qword [rbp + 7]
call fcn.1400ed78c
mov qword [rbp + 0x1f], 7
mov qword [rbp + 0x17], r15
mov word [rbp + 7], r15w
movzx eax, dil
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400efba0
mov rbx, qword [rsp + 0x120]
add rsp, 0xe0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006be50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 1
lea r8, [0x140172390]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xd]
mov dword [rsp + 0x20], 0x650040
mov dword [rsp + 0x24], 0x400077
mov dword [rsp + 0x28], 0x680071
mov dword [rsp + 0x2c], 0x330032
mov dword [rsp + 0x30], 0x65002f
mov dword [rsp + 0x34], 0x6d006d
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.140016520
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400efba0
add rsp, 0x130
pop rbp
ret

Function at 0x14006c0c0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x38
xor r9d, r9d
mov qword [rsp + 0x20], rdx
test rcx, rcx
jne 0x14006c0e7
lea edx, [rcx + 0x17]
xor r8d, r8d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
setns al
add rsp, 0x38
ret
mov r8, rcx
mov edx, 2
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
setns al
add rsp, 0x38
ret
Function at 0x14006daa0
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov edi, ecx
xor ebx, ebx
mov dword [rsp + 0x40], ebx
xor eax, eax
mov qword [r11 - 0x44], rax
mov qword [r11 - 0x3c], rax
mov qword [r11 - 0x34], rax
mov qword [r11 - 0x2c], rax
mov qword [r11 - 0x24], rax
mov dword [rsp + 0x6c], eax
lea rcx, [r11 - 0x48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsp + 0x40], bx
jne 0x14006db04
xor al, al
jmp 0x14006db87
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov r8d, edi
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14005f270
nop
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x14006db3f
mov rbx, qword [rax]
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x38], 0
sete sil
mov rbx, qword [rsp + 0x28]
test rbx, rbx
je 0x14006db83
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
dec eax
jne 0x14006db83
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock dec dword [rbx + 0xc]
jne 0x14006db83
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + ioctlsocket]
movzx eax, sil
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400efba0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14006de90
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rsp + 0x320], rbx
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x78], rcx
xor esi, esi
mov dword [rsp + 0x58], esi
mov dword [rbp + 0xf0], esi
xor edx, edx
lea r8d, [rsi + 0x60]
lea rcx, [rbp + 0xf8]
call fcn.1400efcb0
mov qword [rbp + 0xd0], rsi
xor eax, eax
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xe0], rax
cmp qword [rbx + 0x18], 8
jb 0x14006df10
mov rdx, qword [rbx]
jmp 0x14006df13
mov rdx, rbx
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14006e0b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
mov rdx, rbx
lea rcx, [rbp - 0x78]
call fcn.14002d610
mov rbx, rax
movdqa xmm0, xmmword [0x14019d490]
movdqa xmmword [rbp + 0x160], xmm0
movdqa xmm1, xmmword [0x14019d500]
movdqa xmmword [rbp + 0x170], xmm1
movdqa xmm0, xmmword [0x14019d740]
movdqa xmmword [rbp + 0x180], xmm0
movdqa xmm1, xmmword [0x14019d890]
movdqa xmmword [rbp + 0x190], xmm1
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1a0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1b0], xmm1
movdqa xmmword [rbp + 0x1c0], xmm0
movdqa xmmword [rbp + 0x1d0], xmm1
mov r9b, 0xe5
lea r8, [0x1401725e0]
mov edx, 0x40
lea rcx, [rbp + 0x160]
call fcn.1400164b0
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140019c00
nop
mov rdx, rbx
mov rcx, rax
call fcn.14001baf0
mov rbx, rax
cmp byte [rax + 0x44], 0
je 0x14006e01a
mov rcx, rax
call fcn.14001c7c0
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140030d20
inc dword [rbx + 0x3c]
mov eax, dword [rbx + 0x3c]
cmp qword [rbx + 0x30], 0
je 0x14006e068
mov r9d, dword [rbx + 0x40]
cmp eax, r9d
jge 0x14006e068
mov r10, qword [rbx + 0x18]
movsxd rcx, eax
mov rdx, rcx
shr rdx, 5
lea r8, [r10 + rdx*4]
and ecx, 0x1f
mov edx, 1
shl edx, cl
test dword [r8], edx
je 0x14006e068
inc eax
mov dword [rbx + 0x3c], eax
cmp eax, r9d
jl 0x14006e041
mov rdx, rbx
lea rcx, [rbp - 0x58]
call fcn.140019dc0
nop
cmp qword [rax + 0x18], 0x10
jb 0x14006e07f
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.1400eefd4
nop
lea rax, vtable.message_exception.0
mov qword [rsp + 0x60], rax
lea rdx, [0x1401fdcb0]
lea rcx, [rsp + 0x60]
call fcn.1400ef340
nop
mov rcx, qword [rbp + 0xd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0xd0]
mov rcx, rdi
call fcn.14005f270
nop
mov dword [rsp + 0x58], 1
mov rax, rdi
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.1400efba0
mov rbx, qword [rsp + 0x320]
add rsp, 0x2f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006fce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x5e4c
lea r8, [0x1401727b8]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xd]
mov dword [rsp + 0x20], 0x5e235e1f
mov dword [rsp + 0x24], 0x5e385e2a
mov dword [rsp + 0x28], 0x5e2d5e3b
mov dword [rsp + 0x2c], 0x5e295e3e
mov dword [rsp + 0x30], 0x5e0d5e10
mov dword [rsp + 0x34], 0x5e0b5e1a
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.140016520
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400efba0
add rsp, 0x130
pop rbp
ret

Function at 0x140070270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x140172828]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xe]
mov r9d, 0x792e
mov dword [rsp + 0x20], 0x7941797d
mov dword [rsp + 0x24], 0x795a7948
mov dword [rsp + 0x28], 0x794f7959
mov dword [rsp + 0x2c], 0x794b795c
mov dword [rsp + 0x30], 0x796b7972
mov dword [rsp + 0x34], 0x796b797d
mov qword [rsp + 0x38], 0x792e797a
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.140016520
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400efba0
add rsp, 0x130
pop rbp
ret
Function at 0x140070560
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x140001640]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor edi, edi
mov qword [rbp + 0x1f], rdi
mov qword [rbp + 0x27], rdi
mov qword [rbp + 0x27], 7
mov qword [rbp + 0x1f], rdi
mov word [rbp + 0xf], di
mov qword [rbp - 1], rdi
mov qword [rbp + 7], rdi
mov qword [rbp + 7], 7
mov qword [rbp - 1], rdi
mov word [rbp - 0x11], di
call fcn.140070710
mov qword [rbp + 0x3f], rdi
mov qword [rbp + 0x47], rdi
mov qword [rbp + 0x47], 7
mov qword [rbp + 0x3f], rdi
mov word [rbp + 0x2f], di
cmp word [rax], di
jne 0x1400705e6
mov r8d, edi
jmp 0x1400705fb
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400705f0
mov rdx, rax
lea rcx, [rbp + 0x2f]
call fcn.14003ca90
nop
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 0xf]
call fcn.140057d20
cmp qword [rbp - 1], 0
je 0x14007064d
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x2f]
lea rcx, [rbp - 0x11]
call fcn.140043ae0
lea rcx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14007064d
test al, 0x10
jne 0x140070685
cmp qword [rbp + 0x1f], 0
je 0x140070689
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 0xf]
call fcn.140043ae0
lea rcx, [rbp + 0xf]
cmp qword [rbp + 0x27], 8
cmovae rcx, qword [rbp + 0xf]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140070689
test al, 0x10
je 0x140070689
mov bl, 1
jmp 0x14007068b
xor bl, bl
cmp qword [rbp + 0x47], 8
jb 0x14007069b
mov rcx, qword [rbp + 0x2f]
call fcn.1400ed78c
mov qword [rbp + 0x47], 7
mov qword [rbp + 0x3f], rdi
mov word [rbp + 0x2f], di
cmp qword [rbp + 7], 8
jb 0x1400706bb
mov rcx, qword [rbp - 0x11]
call fcn.1400ed78c
mov qword [rbp + 7], 7
mov qword [rbp - 1], rdi
mov word [rbp - 0x11], di
cmp qword [rbp + 0x27], 8
jb 0x1400706db
mov rcx, qword [rbp + 0xf]
call fcn.1400ed78c
mov qword [rbp + 0x27], 7
mov qword [rbp + 0x1f], rdi
mov word [rbp + 0xf], di
movzx eax, bl
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400efba0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret