joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140277c54
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140277aba
call fcn.140264be0
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.1402550d8
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140277a9c
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140277a9c
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x140277aec
lock or dword [rax + 0x14], 0x10
jmp 0x140277a9c
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140277b09
mov rcx, qword [rbp + 0x20]
call fcn.14027ced8
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x140277b1e
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x140277b24
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.14026861c
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140277340
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x140277b77
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x140277a9c
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140277be3
mov rcx, qword [rbp + 0x20]
call fcn.14026861c
cmp eax, 0xffffffff
je 0x140277bca
mov rcx, qword [rbp + 0x20]
call fcn.14026861c
cmp eax, 0xfffffffe
je 0x140277bca
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.14026861c
movsxd rdi, eax
lea r15, [0x1406e2050]
mov rcx, rbx
sar rdi, 6
call fcn.14026861c
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x140277bd1
lea rax, [0x1406cabf0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140277be3
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x140277c19
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140277c15
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140277c15
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x140277c37
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x140277c42
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x140277aa1
jmp 0x140277a68
Function at 0x140279cbc
Capabilities:
Create thread
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r8d
mov r14, rdx
mov rbx, rcx
call fcn.140273a64
mov bpl, al
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor edi, edi
test eax, eax
je 0x140279d0f
test rbx, rbx
je 0x140279d00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bpl, bpl
je 0x140279d0f
mov edi, 4
jmp 0x140279db8
call fcn.14027383c
test al, al
jne 0x140279d2c
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb edi, edi
neg edi
add edi, 3
jmp 0x140279db8
test bpl, bpl
je 0x140279d8f
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
lea r8, [0x140279c94]
mov dword [rsp + 0x20], edi
xor edx, edx
mov qword [rsp + 0x30], r14
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140279db8
xor r8d, r8d
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rcx, rbx
test eax, eax
je 0x140279d89
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140279db8
mov edi, dword [rsp + 0x44]
jmp 0x140279d81
call fcn.140273990
test al, al
jne 0x140279da0
bts esi, 0x15
xor ecx, ecx
jmp 0x140279da8
call fcn.1402738c8
mov rcx, rax
mov r9d, esi
mov r8, r14
mov rdx, rbx
call fcn.1402736d8
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret

Function at 0x140280170
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rsp + 0x70]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov dword [rsp + 0x28], eax
mov rcx, rdx
mov rax, qword [rsp + 0x68]
mov r8, r10
mov rdx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
add rsp, 0x30
pop rbx
ret

Function at 0x1402803a0
Capabilities:
Create pipe

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rsp + 0x90]
mov r10d, r9d
mov r9d, dword [rsp + 0x70]
mov r11d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rdx
mov eax, dword [rsp + 0x88]
mov r8d, r10d
mov dword [rsp + 0x30], eax
mov edx, r11d
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
add rsp, 0x40
pop rbx
ret

Function at 0x140280420
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [rsp + 0xb0]
mov r10, r9
mov r9, qword [rsp + 0x80]
mov r11, r8
mov qword [rsp + 0x48], rax
mov rcx, rdx
mov rax, qword [rsp + 0xa8]
mov r8, r10
mov qword [rsp + 0x40], rax
mov rdx, r11
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
add rsp, 0x50
pop rbx
ret
Function at 0x1402804a0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x70]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov qword [rsp + 0x28], rax
mov rcx, rdx
mov eax, dword [rsp + 0x68]
mov r8, r10
mov rdx, r11
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x30
pop rbx
ret

Function at 0x140280e40
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x70]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rdx
mov eax, dword [rsp + 0x68]
mov r8, r10
mov edx, r11d
mov dword [rsp + 0x20], eax
call fcn.140265b2c
add rsp, 0x30
pop rbx
ret

Function at 0x140280fd0
Capabilities:
Modify service

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [rsp + 0xc8]
mov r10d, r9d
mov r9d, dword [rsp + 0x90]
mov r11d, r8d
mov qword [rsp + 0x50], rax
mov rcx, rdx
mov rax, qword [rsp + 0xc0]
mov r8d, r10d
mov qword [rsp + 0x48], rax
mov edx, r11d
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
add rsp, 0x60
pop rbx
ret

Function at 0x1402810a0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [rsp + 0xc8]
mov r10, r9
mov r9, qword [rsp + 0x90]
mov r11, r8
mov qword [rsp + 0x50], rax
mov rcx, rdx
mov rax, qword [rsp + 0xc0]
mov r8, r10
mov qword [rsp + 0x48], rax
mov rdx, r11
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
add rsp, 0x60
pop rbx
ret

Function at 0x1402812b0
Capabilities:
Query or enumerate registry key

Disassembly:
sub rsp, 0x48
xor ecx, ecx
mov rax, r9
mov r9, qword [rsp + 0x70]
mov r10d, r8d
mov qword [rsp + 0x38], rcx
mov r11, rdx
mov qword [rsp + 0x30], rcx
mov r8, rax
mov qword [rsp + 0x28], rcx
mov edx, r10d
mov qword [rsp + 0x20], rcx
mov rcx, r11
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add rsp, 0x48
ret

Function at 0x1402814c0
Capabilities:
Get session user name

Disassembly:
sub rsp, 0x28
mov rax, r8
mov ecx, edx
mov rdx, rax
mov r8, r9
call sub.Secur32.dll_GetUserNameExW
movzx eax, al
add rsp, 0x28
ret
Function at 0x1402f3e90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x108
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1406ca7c8]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov r15, r9
mov ebx, r8d
mov r14, rdx
mov rbp, rcx
mov byte [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1b
lea r9, [0x1403c6df0]
lea r8, [0x1406e46e8]
mov rdx, qword [0x1406e3d30]
lea rcx, [rsp + 0x50]
call fcn.14000a0b4
nop
movzx edx, bx
lea r8, str.EMFDATA
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x1402f3fd5
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x1402f3fc6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1402f3f94
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea rcx, [0x1403ca788]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r15
mov r9d, eax
mov r8, rbx
mov rdx, r14
mov rcx, rbp
call fcn.1402f4028
mov dword [rsp + 0x58], eax
test eax, eax
jns 0x1402f3fb7
mov dword [rsp + 0x20], eax
lea r9, str.PrintEMFPage:_SendEMF_failed_with_HR__0x_08X
mov edx, 0x80
lea r8d, [rdx - 0x53]
lea rcx, [rsp + 0x50]
call fcn.14000a4e0
jmp 0x1402f3fb7
lea r9, str.PrintEMFPage:_Failed_to_lock_EMF_page_resource
mov edx, 0x80
lea r8d, [rdx - 0x4e]
lea rcx, [rsp + 0x50]
call fcn.14000a4e0
mov ebx, 0x80004005
mov dword [rsp + 0x58], ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov ebx, dword [rsp + 0x58]
jmp 0x1402f3ffa
lea r9, str.PrintEMFPage:_Failed_to_load_EMF_page_resource
mov r8d, 0x3a
jmp 0x1402f3fe2
lea r9, str.PrintEMFPage:_Failed_to_find_EMF_page_resource
mov r8d, 0x40
mov edx, 0x80
lea rcx, [rsp + 0x50]
call fcn.14000a4e0
mov ebx, 0x80004005
mov dword [rsp + 0x58], ebx
lea rcx, [rsp + 0x50]
call fcn.14000a1fc
mov eax, ebx
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.14024cd60
add rsp, 0x108
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1402fa050
Capabilities:
Send icmp echo request

Disassembly:
push rbx
sub rsp, 0x40
mov eax, dword [rsp + 0x90]
mov r10, r9
movzx r9d, word [rsp + 0x70]
mov r11d, r8d
mov dword [rsp + 0x38], eax
mov rcx, rdx
mov eax, dword [rsp + 0x88]
mov r8, r10
mov dword [rsp + 0x30], eax
mov edx, r11d
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call sub.IPHLPAPI.DLL_IcmpSendEcho
add rsp, 0x40
pop rbx
ret

Function at 0x1402fa1c0
Capabilities:
Connect socket

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rsp + 0x88]
mov r10d, r9d
mov r9, qword [rsp + 0x70]
mov r11, r8
mov qword [rsp + 0x30], rax
mov rcx, rdx
mov rax, qword [rsp + 0x80]
mov r8d, r10d
mov qword [rsp + 0x28], rax
mov rdx, r11
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSAConnect]
add rsp, 0x40
pop rbx
ret
Function at 0x1402fa690
Capabilities:
Encrypt data using dpapi

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rsp + 0x88]
mov r10, r9
mov r9, qword [rsp + 0x70]
mov r11, r8
mov qword [rsp + 0x30], rax
mov rcx, rdx
mov eax, dword [rsp + 0x80]
mov r8, r10
mov dword [rsp + 0x28], eax
mov rdx, r11
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
add rsp, 0x40
pop rbx
ret
Function at 0x140003670
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword gs:[0x60]
mov esi, ecx
mov rdx, qword [rax + 0x18]
mov rdi, qword [rdx + 0x10]
mov rbx, rdi
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
je 0x14000371c
mov rdx, qword [rbx + 0x60]
xor eax, eax
cmp word [rdx], ax
je 0x1400036c8
nop word [rax + rax]
cmp rax, 0x3f
jae 0x1400036c8
movzx ecx, byte [rdx + rax*2]
mov byte [rsp + rax + 0x20], cl
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400036b0
lea rcx, [rsp + 0x20]
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.USER32.dll_CharLowerA]
mov edx, 0x99
mov rcx, 0xffffffffffffffff
mov r8, rax
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400036e7
xor r9d, r9d
test rcx, rcx
je 0x140003718
nop dword [rax + rax]
movsx eax, byte [r8]
lea edx, [rdx + rdx*2]
inc r9d
lea r8, [r8 + 1]
add edx, eax
movsxd rax, r9d
cmp rax, rcx
jb 0x140003700
cmp edx, esi
je 0x140003725
cmp rdi, rbx
jne 0x140003695
mov rax, qword [rbx + 0x30]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x140003740
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
movsxd rax, dword [rcx + 0x3c]
xor r10d, r10d
mov esi, edx
mov rbx, rcx
mov r8d, dword [rax + rcx + 0x88]
mov edi, dword [r8 + rcx + 0x1c]
mov r11d, dword [r8 + rcx + 0x20]
mov r14d, dword [r8 + rcx + 0x24]
add r11, rcx
add r14, rcx
lea rbp, [rcx + rdi]
test edi, edi
je 0x1400037ea
nop word [rax + rax]
mov edx, dword [r11]
mov rax, 0xffffffffffffffff
add rdx, rbx
mov r8d, 0x99
inc rax
cmp byte [rdx + rax], 0
jne 0x1400037a3
xor r9d, r9d
test rax, rax
je 0x1400037d9
nop dword [rax]
nop dword [rax + rax]
movsx ecx, byte [rdx]
lea r8d, [r8 + r8*2]
inc r9d
lea rdx, [rdx + 1]
add r8d, ecx
movsxd rcx, r9d
cmp rcx, rax
jb 0x1400037c0
cmp r8d, esi
je 0x140003803
inc r10d
add r11, 4
cmp r10d, edi
jb 0x140003790
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
movzx ecx, word [r14 + r10*2]
mov eax, dword [rbp + rcx*4]
add rax, rbx
jmp 0x1400037ec
Function at 0x14000cb34
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14000c9c7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000c9c7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000c9c7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000c9c7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000c9c7
cmp dword [rcx + 0x84], 0xe
jbe 0x14000c9c7
cmp dword [rcx + 0xf8], 0
je 0x14000c9c7
mov ecx, ebx
call fcn.14000ca68
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14000c858
cmp dword [rbp + 0x20], 0
je 0x14000ca14
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000ca1c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000c960
Function at 0x140130000
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
xchg r12, r8
mov qword [rsp + 0x18], r12
jmp 0x1401300c1
xchg r12, r8
xchg r15, rdx
mov qword [rsp + 0x10], r15
xchg rdx, r15
test dword [rbp - 0x7272093a], ecx
xchg edi, eax
invalid
jne 0x14013076a
cmp edx, 0xec7954e5
je 0x1401307db
inc r8d
jmp 0x14013079e
mov r10d, r8d
mov edx, 0x5c0a2425
lea rax, [r11 + r10*4]
mov ecx, dword [rax + r9]
add rcx, r9
jmp 0x1401307a3
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
jmp 0x14013078b
invalid
xor eax, edx
imul edx, eax, 0x1000193
invalid
Function at 0x140132278
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov edi, 0x2a96
dec r11
pushf
call fcn.1401328bf
Function at 0x1400027c0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14009d070]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
lea rax, [rcx + 8]
mov rdx, rax
mov r9, qword [rax + 0x18]
cmp r9, 0x10
jb 0x1400027f1
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
cmp r8, 2
jne 0x140002817
cmp byte [rdx], 0x63
jne 0x14000280a
cmp byte [rdx + 1], 0xd
jne 0x14000280a
xor ecx, ecx
jmp 0x14000280f
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x1400028dd
mov rcx, rax
cmp r9, 0x10
jb 0x140002823
mov rcx, qword [rax]
cmp r8, 1
jne 0x14000283f
cmp byte [rcx], 0x63
jne 0x140002832
xor ecx, ecx
jmp 0x140002837
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x1400028dd
mov rcx, rax
cmp r9, 0x10
jb 0x14000284b
mov rcx, qword [rax]
cmp r8, 2
jne 0x140002869
cmp byte [rcx], 0x75
jne 0x140002860
cmp byte [rcx + 1], 0xd
jne 0x140002860
xor ecx, ecx
jmp 0x140002865
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x140002891
mov rcx, rax
cmp r9, 0x10
jb 0x140002875
mov rcx, qword [rax]
cmp r8, 1
jne 0x140002903
cmp byte [rcx], 0x75
jne 0x140002888
xor ecx, ecx
jmp 0x14000288d
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x140002903
lea r8, [rbx + 0x28]
lea rcx, [0x14009dcc0]
cmp rcx, r8
je 0x1400028b7
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x1400028ae
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
call fcn.140004370
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140002c70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
imul ecx, dword [rbx], 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14004d760
add rsp, 0x60
pop rbx
ret
mov rcx, rax
cmp r9, 0x10
jb 0x14000290f
mov rcx, qword [rax]
cmp r8, 2
jne 0x14000291c
cmp word [rcx], 0xd65
je 0x140002930
cmp r9, 0x10
jb 0x140002925
mov rax, qword [rax]
cmp r8, 1
jne 0x1400028dd
cmp byte [rax], 0x65
jne 0x1400028dd
xor ecx, ecx
call fcn.140053f44
int3
Function at 0x14000f360
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rsi, [rcx + rdx]
mov rbx, rcx
mov edi, 0x1505
cmp rcx, rsi
jae 0x14000ef1b
movzx ecx, byte [rbx]
call fcn.14001ee40
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x14000ef00
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
movzx eax, dil
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14000f396
call fcn.14001ff80
test al, al
jne 0x14000f396
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14000f630
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x14000eee0
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140018ed0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0xb1e], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x140018f86
cmp qword [rcx + 0x278], 0
je 0x140018f3b
mov dl, 1
call fcn.14000a8a0
mov rax, qword [rdi + 0x1d8]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x278]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.14000a8a0
mov eax, ebx
jmp 0x140018f88
mov edx, ebx
test ebx, ebx
je 0x140018f4b
sub edx, 1
je 0x140018f4b
cmp edx, 1
jne 0x140018f86
mov r9, qword [rdi + 0x1d0]
lea rax, [0x14007ef00]
mov edx, 2
lea rcx, [rbx + rbx*2]
add rcx, rax
lea r8d, [rdx - 1]
call fcn.14005f970
mov r9, qword [rdi + 0x1d0]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call fcn.14005f970
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400191a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x1400191e2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140019310
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x130
mov rax, qword [0x14009d070]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rbx, qword [rsp + 0x180]
mov rdi, r8
movsxd r8, edx
mov rsi, r9
mov rdx, qword [rcx + 0x18]
mov rbp, rcx
mov r14, qword [rdx + r8*8 + 0x1f0]
call fcn.1400197d0
test eax, eax
je 0x140019368
mov dword [rbx], reloc.WLDAP32.dll_Ordinal_27
mov rax, 0xffffffffffffffff
jmp 0x1400193d5
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
movsxd rdi, eax
mov dword [rbx], 0
cmp rdi, 0xffffffffffffffff
jne 0x1400193d2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp eax, 0x2733
jne 0x1400193a2
xor edi, edi
mov dword [rbx], 0x51
jmp 0x1400193d2
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov ecx, esi
call fcn.1400063d0
mov r8, rax
lea rdx, str.Send_failure:__s
mov rcx, rbp
call fcn.140018fa0
mov dword [rbp + 0xddc], esi
mov dword [rbx], gethostname
mov rax, rdi
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14004d760
add rsp, 0x130
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400197d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd r9, r8d
lea rbx, [rdx + 0x238]
mov rax, r9
mov rbp, rcx
shl rax, 5
add rbx, rax
mov rax, qword [rdx + 0x3f8]
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x84], 3
je 0x1400198bd
lea rax, [0x140019230]
cmp qword [rdx + r9*8 + 0x218], rax
jne 0x1400198bd
cmp qword [rbx], 0
je 0x14001983b
test rdi, rdi
je 0x1400198bd
mov rsi, qword [rdx + r9*8 + 0x1f0]
mov rdx, 0xffffffffffffffff
mov r8, rdx
xor r9d, r9d
mov rcx, rsi
call fcn.1400296d0
cmp eax, 0xffffffff
je 0x1400198bd
test al, 1
je 0x1400198bd
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14001989c
mov eax, dword [rbp + 0x71c]
add eax, eax
movsxd rcx, eax
mov qword [rbx + 8], rcx
call qword [fcn.1400552f4]
mov qword [rbx], rax
mov rcx, rax
test rax, rax
jne 0x14001988e
lea eax, [rcx + 0x1b]
jmp 0x1400198bf
mov rdi, qword [rbx + 8]
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rcx
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x1400198bd
add qword [rbx + 0x10], rcx
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140019ac0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x280], 0
jne 0x140019afa
mov rcx, qword [rcx + 0x1f0]
cmp rcx, 0xffffffffffffffff
je 0x140019afa
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x140019afa
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret