joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140025690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
push r13
push r14
sub rsp, 0xb8
mov r13, rcx
movsxd rax, r9d
xor ecx, ecx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0xe8], ecx
mov r14, rdx
test r9d, r9d
jle 0x1400258f2
mov qword [r11 + 8], rbx
lea rbx, [r8 + 0x20]
mov qword [r11 + 0x10], rbp
movzx ebp, byte [r13 + 0x24]
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x18], rdi
mov edi, 0x100
mov qword [r11 - 0x20], r12
xor r12d, r12d
mov qword [r11 - 0x28], r15
movaps xmmword [r11 - 0x38], xmm6
movaps xmmword [r11 - 0x48], xmm7
xorps xmm7, xmm7
movaps xmmword [r11 - 0x58], xmm8
movzx r11d, byte [r13 + 0x20]
movss xmm8, dword [0x14008e960]
nop word [rax + rax]
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x14002575a
movsxd r10, dword [r14 + 0x24]
mov r9, qword [r14 + 8]
movsx ecx, di
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, di
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
movd xmm0, eax
jmp 0x140025779
movsxd rdx, dword [r14 + 0x1c]
xorps xmm6, xmm8
mov rax, qword [r14 + 8]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
xor edi, edi
mov byte [rbx], r11b
mov byte [rbx + 1], bpl
divss xmm6, xmm0
cmp dword [rbx - 0x10], edi
jle 0x140025890
mov r15, qword [rsp + 0xf0]
mov rax, r12
shl rax, 4
add r15, 6
xor esi, esi
add r15, rax
nop word [rax + rax]
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x1400257c0
mov edx, dword [rbx - 0x1c]
add edx, edi
jmp 0x1400257c3
mov edx, dword [rax + rsi]
mov eax, dword [r13 + 0x24]
xorps xmm3, xmm3
xorps xmm2, xmm2
mov rcx, r14
cvtsi2ss xmm3, rax
mov eax, dword [r13 + 0x20]
cvtsi2ss xmm2, rax
mulss xmm3, xmm6
mulss xmm2, xmm6
call fcn.140020850
mov edx, eax
mov rcx, r14
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
movss dword [rsp + 0x20], xmm7
call fcn.1400232f0
movzx ecx, word [r13 + 0x1c]
inc r12
movzx r11d, word [r13 + 0x20]
movzx eax, cx
sub ax, word [rsp + 0x50]
dec cx
movzx ebp, word [r13 + 0x24]
dec ax
add ax, r11w
inc edi
add ax, word [rsp + 0x54]
add rsi, 4
mov word [r15 - 2], ax
movzx eax, bp
sub ax, word [rsp + 0x58]
add ax, cx
mov ecx, dword [rsp + 0xe8]
add ax, word [rsp + 0x5c]
inc ecx
mov word [r15], ax
add r15, 0x10
mov dword [rsp + 0xe8], ecx
cmp edi, dword [rbx - 0x10]
jl 0x1400257b0
jmp 0x140025897
mov ecx, dword [rsp + 0xe8]
add rbx, 0x28
mov edi, 0x100
sub qword [rsp + 0x60], 1
jne 0x140025710
movaps xmm8, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
mov r15, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
mov eax, ecx
add rsp, 0xb8
pop r14
pop r13
ret
Function at 0x140029ff0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x14002a1a7
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14002a086
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.1400299c0
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.140028fd0
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x14002a077
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.14001e220
mov dword [rbx + 0x80], 0
jmp 0x14002a193
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.140027e00
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140043660
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140096010]
xor rax, rsp
mov qword [rbp - 8], rax
mov edi, dword [0x140096df8]
movsxd rax, dword [0x140096d48]
xor r9d, r9d
cmp eax, 0x7b
ja 0x1400436a0
lea r9, [0x1400961a0]
mov r9, qword [r9 + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
test r9, r9
jne 0x1400436e6
mov qword [rbp - 0x18], 0xa
movsd xmm0, qword [str.Select_Key]
movsd qword [rbp - 0x28], xmm0
movzx eax, word [0x14008e3f8]
mov word [rbp - 0x20], ax
mov byte [rbp - 0x1e], r9b
jmp 0x140043722
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [r9 + rbx], 0
jne 0x1400436f0
lea rcx, [rbp - 0x28]
cmp rbx, 0xf
ja 0x14004371a
mov qword [rbp - 0x18], rbx
mov r8, rbx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rbx - 0x28], 0
jmp 0x140043722
mov rdx, rbx
call fcn.140045390
cmp edi, 1
jne 0x140043774
mov rax, qword [rbp - 0x10]
cmp rax, 0xd
jb 0x14004375f
lea rbx, [rbp - 0x28]
cmp rax, 0x10
cmovae rbx, qword [rbp - 0x28]
mov qword [rbp - 0x18], 0xd
lea r8d, [rdi + 0xc]
lea rdx, str.Press_the_key
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xd], 0
jmp 0x140043774
lea r9, str.Press_the_key
mov edx, 0xd
lea rcx, [rbp - 0x28]
call fcn.140045390
mov dword [rbp - 0x30], 0x42fa0000
mov dword [rbp - 0x2c], 0x41d00000
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rcx, qword [rbp - 0x28]
lea rdx, [rbp - 0x30]
call fcn.140030920
test al, al
je 0x1400437c3
test edi, edi
jne 0x1400437c3
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140043610]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140043801
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400437fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400437fc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140046074
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140045dc0
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x1400442b0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x140096010]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax]
mov eax, dword [rcx + rax]
cmp dword [0x1400972b8], eax
jle 0x14004434b
lea rcx, [0x1400972b8]
call fcn.140046114
cmp dword [0x1400972b8], 0xffffffff
jne 0x14004434b
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14004431a
imul rax, rax, 0x64
jmp 0x140044338
cqo
idiv rbx
mov r8, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rdx, r8, 0x3b9aca00
add rax, rdx
lea rcx, [0x1400972b8]
mov qword [0x1400972c0], rax
call fcn.1400460a8
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140044369
imul rax, rax, 0x64
jmp 0x140044387
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
mov r8d, dword [0x140097254]
mov rcx, rax
sub rcx, qword [0x1400972c0]
inc r8d
mov dword [0x140097254], r8d
cmp rcx, 0x3baa0c40
jl 0x1400443c5
mov dword [0x140097258], r8d
mov dword [0x140097254], 0
mov qword [0x1400972c0], rax
jmp 0x1400443cc
mov r8d, dword [0x140097258]
lea rdx, str.Fps:__03d
lea rcx, [rsp + 0x60]
call fcn.14001ee20
movaps xmm0, xmmword [0x14008e900]
lea rcx, [rsp + 0x50]
mov r8, qword [0x140096cf8]
movups xmmword [rsp + 0x50], xmm0
lea r11, [r8 + 0x1cc8]
call fcn.14000c710
movss xmm2, dword [0x14008e748]
mov r9d, eax
mov r10, qword [r8 + 0x18f0]
test eax, 0xff000000
je 0x1400444b7
lea rax, [rsp + 0x60]
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140044430
lea r8, [rsp + 0x60]
add r8, rcx
lea rax, [rsp + 0x60]
cmp rax, r8
je 0x1400444b7
test r10, r10
jne 0x140044458
mov rax, qword [r11 + 0x38]
mov r10, qword [rax + 8]
mov rax, qword [r11 + 0x68]
xorps xmm1, xmm1
movsxd rcx, dword [r11 + 0x60]
mov rdx, r11
mov byte [rsp + 0x48], 0
add rcx, rcx
movss dword [rsp + 0x40], xmm1
mov qword [rsp + 0x38], r8
movups xmm0, xmmword [rax + rcx*8 - 0x10]
lea rax, [rsp + 0x60]
mov rcx, r10
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x28], rax
movaps xmm0, xmm2
mov dword [rsp + 0x20], r9d
unpcklps xmm0, xmm2
movss xmm2, dword [0x14008e734]
movq r9, xmm0
call fcn.14002db20
call fcn.140001920
mov ecx, dword [0x140096d48]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400444db
cmp byte [0x140096580], 0
je 0x1400444db
call fcn.140001060
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140045dc0
add rsp, 0xb0
pop rbx
ret
Function at 0x1400469dc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140046a26
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140046a26
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140046a26
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140046a26
cmp dword [rcx + 0x84], 0xe
jbe 0x140046a26
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140046a28
xor al, al
add rsp, 0x28
ret
Function at 0x14000211c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rbx, rcx
test dl, dl
je 0x140002206
lea rcx, [rbp + 0x20]
call fcn.14001365c
nop
mov dl, reloc.WS2_32.dll_WSASetLastError
lea rcx, [rbp + 0x20]
call fcn.1400130c4
mov dl, WSAStartup
lea rcx, [rbp + 0x20]
call fcn.1400130c4
mov dl, reloc.WS2_32.dll_WSAGetLastError
lea rcx, [rbp + 0x20]
call fcn.1400130c4
mov dl, 0x67
lea rcx, [rbp + 0x20]
call fcn.1400130c4
mov dl, WSAStartup
lea rcx, [rbp + 0x20]
call fcn.1400130c4
mov dl, 0x61
lea rcx, [rbp + 0x20]
call fcn.1400130c4
mov dl, 0x6d
lea rcx, [rbp + 0x20]
call fcn.1400130c4
mov dl, 0x69
lea rcx, [rbp + 0x20]
call fcn.1400130c4
mov dl, WSAGetLastError
lea rcx, [rbp + 0x20]
call fcn.1400130c4
mov dl, 0x66
lea rcx, [rbp + 0x20]
call fcn.1400130c4
mov dl, reloc.WS2_32.dll_WSAGetLastError
lea rcx, [rbp + 0x20]
call fcn.1400130c4
mov dl, reloc.WS2_32.dll_WSAStartup
lea rcx, [rbp + 0x20]
call fcn.1400130c4
mov dl, 0x2e
lea rcx, [rbp + 0x20]
call fcn.1400130c4
mov dl, 0x63
lea rcx, [rbp + 0x20]
call fcn.1400130c4
mov dl, reloc.WS2_32.dll_WSAGetLastError
lea rcx, [rbp + 0x20]
call fcn.1400130c4
mov dl, 0x6d
lea rcx, [rbp + 0x20]
call fcn.1400130c4
lea rdx, [rbp + 0x20]
mov rcx, rbx
call fcn.140012e24
nop
lea rcx, [rbp + 0x20]
call fcn.1400130dc
jmp 0x140002227
mov dword [rbp - 0x10], 0x616f7373
mov dword [rbp - 0xc], 0x632e6d70
mov word [rbp - 7], WSASetLastError
mov byte [rbp - 8], reloc.WS2_32.dll_WSAGetLastError
lea rdx, [rbp - 0x10]
call fcn.140012d10
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret
Function at 0x140002238
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov sil, dl
mov rbx, rcx
and dword [rbp + 0x47], 0
call fcn.14001365c
mov dword [rbp + 0x47], 1
xor edi, edi
mov word [rbp + 0x2a], 0x656e
mov dword [rbp + 0x30], 0x6c6c64
mov word [rbp + 0x27], 0x654b
mov dword [rbp + 0x2c], 0x2e32336c
mov byte [rbp + 0x29], WSAStartup
mov dword [rbp + 0x38], 0x69547465
mov dword [rbp + 0x40], 0x746e75
mov byte [rbp + 0x37], 0x47
mov dword [rbp + 0x3c], 0x6f436b63
lea rcx, [rbp + 0x27]
call fcn.140117ae0
mov rcx, rax
lea rdx, [rbp + 0x37]
call fcn.140117a08
test rax, rax
je 0x1400022c4
call rax
mov edi, eax
mov dword [rbp - 0x39], 0x70747468
test sil, sil
je 0x14000238c
mov dword [rbp + 0xe], 0x69742664
mov word [rbp + 0xb], 0x253d
mov dword [rbp - 0x16], 0x73726576
mov byte [rbp - 0x2f], reloc.WS2_32.dll_WSAGetLastError
mov dword [rbp - 0x35], 0x2f2f3a73
mov dword [rbp + 0x13], 0x64253d65
mov dword [rbp + 2], 0x26732525
mov dword [rbp - 0x28], 0x2e736f66
mov dword [rbp - 0xe], 0x67267325
mov word [rbp - 0x11], 0x6e6f
mov dword [rbp - 6], 0x26732525
mov dword [rbp - 0x21], 0x6162662f
mov dword [rbp - 0x2c], 0x6e696d61
mov word [rbp - 0x1b], 0x702e
mov dword [rbp - 2], 0x3d726176
mov dword [rbp - 0xa], 0x3d646975
mov word [rbp - 0x18], 0x3f70
mov dword [rbp + 6], 0x756c6176
mov word [rbp - 0x23], 0x6d6f
mov byte [rbp + 0xa], 0x65
mov byte [rbp + 0x17], 0
mov word [rbp - 0x1d], 0x6b63
mov byte [rbp + 0xd], 0x25
mov byte [rbp + 0x12], WSASetLastError
mov byte [rbp - 0x24], 0x63
mov byte [rbp - 0x12], 0x69
mov word [rbp - 0x31], 0x7270
mov byte [rbp - 0x19], 0x68
mov word [rbp - 0x2e], 0x7267
mov byte [rbp - 0xf], 0x3d
lea rdx, [rbp - 0x39]
jmp 0x140002443
mov dword [rbp - 7], 0x253d7261
mov word [rbp + 9], 0x7426
mov dword [rbp - 0xd], 0x7325253d
mov word [rbp - 0x1a], 0x7372
mov dword [rbp - 0x2b], 0x6d6f632e
mov dword [rbp + 3], 0x253d6575
mov word [rbp - 0x12], 0x6726
mov word [rbp + 0xc], 0x656d
mov dword [rbp - 2], 0x61762673
mov dword [rbp - 0x1f], 0x763f7068
mov dword [rbp - 0x32], 0x6f73732f
mov word [rbp + 7], 0x6425
mov dword [rbp - 0x17], 0x253d6e6f
mov word [rbp - 0x2e], 0x7061
mov dword [rbp - 0x25], 0x6b636162
mov word [rbp - 0xf], 0x6469
mov byte [rbp + 2], WSAGetLastError
mov word [rbp - 0x27], 0x662f
mov byte [rbp - 0x2c], WSASetLastError
mov word [rbp - 9], 0x7626
mov word [rbp - 0x21], 0x702e
mov word [rbp + 0xf], 0x6425
mov word [rbp - 0x34], 0x2f3a
mov byte [rbp - 0x1b], 0x65
mov byte [rbp - 0x10], 0x75
mov byte [rbp - 3], 0x25
mov byte [rbp - 0x13], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x18], 0x69
mov byte [rbp + 0xb], 0x69
mov byte [rbp + 0xe], 0x3d
mov byte [rbp - 0x35], reloc.WS2_32.dll_WSAStartup
mov byte [rbp + 0x11], 0
lea rdx, [rbp - 0x39]
mov r8d, edi
mov rcx, rbx
call fcn.140012888
mov rax, rbx
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400026e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x13], 0x72656c6c
mov rbx, rcx
mov dword [rbp - 0x18], 0x74736e49
mov word [rbp - 0x1e], 0x626f
mov word [rbp - 0x1b], 0x5c6c
mov word [rbp - 0xb], 0x78
mov word [rbp - 0xe], 0x7475
mov byte [rbp - 0x19], 0x43
mov word [rbp - 0x20], 0x6c47
mov byte [rbp - 0x14], 0x61
mov byte [rbp - 0xf], 0x4d
mov byte [rbp - 0xc], 0x65
mov byte [rbp - 0x1c], 0x61
call fcn.140012d10
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140002748
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x19], 0x6e494549
mov rbx, rcx
mov dword [rbp - 0x20], 0x626f6c47
mov word [rbp - 0x1c], 0x6c61
mov dword [rbp - 0xc], 0x786574
mov dword [rbp - 0x12], 0x72656c6c
mov byte [rbp - 0x1a], 0x5c
mov word [rbp - 0xe], 0x754d
mov word [rbp - 0x14], 0x6174
mov byte [rbp - 0x15], reloc.WS2_32.dll_WSAStartup
call fcn.140012d10
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400027a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x18], 0x736e4946
mov rbx, rcx
mov dword [rbp - 0x1f], 0x61626f6c
mov word [rbp - 0x14], 0x6174
mov word [rbp - 0xe], 0x754d
mov word [rbp - 0x11], 0x656c
mov dword [rbp - 0xc], 0x786574
mov word [rbp - 0x1a], 0x465c
mov byte [rbp - 0xf], WSAStartup
mov byte [rbp - 0x1b], WSAGetLastError
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0x12], WSAGetLastError
call fcn.140012d10
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140041dd8
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
xor r9d, r9d
cmp byte [rcx + 8], r9b
je 0x140041e0b
cmp dword [rcx + 0x3d0], r9d
jle 0x140041e06
sub r8, rdx
mov al, byte [r8 + rdx]
inc r9d
xor byte [rdx], al
inc rdx
cmp r9d, dword [rcx + 0x3d0]
jl 0x140041df1
add rsp, 0x48
ret
lea rdx, str.Object_not_Initialized
lea rcx, [rsp + 0x20]
call fcn.140041e64
lea rdx, [0x1401426d8]
lea rcx, [rsp + 0x20]
call fcn.1400b0ea8
int3
Function at 0x140066910
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor r9d, r9d
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_recv]
cdqe
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0xffffffffffffffff
jne 0x1400669ba
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0x2733
jne 0x14006696d
mov dword [rsp + 0x24], 1
jmp 0x140066975
mov dword [rsp + 0x24], 0
cmp dword [rsp + 0x24], 0
jne 0x140066986
mov dword [rsp + 0x28], 0
jmp 0x14006698e
mov dword [rsp + 0x28], 1
movzx eax, byte [rsp + 0x28]
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x68]
mov qword [rax], 0
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x1400669b3
mov eax, 0x51
jmp 0x1400669c9
mov eax, 0x38
jmp 0x1400669c9
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
add rsp, 0x48
ret

Function at 0x140066b60
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x158
mov rax, qword [0x140149de8]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor eax, eax
test eax, eax
jne 0x140066b8c
xor eax, eax
test eax, eax
jne 0x140066b92
mov rax, qword [rsp + 0x160]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x30], rax
movsxd rax, dword [rsp + 0x168]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx + rax*8 + 0x1d0]
mov qword [rsp + 0x38], rax
mov r8d, dword [rsp + 0x168]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x160]
call fcn.140067110
test eax, eax
je 0x140066bfb
mov rax, qword [rsp + 0x180]
mov dword [rax], 0x1b
mov rax, 0xffffffffffffffff
jmp 0x140066cb3
xor r9d, r9d
mov r8d, dword [rsp + 0x178]
mov rdx, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_send]
cdqe
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x180]
mov dword [rax], 0
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x140066cae
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x2733
jne 0x140066c63
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x180]
mov dword [rax], 0x51
jmp 0x140066cae
mov r8d, 0x100
lea rdx, [rsp + 0x40]
mov ecx, dword [rsp + 0x20]
call fcn.140096cf0
mov r8, rax
lea rdx, str.Send_failure:__s
mov rcx, qword [rsp + 0x160]
call fcn.1400666a0
mov rax, qword [rsp + 0x160]
mov ecx, dword [rsp + 0x20]
mov dword [rax + 0xd2c], ecx
mov rax, qword [rsp + 0x180]
mov dword [rax], 0x37
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400ae1a0
add rsp, 0x158
ret
Function at 0x140066ff0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0xa77]
test eax, eax
je 0x1400670f9
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x270], 0
je 0x140067084
mov rcx, qword [rsp + 0x50]
call fcn.14004e2f0
mov byte [rsp + 0x30], al
mov dl, 1
mov rcx, qword [rsp + 0x50]
call fcn.14004e280
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x1d8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
call qword [rax + 0x270]
movzx edx, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call fcn.14004e280
jmp 0x1400670f9
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x1400670a3
cmp dword [rsp + 0x34], 1
je 0x1400670a3
cmp dword [rsp + 0x34], 2
je 0x1400670a3
jmp 0x1400670f9
movsxd rax, dword [rsp + 0x58]
imul rax, rax, 3
lea rcx, [0x140123e90]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
mov r9, qword [rcx + 0x1d0]
mov r8d, 1
mov edx, 2
mov rcx, rax
call fcn.1400cf75c
mov rax, qword [rsp + 0x50]
mov r9, qword [rax + 0x1d0]
mov r8d, 1
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.1400cf75c
add rsp, 0x48
ret