joyce8/EMBER2024-capa huggingface dataset:
Function at 0x576ca1d0
Capabilities:
Hash data with md5

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x576ca20a
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0
mov qword [rcx], 0
add rsp, 0x28
ret
lea rdx, str.src_hashes_md5.c
lea rcx, [0x5773f411]
mov r8d, 0xe9
call fcn.576cf170
nop
nop
nop word cs:[rax + rax]
Function at 0x576ca230
Capabilities:
Hash data with md5

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
mov rsi, rdx
je 0x576ca440
test rdx, rdx
je 0x576ca459
mov edx, dword [rcx + 0x18]
mov eax, 0x10
cmp edx, 0x3f
jbe 0x576ca264
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea r8d, [rdx*8]
add r8, qword [rcx]
mov eax, edx
mov qword [rcx], r8
lea ecx, [rdx + 1]
cmp ecx, 0x38
mov dword [rbx + 0x18], ecx
mov byte [rbx + rax + 0x1c], pe_nt_image_headers64
ja 0x576ca3c0
cmp ecx, 0x38
lea rdi, [rbx + 0x1c]
je 0x576ca389
mov edx, ecx
lea r9d, [rcx + 1]
mov eax, ecx
not edx
mov byte [rbx + rax + 0x1c], 0
and edx, 7
cmp r9d, 0x38
je 0x576ca382
test edx, edx
je 0x576ca32d
cmp edx, 1
je 0x576ca31b
cmp edx, 2
je 0x576ca30f
cmp edx, 3
je 0x576ca303
cmp edx, 4
je 0x576ca2f6
cmp edx, 5
je 0x576ca2e9
cmp edx, 6
je 0x576ca2dd
mov byte [rbx + r9 + 0x1c], 0
lea r9d, [rcx + 2]
mov ecx, r9d
add r9d, 1
mov byte [rbx + rcx + 0x1c], 0
mov r10d, r9d
add r9d, 1
mov byte [rbx + r10 + 0x1c], 0
mov r11d, r9d
add r9d, 1
mov byte [rbx + r11 + 0x1c], 0
mov edx, r9d
add r9d, 1
mov byte [rbx + rdx + 0x1c], 0
mov eax, r9d
add r9d, 1
mov byte [rbx + rax + 0x1c], 0
mov ecx, r9d
add r9d, 1
cmp r9d, 0x38
mov byte [rbx + rcx + 0x1c], 0
je 0x576ca382
lea r11d, [r9 + 1]
lea edx, [r9 + 2]
mov r10d, r9d
mov byte [rbx + r10 + 0x1c], 0
lea eax, [r9 + 3]
lea ecx, [r9 + 4]
mov byte [rbx + r11 + 0x1c], 0
lea r10d, [r9 + 5]
mov byte [rbx + rdx + 0x1c], 0
lea r11d, [r9 + 6]
lea edx, [r9 + 7]
add r9d, 8
cmp r9d, 0x38
mov byte [rbx + rax + 0x1c], 0
mov byte [rbx + rcx + 0x1c], 0
mov byte [rbx + r10 + 0x1c], 0
mov byte [rbx + r11 + 0x1c], 0
mov byte [rbx + rdx + 0x1c], 0
jne 0x576ca32d
mov dword [rbx + 0x18], 0x38
mov qword [rbx + 0x54], r8
mov rdx, rdi
mov rcx, rbx
call fcn.576c9990
mov r9d, dword [rbx + 8]
xor eax, eax
mov dword [rsi], r9d
mov edi, dword [rbx + 0xc]
mov dword [rsi + 4], edi
mov r8d, dword [rbx + 0x10]
mov dword [rsi + 8], r8d
mov ebx, dword [rbx + 0x14]
mov dword [rsi + 0xc], ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
cmp ecx, 0x40
je 0x576ca427
lea edi, [rdx + 2]
mov byte [rbx + rcx + 0x1c], 0
cmp edi, 0x40
je 0x576ca420
lea r8d, [rdx + 3]
mov byte [rbx + rdi + 0x1c], 0
cmp r8d, 0x40
je 0x576ca420
lea r9d, [rdx + 4]
mov byte [rbx + r8 + 0x1c], 0
cmp r9d, 0x40
je 0x576ca420
lea r10d, [rdx + 5]
mov byte [rbx + r9 + 0x1c], 0
cmp r10d, 0x40
je 0x576ca420
lea r11d, [rdx + 6]
mov byte [rbx + r10 + 0x1c], 0
cmp r11d, 0x40
je 0x576ca420
cmp edx, 0x38
mov byte [rbx + r11 + 0x1c], 0
jne 0x576ca420
mov byte [rbx + 0x5b], 0
mov dword [rbx + 0x18], 0x40
lea rdi, [rbx + 0x1c]
mov rcx, rbx
mov rdx, rdi
call fcn.576c9990
mov r8, qword [rbx]
xor ecx, ecx
jmp 0x576ca295
lea rdx, str.src_hashes_md5.c
lea rcx, [0x5773f411]
mov r8d, 0x106
call fcn.576cf170
lea rdx, str.src_hashes_md5.c
lea rcx, [0x5773f41c]
mov r8d, 0x107
call fcn.576cf170
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x577125b0
Capabilities:
Check for software breakpoints

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
test r8d, r8d
mov rbp, rcx
je 0x577125f0
mov rcx, qword [rdx + 0x10]
cmp dword [rcx + 8], 0xcd
je 0x577125e2
test byte [rcx + 0xd], 0x10
jne 0x577125e2
cmp qword [rdx + 0x28], 0
jne 0x577125e2
cmp qword [rcx + 0x28], rdx
je 0x577125f3
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rdx
mov rsi, qword [rdx + 0x18]
mov rbx, qword [rcx]
mov rdi, qword [rdx + 0x20]
and esi, 0x7fff
test rbx, rbx
je 0x577125e2
mov edx, dword [rbx + 8]
movsxd r12, esi
cmp edx, 0x5c
je 0x57712673
ja 0x57712690
lea eax, [rdx - 7]
cmp eax, 1
jbe 0x577125e2
mov rcx, rbp
call fcn.577121a0
test al, 4
jne 0x577125e2
mov edx, eax
and edx, 3
cmp edx, 3
je 0x57712710
mov edx, eax
and edx, 0x300
cmp edx, 0x300
je 0x57712740
and eax, 0x30000
mov rcx, rbx
cmp eax, 0x30000
je 0x57712766
mov rbx, qword [rcx]
test rbx, rbx
je 0x577125e2
mov edx, dword [rbx + 8]
cmp edx, 0x5c
jne 0x57712614
mov rax, qword [rbx + 0x10]
and eax, 0x7fff
cmp r12, rax
je 0x577126a3
mov rcx, rbx
jmp 0x5771265f
cmp edx, 0xcd
jne 0x5771261e
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp word [rbx + 0xc], 0
jne 0x577125e2
cmp qword [rbx + 0x18], rdi
jne 0x577125e2
cmp rcx, rbx
mov rax, qword [rbx]
je 0x577127a0
mov qword [rcx], rax
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x28], 0
mov rax, qword [rbp + 0x38]
mov rdx, qword [rax + 0x100]
mov qword [rbx], rdx
mov qword [rax + 0x100], rbx
jmp 0x5771265f
test al, 8
je 0x57712780
mov edx, dword [rbx + 0x10]
and edx, 0x7fff
cmp edx, esi
je 0x577125e2
mov edx, dword [rbx + 0x14]
and edx, 0x7fff
cmp edx, esi
jne 0x57712638
jmp 0x577125e2
mov rdx, qword [rbx + 0x18]
and edx, 0x7fff
cmp r12, rdx
je 0x577125e2
and eax, 0x30000
mov rcx, rbx
cmp eax, 0x30000
jne 0x5771265f
mov rax, qword [rbx + 0x20]
and eax, 0x7fff
cmp r12, rax
jne 0x5771265f
jmp 0x577125e2
mov rdx, qword [rbx + 0x10]
and edx, 0x7fff
cmp r12, rdx
jne 0x57712638
jmp 0x577125e2
mov rdx, qword [rbp + 0x38]
mov qword [rdx], rax
jmp 0x577126c7
Function at 0x57730ad0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x20
cmp dword [rcx + 0x244], 0x10
ja 0x57730b50
mov rbx, rcx
mov ecx, dword [rcx + 0x238]
mov rsi, rdx
mov edi, r8d
call fcn.576cf1b0
test eax, eax
mov r14d, eax
jne 0x57730b56
mov eax, dword [rbx + 0x240]
test eax, eax
jne 0x57730b41
movsxd rcx, dword [rbx + 0x244]
test ecx, ecx
jne 0x57730b70
cmp qword [rbx + 0x248], 0
je 0x57730d60
lea r13, [rbx + 0x228]
lea r12, [rbx + 0x1f8]
jmp 0x57730bea
cmp eax, 1
je 0x57730d70
nop word [rax + rax]
mov r14d, 0x10
lea rsp, [rbp - 0x38]
mov eax, r14d
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [rbx + 0x23c]
lea r13, [rbx + 0x228]
test eax, eax
jne 0x57730bb0
cmp ecx, 0xc
jne 0x57730bb0
mov rax, qword [rbx + 0x228]
mov qword [rbx + 0x208], rax
mov eax, dword [r13 + 8]
mov dword [rbx + 0x214], 0x1000000
mov dword [rbx + 0x210], eax
jmp 0x57730c55
lea eax, [rcx - 1]
lea r12, [rbx + 0x1f8]
lea r8, [rbx + rax + 0x1f9]
mov rdx, r12
movzx eax, byte [rdx + 0x30]
xor byte [rdx], al
add rdx, 1
cmp rdx, r8
jne 0x57730bc5
shl rcx, 3
add qword [rbx + 0x248], rcx
mov rdx, r12
mov rcx, rbx
call fcn.576c92d0
mov edx, 8
mov rcx, r13
call fcn.576cfcb0
mov rax, qword [rbx + 0x248]
mov rdx, r12
bswap rax
mov qword [rbx + 0x230], rax
lea rax, [rbx + 0x208]
movzx ecx, byte [rdx + 0x30]
xor byte [rdx], cl
add rdx, 1
cmp rax, rdx
jne 0x57730c12
mov rdx, r12
mov rcx, rbx
call fcn.576c92d0
mov rdx, qword [rbx + 0x200]
mov rax, qword [rbx + 0x1f8]
mov rcx, r12
mov qword [rbx + 0x210], rdx
mov qword [rbx + 0x208], rax
mov edx, 0x10
call fcn.576cfcb0
mov rdx, qword [rbx + 0x210]
mov rax, qword [rbx + 0x208]
mov rcx, r13
mov qword [rbx + 0x220], rdx
mov qword [rbx + 0x218], rax
mov edx, 0x10
call fcn.576cfcb0
mov qword [rbx + 0x240], 1
mov qword [rbx + 0x248], 0
mov r13d, edi
and r13d, 0xfffffff0
je 0x57730d90
lea r15, [rbx + 0x1f8]
xor r12d, r12d
nop dword [rax + rax]
mov eax, r12d
mov rdx, r15
mov rcx, rbx
mov rax, qword [rsi + rax]
xor qword [rbx + 0x1f8], rax
lea eax, [r12 + 8]
add r12d, 0x10
mov rax, qword [rsi + rax]
xor qword [rbx + 0x200], rax
call fcn.576c92d0
sub qword [rbx + 0x248], 0xffffffffffffff80
cmp r12d, r13d
jb 0x57730cb0
mov eax, r12d
add rsi, rax
cmp edi, r12d
jbe 0x57730b56
sub edi, 1
sub edi, r12d
lea r12, [rsi + rdi + 1]
lea rdi, [rbx + 0x1f8]
jmp 0x57730d19
cmp rsi, r12
je 0x57730b56
movsxd rdx, dword [rbx + 0x244]
add rsi, 1
movzx ecx, byte [rsi - 1]
lea eax, [rdx + 1]
mov dword [rbx + 0x244], eax
xor byte [rbx + rdx + 0x1f8], cl
cmp eax, 0x10
jne 0x57730d10
mov rdx, rdi
mov rcx, rbx
call fcn.576c92d0
mov dword [rbx + 0x244], 0
sub qword [rbx + 0x248], 0xffffffffffffff80
jmp 0x57730d10
mov r14d, 1
jmp 0x57730b56
mov eax, dword [rbx + 0x244]
cmp eax, 0xf
jg 0x57730b50
xor r12d, r12d
test eax, eax
jne 0x57730cf0
jmp 0x57730c94
xor r12d, r12d
jmp 0x57730cf0
Function at 0x577311c0
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
mov ebp, 0x10
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x240]
test eax, eax
jne 0x57731301
cmp dword [rcx + 0x244], 0xf
mov rbx, rcx
ja 0x57731301
mov ecx, dword [rcx + 0x238]
mov rsi, rdx
mov r12d, r8d
call fcn.576cf1b0
test eax, eax
mov ebp, eax
jne 0x57731301
mov eax, dword [rbx + 0x244]
lea edx, [rax + r12]
cmp edx, 0xc
jbe 0x57731222
or dword [rbx + 0x23c], 1
xor edi, edi
test eax, eax
jne 0x5773127b
mov r13d, r12d
and r13d, 0xfffffff0
je 0x57731312
lea r14, [rbx + 0x1f8]
nop dword [rax]
mov eax, edi
mov rdx, r14
mov rcx, rbx
mov rax, qword [rsi + rax]
xor qword [rbx + 0x1f8], rax
lea eax, [rdi + 8]
add edi, 0x10
mov rax, qword [rsi + rax]
xor qword [rbx + 0x200], rax
call fcn.576c92d0
sub qword [rbx + 0x248], 0xffffffffffffff80
cmp edi, r13d
jb 0x57731240
mov eax, edi
add rsi, rax
cmp r12d, edi
jbe 0x57731301
sub r12d, 1
lea r13, [rbx + 0x1f8]
sub r12d, edi
lea rdi, [rbx + 0x208]
lea r12, [rsi + r12 + 1]
jmp 0x577312a5
cmp r12, rsi
je 0x57731301
movsxd rdx, dword [rbx + 0x244]
add rsi, 1
lea ecx, [rdx + 1]
mov dword [rbx + 0x244], ecx
movzx eax, byte [rsi - 1]
cmp ecx, 0x10
mov byte [rbx + rdx + 0x228], al
jne 0x577312a0
mov rdx, r13
nop dword [rax]
movzx ecx, byte [rdx + 0x30]
xor byte [rdx], cl
add rdx, 1
cmp rdi, rdx
jne 0x577312d0
mov rdx, r13
mov rcx, rbx
call fcn.576c92d0
sub qword [rbx + 0x248], 0xffffffffffffff80
cmp r12, rsi
mov dword [rbx + 0x244], 0
jne 0x577312a5
add rsp, 0x20
mov eax, ebp
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edi, eax
jmp 0x5773127b

Function at 0x57732740
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x57743c70]
mov rdx, rcx
cmp word [r8], 0x5a4d
jne 0x577327ad
mov rcx, r8
call fcn.57732620
test eax, eax
je 0x577327ad
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x577327ad
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x577327a4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x577327af
add rax, 0x28
cmp rax, r9
jne 0x57732790
xor eax, eax
add rsp, 0x28
ret
Function at 0x141b32058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141b321df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141b32089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b3206f
add dl, dl
jne 0x141b32096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b320f6
xor eax, eax
add dl, dl
jne 0x141b320a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b321ad
add dl, dl
jne 0x141b320b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b320c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b320d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b320dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141b320ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141b3207e
mov eax, 1
add dl, dl
jne 0x141b32106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b32113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b320fb
sub eax, ebx
mov ebx, 1
jne 0x141b3214c
mov ecx, 1
add dl, dl
jne 0x141b3212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141b3213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b32123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b3207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141b32168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141b32175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b3215d
cmp eax, 0x7d00
jae 0x141b3219b
cmp eax, 0x500
jb 0x141b32196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b3207e
cmp eax, 0x7f
ja 0x141b3219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b3207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141b321d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141b3207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000c650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rdx, r8
je 0x14000c75f
push rbx
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
mov r11, r8
lea rdi, [0x140000000]
mov r10, rdx
mov rbx, rcx
movzx edx, byte [r10 + 9]
movzx eax, dl
and al, 7
cmp al, 3
jne case.0x14000c6ba.8
xor dl, 7
mov byte [r10 + 9], dl
test dl, 0x20
je case.0x14000c6ba.8
movzx eax, byte [r10 + 8]
add eax, 0xfffffffc
cmp eax, 0x22
ja case.0x14000c6ba.8
cdqe
movzx eax, byte [rdi + rax + 0xc774]
mov ecx, dword [rdi + rax*4 + 0xc760]
add rcx, rdi
jmp rcx
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
jmp case.0x14000c6ba.8
mov rcx, qword [r10 + 0x10]
lea rax, [r10 + 0x18]
cmp rcx, rax
je 0x14000c6dd
and dl, 0xc7
jmp 0x14000c6e3
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
test byte [rcx + 8], 0x40
je case.0x14000c6ba.8
mov rdx, qword [rcx]
test byte [rdx + 9], 0x18
je case.0x14000c6ba.8
mov rcx, rbx
call fcn.14000cd80
jmp case.0x14000c6ba.8
cmp word [r10 + 0xa], 0
jne case.0x14000c6ba.5
mov rdx, qword [r10 + 0x18]
test rdx, rdx
je 0x14000c71f
test byte [rdx + 9], 0x18
je 0x14000c71f
mov rcx, rbx
call fcn.14000cd80
and byte [r10 + 9], 0xe7
or byte [r10 + 9], 0x20
jmp case.0x14000c6ba.8
mov rcx, r10
call fcn.14000bb90
mov rcx, qword [rbx + 0x88]
mov qword [rax], rcx
mov qword [rbx + 0x88], r10
and byte [r10 + 9], 0xc7
mov r10, qword [r10]
cmp r10, r11
jne 0x14000c673
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x14000e210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov eax, 1
movzx ecx, byte [rdx + 0xb]
mov rdi, rdx
shl eax, cl
mov rcx, rdx
cdqe
lea r8, [rax + rax*2]
mov rax, qword [rdx + 0x18]
lea rsi, [rax + r8*8]
call fcn.140017ca0
test eax, eax
je 0x14000e278
xor r10d, r10d
mov r11d, eax
mov rax, qword [rdi + 0x10]
test byte [r10 + rax + 8], 0x40
je 0x14000e26e
mov rdx, qword [r10 + rax]
test byte [rdx + 9], 0x18
je 0x14000e26e
mov rcx, rbx
call fcn.14000cd80
add r10, 0x10
sub r11, 1
jne 0x14000e250
mov r10, qword [rdi + 0x18]
cmp r10, rsi
jae 0x14000e2cf
test byte [r10 + 8], 0xf
movzx eax, byte [r10 + 9]
jne 0x14000e298
test al, 0x40
je 0x14000e2c6
mov byte [r10 + 9], reloc.WS2_32.dll_inet_addr
jmp 0x14000e2c6
test al, 0x40
je 0x14000e2ae
mov rdx, qword [r10 + 0x10]
test byte [rdx + 9], 0x18
je 0x14000e2ae
mov rcx, rbx
call fcn.14000cd80
test byte [r10 + 8], 0x40
je 0x14000e2c6
mov rdx, qword [r10]
test byte [rdx + 9], 0x18
je 0x14000e2c6
mov rcx, rbx
call fcn.14000cd80
add r10, 0x18
cmp r10, rsi
jb 0x14000e281
movzx eax, byte [rdi + 9]
movzx ecx, al
and cl, 7
cmp cl, 5
jne 0x14000e30b
mov rcx, rdi
call fcn.14000bb90
mov rcx, qword [rbx + 0x90]
mov qword [rax], rcx
mov qword [rbx + 0x90], rdi
and byte [rdi + 9], 0xc7
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp cl, 6
jne 0x14000e315
xor al, 2
mov byte [rdi + 9], al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140011290
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x110
mov rax, qword [0x14006c408]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r14, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
call fcn.140010750
mov r9, rax
test rax, rax
je 0x1400112e9
mov r8, qword [rsp + 0x20]
mov al, 3
sub r9, rbx
mov qword [r14], r8
mov byte [r14 + 8], al
lea rax, [r9 + 1]
jmp 0x140011469
lea rdx, [0x140059b60]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
test rax, rax
je 0x140011321
movzx edi, byte [rax]
or edi, 0x20
cmp edi, 0x6e
je 0x140011467
cmp edi, 0x78
jne 0x140011323
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400115d0
jmp 0x140011331
xor edi, edi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtod]
mov rax, qword [rsp + 0x20]
lea rbp, [0x140059230]
cmp rax, rbx
je 0x140011374
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
je 0x140011362
nop dword [rax]
inc rax
mov qword [rsp + 0x20], rax
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
jne 0x140011350
xor r9d, r9d
test cl, cl
cmove r9, rax
test r9, r9
jne 0x140011453
mov edx, 0x2e
mov rcx, rbx
call sub.VCRUNTIME140.dll_strchr
mov rsi, rax
test rax, rax
je 0x140011467
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140011394
cmp rcx, 0xc8
ja 0x140011467
lea rdx, [rsp + 0x30]
mov rcx, rbx
sub rdx, rbx
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400113c0
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
sub rsi, rbx
lea rdx, [rsp + 0x20]
mov rcx, qword [rax]
movzx eax, byte [rcx]
lea rcx, [rsp + 0x30]
mov byte [rsp + rsi + 0x30], al
cmp edi, 0x78
jne 0x1400113f7
call fcn.1400115d0
jmp 0x1400113fd
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtod]
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
cmp rax, rcx
je 0x140011467
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
je 0x140011432
nop word [rax + rax]
inc rax
mov qword [rsp + 0x20], rax
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
jne 0x140011420
xor r9d, r9d
test cl, cl
cmove r9, rax
test r9, r9
je 0x140011467
lea rcx, [rsp + 0x30]
mov rax, rbx
sub rax, rcx
add r9, rax
test r9, r9
je 0x140011467
mov al, reloc.WS2_32.dll_send
movsd qword [r14], xmm0
sub r9, rbx
mov byte [r14 + 8], al
lea rax, [r9 + 1]
jmp 0x140011469
xor eax, eax
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140056920
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400115d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov qword [rsp + 0x50], rbx
mov r12, rdx
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
xor edi, edi
lea r13, [0x140059230]
xorps xmm1, xmm1
mov r10d, edi
mov esi, edi
mov r9d, edi
mov r8, qword [rax]
mov r11d, edi
movsx r14d, byte [r8]
mov qword [r12], rbx
movzx eax, byte [rbx]
test byte [rax + r13 + 1], 8
je 0x14001162f
nop
movzx eax, byte [rbx + 1]
inc rbx
test byte [rax + r13 + 1], 8
jne 0x140011620
mov qword [rsp + 0x58], r15
lea rdx, [rbx + 1]
mov ebp, 1
cmp al, 0x2d
jne 0x140011646
mov r15d, ebp
jmp 0x14001164f
cmp al, 0x2b
mov r15d, edi
cmovne rdx, rbx
cmp byte [rdx], 0x30
mov rbx, qword [rsp + 0x50]
jne 0x140011788
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x140011788
movsd xmm2, qword [0x140059bc8]
add rdx, 2
nop word [rax + rax]
movzx r8d, byte [rdx]
movsx rcx, r8b
cmp ecx, r14d
jne 0x14001169a
test r11d, r11d
jne 0x1400116ef
mov r11d, ebp
inc rdx
jmp 0x140011680
test byte [r8 + r13 + 1], 0x10
je 0x1400116ef
test r10d, r10d
jne 0x1400116b1
cmp r8b, 0x30
jne 0x1400116b1
inc esi
jmp 0x1400116e2
inc r10d
cmp r10d, 0x1e
jg 0x1400116df
test byte [rcx + r13 + 1], 2
je 0x1400116c7
add ecx, 0xffffffd0
jmp 0x1400116cd
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x1400116e2
inc r9d
test r11d, r11d
je 0x1400116ea
dec r9d
inc rdx
jmp 0x140011680
lea eax, [rsi + r10]
test eax, eax
je 0x140011788
mov qword [r12], rdx
lea r9d, [r9*4]
movzx eax, byte [rdx]
sub al, 0x50
test al, 0xdf
jne 0x14001176e
movzx ecx, byte [rdx + 1]
cmp cl, 0x2d
jne 0x140011720
mov eax, 2
jmp 0x14001172e
cmp cl, 0x2b
mov rax, rdi
mov ebp, edi
sete al
inc rax
lea r8, [rdx + rax]
movzx edx, byte [rdx + rax]
test byte [rdx + r13 + 1], 2
je 0x140011788
nop
movsx eax, dl
lea edi, [rdi + rdi*4]
inc r8
lea edi, [rdi - 0x18]
lea edi, [rax + rdi*2]
movzx eax, byte [r8]
movzx edx, al
test byte [rax + r13 + 1], 2
jne 0x140011740
mov eax, edi
mov qword [r12], r8
neg eax
test ebp, ebp
cmove eax, edi
add r9d, eax
test r15d, r15d
je 0x14001177a
xorps xmm1, xmmword [0x140059bd0]
mov edx, r9d
movaps xmm0, xmm1
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
jmp 0x14001178b
xorps xmm0, xmm0
mov r15, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x140016a90
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
mov r9, rcx
xor eax, r8d
test rdx, rdx
je 0x140016abf
nop dword [rax]
movzx r8d, byte [r9 + rdx - 1]
mov ecx, eax
shl ecx, 5
add r8d, ecx
mov ecx, eax
shr ecx, 2
add r8d, ecx
xor eax, r8d
sub rdx, 1
jne 0x140016aa0
ret
Function at 0x140016d20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
cmp r8, 0x28
ja 0x140016d45
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp fcn.1400167d0
movabs rax, 0x7fffffffffffffdf
cmp rsi, rax
jae 0x140016dad
mov rax, qword [rcx + 0x18]
add r8, 0x19
mov qword [rsp + 0x30], rbx
mov edx, shutdown
mov qword [rsp + 0x38], rdi
mov ebx, dword [rax + 0x60]
call fcn.14000c000
mov r8, rsi
mov rdx, rbp
mov rdi, rax
mov dword [rax + 0xc], ebx
lea rcx, [rax + 0x18]
mov byte [rax + 0xa], 0
mov byte [rax + rsi + 0x18], 0
mov qword [rax + 0x10], rsi
call sub.VCRUNTIME140.dll_memcpy
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
call fcn.1400104e0
int3