joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d9e0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x14000da10
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x14000da92
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x14000da5e
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x14000da66
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14000da05
mov qword [rsp + 8], 0xe3
jmp 0x14000daaa
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x14000db31
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x14000dafb
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x14000db03
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14000da9d
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x14000db85
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x14000db8d
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret
Function at 0x14000dbd4
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x14000dbf5
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x14000dc79
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x14000dc44
mov dword [rsp + 4], 0x9908b0df
jmp 0x14000dc4c
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14000dbe8
add rsp, 0x18
ret
Function at 0x14000f01c
Capabilities:
Terminate process

Disassembly:
push rdi
mov eax, 0x307090
call fcn.140013060
sub rsp, rax
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x2c], 0xa
lea rax, [rsp + 0x140]
mov rdi, rax
xor eax, eax
mov ecx, 0x306f42
rep stosb byte [rdi], al
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0x20]
call fcn.14000aeac
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400040dc
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.14000ac60
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.14000547c
nop
lea rcx, [rsp + 0x40]
call fcn.14000a650
lea rdx, [0x14001e018]
lea rcx, [rsp + 0xd8]
call fcn.14000f66c
lea rcx, [rsp + 0xd8]
call fcn.14000eaf0
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x140]
mov rcx, qword [rsp + 0x48]
call fcn.14000bc74
movzx eax, al
test eax, eax
jne 0x14000f0fd
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x88]
call fcn.14000547c
nop
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x88]
call fcn.14000f968
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x88]
call fcn.14000ea98
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call fcn.1400091e8
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0xf8]
call fcn.14000b904
nop
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0xb8]
call fcn.140005fb4
nop
lea rcx, [rsp + 0xb8]
call fcn.14000eaf0
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x70]
call fcn.140009b70
nop
mov dword [rsp + 0x24], 0
jmp 0x14000f1b9
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
movsxd rax, dword [rsp + 0x24]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0xb8]
call fcn.1400062fc
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
jae 0x14000f203
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x68]
movsx eax, byte [rcx + rax]
xor eax, 0xa
xor eax, 8
mov byte [rsp + 0x21], al
lea rdx, [rsp + 0x21]
lea rcx, [rsp + 0x70]
call fcn.140010ef8
jmp 0x14000f1af
lea rcx, [rsp + 0x70]
call fcn.140011044
nop
lea rcx, [rsp + 0x70]
call fcn.14000a858
nop
lea rcx, [rsp + 0xb8]
call fcn.140005718
nop
lea rcx, [rsp + 0xf8]
call fcn.140005718
nop
lea rcx, [rsp + 0x88]
call fcn.140005718
nop
lea rcx, [rsp + 0xd8]
call fcn.140005718
add rsp, 0x307090
pop rdi
ret
Function at 0x14001018c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x1408
call fcn.140013060
sub rsp, rax
cmp dword [0x14001e580], 0
je 0x14001030f
cmp qword [0x14001e560], 0
jne 0x14001030f
mov rcx, qword [rsp + 0x1410]
call fcn.140010318
movzx eax, al
test eax, eax
je 0x14001030f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x60000
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14000ee00
nop
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.140007e38
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x38]
call fcn.14000e428
mov qword [rsp + 0x48], rax
jmp 0x140010223
mov rax, qword [rsp + 0x30]
add rax, 0x30
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x48]
cmp qword [rsp + 0x30], rax
je 0x1400102fb
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
cmp qword [rsp + 0x1410], rax
jbe 0x1400102f6
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
add rax, qword [rcx + 0x18]
cmp qword [rsp + 0x1410], rax
jae 0x1400102f6
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [0x14001e560], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
mov qword [0x14001e568], rax
mov byte [0x14001e570], 0
lea rcx, [rsp + 0x20]
call fcn.14000b484
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.140009ad0
mov r8d, 0xffffffff
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140009b40
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.140006bf0
mov dword [0x14001e574], eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.140006bf0
mov dword [0x14001e578], eax
lea rcx, [rsp + 0x50]
call fcn.14000a870
jmp 0x14001030f
jmp 0x140010215
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0x1408
ret
Function at 0x140011b08
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x80], 0
jg 0x140011b2d
xor eax, eax
jmp 0x140011cf3
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x140011b56
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140011cf3
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jbe 0x140011bf5
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.140005378
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.140005f58
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x140011ce3
mov rcx, qword [rsp + 0x70]
call fcn.14000ddd0
mov qword [rsp + 0x58], 0xfff
cmp qword [rsp + 0x20], 0xfff
jbe 0x140011c96
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x30], 0xfff
je 0x140011c94
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
jmp 0x140011cf3
jmp 0x140011c1b
cmp qword [rsp + 0x20], 0
jbe 0x140011ce3
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x20]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
add rsp, 0x68
ret
Function at 0x140011cf8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x140011d31
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140011e1f
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x140011dc7
cmp qword [rsp + 0x20], 0
jle 0x140011dc7
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x140011d71
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140005f58
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rsp + 0x50], 0
jle 0x140011e0f
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x140011e0f
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret

Function at 0x140011e58
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov ecx, 2
call fcn.140004470
movzx eax, al
test eax, eax
jne 0x140011e78
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.14000c430
call fcn.14000f01c
xor eax, eax
add rsp, 0x28
ret
Function at 0x140012430
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x4051029d
call fcn.140011eec
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140012470
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x43504bc7
call fcn.140011eec
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400124b0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x46a780d9
call fcn.140011eec
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400124f0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xcd90cc0e
call fcn.140011eec
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140012530
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x9900d1d
call fcn.140011eec
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140012674
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400126ae
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400126b3
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400126fc
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400196a0]
cmp byte [rcx + rax], 0
je 0x1400126fc
dec r8
sub rdx, 1
jne 0x1400126e2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140013758
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400137a2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400137a2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400137a2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400137a2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400137a2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400137a4
xor al, al
add rsp, 0x28
ret
Function at 0x140f59928
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f59932
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f5995b
pop rbp
sub rbp, 0x33
sub rbp, 0xf59928
sub rsp, 0x20
jmp 0x140f5997a
mov rax, 0xf59928
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
call 0xc5b61ad0
add byte [rax], al
add byte [rax - 0x39], cl
ror dword [rbx], 6
add byte [rax], al
mov rdx, 0x7b277e20
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f59999
jmp 0x140f599b0
push 0xffffffffa9abc9a9
sbb al, 0x20
and byte [rax], ah
push 0x2128e1a1
and byte [rax], ah
push 0xffffffffe768c921
loopne 0x140f599ef
and byte [rax], ah
and byte [rax - 0x19], ch
loop 0x140f599d6
and byte [rax], ah
and byte [rax - 0x29], ch
ret 0x2168
loope 0x140f59983
movabs eax, dword [0x70c821682020202c]
jo 0x140f59a4b
cwde
fdivr qword [rcx + rcx + 0x20202020]
and byte [rax - 0x67], ch
or al, 0xdc
jmp 0x140f59a12
fsub st(3), st(0)
and byte [rax], ah
and byte [rax], ah
and byte [rax + 0x21], ch
leave
push 0xffffffffd127079a
or esp, dword [rax]
and byte [rax], ah
and al, cl
and eax, 0xc9202020
and byte ss:[rax], ah
and cl, ah
enter 0x1122, 0x31
push 0x2024e1a1
and byte [rax], ah
push 0xffffffffa52fe8df
invalid
and byte [rax], ah
and byte [rdx + 0x77], bh
push 0x1168f7a9
jmp 0xe4e7abc2
Function at 0x100001510
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x100004100]
xor rax, rsp
mov qword [rsp + 0x30], rax
movzx esi, dx
mov edx, 1
mov ebx, ecx
mov ebp, 2
lea r8d, [rdx + 5]
mov ecx, ebp
call sub.WSOCK32.dll_socket
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1000014d8
xor eax, eax
lea r8d, [rbp + 0xe]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x22], rax
mov rcx, rdi
mov word [rsp + 0x20], bp
mov word [rsp + 0x22], si
mov dword [rsp + 0x24], ebx
mov dword [rsp + 0x2a], eax
mov word [rsp + 0x2e], ax
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x1000014de
call sub.WSOCK32.dll_WSAGetLastError
mov rcx, rdi
mov ebx, eax
call sub.WSOCK32.dll_closesocket
mov ecx, ebx
call sub.WSOCK32.dll_WSASetLastError
or rax, 0xffffffffffffffff
jmp 0x1000014e1
mov rax, rdi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.100002850
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
push rdi
sub rsp, 0x20
movzx edi, dx
test rcx, rcx
jne 0x100001528
or rax, 0xffffffffffffffff
add rsp, 0x20
pop rdi
ret
test di, di
je 0x10000151e
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
call fcn.100001390
mov rcx, rax
mov rbx, rax
call sub.WSOCK32.dll_inet_addr
mov esi, eax
cmp eax, 0xffffffff
jne 0x100001581
mov rcx, rbx
call sub.WSOCK32.dll_gethostbyname
test rax, rax
jne 0x100001578
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
or rax, 0xffffffffffffffff
add rsp, 0x20
pop rdi
ret
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov esi, dword [rcx]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
movzx edx, di
mov ecx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x100001450
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
jne 0x1000015d4
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test rdx, rdx
je 0x1000015c5
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x30], rsi
call qword [sym.imp.msvcrt.dll_wcstoul]
mov ecx, eax
call sub.WSOCK32.dll_htons
test ax, ax
jne 0x10000163b
mov rcx, rbx
call fcn.100001390
lea rdx, [0x10000126c]
mov rcx, rax
mov rbx, rax
call sub.WSOCK32.dll_getservbyname
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.msvcrt.dll_free]
test rsi, rsi
jne 0x100001637
or rax, 0xffffffffffffffff
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, word [rsi + 0x18]
movzx edx, ax
mov rcx, rdi
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x100001510
Function at 0x1000015b0
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x100004100]
xor rax, rsp
mov qword [rsp + 0x30], rax
movzx esi, dx
mov edx, 1
mov ebx, ecx
mov ebp, 2
lea r8d, [rdx + 5]
mov ecx, ebp
call sub.WSOCK32.dll_socket
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1000014d8
xor eax, eax
lea r8d, [rbp + 0xe]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x22], rax
mov rcx, rdi
mov word [rsp + 0x20], bp
mov word [rsp + 0x22], si
mov dword [rsp + 0x24], ebx
mov dword [rsp + 0x2a], eax
mov word [rsp + 0x2e], ax
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x1000014de
call sub.WSOCK32.dll_WSAGetLastError
mov rcx, rdi
mov ebx, eax
call sub.WSOCK32.dll_closesocket
mov ecx, ebx
call sub.WSOCK32.dll_WSASetLastError
or rax, 0xffffffffffffffff
jmp 0x1000014e1
mov rax, rdi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.100002850
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
push rdi
sub rsp, 0x20
movzx edi, dx
test rcx, rcx
jne 0x100001528
or rax, 0xffffffffffffffff
add rsp, 0x20
pop rdi
ret
test di, di
je 0x10000151e
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
call fcn.100001390
mov rcx, rax
mov rbx, rax
call sub.WSOCK32.dll_inet_addr
mov esi, eax
cmp eax, 0xffffffff
jne 0x100001581
mov rcx, rbx
call sub.WSOCK32.dll_gethostbyname
test rax, rax
jne 0x100001578
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
or rax, 0xffffffffffffffff
add rsp, 0x20
pop rdi
ret
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov esi, dword [rcx]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
movzx edx, di
mov ecx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x100001450
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
jne 0x1000015d4
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test rdx, rdx
je 0x1000015c5
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x30], rsi
call qword [sym.imp.msvcrt.dll_wcstoul]
mov ecx, eax
call sub.WSOCK32.dll_htons
test ax, ax
jne 0x10000163b
mov rcx, rbx
call fcn.100001390
lea rdx, [0x10000126c]
mov rcx, rax
mov rbx, rax
call sub.WSOCK32.dll_getservbyname
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.msvcrt.dll_free]
test rsi, rsi
jne 0x100001637
or rax, 0xffffffffffffffff
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, word [rsi + 0x18]
movzx edx, ax
mov rcx, rdi
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x100001510