joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140082e00
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, qword [rsp + 0x50]
xor eax, eax
mov qword [r9], rax
mov rsi, r9
mov rbx, r8
mov rdi, rdx
mov qword [r14], rax
test r8, r8
jne 0x140082e48
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rdx + rbx], al
jne 0x140082e40
lea rcx, [rbx + 2]
movabs rbp, 0xaaaaaaaaaaaaaaab
mov rax, rbp
mul rcx
shr rdx, 1
lea rcx, [rdx*4 + 1]
call qword [0x140163098]
mov rcx, rax
mov r9, rax
test rax, rax
jne 0x140082e82
mov eax, 0x1b
jmp 0x140082f73
lea r10, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
cmp rbx, 3
jb 0x140082f08
mov rax, rbp
mul rbx
mov r8, rdx
shr r8, 1
imul rax, r8, 0xfffffffffffffffd
add rbx, rax
movzx eax, byte [rdi]
shr rax, 2
movzx eax, byte [rax + r10]
mov byte [rcx], al
movzx edx, byte [rdi]
movzx eax, byte [rdi + 1]
and edx, 3
shr rax, 4
shl rdx, 4
or rdx, rax
movzx eax, byte [rdx + r10]
mov byte [rcx + 1], al
movzx edx, byte [rdi + 1]
movzx eax, byte [rdi + 2]
and edx, 0xf
shr rax, 6
shl rdx, 2
or rdx, rax
movzx eax, byte [rdx + r10]
mov byte [rcx + 2], al
movzx eax, byte [rdi + 2]
add rdi, 3
and eax, 0x3f
movzx eax, byte [rax + r10]
mov byte [rcx + 3], al
add rcx, 4
sub r8, 1
jne 0x140082ea2
test rbx, rbx
je 0x140082f65
movzx eax, byte [rdi]
shr rax, 2
movzx eax, byte [rax + r10]
mov byte [rcx], al
movzx edx, byte [rdi]
and edx, 3
shl rdx, 4
cmp rbx, 1
jne 0x140082f3b
movzx eax, byte [rdx + r10]
mov byte [rcx + 1], al
mov word [rcx + 2], 0x3d3d
jmp 0x140082f61
movzx eax, byte [rdi + 1]
shr rax, 4
or rax, rdx
movzx eax, byte [rax + r10]
mov byte [rcx + 1], al
movzx eax, byte [rdi + 1]
and eax, 0xf
movzx eax, byte [r10 + rax*4]
mov byte [rcx + 2], al
mov byte [rcx + 3], 0x3d
add rcx, 4
mov byte [rcx], 0
sub rcx, r9
mov qword [r14], rcx
xor eax, eax
mov qword [rsi], r9
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14008f6d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x9ae], 0
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
je 0x14008f79a
cmp qword [rcx + 0x280], 0
je 0x14008f762
mov rcx, qword [rcx + 0xe8]
test rcx, rcx
je 0x14008f71e
cmp byte [rcx + 0x25b], 0
je 0x14008f71e
mov sil, 1
jmp 0x14008f726
xor sil, sil
test rcx, rcx
je 0x14008f72d
mov byte [rcx + 0x25b], 1
mov rax, qword [rbx + 0x1f8]
mov r9, rdi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, 1
mov rcx, rbx
call qword [rbx + 0x280]
mov rax, qword [rbx + 0xe8]
test rax, rax
je 0x14008f79a
mov byte [rax + 0x25b], sil
jmp 0x14008f79a
mov r9, qword [rcx + 0x1f0]
mov edx, 2
lea rcx, [0x14014737b]
mov r8d, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rbx + 0x1f0]
mov r8d, 1
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov edx, 4
lea rsi, [rbx + 0x14c]
mov eax, dword [rsi]
mov ecx, 0x24
sub eax, 0x64
mov r9, rdi
cmp eax, 0x64
mov r8, rbp
cmovb edx, ecx
mov rcx, rbx
call fcn.1400656f0
test eax, eax
jne 0x14008f856
mov edx, dword [rbx + 0x134]
mov r9d, 0x4b000
cmp rdi, r9
jae 0x14008f81b
mov ecx, dword [rbx + 0x1288]
lea eax, [rdi + rdx]
add dword [rbx + 0x130], edi
add ecx, edi
mov dword [rbx + 0x1288], ecx
mov dword [rbx + 0x134], eax
cmp eax, r9d
ja 0x14008f80f
cmp ecx, 0x5dc000
jbe 0x14008f83a
mov r9d, 0x5dc000
mov eax, ecx
lea rsi, [rbx + 0x14c]
mov r8d, eax
jmp 0x14008f81f
lea r8, [rdi + rdx]
test r8, r8
je 0x14008f83a
lea rdx, str.Too_large_response_headers:__zu____u
mov rcx, rbx
call fcn.140077850
mov eax, 0x38
jmp 0x14008f856
mov eax, dword [rsi]
sub eax, 0x64
cmp eax, 0x63
ja 0x14008f84c
mov eax, dword [rbx + 0x130]
jmp 0x14008f84e
xor eax, eax
mov dword [rbx + 0x138], eax
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140097240
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Move file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
cmp byte [0x140163eb8], 0
mov rbx, rdx
mov rdi, rcx
je 0x140097295
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r9, qword [0x140163eb0]
mov rax, qword [rsp + 0x50]
cqo
idiv r9
mov rsi, rax
mov rax, qword [rsp + 0x50]
cqo
idiv r9
imul rax, rdx, 0xf4240
cqo
idiv r9
mov rbp, rax
jmp 0x1400972bb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0x10624dd3
mul r8d
shr edx, 6
imul ecx, edx, 0x3e8
mov esi, edx
sub r8d, ecx
imul ebp, r8d, 0x3e8
mov qword [rsp + 0x40], r14
mov rcx, rdi
mov qword [rsp + 0x48], r15
call fcn.14007e8e0
mov rcx, rbx
mov rdi, rax
call fcn.14007e8e0
mov r8d, 1
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1400973d4
movabs r15, 0x20c49ba5e353f7
movabs r14, 0xffdf3b645a1cac09
nop dword [rax]
cmp byte [0x140163eb8], 0
je 0x14009734a
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x50]
cqo
idiv qword [0x140163eb0]
mov r8, rax
imul rax, rdx, 0xf4240
cqo
idiv qword [0x140163eb0]
mov rcx, rax
jmp 0x140097371
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, eax
mov eax, 0x10624dd3
mul r9d
shr edx, 6
imul ecx, edx, 0x3e8
mov r8d, edx
sub r9d, ecx
imul ecx, r9d, 0x3e8
sub r8, rsi
cmp r8, r15
jge 0x140097409
cmp r8, r14
jle 0x140097409
sub ecx, ebp
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul rax, r8, 0x3e8
movsxd rdx, edx
add rdx, rax
cmp rdx, 0x3e8
ja 0x140097409
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140097310
test rdi, rdi
je 0x1400973e2
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x1400973f0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov r15, qword [rsp + 0x48]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
test rdi, rdi
je 0x140097417
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x140097425
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, 1
jmp 0x1400973f2
Function at 0x14009eae0
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push r12
push r13
push r15
sub rsp, 0x20
xor r13d, r13d
mov r12, r9
mov qword [r9], r13
mov esi, r13d
lea r9, [rsp + 0x68]
mov ebp, r13d
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r15d, eax
test eax, eax
jne 0x14009ec50
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x14009ec30
mov qword [rsp + 0x60], r14
nop
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x14009eb4e
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r13b
jne 0x14009eb40
inc rbx
jmp 0x14009eb51
mov rbx, r13
cmp dword [rdi + 4], 2
jne 0x14009ebdd
cmp qword [rdi + 0x20], r13
je 0x14009ebdd
cmp qword [rdi + 0x10], 0x10
jb 0x14009ebdd
lea rcx, [rbx + 0x40]
call qword [0x140163098]
mov r14, rax
test rax, rax
je 0x14009ebec
mov ecx, dword [rdi]
mov dword [rax], ecx
mov ecx, dword [rdi + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rdi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rdi + 0xc]
mov dword [rax + 0xc], ecx
lea rcx, [rax + 0x30]
mov qword [rax + 0x20], rcx
mov dword [rax + reloc.WS2_32.dll_recv], 0x10
mov qword [rax + 0x18], r13
mov qword [rax + 0x28], r13
mov rax, qword [rdi + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
test rbx, rbx
je 0x14009ebca
add rcx, 0x10
mov r8, rbx
mov qword [r14 + 0x18], rcx
mov rdx, qword [rdi + 0x18]
call sub.VCRUNTIME140.dll_memcpy
test rsi, rsi
cmove rsi, r14
test rbp, rbp
je 0x14009ebda
mov qword [rbp + 0x28], r14
mov rbp, r14
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x14009eb30
jmp 0x14009ebf2
mov r15d, 8
mov rcx, qword [rsp + 0x68]
mov r14, qword [rsp + 0x60]
test rcx, rcx
je 0x14009ec07
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r15d, r15d
je 0x14009ec2b
test rsi, rsi
je 0x14009ec26
mov rbx, qword [rsi + 0x28]
mov rcx, rsi
call qword [0x1401630a8]
mov rsi, rbx
test rbx, rbx
jne 0x14009ec11
mov rsi, r13
jmp 0x14009ec3f
test rsi, rsi
jne 0x14009ec3f
mov r15d, 0x2af9
mov ecx, r15d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rdi, qword [rsp + 0x58]
mov eax, r15d
mov rbx, qword [rsp + 0x50]
mov qword [r12], rsi
add rsp, 0x20
pop r15
pop r13
pop r12
pop rsi
pop rbp
ret
Function at 0x1400a0ca0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r15, qword [r8 + 0x28]
lea rbx, [r8 + 0x40]
xor eax, eax
mov rdi, rdx
mov rdx, qword [rbx]
mov r14, r9
mov dword [rsp + 0x78], eax
mov rsi, r8
cmp r15, rdx
jbe 0x1400a0df1
mov r12, qword [r8 + 0x20]
mov r9, r15
mov rcx, qword [rcx + 8]
add r12, rdx
sub r9, rdx
mov r8, r12
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x28], rdx
mov rdx, rdi
mov rax, qword [rcx]
mov byte [rsp + 0x20], 0
call qword [rax + 0x48]
mov rbp, rax
test rax, rax
jns 0x1400a0d21
mov eax, dword [rsp + 0x78]
cmp eax, 0x51
jne 0x1400a0dd6
xor eax, eax
jmp 0x1400a0df1
add qword [rbx], rbp
cmp byte [rdi + 0x9ae], 0
je 0x1400a0dd2
cmp qword [rdi + 0x280], 0
je 0x1400a0d9a
mov rcx, qword [rdi + 0xe8]
test rcx, rcx
je 0x1400a0d54
cmp byte [rcx + 0x25b], 0
je 0x1400a0d54
mov bl, 1
jmp 0x1400a0d5b
xor bl, bl
test rcx, rcx
je 0x1400a0d62
mov byte [rcx + 0x25b], 1
mov rax, qword [rdi + 0x1f8]
mov r9, rbp
mov r8, r12
mov qword [rsp + 0x20], rax
mov edx, 2
mov rcx, rdi
call qword [rdi + 0x280]
mov rax, qword [rdi + 0xe8]
test rax, rax
je 0x1400a0d94
mov byte [rax + 0x25b], bl
lea rbx, [rsi + 0x40]
jmp 0x1400a0dd2
mov r9, qword [rdi + 0x1f0]
lea rcx, [0x14014737e]
mov edx, 2
mov r8d, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x1f0]
mov r8d, 1
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x1400a0df1
lea rdx, str.Failed_sending_CONNECT_to_proxy
mov rcx, rdi
call fcn.140077850
mov eax, dword [rsp + 0x78]
test eax, eax
jne 0x1400a0dfc
cmp qword [rbx], r15
jb 0x1400a0dfc
mov byte [r14], 1
jmp 0x1400a0e00
mov byte [r14], 0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400a3880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
cmp rdx, r8
jae 0x1400a39cd
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0x186a0
call fcn.1400a37d0
test eax, eax
jne 0x1400a39cf
mov rax, qword [str.1.2.840.10040.4.1]
lea r10, str.1.2.840.10040.4.1
mov r9, qword [rsp + 0x20]
test rax, rax
je 0x1400a399c
lea r11, [0x140147570]
nop dword [rax + rax]
mov r8, r9
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400a3913
inc rax
test ecx, ecx
jne 0x1400a3900
test edx, edx
je 0x1400a3966
mov rax, qword [r10 + 8]
test rax, rax
je 0x1400a3986
test r9, r9
je 0x1400a398b
cmp byte [rax], 0
mov r8, r9
je 0x1400a3951
nop dword [rax]
movzx ecx, byte [r8]
test cl, cl
je 0x1400a3951
movzx edx, byte [rax]
movzx ecx, byte [rcx + r11]
cmp byte [rdx + r11], cl
jne 0x1400a3982
inc rax
inc r8
cmp byte [rax], 0
jne 0x1400a3930
xor ecx, ecx
cmp byte [rax], cl
sete cl
xor eax, eax
cmp byte [r8], al
setne al
xor ecx, eax
test ecx, ecx
je 0x1400a398b
test r10, r10
je 0x1400a399c
mov rdx, qword [r10 + 8]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1400a3976
jmp 0x1400a39b0
xor ecx, ecx
jmp 0x1400a3962
test r9, r9
je 0x1400a3966
mov rax, qword [r10 + 0x10]
add r10, 0x10
test rax, rax
jne 0x1400a38f0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [r9 + r8], 0
jne 0x1400a39a3
mov rdx, r9
mov rcx, rbx
call fcn.1400678e0
mov rcx, qword [rsp + 0x20]
mov ebx, eax
call qword [0x1401630a8]
mov eax, ebx
add rsp, 0x40
pop rbx
ret
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x1400aaf90
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbp
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, r8
mov dword [rsp + 0x20], 0xf0000040
mov rbp, rdx
mov rdi, rcx
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1400aafdf
mov eax, 0x1b
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1400ab02e
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov qword [rsp + 0x30], 0
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x68]
xor r8d, r8d
mov dword [rsp + 0x68], 0
mov edx, 2
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x68], 0x20
jne 0x1400ab091
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x68]
mov r8, rdi
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400ab0a1
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400ab0b3
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbp, qword [rsp + 0x50]
xor eax, eax
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400ab0d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x20
mov ecx, 0x58
mov r14, r9
mov rsi, r8
mov rdi, rdx
call qword [0x140163098]
mov rbx, rax
test rax, rax
je 0x1400ab25a
mov qword [rsp + 0x48], rbp
lea rcx, [rbx + 0x18]
mov qword [rbx + 8], rcx
lea rdx, [rcx + 0x10]
mov qword [rbx + 0x10], rdx
lea rax, fcn.1400aae70
mov qword [rbx], rax
cmp esi, 0x40
jbe 0x1400ab153
call fcn.1400aae70
mov rcx, qword [rbx + 8]
mov r8d, esi
mov rdx, rdi
call fcn.1400aaef0
mov rdi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
add rdi, 0x10
mov rcx, rdi
call fcn.1400aaf00
mov esi, 0x20
mov rcx, qword [rbx + 8]
call fcn.1400aae70
mov rcx, qword [rbx + 0x10]
call fcn.1400aae70
xor ebp, ebp
mov esi, esi
test rsi, rsi
je 0x1400ab1ba
mov ebp, esi
movzx eax, byte [rdi]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rbx + 8]
call fcn.1400aaef0
movzx eax, byte [rdi]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea rdi, [rdi + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call fcn.1400aaef0
sub rsi, 1
jne 0x1400ab170
cmp rbp, 0x40
jae 0x1400ab1f4
mov edi, 0x40
sub rdi, rbp
mov rcx, qword [rbx + 8]
lea rdx, [0x1400ae13c]
mov r8d, 1
call fcn.1400aaef0
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1400ae13b]
mov r8d, 1
call fcn.1400aaef0
sub rdi, 1
jne 0x1400ab1c2
mov rax, qword [rbx]
mov rdx, r14
mov r8d, dword [rsp + 0x60]
mov rcx, qword [rbx + 8]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rbx]
test rdi, rdi
jne 0x1400ab21a
mov edi, dword [rbp + 0x18]
add rdi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, rdi
call qword [rbp + reloc.WS2_32.dll_recv]
mov r8d, dword [rbp + 0x20]
mov rdx, rdi
mov rcx, qword [rbx + 0x10]
call qword [rbp + reloc.WS2_32.dll_htonl]
mov rdx, qword [rbx + 0x10]
mov rcx, rdi
call qword [rbp + reloc.WS2_32.dll_recv]
mov rcx, rbx
call qword [0x1401630a8]
mov rbp, qword [rsp + 0x48]
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rbx, qword [rsp + 0x50]
mov eax, 0x1b
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x1400abb54
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400abb9e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400abb9e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400abb9e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400abb9e
cmp dword [rcx + 0x84], 0xe
jbe 0x1400abb9e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400abba0
xor al, al
add rsp, 0x28
ret
Function at 0x14000bda0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x20], r9b
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov byte [rsp + 8], cl
sub rsp, 0xb8
movzx eax, word [0x14017711c]
mov word [rsp + 0x14], ax
mov eax, dword [0x14017712c]
mov dword [rsp + 0x40], eax
mov eax, 0x54d7
mov word [rsp + 0xc], ax
mov eax, dword [0x140177118]
mov eax, eax
mov qword [rsp + 0x50], rax
mov eax, 0xb5
mov word [rsp + 0x18], ax
mov byte [rsp + 1], 0xd
movabs rax, 0xc2a91f617ff74
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x3c], 0x8e3f
mov eax, 0xa382
mov word [rsp + 0x1c], ax
mov rax, qword [0x140177120]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140177180]
mov dword [rsp + 0x38], eax
movabs rax, 0x45b21e7ce0edd
mov qword [rsp + 0x70], rax
movsx ax, byte [0x140177086]
mov word [rsp + 8], ax
mov qword [rsp + 0x78], 0x37b0
mov rax, qword [0x140177150]
mov word [rsp + 0x20], ax
mov eax, 0xffff9565
mov word [rsp + 0x24], ax
movzx eax, byte [0x140177026]
movzx eax, al
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 0xab
mov byte [rsp], 0xb6
movzx eax, byte [0x14017704f]
mov byte [rsp + 2], al
mov dword [rsp + 0x10], 0x5b
movzx eax, word [0x140177148]
mov word [rsp + 0x28], ax
movzx eax, byte [0x14017706e]
movzx eax, al
mov dword [rsp + 0x44], eax
movzx eax, byte [0x140177026]
movzx eax, al
mov qword [rsp + 0x58], rax
movsxd rax, dword [0x14017712c]
mov qword [rsp + 0x90], rax
mov byte [rsp + 3], 0xe2
mov rax, qword [0x140177100]
mov byte [rsp + 4], al
mov byte [rsp + 5], 0x56
movsx eax, byte [0x14017706b]
mov dword [rsp + 0x48], eax
mov eax, 0x5b
mov word [rsp + 0x2c], ax
movsx rax, word [0x140177144]
mov qword [rsp + 0x98], rax
mov eax, 0xe9
mov word [rsp + 0x30], ax
movzx eax, word [0x14017711c]
cwde
mov dword [rsp + 0x4c], eax
movzx eax, byte [0x14017706e]
movzx eax, al
mov qword [rsp + 0xa0], rax
movzx eax, byte [0x14017704f]
movzx eax, al
mov word [rsp + 0x34], ax
movzx eax, word [0x1401770d4]
movzx eax, ax
mov qword [rsp + 0xa8], rax
mov eax, 8
mov word [rsp + 8], ax
mov eax, 2
mov word [0x1401770d4], ax
movzx eax, byte [0x14017704e]
test eax, eax
je 0x14000bf95
mov dword [rsp + 0x10], 0x6c3
mov rax, qword [0x140177158]
add rax, 0x17f0
mov word [rsp + 0xc], ax
jmp 0x14000bfbc
mov eax, dword [0x140178dc0]
mov qword [rsp + 0x50], rax
mov rax, qword [0x140177160]
sub rax, 0xb51d
mov byte [rsp], al
mov eax, 0x6e
mov word [0x14017709c], ax
mov eax, dword [rsp + 0x38]
add eax, 0x5fe
mov dword [rsp + 0x3c], eax
mov eax, dword [0x140178dc0]
mov dword [rsp + 0x10], eax
movzx eax, byte [rsp + 0x58]
add rsp, 0xb8
ret
Function at 0x140030970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x28], 0x24
mov byte [rsp + 0x30], 0xf5
mov byte [rsp + 0x31], 0x15
mov byte [rsp + 0x32], 0x1c
mov byte [rsp + 0x33], 0x5f
mov byte [rsp + 0x34], 0xe2
mov byte [rsp + 0x35], 0x91
mov byte [rsp + 0x36], 0xd7
mov byte [rsp + 0x37], 0xfe
mov byte [rsp + 0x38], 0x42
mov byte [rsp + 0x39], 0x4d
mov byte [rsp + 0x3a], 0xe7
mov byte [rsp + 0x3b], 0xe7
mov byte [rsp + 0x3c], 0xde
mov byte [rsp + 0x3d], 0x59
mov byte [rsp + 0x3e], 0x7f
mov byte [rsp + 0x3f], 0x50
mov byte [rsp + 0x40], 0xd8
mov byte [rsp + 0x41], 0xd8
mov byte [rsp + 0x42], 0xff
mov byte [rsp + 0x43], 0xcc
mov byte [rsp + 0x44], 0x46
mov byte [rsp + 0x45], 0x10
mov byte [rsp + 0x46], 0xb1
mov byte [rsp + 0x47], 0xd4
mov byte [rsp + 0x48], 0xc4
mov byte [rsp + 0x49], 0x59
mov byte [rsp + 0x4a], 0x4a
mov byte [rsp + 0x4b], 0x66
mov byte [rsp + 0x4c], 0xd9
mov byte [rsp + 0x4d], 0xce
mov byte [rsp + 0x4e], 0xe8
mov byte [rsp + 0x4f], 0x87
mov byte [rsp + 0x50], 0x4e
mov byte [rsp + 0x51], 0x5b
mov byte [rsp + 0x52], 0xe6
mov byte [rsp + 0x53], 0x88
mov eax, 0x610
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x140030ad3
mov eax, 0x610
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x141f20340]
mov rcx, qword gs:[0x58]
mov edx, 0x610
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x5e8
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140031370
lea rcx, [0x140139e10]
call fcn.1401258bc
nop
mov eax, 0x5e8
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x68
ret
Function at 0x1400324e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x28], 0x11
mov byte [rsp + 0x30], 0xed
mov byte [rsp + 0x31], 0x5e
mov byte [rsp + 0x32], 0x53
mov byte [rsp + 0x33], 0x6f
mov byte [rsp + 0x34], 0xe8
mov byte [rsp + 0x35], 0x6a
mov byte [rsp + 0x36], 0x40
mov byte [rsp + 0x37], 0xf7
mov byte [rsp + 0x38], 0x4c
mov byte [rsp + 0x39], 0xd6
mov byte [rsp + 0x3a], 0x66
mov byte [rsp + 0x3b], 0x4a
mov byte [rsp + 0x3c], 0xcc
mov byte [rsp + 0x3d], 0x45
mov byte [rsp + 0x3e], 0x66
mov byte [rsp + 0x3f], 0x7b
mov byte [rsp + 0x40], 0x81
mov eax, 0x4fc
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x1400325e4
mov eax, 0x4fc
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x141f20340]
mov rcx, qword gs:[0x58]
mov edx, 0x4fc
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x4e8
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140031060
lea rcx, [0x140139d80]
call fcn.1401258bc
nop
mov eax, 0x4e8
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x58
ret