joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008c7a0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
movsxd rdi, edx
mov rbx, rcx
mov r8, qword [rax + 0x1a8]
mov r10d, dword [r8 + rdi*4 + 0xc08]
sub r10d, 1
je 0x14008c868
sub r10d, 1
je 0x14008c836
cmp r10d, 1
jne 0x14008c8db
mov ecx, dword [r8 + rdi*4 + 0x1008]
test ecx, ecx
je 0x14008c821
cmp ecx, r10d
jne 0x14008c8db
xor eax, eax
mov dword [r8 + rdi*4 + 0xc08], 2
mov edx, 0xfd
mov dword [r8 + rdi*4 + 0x1008], eax
mov r8d, edi
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.14008c550
xor eax, eax
mov dword [r8 + rdi*4 + 0xc08], eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [r8 + rdi*4 + 0x1008]
test ecx, ecx
je 0x14008c821
cmp ecx, 1
jne 0x14008c8db
xor eax, eax
mov dword [r8 + rdi*4 + 0xc08], eax
mov dword [r8 + rdi*4 + 0x1008], eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov qword [rsp + 0x30], rsi
lea rdx, [rsp + 0x38]
mov dword [r8 + rdi*4 + 0xc08], eax
mov rsi, qword [rcx]
mov rcx, qword [rcx + 0x1d0]
lea r8d, [rax + 3]
xor r9d, r9d
mov byte [rsp + 0x38], 0xff
mov byte [rsp + 0x39], 0xfe
mov byte [rsp + 0x3a], dil
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14008c8be
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.140075620
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, 0xfe
call fcn.14008c410
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14008c8f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
movsxd rdi, edx
mov rbx, rcx
mov r8, qword [rax + 0x1a8]
mov r10d, dword [r8 + rdi*4 + 8]
sub r10d, 1
je 0x14008c9ac
sub r10d, 1
je 0x14008c97d
cmp r10d, 1
jne 0x14008ca1c
mov ecx, dword [r8 + rdi*4 + 0x408]
test ecx, ecx
je 0x14008c96b
cmp ecx, r10d
jne 0x14008ca1c
xor eax, eax
mov dword [r8 + rdi*4 + 8], 2
mov edx, 0xfb
mov dword [r8 + rdi*4 + 0x408], eax
mov r8d, edi
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.14008c550
xor eax, eax
mov dword [r8 + rdi*4 + 8], eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [r8 + rdi*4 + 0x408]
test ecx, ecx
je 0x14008c96b
cmp ecx, 1
jne 0x14008ca1c
xor eax, eax
mov dword [r8 + rdi*4 + 8], eax
mov dword [r8 + rdi*4 + 0x408], eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov qword [rsp + 0x30], rsi
lea rdx, [rsp + 0x38]
mov dword [r8 + rdi*4 + 8], eax
mov rsi, qword [rcx]
mov rcx, qword [rcx + 0x1d0]
lea r8d, [rax + 3]
xor r9d, r9d
mov byte [rsp + 0x38], 0xff
mov byte [rsp + 0x39], 0xfc
mov byte [rsp + 0x3a], dil
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14008c9ff
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.140075620
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, 0xfc
call fcn.14008c410
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14008d5c0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
sub rsp, 0x20
mov rax, qword [rcx]
xor r13d, r13d
mov r12, rcx
mov rbp, qword [rax + 0x1a8]
mov ebx, 0x408
mov qword [rsp + 0x60], rsi
add rbp, 0x1408
mov edi, r13d
cmp edi, 1
je 0x14008d777
cmp dword [rbp - 0xc00], 1
jne 0x14008d6ae
mov rax, qword [r12]
mov rdx, qword [rax + 0x1a8]
mov ecx, dword [rbx + rdx - 0x400]
test ecx, ecx
je 0x14008d641
sub ecx, 2
je 0x14008d635
cmp ecx, 1
jne 0x14008d6ae
cmp dword [rbx + rdx], r13d
jne 0x14008d6ae
mov dword [rbx + rdx], ecx
jmp 0x14008d6ae
cmp dword [rbx + rdx], 1
jne 0x14008d6ae
mov dword [rbx + rdx], r13d
jmp 0x14008d6ae
mov dword [rbx + rdx - 0x400], 2
mov rcx, qword [r12 + 0x1d0]
mov rsi, qword [r12]
xor r9d, r9d
lea rdx, [rsp + 0x50]
mov byte [rsp + 0x50], 0xff
lea r8d, [r9 + 3]
mov byte [rsp + 0x51], 0xfb
mov byte [rsp + 0x52], dil
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14008d695
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.140075620
mov rcx, qword [r12]
lea rdx, str.SENT
mov r9d, edi
mov r8d, 0xfb
call fcn.14008c410
cmp dword [rbp], 1
jne 0x14008d777
mov rax, qword [r12]
mov rdx, qword [rax + 0x1a8]
mov ecx, dword [rbx + rdx + 0x800]
test ecx, ecx
je 0x14008d70a
sub ecx, 2
je 0x14008d6f6
cmp ecx, 1
jne 0x14008d777
cmp dword [rbx + rdx + 0xc00], r13d
jne 0x14008d777
mov dword [rbx + rdx + 0xc00], ecx
jmp 0x14008d777
cmp dword [rbx + rdx + 0xc00], 1
jne 0x14008d777
mov dword [rbx + rdx + 0xc00], r13d
jmp 0x14008d777
mov dword [rbx + rdx + 0x800], 2
mov rcx, qword [r12 + 0x1d0]
mov rsi, qword [r12]
xor r9d, r9d
lea rdx, [rsp + 0x58]
mov byte [rsp + 0x58], 0xff
lea r8d, [r9 + 3]
mov byte [rsp + 0x59], 0xfd
mov byte [rsp + 0x5a], dil
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14008d75e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.140075620
mov rcx, qword [r12]
lea rdx, str.SENT
mov r9d, edi
mov r8d, 0xfd
call fcn.14008c410
add edi, 1
add rbx, 4
add rbp, 4
cmp edi, 0x28
jl 0x14008d5f0
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x14008e890
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbp, qword [rcx + 0x1d8]
mov rsi, qword [rcx]
mov rbx, rcx
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov rcx, rbp
or rdi, 0xffffffffffffffff
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x14008e907
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov rcx, rbp
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.WS2_32.dll_accept]
mov rdi, rax
mov rdx, rbp
mov rcx, rbx
call fcn.1400790f0
cmp rdi, 0xffffffffffffffff
mov rcx, rsi
jne 0x14008e92f
lea rdx, str.Error_accept__ing_server_connect
call fcn.140075620
lea eax, [rdi + 0x1f]
jmp 0x14008e9b4
lea rdx, str.Connection_accepted_from_server_n
call fcn.140075570
xor ebp, ebp
mov rcx, rdi
lea edx, [rbp + 1]
mov dword [rbx + 0x354], ebp
mov qword [rbx + 0x1d8], rdi
call fcn.14009f3a0
mov dword [rbx + 0x1f4], 1
mov rax, qword [rsi + 0x278]
test rax, rax
je 0x14008e9b2
mov rcx, qword [rsi + 0x280]
lea r8d, [rbp + 1]
mov rdx, rdi
call rax
test eax, eax
je 0x14008e9b2
mov rdx, qword [rbx + 0x1d8]
cmp rdx, 0xffffffffffffffff
je 0x14008e99f
mov rcx, rbx
call fcn.1400790f0
mov qword [rbx + 0x1d8], 0xffffffffffffffff
mov dword [rbx + 0x35c], ebp
mov dword [rbx + 0x7fc], ebp
mov eax, Ordinal_46
jmp 0x14008e9b4
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140041910
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140092e50
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, 0x51eb851f
mov esi, r8d
mov r8d, edx
xor ebx, ebx
mov rdi, rcx
mov rcx, qword [rcx]
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 2
je 0x140092ea2
lea rdx, str.Couldnt_set_desired_mode
call fcn.140075620
lea eax, [rbx + 0x11]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp r8d, 0xc8
je 0x140092eb7
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200_n
call fcn.140075570
cmp esi, 0x13
jne 0x140092f5b
mov rax, qword [rdi]
lea rcx, [rdi + 0x6e8]
mov rdx, qword [rax + 0x1a8]
mov eax, dword [rdx + 0x18]
cmp eax, 1
jne 0x140092f15
mov r8, qword [rcx + 0x80]
test r8, r8
je 0x140092f15
lea rdx, str.SIZE__s
call fcn.1400c1ea0
test eax, eax
mov ebx, eax
jne 0x140092f8f
mov dword [rdi + 0x7a0], 0x17
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test eax, eax
je 0x140092f51
cmp qword [rdi + 0x768], rbx
je 0x140092f51
lea rdx, str.REST__d
xor r8d, r8d
call fcn.1400c1ea0
test eax, eax
mov ebx, eax
jne 0x140092f8f
mov dword [rdi + 0x7a0], 0x1a
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call fcn.140092a60
jmp 0x140092f8d
cmp esi, 0x14
jne 0x140092f6a
mov rcx, rdi
call fcn.14008f440
jmp 0x140092f8d
cmp esi, 0x15
jne 0x140092f79
mov rcx, rdi
call fcn.140092d20
jmp 0x140092f8d
cmp esi, 0x16
jne 0x140092f8f
lea edx, [rsi - 0x15]
lea r8d, [rsi - 8]
mov rcx, rdi
call fcn.140091d90
mov ebx, eax
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140093890
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x40
mov rbp, qword [rcx]
mov edi, dword [rcx + 0x794]
mov eax, 0x51eb851f
imul edx
sar edx, 5
mov rbx, rcx
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 2
je 0x14009391d
test edi, edi
jne 0x1400938da
lea rdx, str.disabling_EPRT_usage_n
mov rcx, rbp
call fcn.140075570
mov dword [rbx + 0x378], edi
add edi, 1
cmp edi, 2
jne 0x140093904
lea rdx, str.Failed_to_do_PORT
mov rcx, rbp
call fcn.140075620
lea eax, [rdi + 0x1c]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov edx, edi
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp 0x14008eb90
lea rdx, str.Connect_data_stream_actively_n
mov rcx, rbp
call fcn.140075570
mov dword [rbx + 0x7a0], 0
mov rax, qword [rbx]
mov rcx, qword [rax + 0x1a8]
cmp dword [rcx + 0x18], 0
je 0x140093974
or r8, 0xffffffffffffffff
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov rcx, rbx
or edx, r8d
mov dword [rsp + 0x28], 0xffffffff
mov qword [rsp + 0x20], 0
call fcn.14009e4f0
jmp 0x14009397e
mov dword [rbx + 0x354], 1
mov rbp, qword [rsp + 0x58]
mov dword [rbx + 0x774], 1
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x14009b420
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.140061250
mov byte [rsp + 0x20], 0
test rax, rax
je 0x14009b486
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x14009b486
lea rcx, [rsp + 0x20]
call qword [fcn.140065b10]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140041910
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140041910
add rsp, 0x148
ret

Function at 0x14009f3a0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
xor eax, eax
test edx, edx
lea r8, [rsp + 0x38]
setne al
mov edx, 0x8004667e
mov dword [rsp + 0x38], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret

Function at 0x14009f7e0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.140189b00
sub rsp, rax
xor ebx, ebx
mov rbp, rdx
mov rsi, rcx
mov rdi, rbx
call fcn.1400e71c0
test eax, eax
jne 0x14009f86d
lea rcx, str.RANDFILE
call fcn.140061250
test rax, rax
mov rdi, rax
je 0x14009f86d
cmp byte [rax], bl
je 0x14009f86d
mov rdx, rax
mov ecx, ebx
nop
cmp ecx, 0x80000000
jae 0x14009f843
add rdx, 1
add ecx, 1
cmp byte [rdx], bl
jne 0x14009f830
btr ecx, 0x1f
lea eax, [rcx + 1]
cmp rax, rbp
jae 0x14009f86d
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
call fcn.1400c8b40
cmp rax, rbp
jb 0x14009f91a
xor eax, eax
jmp 0x14009f91d
call fcn.1400e71c0
test eax, eax
jne 0x14009f885
lea rcx, str.HOME
call fcn.140061250
mov rdi, rax
test rdi, rdi
lea rdx, [0x1401f4d6c]
cmovne rdx, rdi
cmp byte [rdx], bl
je 0x14009f917
mov rcx, rdx
mov eax, ebx
cmp eax, 0x80000000
jae 0x14009f8b2
add rcx, 1
add eax, 1
cmp byte [rcx], bl
jne 0x14009f8a0
cmp byte [reloc.WLDAP32.dll_Ordinal_46], bl
lea rcx, [0x1401f4d70]
je 0x14009f8d5
cmp ebx, 0x80000000
jae 0x14009f8d5
add rcx, 1
add ebx, 1
cmp byte [rcx], 0
jne 0x14009f8c1
btr ebx, 0x1f
btr eax, 0x1f
lea ecx, [rbx + rax + 2]
cmp rcx, rbp
jae 0x14009f917
mov r8, rbp
mov rcx, rsi
call fcn.1400c8b40
lea rdx, [0x1401f4d78]
mov r8, rbp
mov rcx, rsi
call fcn.1400c8ba0
lea rdx, str..rnd
mov r8, rbp
mov rcx, rsi
call fcn.1400c8ba0
jmp 0x14009f91a
mov byte [rsi], 0
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a87e0
Capabilities:
Query environment variable

Disassembly:
mov eax, Ordinal_41
call fcn.140189b00
sub rsp, rax
lea rcx, str.OPENSSL_CONF
call fcn.140061250
test rax, rax
je 0x1400a880a
mov rcx, rax
add rsp, 0x28
jmp fcn.1400c8c20
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
call fcn.1400eafe0
xor edx, edx
mov ecx, edx
cmp byte [rax], cl
je 0x1400a8834
cmp ecx, 0x80000000
jae 0x1400a8834
add rax, 1
add ecx, 1
cmp byte [rax], dl
jne 0x1400a8821
btr ecx, 0x1f
lea rax, [0x1401f6d28]
add ecx, 1
cmp byte [reloc.WS2_32.dll_WSAGetLastError], dl
je 0x1400a8864
nop
nop
cmp edx, 0x80000000
jae 0x1400a8864
add rax, 1
add edx, 1
cmp byte [rax], 0
jne 0x1400a8850
btr edx, 0x1f
mov r8d, 0x21b
lea ebx, [rdx + rcx + 1]
lea rdx, [0x1401f6d38]
mov ecx, ebx
call fcn.1400adb80
test rax, rax
mov rdi, rax
jne 0x1400a8897
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
movsxd rbx, ebx
call fcn.1400eafe0
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.1400c8b40
lea rdx, [0x1401f6d34]
mov r8, rbx
mov rcx, rdi
call fcn.1400c8ba0
lea rdx, str.openssl.cnf
mov r8, rbx
mov rcx, rdi
call fcn.1400c8ba0
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x1400bbf50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r10, dword [rdx + 8]
lea rbx, [rcx - 1]
movsxd rcx, dword [r8 + 8]
xor rcx, r10
shr rbx, 0x3f
movsxd rsi, r9d
sub rbx, 1
lea eax, [rsi - 1]
mov r11, r8
and rcx, rbx
mov rdi, rdx
xor r10d, ecx
mov dword [rdx + 8], r10d
xor dword [r8 + 8], ecx
cmp eax, 9
ja case.default.0x1400bbfa8
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0xbc150]
add rcx, rdx
jmp rcx
mov r9d, 0xa
cmp r9, rsi
jge case.0x1400bbfa8.10
nop
nop
nop
mov rax, qword [r11]
mov r8, qword [rdi]
add r9, 1
mov rcx, qword [r8 + r9*8 - 8]
mov rdx, qword [rax + r9*8 - 8]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + r9*8 - 8], rcx
mov rax, qword [r11]
xor qword [rax + r9*8 - 8], rdx
cmp r9, rsi
jl 0x1400bbfc0
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x48]
mov rdx, qword [rax + 0x48]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x48], rcx
mov rax, qword [r11]
xor qword [rax + 0x48], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x40]
mov rdx, qword [rax + 0x40]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x40], rcx
mov rax, qword [r11]
xor qword [rax + 0x40], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x38]
mov rdx, qword [rax + 0x38]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x38], rcx
mov rax, qword [r11]
xor qword [rax + 0x38], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x30]
mov rdx, qword [rax + 0x30]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x30], rcx
mov rax, qword [r11]
xor qword [rax + 0x30], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x28]
mov rdx, qword [rax + 0x28]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x28], rcx
mov rax, qword [r11]
xor qword [rax + 0x28], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x20]
mov rdx, qword [rax + 0x20]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x20], rcx
mov rax, qword [r11]
xor qword [rax + 0x20], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x18]
mov rdx, qword [rax + 0x18]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x18], rcx
mov rax, qword [r11]
xor qword [rax + 0x18], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x10]
mov rdx, qword [rax + 0x10]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x10], rcx
mov rax, qword [r11]
xor qword [rax + 0x10], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 8]
mov rdx, qword [rax + 8]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 8], rcx
mov rax, qword [r11]
xor qword [rax + 8], rdx
mov r8, qword [rdi]
mov rax, qword [r11]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [r8]
mov rcx, qword [rax]
mov rdi, qword [rsp + 0x18]
xor rcx, rdx
and rcx, rbx
mov rbx, qword [rsp + 8]
xor rdx, rcx
mov qword [r8], rdx
mov rax, qword [r11]
xor qword [rax], rcx
ret
Function at 0x1400bf9a0
Capabilities:
Hash data with md5

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.140189b00
sub rsp, rax
lea r8d, [rax + 0x3c]
xor edx, edx
mov rbx, rcx
call fcn.140041940
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1400c0690
Capabilities:
Hash data using sha224

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.140189b00
sub rsp, rax
lea r8d, [rax + 0x50]
xor edx, edx
mov rbx, rcx
call fcn.140041940
mov dword [rbx], 0xc1059ed8
mov dword [rbx + 4], 0x367cd507
mov dword [rbx + 8], 0x3070dd17
mov dword [rbx + 0xc], 0xf70e5939
mov dword [rbx + 0x10], 0xffc00b31
mov dword [rbx + 0x14], 0x68581511
mov dword [rbx + 0x18], 0x64f98fa7
mov dword [rbx + 0x1c], 0xbefa4fa4
mov dword [rbx + 0x6c], Ordinal_30
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1400c0700
Capabilities:
Hash data using sha256

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.140189b00
sub rsp, rax
lea r8d, [rax + 0x50]
xor edx, edx
mov rbx, rcx
call fcn.140041940
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov dword [rbx + 0x6c], reloc.WLDAP32.dll_Ordinal_32
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1400c3170
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
mov rdi, rcx
mov byte [rcx], 0
mov edx, ebx
call qword [sym.imp.WS2_32.dll_gethostname]
mov byte [rbx + rdi - 1], 0
test eax, eax
jne 0x1400c31a9
lea edx, [rax + 0x2e]
mov rcx, rdi
call fcn.140048760
test rax, rax
je 0x1400c31a7
mov byte [rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c9370
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor r9b, r9b
test r8, r8
mov r10, rdx
je 0x1400c9397
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
add rcx, 1
xor dl, al
or r9b, dl
sub r8, 1
jne 0x1400c9380
movzx eax, r9b
ret

Function at 0x1400c98d0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
test rcx, rcx
mov r9, rcx
je 0x1400c9928
movzx eax, byte [rcx]
test al, al
je 0x1400c9928
mov r10d, 0x100
nop
nop
movsx edx, al
add r9, 1
or edx, r10d
add r10d, 0x100
mov eax, edx
shr eax, 2
xor eax, edx
and eax, 0xf
movzx ecx, al
mov al, byte [r9]
imul edx, edx
rol r8d, cl
xor r8d, edx
test al, al
jne 0x1400c98f0
mov eax, r8d
shr eax, 0x10
xor eax, r8d
ret
xor eax, eax
ret
Function at 0x1400e0d80
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, gethostbyname
call fcn.140189b00
sub rsp, rax
mov rbx, rdx
mov rsi, rcx
call fcn.1400e0610
test rax, rax
mov rdi, rax
jne 0x1400e0e62
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, [0x140208480]
lea edx, [rdi + 1]
lea ecx, [rdi + 2]
mov r8d, eax
mov dword [rsp + 0x20], 0xaf
call fcn.1400a5900
lea r11, [0x140208498]
lea r9, [0x14020849c]
mov qword [rsp + 0x28], r11
lea rdx, [0x1402084a0]
lea ecx, [rdi + 5]
mov r8, rsi
mov qword [rsp + 0x20], rbx
call fcn.1400a5e70
call fcn.1400441f0
lea edx, [rdi + 0x6d]
cmp dword [rax], 2
lea ecx, [rdi + 0x20]
jne 0x1400e0e36
lea r9, [0x1402084a8]
lea r8d, [rdx + 0x13]
mov dword [rsp + 0x20], 0xb2
call fcn.1400a5900
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea r9, [0x1402084c0]
mov r8d, 2
mov dword [rsp + 0x20], 0xb4
call fcn.1400a5900
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rcx, [0x140208430]
call fcn.1400a6ce0
test rax, rax
mov rbx, rax
jne 0x1400e0e90
mov rcx, rdi
call fcn.140043cb0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
xor edx, edx
mov rcx, rax
call fcn.1400a61c0
mov edx, 0x6a
mov r9, rdi
lea r8d, [rdx - 0x69]
mov rcx, rbx
call fcn.1400a6790
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14010ba60
Capabilities:
Query environment variable

Disassembly:
push rdi
mov eax, gethostbyname
call fcn.140189b00
sub rsp, rax
test rcx, rcx
mov rdi, rcx
jne 0x14010ba9d
lea r9, [0x140218b38]
lea edx, [rax + 0x3a]
lea ecx, [rax - 0xa]
lea r8d, [rax + 0x13]
mov dword [rsp + 0x20], 0x14a
call fcn.1400a5900
xor eax, eax
add rsp, 0x30
pop rdi
ret
mov edx, reloc.WLDAP32.dll_Ordinal_30
lea r8, [0x140218b58]
mov r9d, 0x14d
lea ecx, [rdx - 0x15]
mov qword [rsp + 0x40], rbx
call fcn.1400c93a0
mov rbx, qword [0x140241808]
test rbx, rbx
je 0x14010bb34
nop
nop
mov r8, qword [rbx]
mov rax, rdi
sub r8, rdi
nop
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14010baf4
add rax, 1
test ecx, ecx
jne 0x14010bae0
test edx, edx
je 0x14010bb06
mov rbx, qword [rbx + 0xd0]
test rbx, rbx
jne 0x14010bad0
jmp 0x14010bb34
test byte [rbx + 0xa8], 4
je 0x14010bb2d
call fcn.14010a950
test rax, rax
mov rcx, rax
jne 0x14010bb20
xor ebx, ebx
jmp 0x14010bb34
mov rdx, rbx
call fcn.14010b9a0
mov rbx, rcx
jmp 0x14010bb34
add dword [rbx + 0xac], 1
mov edx, reloc.WLDAP32.dll_Ordinal_30
lea r8, [0x140218b78]
mov r9d, 0x164
lea ecx, [rdx - 0x14]
call fcn.1400c93a0
test rbx, rbx
je 0x14010bb61
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea r8, [0x140218b98]
mov rax, rdi
sub r8, rdi
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14010bb84
add rax, 1
test ecx, ecx
jne 0x14010bb70
test edx, edx
mov qword [rsp + 0x48], rsi
je 0x14010bc5b
lea rcx, str.OPENSSL_ENGINES
call fcn.140061250
lea rsi, str._usr_local_ssl_lib_engines
lea rcx, str.dynamic
test rax, rax
cmovne rsi, rax
call fcn.14010ba60
test rax, rax
mov rbx, rax
je 0x14010bc5b
lea rdx, [0x140218bd8]
xor r9d, r9d
mov r8, rdi
mov rcx, rax
call fcn.140138120
test eax, eax
je 0x14010bc5b
lea r8, [0x140218bdc]
lea rdx, str.DIR_LOAD
xor r9d, r9d
mov rcx, rbx
call fcn.140138120
test eax, eax
je 0x14010bc5b
lea rdx, str.DIR_ADD
xor r9d, r9d
mov r8, rsi
mov rcx, rbx
call fcn.140138120
test eax, eax
je 0x14010bc5b
lea r8, [0x140218bf8]
lea rdx, str.LIST_ADD
xor r9d, r9d
mov rcx, rbx
call fcn.140138120
test eax, eax
je 0x14010bc5b
lea rdx, str.LOAD
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call fcn.140138120
test eax, eax
je 0x14010bc5b
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, rbx
call fcn.14010aaa0
mov edx, 0x6a
lea r9, [0x140218c18]
lea ecx, [rdx - 0x44]
lea r8d, [rdx + 0xa]
mov dword [rsp + 0x20], 0x186
call fcn.1400a5900
lea rdx, [0x140218c34]
mov r8, rdi
mov ecx, 2
call fcn.1400a5e70
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret