joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000cfa0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14000cfad
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14000cfbd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14000cfa5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14000cfd5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14000cfc2
sub eax, 3
jb 0x14000cfef
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14000d026
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14000d016
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14000d014
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14000d003
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14000cf62
jmp 0x14000cfad
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x3600
mov dl, 1
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14000d072
cmp rsi, rcx
jae 0x14000d07a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14000d059
cmp al, 0x8f
ja 0x14000d059
cmp byte [rsi - 2], 0xf
je 0x14000d05f
sub al, 0xe8
cmp al, 1
ja 0x14000d043
cmp rsi, rcx
jae 0x14000d07a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14000d049
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14000d07a
lodsb al, byte [rsi]
jmp 0x14000d059
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xa000]
mov eax, dword [rdi]
or eax, eax
je 0x14000d0d7
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xd1dc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14000d087
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14000d0d1
mov qword [rbx], rax
add rbx, 8
jmp 0x14000d0a7
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14000d111
cmp al, 0xef
ja 0x14000d103
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14000d0e3
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14000d0f2
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14000d165
sub rsp, 0xffffffffffffff80
jmp 0x14000382c
Function at 0x140133c30
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
movaps xmm0, xmmword [str.expand_32_byte_k_D_w]
movaps xmmword [rcx], xmm0
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x10], eax
mov dword [rcx + 0x14], 0
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x1c], eax
mov dword [rcx + 0x20], 0
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x28], eax
mov eax, dword [r8 + 4]
mov dword [rcx + 0x2c], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x30], eax
mov eax, dword [rdx]
mov dword [rcx + 0x34], eax
mov eax, dword [r8]
mov dword [rcx + 0x38], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x3c], eax
ret

Function at 0x140134a30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
test rdx, rdx
jle 0x140134a66
add rdx, rcx
movabs r9, 0x100000001b3
nop word cs:[rax + rax]
movzx eax, byte [rcx]
inc rcx
xor rax, r8
imul rax, r9
mov r8, rax
cmp rcx, rdx
jb 0x140134a50
ret
mov rax, r8
ret
Function at 0x140135070
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
movabs r9, 0xc2b2ae3d27d4eb4f
movabs r11, 0x9e3779b185ebca87
movabs r10, 0x27d4eb2f165667c5
cmp rdx, 0x20
jb 0x1401351c5
lea r13, [rcx + rdx]
add r13, 0xffffffffffffffe1
movabs r12, 0x60ea27eeadc0b5d6
add r12, r8
lea r15, [r8 + r9]
movabs r14, 0x61c8864e7a143579
add r14, r8
nop dword [rax]
mov rbx, qword [rcx]
imul rbx, r9
add rbx, r12
rol rbx, 0x1f
mov r12, rbx
imul r12, r11
mov rdi, qword [rcx + 8]
imul rdi, r9
add rdi, r15
rol rdi, 0x1f
mov r15, rdi
mov rax, qword [rcx + 0x10]
imul rax, r9
add rax, r8
rol rax, 0x1f
imul r15, r11
mov r8, rax
imul r8, r11
mov rsi, qword [rcx + 0x18]
imul rsi, r9
add rsi, r14
rol rsi, 0x1f
mov r14, rsi
imul r14, r11
add rcx, 0x20
cmp rcx, r13
jb 0x1401350d0
rol r12, 1
rol r15, 7
add r15, r12
rol r8, 0xc
rol r14, 0x12
add r8, r15
add r14, r8
movabs r8, 0xdef35b010f796ca9
imul rbx, r8
rol rbx, 0x1f
imul rbx, r11
xor rbx, r14
imul rbx, r11
movabs r14, 0x85ebca77c2b2ae63
add rbx, r14
imul rdi, r8
rol rdi, 0x1f
imul rdi, r11
xor rdi, rbx
imul rdi, r11
imul rax, r8
rol rax, 0x1f
add rdi, r14
imul rax, r11
xor rax, rdi
imul rax, r11
add rax, r14
imul rsi, r8
rol rsi, 0x1f
imul rsi, r11
xor rsi, rax
imul rsi, r11
add rsi, r14
add rsi, rdx
and edx, 0x1f
cmp rdx, 8
jae 0x1401351d7
mov rax, rsi
jmp 0x14013521e
add r8, r10
mov rsi, r8
add rsi, rdx
and edx, 0x1f
cmp rdx, 8
jb 0x1401351c0
movabs rbx, 0x85ebca77c2b2ae63
nop word cs:[rax + rax]
mov rax, qword [rcx]
imul rax, r9
rol rax, 0x1f
imul rax, r11
xor rax, rsi
add rcx, 8
rol rax, 0x1b
imul rax, r11
add rax, rbx
add rdx, 0xfffffffffffffff8
mov rsi, rax
cmp rdx, 7
ja 0x1401351f0
movabs rsi, 0x165667b19e3779f9
cmp rdx, 4
jb 0x14013524d
mov ebx, dword [rcx]
imul rbx, r11
xor rbx, rax
add rcx, 4
rol rbx, 0x17
imul rbx, r9
add rbx, rsi
add rdx, 0xfffffffffffffffc
mov rax, rbx
test rdx, rdx
je 0x140135262
test dl, 1
jne 0x140135267
mov rdi, rdx
cmp rdx, 1
jne 0x140135289
jmp 0x1401352c0
mov rbx, rax
jmp 0x1401352c0
movzx ebx, byte [rcx]
imul rbx, r10
xor rbx, rax
rol rbx, 0xb
inc rcx
imul rbx, r11
lea rdi, [rdx - 1]
mov rax, rbx
cmp rdx, 1
je 0x1401352c0
xor edx, edx
mov rbx, rax
nop
movzx eax, byte [rcx + rdx]
imul rax, r10
xor rax, rbx
rol rax, 0xb
imul rax, r11
movzx ebx, byte [rcx + rdx + 1]
imul rbx, r10
xor rbx, rax
rol rbx, 0xb
imul rbx, r11
add rdx, 2
cmp rdi, rdx
jne 0x140135290
mov rax, rbx
shr rax, 0x21
xor rax, rbx
imul rax, r9
mov rcx, rax
shr rcx, 0x1d
xor rcx, rax
imul rcx, rsi
mov rax, rcx
shr rax, 0x20
xor rax, rcx
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401581e0
Capabilities:
Set socket configuration

Disassembly:
add rcx, 0xc8
jmp 0x1401597e0
push rbp
push rsi
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, rcx
mov dword [rbp - 0xc], edx
mov rcx, qword [rcx + 0x60]
mov dword [rsp + 0x20], 8
lea r9, [rbp - 0xc]
mov edx, 0xffff
mov r8d, 0x1006
call qword [sym.imp.WS2_32.dll_setsockopt]
mov esi, eax
test eax, eax
jns 0x1401598db
test byte [rdi + 0x48], 1
je 0x1401598db
mov ecx, 0x60
call fcn.14038a538
mov qword [rbp - 0x30], rax
movaps xmm0, xmmword [0x1404e8810]
movups xmmword [rbp - 0x20], xmm0
movups xmm0, xmmword [0x1404e88ce]
movups xmmword [rax + 0x4e], xmm0
movups xmm0, xmmword [0x1404e88c0]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [0x1404e88b0]
movups xmmword [rax + 0x30], xmm0
movups xmm0, xmmword [0x1404e88a0]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x1404e8890]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str._TCPServer__Error__CTCPClient::SetRcvTimeout_:_Socket_error_in_SO_RCVTIMEO_call_to_setsockopt.]
movups xmmword [rax], xmm0
mov byte [rax + 0x5e], 0
mov rcx, qword [rdi + 0x40]
test rcx, rcx
je 0x1401598e8
mov rax, qword [rcx]
lea rdx, [rbp - 0x30]
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [rbp - 0x18]
cmp rax, 0x10
jb 0x1401598db
mov rcx, qword [rbp - 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1401598d6
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x1401598ed
add rax, 0x28
mov rdx, rax
mov rcx, rdi
call fcn.14038a574
test esi, esi
setns al
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
call fcn.1403873f4
call fcn.14039178c
int3
Function at 0x1401581f0
Capabilities:
Set socket configuration

Disassembly:
add rcx, 0xc8
jmp 0x140159950
push rbp
push rsi
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, rcx
mov dword [rbp - 0xc], edx
mov rcx, qword [rcx + 0x60]
mov dword [rsp + 0x20], 8
lea r9, [rbp - 0xc]
mov edx, 0xffff
mov r8d, 0x1005
call qword [sym.imp.WS2_32.dll_setsockopt]
mov esi, eax
test eax, eax
jns 0x140159a4b
test byte [rdi + 0x48], 1
je 0x140159a4b
mov ecx, 0x60
call fcn.14038a538
mov qword [rbp - 0x30], rax
movaps xmm0, xmmword [0x1404e8810]
movups xmmword [rbp - 0x20], xmm0
movups xmm0, xmmword [0x1404e892d]
movups xmmword [rax + 0x4e], xmm0
movups xmm0, xmmword [0x1404e891f]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [0x1404e890f]
movups xmmword [rax + 0x30], xmm0
movups xmm0, xmmword [0x1404e88ff]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x1404e88ef]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str._TCPServer__Error__CTCPClient::SetSndTimeout_:_Socket_error_in_SO_SNDTIMEO_call_to_setsockopt.]
movups xmmword [rax], xmm0
mov byte [rax + 0x5e], 0
mov rcx, qword [rdi + 0x40]
test rcx, rcx
je 0x140159a58
mov rax, qword [rcx]
lea rdx, [rbp - 0x30]
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [rbp - 0x18]
cmp rax, 0x10
jb 0x140159a4b
mov rcx, qword [rbp - 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140159a46
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x140159a5d
add rax, 0x28
mov rdx, rax
mov rcx, rdi
call fcn.14038a574
test esi, esi
setns al
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
call fcn.1403873f4
call fcn.14039178c
int3
Function at 0x1401597e0
Capabilities:
Set socket configuration

Disassembly:
add rcx, 0xc8
jmp 0x1401597e0
push rbp
push rsi
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, rcx
mov dword [rbp - 0xc], edx
mov rcx, qword [rcx + 0x60]
mov dword [rsp + 0x20], 8
lea r9, [rbp - 0xc]
mov edx, 0xffff
mov r8d, 0x1006
call qword [sym.imp.WS2_32.dll_setsockopt]
mov esi, eax
test eax, eax
jns 0x1401598db
test byte [rdi + 0x48], 1
je 0x1401598db
mov ecx, 0x60
call fcn.14038a538
mov qword [rbp - 0x30], rax
movaps xmm0, xmmword [0x1404e8810]
movups xmmword [rbp - 0x20], xmm0
movups xmm0, xmmword [0x1404e88ce]
movups xmmword [rax + 0x4e], xmm0
movups xmm0, xmmword [0x1404e88c0]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [0x1404e88b0]
movups xmmword [rax + 0x30], xmm0
movups xmm0, xmmword [0x1404e88a0]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x1404e8890]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str._TCPServer__Error__CTCPClient::SetRcvTimeout_:_Socket_error_in_SO_RCVTIMEO_call_to_setsockopt.]
movups xmmword [rax], xmm0
mov byte [rax + 0x5e], 0
mov rcx, qword [rdi + 0x40]
test rcx, rcx
je 0x1401598e8
mov rax, qword [rcx]
lea rdx, [rbp - 0x30]
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [rbp - 0x18]
cmp rax, 0x10
jb 0x1401598db
mov rcx, qword [rbp - 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1401598d6
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x1401598ed
add rax, 0x28
mov rdx, rax
mov rcx, rdi
call fcn.14038a574
test esi, esi
setns al
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
call fcn.1403873f4
call fcn.14039178c
int3
Function at 0x140159950
Capabilities:
Set socket configuration

Disassembly:
add rcx, 0xc8
jmp 0x140159950
push rbp
push rsi
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, rcx
mov dword [rbp - 0xc], edx
mov rcx, qword [rcx + 0x60]
mov dword [rsp + 0x20], 8
lea r9, [rbp - 0xc]
mov edx, 0xffff
mov r8d, 0x1005
call qword [sym.imp.WS2_32.dll_setsockopt]
mov esi, eax
test eax, eax
jns 0x140159a4b
test byte [rdi + 0x48], 1
je 0x140159a4b
mov ecx, 0x60
call fcn.14038a538
mov qword [rbp - 0x30], rax
movaps xmm0, xmmword [0x1404e8810]
movups xmmword [rbp - 0x20], xmm0
movups xmm0, xmmword [0x1404e892d]
movups xmmword [rax + 0x4e], xmm0
movups xmm0, xmmword [0x1404e891f]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [0x1404e890f]
movups xmmword [rax + 0x30], xmm0
movups xmm0, xmmword [0x1404e88ff]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x1404e88ef]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str._TCPServer__Error__CTCPClient::SetSndTimeout_:_Socket_error_in_SO_SNDTIMEO_call_to_setsockopt.]
movups xmmword [rax], xmm0
mov byte [rax + 0x5e], 0
mov rcx, qword [rdi + 0x40]
test rcx, rcx
je 0x140159a58
mov rax, qword [rcx]
lea rdx, [rbp - 0x30]
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [rbp - 0x18]
cmp rax, 0x10
jb 0x140159a4b
mov rcx, qword [rbp - 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140159a46
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x140159a5d
add rax, 0x28
mov rdx, rax
mov rcx, rdi
call fcn.14038a574
test esi, esi
setns al
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
call fcn.1403873f4
call fcn.14039178c
int3
Function at 0x14015aa70
Capabilities:
Initialize winsock library

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
lea rdx, [0x1405476f8]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14015ab4c
mov edi, eax
mov ecx, gethostbyaddr
call fcn.14038a538
mov qword [rbp - 0x40], rax
movaps xmm0, xmmword [0x1404e8bb0]
movups xmmword [rbp - 0x30], xmm0
movups xmm0, xmmword [str._TCPClient__Error__WSAStartup_failed_:__d]
movups xmmword [rax], xmm0
movups xmm0, xmmword [0x1404e8bd0]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [0x1404e8bd9]
movups xmmword [rax + 0x19], xmm0
mov byte [rax + 0x29], 0
lea rbx, [rbp - 0x20]
lea rdx, [rbp - 0x40]
mov rcx, rbx
mov r8d, edi
call fcn.14015ac30
mov r8, qword [rbp - 0x10]
cmp qword [rbp - 8], 0x10
jb 0x14015ab02
mov rbx, qword [rbp - 0x20]
lea rcx, [0x140545fe0]
mov rdx, rbx
call fcn.14015dc10
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x14015ab4c
mov rcx, qword [rbp - 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14015ab47
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14015ab58
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.14038a574
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
call fcn.14039178c
int3

Function at 0x14015c750
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov ecx, reloc.WS2_32.dll_recv
call fcn.14038a538
mov r9, rax
test rax, rax
je 0x14015c786
mov rax, qword [rdi]
mov qword [r9], rax
mov qword [r9 + 8], rsi
jmp 0x14015c789
xor r9d, r9d
mov qword [rsp + 0x40], r9
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
lea r8, [0x14015ded0]
xor edx, edx
xor ecx, ecx
call fcn.140398cdc
mov qword [rbx], rax
test rax, rax
je 0x14015c7ca
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call fcn.140387b9c
int3

Function at 0x14015c7e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov ecx, 8
call fcn.14038a538
test rax, rax
je 0x14015c802
mov qword [rax], rdi
mov qword [rsp + 0x40], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14015df00]
xor edx, edx
xor ecx, ecx
call fcn.140398cdc
mov qword [rbx], rax
test rax, rax
je 0x14015c841
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call fcn.140387b9c
int3
Function at 0x1401733d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140173401
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x14017347b
mov rdi, r14
mov rcx, rbx
call fcn.140164640
test rax, rax
jle 0x140173453
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.14038cc40
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14017346b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_getservbyport]
cmp eax, 0xffffffff
je 0x140173473
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140173415
sub r14, rdi
jmp 0x14017355f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140173492
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140173494
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1401734c6
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14038cc40
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14017355c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140173501
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14017353d
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140393b14
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14017355c
cmp rbp, rax
ja 0x140173510
test rbp, rbp
je 0x14017355c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140393b14
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140173630
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov rbx, r8
je 0x1401736c8
test r8, r8
jle 0x1401736c0
nop word [rax + rax]
mov rcx, rdi
call fcn.140165260
test rax, rax
jle 0x14017369e
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov rax, qword [rdi + 0x40]
mov r8, rsi
mov rcx, qword [rax]
call fcn.14038cc40
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x1401736b8
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1401736c0
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x140173660
sub r14, rbx
mov rax, r14
jmp 0x140173746
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], r15
mov r9, qword [rax]
test r9, r9
je 0x1401736e1
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1401736e3
xor ecx, ecx
movsxd rsi, ecx
test r14, r14
jle 0x14017373b
test ecx, ecx
jle 0x14017371c
cmp r14, rsi
mov rcx, r9
cmovl rsi, r14
mov r8, rsi
call fcn.14038cc40
mov rax, qword [rdi + 0x58]
add rbp, rsi
sub r14, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
test r14, r14
jle 0x14017373b
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14017373b
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.14039407c
sub r14, rax
mov r15, qword [rsp + 0x40]
sub rbx, r14
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140175cf0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.14038ab90
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.DLL_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1401795c0
Capabilities:
Encode data using add xor sub operations

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x14017962c
movzx ecx, byte [rcx]
test cl, cl
je 0x14017962c
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
or r9d, r11d
mov r8d, eax
mov edx, r9d
mov ecx, 0x20
shr edx, 2
add r11d, 0x100
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x1401795e0
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret

Function at 0x140179630
Capabilities:
Encode data using add xor sub operations

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x1401796a0
movzx ecx, byte [rcx]
test cl, cl
je 0x1401796a0
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
mov r8d, eax
and r9d, 0xffffffdf
or r9d, r11d
mov ecx, 0x20
mov edx, r9d
add r11d, 0x100
shr edx, 2
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x140179650
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret
Function at 0x14017b4e0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x28
call fcn.14038ab90
sub rsp, rax
cmp dword [0x140542ae0], 0
jne 0x14017b660
mov qword [rsp + 0x30], rbx
lea r8d, [rax + 8]
mov qword [rsp + 0x38], rbp
lea rcx, str.OPENSSL_ia32cap
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
lea rdi, [0x140542a80]
mov rdx, rdi
mov qword [rsp + 0x20], r14
mov dword [0x140542ae0], 1
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
dec eax
cmp eax, 0x2e
ja 0x14017b622
movzx ebx, word [0x140542a80]
xor ebp, ebp
cmp bx, 0x7e
mov ecx, ebp
mov r14d, 2
cmove ecx, r14d
add rcx, rdi
call fcn.14017b670
mov rsi, rax
cmp bx, 0x7e
jne 0x14017b5a1
lea rcx, [0x140547cc0]
mov rbx, rax
call fcn.140001030
not rsi
movabs rcx, 0xedfff7fdffffffff
and rax, rsi
and ebx, 0x1000000
mov rsi, rax
and rsi, rcx
test rbx, rbx
cmove rsi, rax
jmp 0x14017b5ba
cmp word [0x140542a80], 0x3a
jne 0x14017b5ba
lea rcx, [0x140547cc0]
call fcn.140001030
mov rsi, rax
movzx eax, word [0x140542a80]
test ax, ax
je 0x14017b5d8
lea rdi, [rdi + 2]
cmp ax, 0x3a
je 0x14017b5e1
movzx eax, word [rdi]
test ax, ax
jne 0x14017b5c6
mov qword [0x140547cc8], rbp
jmp 0x14017b631
movzx ebx, word [rdi]
cmp bx, 0x7e
cmove rbp, r14
lea rcx, [rdi + rbp]
call fcn.14017b670
mov rcx, rax
shr rcx, 0x20
cmp bx, 0x7e
jne 0x14017b614
not eax
not ecx
and dword [0x140547cc8], eax
and dword [0x140547ccc], ecx
jmp 0x14017b631
mov dword [0x140547cc8], eax
mov dword [0x140547ccc], ecx
jmp 0x14017b631
lea rcx, [0x140547cc0]
call fcn.140001030
mov rsi, rax
mov r14, qword [rsp + 0x20]
mov eax, esi
mov rdi, qword [rsp + 0x48]
bts eax, 0xa
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
shr rsi, 0x20
mov dword [0x140547cc4], esi
mov rsi, qword [rsp + 0x40]
mov dword [0x140547cc0], eax
add rsp, 0x28
ret

Function at 0x1401815d0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.14038ab90
sub rsp, rax
lea rcx, [0x140542c88]
add rsp, 0x28
jmp fcn.140175b70

Function at 0x14019a190
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x28
call fcn.14038ab90
sub rsp, rax
cmp dword [0x140542e20], 0
jne 0x14019a24a
xor edx, edx
mov dword [0x140542e20], 1
mov r8d, 0x198
lea rcx, [0x140542e30]
call fcn.14038d2f0
mov ecx, 0x202
lea rdx, [0x140542e30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14019a24a
call fcn.140179fa0
lea r8, str.BIO_sock_init
mov edx, __WSAFDIsSet
lea rcx, str.crypto_bio_bio_sock.c
call fcn.14017a0c0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_wsastartup__
mov ecx, 2
mov edx, eax
call fcn.14017a1c0
call fcn.140179fa0
lea r8, str.BIO_sock_init
mov edx, __WSAFDIsSet
lea rcx, str.crypto_bio_bio_sock.c
call fcn.14017a0c0
xor r8d, r8d
lea edx, [r8 + 0x7a]
lea ecx, [rdx - 0x5a]
call fcn.14017a1c0
mov eax, 0xffffffff
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret