joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000bae8
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, qword [rcx + 8]
mov r11, r9
mov rbx, r8
mov r10, rdx
mov rdi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x78], 0
je 0x14000bb1a
xor r9d, r9d
xor r8d, r8d
jmp 0x14000bb29
cmp qword [rdx], 0xffffffffffffffff
jne 0x14000bb37
xor r9d, r9d
mov r8d, 0x2719
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rcx + 8]
jmp 0x14000bb9a
and qword [rsp + 0x30], 0
lea r9, [rsp + 0x78]
mov eax, dword [rsp + 0x70]
mov r8d, r11d
mov rsi, qword [rsp + 0x80]
mov rdx, rbx
mov rcx, qword [r10]
and dword [rsp + 0x78], 0
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x14000bba1
cmp eax, 0x3e5
je 0x14000bba1
mov r9d, dword [rsp + 0x78]
mov r8d, eax
mov rcx, qword [rdi + 8]
mov rdx, rsi
call fcn.1400097b4
jmp 0x14000bbad
mov rcx, qword [rdi + 8]
mov rdx, rsi
call fcn.140009720
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x14000bbc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [rcx + 8]
mov r11, r9
mov rsi, r8
mov r10, rdx
mov rbx, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x78], 0
je 0x14000bbf2
xor r9d, r9d
xor r8d, r8d
jmp 0x14000bc01
cmp qword [rdx], 0xffffffffffffffff
jne 0x14000bc0f
xor r9d, r9d
mov r8d, 0x2719
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rcx + 8]
jmp 0x14000bc88
mov eax, dword [rsp + 0x70]
lea r9, [rsp + 0x78]
and qword [rsp + 0x30], 0
mov r8d, r11d
mov rdi, qword [rsp + 0x80]
mov rdx, rsi
mov rcx, qword [r10]
and dword [rsp + 0x78], 0
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSARecv]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x14000bc61
mov eax, 0x2746
jmp 0x14000bc6e
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
je 0x14000bc8f
cmp eax, 0x3e5
je 0x14000bc8f
mov r9d, dword [rsp + 0x78]
mov r8d, eax
mov rcx, qword [rbx + 8]
mov rdx, rdi
call fcn.1400097b4
jmp 0x14000bc9b
mov rcx, qword [rbx + 8]
mov rdx, rdi
call fcn.140009720
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000cbec
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x38
mov r12, r8
mov rbx, rcx
and dword [rbp - 0x18], 0
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
and qword [rcx + 0x10], 0
and qword [rcx + 0x10], 0
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], 0
mov dword [rbp - 0x18], 1
xor edi, edi
xor ecx, ecx
lea esi, [rdi + 3]
dec r12
mov al, byte [rdx]
mov byte [rbp + rcx + 0x58], al
inc edi
inc rcx
inc rdx
mov qword [rbp + 0x50], rdx
mov r13b, byte [rbp + 0x5a]
mov r14b, byte [rbp + 0x59]
mov r15b, byte [rbp + 0x58]
cmp rcx, rsi
jne 0x14000ccff
mov al, r15b
shr al, 2
mov byte [rbp + 0x60], al
mov cl, r15b
and cl, sil
shl cl, 4
mov al, r14b
shr al, 4
add cl, al
mov byte [rbp + 0x61], cl
mov cl, r14b
and cl, 0xf
shl cl, 2
mov al, r13b
shr al, 6
add cl, al
mov byte [rbp + 0x62], cl
mov al, r13b
and al, 0x3f
mov byte [rbp + 0x63], al
xor edi, edi
lea rcx, [0x14008bb88]
cmp qword [0x14008bba0], 0xf
cmova rcx, qword [0x14008bb88]
movzx eax, byte [rbp + rdi + 0x60]
mov r9b, byte [rax + rcx]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x14000cce6
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000ccdb
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000ccee
mov rcx, rbx
call fcn.140027abc
inc rdi
cmp rdi, 4
jl 0x14000cc9c
xor edi, edi
xor ecx, ecx
mov rdx, qword [rbp + 0x50]
test r12, r12
jne 0x14000cc37
test edi, edi
je 0x14000ce1b
cmp edi, esi
jge 0x14000cd38
mov eax, esi
sub eax, edi
movsxd r8, eax
movsxd rax, edi
lea rcx, [rbp + 0x58]
add rcx, rax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r13b, byte [rbp + 0x5a]
mov r14b, byte [rbp + 0x59]
mov r15b, byte [rbp + 0x58]
mov al, r15b
shr al, 2
mov byte [rbp + 0x60], al
and r15b, sil
shl r15b, 4
mov al, r14b
shr al, 4
add r15b, al
mov byte [rbp + 0x61], r15b
and r14b, 0xf
shl r14b, 2
mov al, r13b
shr al, 6
add r14b, al
mov byte [rbp + 0x62], r14b
and r13b, 0x3f
mov byte [rbp + 0x63], r13b
xor r14d, r14d
lea eax, [rdi + 1]
movsxd r15, eax
test eax, eax
jle 0x14000cdda
lea rcx, [0x14008bb88]
cmp qword [0x14008bba0], 0xf
cmova rcx, qword [0x14008bb88]
movzx eax, byte [rbp + r14 + 0x60]
mov r9b, byte [rax + rcx]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x14000cdca
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000cdbf
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000cdd2
mov rcx, rbx
call fcn.140027abc
inc r14
cmp r14, r15
jl 0x14000cd7f
cmp edi, esi
jge 0x14000ce1b
sub esi, edi
movsxd rdi, esi
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x14000ce0a
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000ce02
mov rax, qword [rbx]
mov word [rax + rcx], 0x3d
jmp 0x14000ce15
mov r9b, 0x3d
mov rcx, rbx
call fcn.140027abc
sub rdi, 1
jne 0x14000cde3
mov rax, rbx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000e59c
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
mov r13d, dword [rcx]
mov rbx, rdx
mov r10d, dword [rcx + 4]
mov esi, r13d
mov r9d, dword [rcx + 8]
mov r11, rcx
mov edi, dword [rcx + 0xc]
xor r8d, r8d
mov r14d, dword [rcx + 0x10]
mov eax, r9d
mov ecx, r10d
and eax, r10d
mov edx, esi
ror edx, 0x1b
not ecx
and ecx, edi
or eax, ecx
add eax, edx
add eax, dword [rbx + r8*4]
inc r8
add eax, r14d
mov r14d, edi
mov edi, r9d
mov r9d, r10d
shr r10d, 2
shl r9d, 0x1e
or r9d, r10d
mov r10d, esi
lea esi, [rax + 0x5a827999]
cmp r8, 0x10
jl 0x14000e5d5
lea rbp, [rbx + 8]
mov r15d, 4
mov eax, dword [rbp + 0x2c]
mov edx, r10d
xor eax, dword [rbp + 0x18]
mov ecx, esi
xor eax, dword [rbp - 8]
not edx
xor eax, dword [rbp]
and edx, edi
mov r8d, eax
ror ecx, 0x1b
add eax, eax
shr r8d, 0x1f
or r8d, eax
mov eax, r9d
mov dword [rbp + 0x38], r8d
lea rbp, [rbp + 4]
and eax, r10d
or edx, eax
lea eax, [r8 + rcx]
add eax, edx
add eax, r14d
mov r14d, edi
mov edi, r9d
mov r9d, r10d
shr r10d, 2
shl r9d, 0x1e
or r9d, r10d
mov r10d, esi
lea esi, [rax + 0x5a827999]
sub r15, 1
jne 0x14000e622
lea ebp, [r15 + 0x14]
mov r15d, ebp
lea r8, [rbx + 0x18]
mov eax, dword [r8 + 0x2c]
mov ecx, edi
xor eax, dword [r8 + 0x18]
xor ecx, r9d
xor eax, dword [r8 - 8]
xor ecx, r10d
xor eax, dword [r8]
lea r8, [r8 + 4]
mov edx, eax
add eax, eax
shr edx, 0x1f
or edx, eax
mov eax, esi
ror eax, 0x1b
add eax, edx
mov dword [r8 + 0x34], edx
add eax, ecx
add eax, r14d
mov r14d, edi
mov edi, r9d
mov r9d, r10d
shr r10d, 2
shl r9d, 0x1e
or r9d, r10d
mov r10d, esi
lea esi, [rax + 0x6ed9eba1]
sub r15, 1
jne 0x14000e68d
lea r15, [rbx + 0x68]
mov r12, rbp
mov eax, dword [r15 + 0x2c]
mov ecx, r9d
xor eax, dword [r15 + 0x18]
or ecx, r10d
xor eax, dword [r15 - 8]
and ecx, edi
xor eax, dword [r15]
mov edx, esi
mov r8d, eax
ror edx, 0x1b
add eax, eax
shr r8d, 0x1f
or r8d, eax
mov eax, r9d
mov dword [r15 + 0x38], r8d
lea r15, [r15 + 4]
and eax, r10d
or ecx, eax
lea eax, [r14 + rdx]
add ecx, r8d
add eax, 0x8f1bbcdc
add eax, ecx
mov r14d, edi
mov edi, r9d
mov r9d, r10d
shr r10d, 2
shl r9d, 0x1e
or r9d, r10d
mov r10d, esi
mov esi, eax
sub r12, 1
jne 0x14000e6eb
add rbx, 0xb8
mov eax, dword [rbx + 0x2c]
mov ecx, esi
xor eax, dword [rbx + 0x18]
xor eax, dword [rbx - 8]
xor eax, dword [rbx]
lea rbx, [rbx + 4]
mov edx, eax
ror ecx, 0x1b
add eax, eax
shr edx, 0x1f
or edx, eax
mov eax, edi
xor eax, r9d
mov dword [rbx + 0x34], edx
xor eax, r10d
add eax, edx
lea edx, [r14 + rcx]
add edx, 0xca62c1d6
mov r14d, edi
mov edi, r9d
add edx, eax
mov r9d, r10d
shr r10d, 2
shl r9d, 0x1e
or r9d, r10d
mov r10d, esi
mov esi, edx
sub rbp, 1
jne 0x14000e757
add dword [r11 + 0xc], edi
lea eax, [rdx + r13]
add dword [r11 + 4], r10d
add dword [r11 + 8], r9d
add dword [r11 + 0x10], r14d
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov dword [r11], eax
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1400105bc
Capabilities:
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x450
mov r14d, 2
mov rsi, r9
mov rdi, r8
mov ebp, edx
mov rbx, rcx
cmp word [rcx], r14w
je 0x1400105f5
cmp word [rcx], 0x17
jne 0x140010604
movzx ecx, word [rcx + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rsi], eax
mov esi, 0x401
lea rcx, [rsp + 0x40]
mov r8d, esi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], r14d
lea r8, [rsp + 0x40]
xor r14d, r14d
mov r9d, esi
mov dword [rsp + 0x28], r14d
mov edx, ebp
mov rcx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x140010690
lea rax, [rsp + 0x40]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r14b
jne 0x14001064a
cmp rbx, qword [rdi + 0x18]
ja 0x140010680
cmp qword [rdi + 0x18], 0xf
mov rsi, rdi
jbe 0x140010666
mov rsi, qword [rdi]
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], r14b
jmp 0x140010690
lea r9, [rsp + 0x40]
mov rdx, rbx
mov rcx, rdi
call fcn.140027bfc
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400117f8
Capabilities:
Get socket status

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x240
mov rdx, qword [rcx + 8]
mov r8, qword [rcx + 0x18]
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x38], rdx
lea edi, [rdx + 1]
mov dword [rsp + 0x30], 1
mov dword [r11 + 8], eax
mov dword [r11 + 0xc], r8d
lea rax, [rsp + 0x250]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
mov ecx, edi
call qword [sym.imp.WS2_32.dll_select]
mov ebx, eax
test eax, eax
jns 0x14001185c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14001182b
test ebx, ebx
mov rbx, qword [rsp + 0x258]
setg al
add rsp, 0x240
pop rdi
ret

Function at 0x140011874
Capabilities:
Get socket status

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x240
mov rdx, qword [rcx + 8]
mov r8, qword [rcx + 0x28]
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x38], rdx
lea edi, [rdx + 1]
mov dword [rsp + 0x30], 1
mov dword [r11 + 8], eax
mov dword [r11 + 0xc], r8d
lea rax, [rsp + 0x250]
xor r9d, r9d
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, edi
call qword [sym.imp.WS2_32.dll_select]
mov ebx, eax
test eax, eax
jns 0x1400118d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x1400118a7
test ebx, ebx
mov rbx, qword [rsp + 0x258]
setg al
add rsp, 0x240
pop rdi
ret

Function at 0x1400118f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call qword [rax + reloc.WS2_32.dll_htonl]
test al, al
je 0x140011932
cmp rbx, 0x7fffffff
ja 0x140011932
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_recv]
cdqe
jmp 0x140011936
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140011948
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
je 0x14001198a
cmp rbx, 0x7fffffff
ja 0x14001198a
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_send]
cdqe
jmp 0x14001198e
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140017668
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x18], 0xf
mov rdx, rcx
jbe 0x14001767b
mov rdx, qword [rcx]
mov r9, qword [rcx + 0x10]
add r9, rdx
cmp qword [rcx + 0x18], 0xf
jbe 0x14001768c
mov rcx, qword [rcx]
xor ebx, ebx
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
cmp rcx, r9
jne 0x1400176b3
lea eax, [rbx + 7]
mov word [rsp + 0x30], bx
mov qword [rsp + 0x48], rax
jmp 0x1400176c8
sub r9, rcx
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.14002eeac
mov rax, qword [rsp + 0x48]
cmp rax, 7
mov dword [rsp + 0x28], 1
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
cmova r8, qword [rsp + 0x30]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rsp + 0x48]
cmp eax, 0x20
setg bl
cmp rdx, 7
jbe 0x140017741
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001773c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001773c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059748
mov al, bl
add rsp, 0x50
pop rbx
ret
Function at 0x14001c104
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x1f0
mov bl, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x14008bc08], eax
inc eax
cmp eax, 1
jne 0x14001c145
mov ecx, 0x202
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x14008bc0c], eax
test bl, bl
je 0x14001c1d2
xor ebx, ebx
lock xadd dword [0x14008bc0c], ebx
test ebx, ebx
je 0x14001c1d2
and dword [rsp + 0x3c], 0
lea rsi, [0x1400840e0]
movabs rcx, 0x4d54ee85da812030
add rcx, qword [0x1400840e8]
cmp rcx, 1
jbe 0x14001c18f
mov rax, qword [0x1400840e0]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x14001c191
mov al, 1
lea rcx, str.E:_software_boost_1_85_0_boost_asiodetailimplwinsock_init.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x48], rax
lea rcx, str.void___cdecl_boost::asio::detail::winsock_init_base::throw_on_error_struct_boost::asio::detail::winsock_init_base::data__
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x30], 0x48
mov dword [rsp + 0x34], 0x1a
test al, 1
jne 0x14001c1ea
lea r11, [rsp + 0x1f0]
mov rax, rdi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.140007cdc
int3

Function at 0x14001ca38
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rcx, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x14001ca6b
movzx eax, byte [rdx + r9]
movabs r10, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, r10
cmp r9, r8
jb 0x14001ca4d
mov eax, ecx
ret
Function at 0x14003a7b8
Capabilities:
Hash data using sha1

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x1a0
mov rdi, r8
mov r14, rdx
mov rcx, rdi
lea rdx, str.258EAFA5_E914_47DA_95CA_C5AB0DC85B11
mov r8d, 0x24
call fcn.14001d34c
cmp qword [rdi + 0x18], 0xf
mov r15, rdi
jbe 0x14003a806
mov r15, qword [rdi]
mov rsi, qword [rdi + 0x10]
xor ebx, ebx
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
mov dword [rsp + 0x30], 0xc3d2e1f0
cmp rsi, 0x40
jb 0x14003a8a0
lea r12, [rsi - 0x40]
lea rax, [rbx + 0x40]
cmp rbx, rax
jae 0x14003a88c
lea rdx, [r15 + 2]
mov r9d, reloc.WS2_32.dll_recv
add rdx, rbx
lea r8, [rsp + 0x60]
add rbx, 0x40
movzx eax, byte [rdx - 1]
movzx ecx, byte [rdx - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx]
shl ecx, 8
lea rdx, [rdx + 4]
or ecx, eax
movzx eax, byte [rdx - 3]
shl ecx, 8
or ecx, eax
mov dword [r8], ecx
lea r8, [r8 + 4]
sub r9, 1
jne 0x14003a85d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.14000e59c
cmp rbx, r12
jbe 0x14003a83e
mov r10, rsi
mov eax, reloc.WS2_32.dll_ntohs
sub r10, rbx
and dword [rsp + rax*4 + 0x60], 0
sub rax, 1
jns 0x14003a8ab
xor r9d, r9d
lea r11d, [r9 + 3]
test r10, r10
je 0x14003a8f0
add rbx, r15
movzx edx, byte [rbx + r9]
mov cl, r9b
and cl, r11b
mov r8, r9
shr r8, 2
mov eax, r11d
sub al, cl
inc r9
shl al, 3
mov cl, al
shl edx, cl
or dword [rsp + r8*4 + 0x60], edx
cmp r9, r10
jb 0x14003a8c5
mov rdx, r9
mov eax, 0x80
and r9b, r11b
shr rdx, 2
sub r11b, r9b
mov cl, r11b
shl cl, 3
shl eax, cl
or dword [rsp + rdx*4 + 0x60], eax
cmp r10, 0x38
jb 0x14003a938
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.14000e59c
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
lea rax, [rsi*8]
lea rdx, [rsp + 0x60]
mov dword [rbp - 0x64], eax
lea rcx, [rsp + 0x20]
call fcn.14000e59c
lea r8, [rsp + 0x53]
mov edx, 0xffffff80
mov r9d, reloc.WS2_32.dll_send
mov rax, r9
mov ecx, edx
sar rax, 2
and ecx, 0x18
dec r9
add edx, 8
mov eax, dword [rsp + rax*4 + 0x20]
shr eax, cl
mov byte [r8], al
dec r8
cmp edx, 0x18
jle 0x14003a962
mov r8d, socket
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14000cbec
mov rdx, rax
mov rcx, rdi
call fcn.14001d48c
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14003a9e5
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a9e0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a9e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059748
and dword [r14], 0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x20]
lea rax, [0x140084350]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov qword [r14 + 8], rax
mov rax, r14
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140056990
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400569ca
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400569cf
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140056a18
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x140056a18
dec r8
sub rdx, 1
jne 0x1400569fe
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140059660
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
lea r8, [rsp + 0x30]
mov edx, 4
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x14005968a
mov eax, dword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
lea rdx, str.error_while_reading
mov rcx, rbx
call fcn.1400596a0
int3

Function at 0x14005a6c4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005a70e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005a70e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005a70e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005a70e
cmp dword [rcx + 0x84], 0xe
jbe 0x14005a70e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005a710
xor al, al
add rsp, 0x28
ret
Function at 0x140001e58
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001ea2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001ea2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001ea2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001ea2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001ea2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001ea4
xor al, al
add rsp, 0x28
ret

Function at 0xc8c058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00c8c1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0xc8c089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xc8c06f
add dl, dl
jne 0xc8c096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xc8c0f6
xor eax, eax
add dl, dl
jne 0xc8c0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xc8c1ad
add dl, dl
jne 0xc8c0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc8c0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc8c0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc8c0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0xc8c0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0xc8c07e
mov eax, 1
add dl, dl
jne 0xc8c106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc8c113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xc8c0fb
sub eax, ebx
mov ebx, 1
jne 0xc8c14c
mov ecx, 1
add dl, dl
jne 0xc8c12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc8c13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xc8c123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xc8c07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xc8c168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc8c175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xc8c15d
cmp eax, 0x7d00
jae 0xc8c19b
cmp eax, 0x500
jb 0xc8c196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xc8c07e
cmp eax, 0x7f
ja 0xc8c19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xc8c07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0xc8c1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0xc8c07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20