joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f81a0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1400f81c2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x1400f8243
mov rdi, r14
mov rcx, rbx
call fcn.14005c0e0
test rax, rax
jle 0x1400f8214
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.14026bb50
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400f8233
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x1400ac8a1.0]
cmp eax, 0xffffffff
je 0x1400f823b
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1400f81d6
sub r14, rdi
jmp 0x1400f8338
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400f825a
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400f825c
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400f8291
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14026bb50
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400f8335
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x1400f82cc
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x1400f8310
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140289ea8
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x1400f834e
cmp rbp, rax
ja 0x1400f82e0
mov r8, rdi
test rdi, rdi
je 0x1400f8335
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140289ea8
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x1400f8338
Function at 0x1400fd1d0
Capabilities:
Encode data using base64 via winapi

Disassembly:
push rbx
push rsi
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x14035dc30]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], rcx
xor esi, esi
mov r15, qword [rdx]
mov rbx, rcx
mov r14, qword [rdx + 8]
cmp r15, r14
jne 0x1400fd217
mov qword [rcx], rsi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 7
mov word [rcx], si
jmp 0x1400fd319
lea rax, [rsp + 0x30]
mov qword [rsp + 0xa0], rbp
sub r14d, r15d
mov qword [rsp + 0x60], rdi
mov edx, r14d
mov dword [rsp + 0x30], esi
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8d, 0x40000001
mov rcx, r15
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
mov eax, dword [rsp + 0x30]
dec eax
mov qword [rsp + 0x38], rsi
mov ebp, eax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], 7
cmp rbp, 7
ja 0x1400fd28d
mov qword [rsp + 0x48], rbp
test eax, eax
je 0x1400fd281
movzx eax, si
lea rdi, [rsp + 0x38]
mov ecx, ebp
rep stosw word [rdi], ax
mov word [rsp + rbp*2 + 0x38], si
mov rdx, qword [rsp + 0x38]
jmp 0x1400fd2d0
mov eax, 0xa
lea rcx, [rsp + 0x38]
mov rdi, rbp
or rdi, 7
cmp rdi, rax
cmovb rdi, rax
lea rdx, [rdi + 1]
call fcn.140026230
mov rdx, rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rbp
mov rdi, rdx
movzx eax, si
mov rcx, rbp
rep stosw word [rdi], ax
mov word [rdx + rbp*2], si
mov qword [rsp + 0x38], rdx
cmp qword [rsp + 0x50], 8
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
cmovae r9, rdx
mov r8d, 0x40000001
mov edx, r14d
mov rcx, r15
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
movups xmm0, xmmword [rsp + 0x38]
mov rdi, qword [rsp + 0x60]
movups xmm1, xmmword [rsp + 0x48]
mov rbp, qword [rsp + 0xa0]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140269300
add rsp, 0x68
pop r15
pop r14
pop rsi
pop rbx
ret

Function at 0x140102330
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor bl, bl
mov qword [rsp + 0x20], rcx
cmp qword [rcx + 0x18], 8
mov rdi, rcx
jb 0x14010234e
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140102363
mov ebx, eax
shr ebx, 4
not bl
and bl, 1
mov rcx, rdi
call fcn.140025de0
movzx eax, bl
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140103240
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rdi, rcx
test r8, r8
jg 0x140103271
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
je 0x1401032f3
mov rbx, r14
mov rcx, rdi
call fcn.14005c0e0
test rax, rax
jle 0x1401032c3
mov rdx, qword [rdi + 0x38]
cmp rbx, rax
mov rbp, rbx
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.14026bb50
mov rax, qword [rdi + 0x50]
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1401032e6
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 0x38]
call qword [case.0x1400ac8a1.0]
cmp eax, 0xffffffff
je 0x1401033df
mov byte [rsi], al
dec rbx
mov ebp, 1
add rsi, rbp
test rbx, rbx
jg 0x140103285
jmp 0x1401033df
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14010330a
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14010330c
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14010333e
cmp rax, r14
mov rbx, r14
mov rcx, rsi
cmovb rbx, rax
mov r8, rbx
call fcn.14026bb50
mov rax, qword [rdi + 0x50]
add rsi, rbx
sub rbp, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
mov rbx, rbp
je 0x1401033df
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x14010337c
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x1401033c0
nop word [rax + rax]
mov r9, qword [rdi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140289ea8
sub rbp, rax
add rsi, rax
mov rbx, rbp
cmp rax, 0xfff
jne 0x140103400
cmp rbp, rax
ja 0x140103390
test rbx, rbx
je 0x1401033df
mov r9, qword [rdi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140289ea8
sub rbx, rax
sub r14, rbx
mov rbx, qword [rsp + 0x30]
mov rax, r14
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
sub r14, rbp
jmp 0x1401033e2
Function at 0x140105a50
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r14, r9
mov r15, r8
mov r12, rdx
mov rsi, rcx
mov dword [rsp + 0x20], 1
cmp qword [rcx + 0x10], 0
je 0x140105bdd
cmp qword [rcx + 0x18], 8
jb 0x140105a8f
mov rcx, qword [rcx]
lea rdx, [rsp + 0x20]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
test eax, eax
je 0x140105bdd
inc ebp
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x80], 0
mov qword [rsp + 0x28], 0
mov ecx, ebp
call fcn.140269b2c
mov rbx, rax
mov qword [rsp + 0x30], rax
mov ecx, 0x18
call fcn.1402695b8
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140105b0c
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_void_.0
mov qword [rdi], rax
mov qword [rdi + 0x10], rbx
jmp 0x140105b0e
xor edi, edi
xor edx, edx
xor ecx, ecx
call fcn.140269844
cmp qword [rsi + 0x18], 8
jb 0x140105b21
mov rsi, qword [rsi]
mov r9, rbx
mov r8d, ebp
xor edx, edx
mov rcx, rsi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x140105b95
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x28]
lea rdx, [0x1402f7cc4]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140105b95
cmp dword [rsp + 0x80], 0
je 0x140105b95
mov rcx, qword [rsp + 0x28]
cmp dword [rcx], 0xfeef04bd
jne 0x140105b95
movzx eax, word [rcx + 0x12]
mov dword [r12], eax
movzx eax, word [rcx + 0x10]
mov dword [r15], eax
movzx eax, word [rcx + 0x16]
mov dword [r14], eax
movzx ecx, word [rcx + 0x14]
mov rax, qword [rsp + 0xa0]
mov dword [rax], ecx
mov sil, 1
jmp 0x140105b98
xor sil, sil
test rdi, rdi
je 0x140105bd7
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140105bd7
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax]
call qword [case.0x1400ac8a1.0]
lock xadd dword [rdi + 0xc], ebx
cmp ebx, 1
jne 0x140105bd7
mov rdx, qword [rdi]
mov rcx, rdi
mov rax, qword [rdx + 8]
call qword [case.0x1400ac8a1.0]
movzx eax, sil
jmp 0x140105bdf
xor al, al
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140114a50
Capabilities:
Initialize winhttp library

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14035dc30]
xor rax, rsp
mov qword [rsp + 0x68], rax
movzx ebp, r8w
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x58], rcx
xor eax, eax
mov qword [rcx], rax
lea rdi, [rcx + 8]
mov qword [rdi], rax
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
lea edx, [rax + 4]
lea rcx, str.Simple_HttpFetcher_1.1
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
lea rcx, [rsp + 0x30]
cmp rbx, rcx
je 0x140114ab7
mov rcx, qword [rbx]
mov qword [rbx], rax
test rcx, rcx
je 0x140114ac5
jmp 0x140114abf
test rax, rax
je 0x140114ac5
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140114b9d
mov dword [rsp + 0x60], 0xaa0
mov r9d, 4
lea r8, [rsp + 0x60]
lea edx, [r9 + 0x50]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
je 0x140114bdb
cmp qword [rsi + 0x18], 8
jb 0x140114b00
mov rsi, qword [rsi]
xor r9d, r9d
movzx r8d, bp
mov rdx, rsi
mov rcx, qword [rbx]
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
lea rcx, [rsp + 0x30]
cmp rdi, rcx
je 0x140114b2a
mov rcx, qword [rdi]
mov qword [rdi], rax
test rcx, rcx
je 0x140114b38
jmp 0x140114b32
test rax, rax
je 0x140114b38
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
cmp qword [rdi], 0
je 0x140114b5e
mov rax, rbx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140269300
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, eax
call fcn.1400f64e0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.WinHttp:_Failed_to_connect_to_host
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x38]
call fcn.14008f280
lea rdx, [0x140356788]
lea rcx, [rsp + 0x38]
call fcn.14026ba78
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400f64e0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.WinHttp:_Failed_to_create_session
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x38]
call fcn.14008f280
lea rdx, [0x140356788]
lea rcx, [rsp + 0x38]
call fcn.14026ba78
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400f64e0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.WinHttp:_Failed_to_set_secure_protocols
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x38]
call fcn.14008f280
lea rdx, [0x140356788]
lea rcx, [rsp + 0x38]
call fcn.14026ba78
int3
Function at 0x140114c30
Capabilities:
Read http header

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14035dc30]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15d, r8d
mov r14, rdx
mov rbx, rcx
mov qword [rbp - 0x30], rcx
xor r12d, r12d
mov dword [rbp - 0x30], r12d
mov qword [rsp + 0x28], r12
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x140114e0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2f76
jne 0x140114cd0
mov qword [rbx], r12
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140269300
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140114e2f
mov esi, dword [rbp - 0x30]
shr rsi, 1
dec rsi
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r12w
cmp rsi, 7
ja 0x140114d26
mov qword [rbp - 0x18], rsi
test rsi, rsi
je 0x140114d1a
movzx eax, r12w
lea rdi, [rbp - 0x28]
mov rcx, rsi
rep stosw word [rdi], ax
mov word [rbp + rsi*2 - 0x28], r12w
mov rdx, qword [rbp - 0x28]
jmp 0x140114d90
movabs rdi, 0x7ffffffffffffffe
cmp rsi, rdi
ja 0x140114e6b
mov rax, rsi
or rax, 7
cmp rax, rdi
ja 0x140114d54
mov rdi, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rdi, rcx
mov rdx, rdi
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140026230
mov rdx, rax
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], rdi
movzx eax, r12w
mov rdi, rdx
mov rcx, rsi
rep stosw word [rdi], ax
mov word [rdx + rsi*2], r12w
mov qword [rbp - 0x28], rdx
lea r9, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r9, rdx
mov qword [rsp + 0x28], r12
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, r15d
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x140114dd2
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rbx + 0x10], xmm1
jmp 0x140114caf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400f64e0
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.WinHttp:_Failed_to_query_header_value
mov r8, rdi
mov edx, eax
lea rcx, [rbp - 0x50]
call fcn.14008f280
lea rdx, [0x140356788]
lea rcx, [rbp - 0x50]
call fcn.14026ba78
nop
lea rdx, str.WinHttp:_WinHttpQueryHeader_unexpectedly_returned_true
lea rcx, [rbp - 0x50]
call fcn.14004a9c0
lea rdx, [0x1403563c0]
lea rcx, [rbp - 0x50]
call fcn.14026ba78
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400f64e0
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.WinHttp:_Failed_to_query_header_length
mov r8, rdi
mov edx, eax
lea rcx, [rbp - 0x50]
call fcn.14008f280
lea rdx, [0x140356788]
lea rcx, [rbp - 0x50]
call fcn.14026ba78
int3
call fcn.1400255b0
int3
Function at 0x140140f80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x38
mov rsi, qword [rcx + 0x98]
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
mov r12, qword [rcx]
test rsi, rsi
je 0x14014117d
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r13
xor r13d, r13d
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x30], r15
nop dword [rax + rax]
movsxd rbp, dword [rsi + 0x10]
movzx eax, byte [rbx + 0x1f]
mov r14d, dword [rsi + 0x14]
shl rbp, 5
add rbp, qword [r12 + 0x20]
test al, al
jne 0x140140fe2
inc dword [rbx + 0x38]
mov r15d, dword [rbx + 0x38]
jmp 0x140140ff2
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov r15d, dword [rbx + rax*4 + 0xd0]
movsxd rcx, dword [rdi + 0x90]
lea r8d, [r14 + 2]
lea edx, [rcx + 7]
cmp dword [rdi + 0x94], ecx
jg 0x14014101f
mov r9d, edx
mov dword [rsp + 0x20], r14d
mov edx, reloc.WS2_32.dll_getservbyname
mov rcx, rdi
call fcn.14015ae20
jmp 0x14014104d
lea eax, [rcx + 1]
mov dword [rdi + 0x90], eax
lea rcx, [rcx + rcx*2]
mov rax, qword [rdi + 0x88]
mov dword [rax + rcx*8], reloc.WS2_32.dll_getservbyname
mov dword [rax + rcx*8 + 4], r8d
mov dword [rax + rcx*8 + 8], edx
mov dword [rax + rcx*8 + 0xc], r14d
mov qword [rax + rcx*8 + 0x10], r13
mov r9, qword [rbp + 0x18]
xor edx, edx
mov r8d, dword [rsi + 0x10]
mov rcx, rbx
mov dword [rsp + 0x20], 0x63
mov r9, qword [r9 + 0x68]
call fcn.140197400
mov eax, dword [rdi + 0x90]
add eax, 5
cmp eax, dword [rdi + 0x94]
jle 0x140141091
mov edx, 5
mov rcx, rdi
call fcn.14015ae90
test eax, eax
jne 0x140141169
movsxd rax, dword [rdi + 0x90]
lea rcx, [rax + rax*2]
mov rax, qword [rdi + 0x88]
mov dword [rax + rcx*8 + 8], 2
mov byte [rax + rcx*8], getprotobynumber
mov dword [rax + rcx*8 + 4], r13d
lea rdx, [rax + rcx*8]
mov eax, dword [rdi + 0x90]
mov dword [rdx + 0xc], r13d
lea ecx, [r14 + 1]
mov byte [rdx + 1], r13b
add eax, 2
mov dword [rdx + 8], eax
lea eax, [r14 - 1]
mov qword [rdx + 0x10], r13
mov word [rdx + 2], r13w
mov qword [rdx + 0x18], 0x7b
mov qword [rdx + 0x20], r13
mov qword [rdx + 0x28], r13
mov qword [rdx + 0x30], 0x5d
mov qword [rdx + 0x38], 2
mov qword [rdx + 0x40], r13
mov qword [rdx + 0x48], 0x7c
mov qword [rdx + 0x50], r13
mov qword [rdx + 0x58], r13
mov qword [rdx + 0x60], 0x76
mov qword [rdx + 0x68], r13
mov qword [rdx + 0x70], r13
add dword [rdi + 0x90], 5
mov dword [rdx + 0x34], eax
mov eax, 8
mov word [rdx + 0x4a], ax
mov dword [rdx + 4], ecx
mov dword [rdx + 0x20], ecx
mov dword [rdx + 0x3c], r15d
mov dword [rdx + 0x50], r15d
mov dword [rdx + 0x54], ecx
test r15d, r15d
je 0x14014115d
movzx eax, byte [rbx + 0x1f]
cmp al, 8
jae 0x14014115d
mov dword [rbx + rax*4 + 0xd0], r15d
inc byte [rbx + 0x1f]
mov rsi, qword [rsi]
test rsi, rsi
jne 0x140140fc0
mov r15, qword [rsp + 0x30]
mov r13, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x70]
add rsp, 0x38
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140151e80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push r14
sub rsp, 0x68
movzx eax, byte [rdx]
mov r14, rdx
mov rdi, rcx
cmp al, 0xaf
jne 0x140151e99
movzx eax, byte [rdx + 2]
cmp al, 0xb0
jne 0x140151ea3
mov rax, qword [rdx + 0x20]
jmp 0x140151eb3
cmp al, 0x89
jne 0x140152037
mov rax, qword [rdx + 0x20]
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax]
cmp ecx, 1
je 0x140152037
mov dword [r8], 0
cmp byte [rdx], 0x89
jne 0x140151eda
mov rcx, rdi
add rsp, 0x68
pop r14
pop rdi
jmp fcn.14017bca0
mov eax, dword [rdi + 0x38]
mov qword [rsp + 0x60], r12
mov r12, rcx
mov qword [rsp + 0x58], r13
lea r13d, [rax + 1]
add eax, ecx
mov dword [rsp + 0x88], r13d
mov dword [rdi + 0x38], eax
test ecx, ecx
jle 0x140152022
mov qword [rsp + 0x80], rbx
lea rcx, [0x1401a7c30]
mov qword [rsp + 0x90], rbp
mov ebp, r13d
mov qword [rsp + 0x50], r15
lea r13, [fcn.140152ef0]
xor r15d, r15d
mov qword [rsp + 0x98], rsi
lea edx, [r15 + 2]
nop dword [rax + rax]
cmp byte [rdi + 0x23], 0
mov rax, qword [r14 + 0x20]
mov rbx, qword [rax + r15 + 8]
je 0x140151f90
mov word [rsp + 0x44], dx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x48], 0
test rbx, rbx
je 0x140151f80
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1401d6d50
cmp word [rsp + 0x44], 0
je 0x140151f90
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.1401857d0
jmp 0x140151fd0
mov rsi, qword [rdi]
test rbx, rbx
je 0x140151fac
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.140152300
mov rbx, rax
cmp byte [rsi + 0x63], 0
jne 0x140151fc0
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.140183d10
test rbx, rbx
je 0x140151fd0
mov rdx, rbx
mov rcx, rsi
call fcn.1401874e0
inc ebp
lea rcx, [0x1401a7c30]
add r15, 0x20
mov edx, 2
sub r12, 1
jne 0x140151f40
mov eax, dword [rsp + 0x88]
mov r15, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r14
pop rdi
ret
mov r12, qword [rsp + 0x60]
mov eax, r13d
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r14
pop rdi
ret
mov rcx, rdi
add rsp, 0x68
pop r14
pop rdi
jmp fcn.140186df0
Function at 0x14016af80
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14d, dword [rsp + 0x70]
mov ebx, r8d
mov dword [rax - 0x18], r14d
mov rbp, r9
mov qword [rax - 0x20], r9
mov rdi, rdx
mov r9, rdx
mov byte [rcx + 0x1c], 1
mov r8, rdx
mov dword [rax - 0x28], ebx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov rsi, rcx
call fcn.140197050
test ebx, ebx
jne 0x14016afe9
mov r9, rbp
mov dword [rsp + 0x20], r14d
mov r8, rdi
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov rcx, rsi
call fcn.140197050
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140189f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
xor r11d, r11d
mov rdi, r8
mov ebx, r11d
mov r14, rdx
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x14018a049
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r12
lea r12, str.main
mov qword [rsp + 0x20], r15
lea r15, [0x1402ced20]
nop
mov rax, qword [rsi + 0x20]
mov r10d, ebx
xor r10d, 1
cmp ebx, 2
cmovge r10d, ebx
movsxd rcx, r10d
shl rcx, 5
mov rbp, qword [rcx + rax + 0x18]
test rdi, rdi
je 0x140189fc1
mov r8, qword [rcx + rax]
mov r9, rdi
sub r9, r8
nop dword [rax]
movzx ecx, byte [r8]
movzx eax, byte [r9 + r8]
cmp ecx, eax
jne 0x140189ffc
test ecx, ecx
jne 0x14018a00a
lea rcx, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
call fcn.140154030
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x140189fe0
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x140189f80
mov r12, qword [rsp + 0x60]
mov rax, r11
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
movzx edx, byte [rax + r15]
movzx ecx, byte [rcx + r15]
cmp ecx, edx
jne 0x14018a00f
inc r8
jmp 0x140189fb0
test r10d, r10d
jne 0x140189fd9
mov r9, rdi
mov rax, r12
sub r9, r12
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [r9 + rax]
cmp edx, ecx
jne 0x14018a035
test edx, edx
je 0x140189fc1
inc rax
jmp 0x14018a020
movzx r8d, byte [rcx + r15]
movzx edx, byte [rdx + r15]
cmp edx, r8d
jne 0x140189fd9
inc rax
jmp 0x14018a020
mov rax, r11
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401d21b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [rcx], 0
mov ecx, 0x28
mov rsi, r8
mov rbp, rdx
call fcn.140196750
mov rbx, rax
test rax, rax
jne 0x1401d21ee
lea eax, [rbx + 7]
jmp 0x1401d227b
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x1401d2246
mov rax, qword [0x14035adc0]
test rax, rax
je 0x1401d2212
mov ecx, 0xc8
call qword [case.0x1400ac8a1.0]
test eax, eax
jne 0x1401d2246
lea rax, [rbx + 8]
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x28], rax
lea r8, [0x1401a9b80]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
mov qword [rbx + 0x18], rsi
xor ecx, ecx
call fcn.1402835f8
mov qword [rbx], rax
test rax, rax
jne 0x1401d2256
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x10], 0
jne 0x1401d2276
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 8], eax
mov rcx, rsi
mov rax, rbp
call qword [case.0x1400ac8a1.0]
mov qword [rbx + 0x20], rax
mov qword [rdi], rbx
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret