joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140278340
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140278531
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [rsi + 8]
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
mov r8, rbx
call fcn.140028b70
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1402784ef
movabs rbp, 0x100000001b3
movabs r14, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdx]
movzx r8d, byte [rcx + 0x10]
xor r8, r14
imul r8, rbp
movzx eax, byte [rcx + 0x11]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x12]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x13]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x14]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x15]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x16]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x17]
xor r8, rax
imul r8, rbp
and r8, qword [rsi + 0x30]
mov r11, r8
shl r11, 4
add r11, qword [rsi + 0x18]
add r8, r8
mov rax, qword [rsi + 0x18]
lea rdi, [rax + r8*8]
cmp qword [r11], rbx
jne 0x140278464
mov qword [r11], rcx
mov qword [rdi + 8], rcx
jmp 0x1402784e3
mov rax, qword [rdi + 8]
mov r8, qword [rax + 0x10]
cmp qword [rcx + 0x10], r8
jne 0x1402784a1
mov r8, qword [rax]
cmp r8, rcx
je 0x14027849b
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov rax, qword [rdx + 8]
mov qword [rax], r8
mov r9, qword [r8 + 8]
mov qword [r9], rcx
mov qword [r8 + 8], rax
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
mov qword [rdi + 8], rcx
jmp 0x1402784e3
cmp qword [r11], rax
je 0x1402784bf
mov r9, qword [rcx + 0x10]
mov r8, qword [r11]
nop dword [rax]
mov rax, qword [rax + 8]
cmp r9, qword [rax + 0x10]
je 0x14027850b
cmp r8, rax
jne 0x1402784b0
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov qword [rax + 8], r8
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x1402783e0
mov qword [rsp + 0x48], 0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rax]
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov qword [rax + 8], r8
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
jmp 0x1402784e3
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x140278540
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140278731
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [rsi + 8]
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
mov r8, rbx
call fcn.140028b70
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1402786ef
movabs rbp, 0x100000001b3
movabs r14, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdx]
movzx r8d, byte [rcx + 0x10]
xor r8, r14
imul r8, rbp
movzx eax, byte [rcx + 0x11]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x12]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x13]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x14]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x15]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x16]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x17]
xor r8, rax
imul r8, rbp
and r8, qword [rsi + 0x30]
mov r11, r8
shl r11, 4
add r11, qword [rsi + 0x18]
add r8, r8
mov rax, qword [rsi + 0x18]
lea rdi, [rax + r8*8]
cmp qword [r11], rbx
jne 0x140278664
mov qword [r11], rcx
mov qword [rdi + 8], rcx
jmp 0x1402786e3
mov rax, qword [rdi + 8]
mov r8, qword [rax + 0x10]
cmp qword [rcx + 0x10], r8
jne 0x1402786a1
mov r8, qword [rax]
cmp r8, rcx
je 0x14027869b
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov rax, qword [rdx + 8]
mov qword [rax], r8
mov r9, qword [r8 + 8]
mov qword [r9], rcx
mov qword [r8 + 8], rax
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
mov qword [rdi + 8], rcx
jmp 0x1402786e3
cmp qword [r11], rax
je 0x1402786bf
mov r9, qword [rcx + 0x10]
mov r8, qword [r11]
nop dword [rax]
mov rax, qword [rax + 8]
cmp r9, qword [rax + 0x10]
je 0x14027870b
cmp r8, rax
jne 0x1402786b0
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov qword [rax + 8], r8
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x1402785e0
mov qword [rsp + 0x48], 0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rax]
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov qword [rax + 8], r8
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
jmp 0x1402786e3
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x140279110
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
xor edi, edi
mov dword [rbp - 0x40], edi
lea rdx, [rbp - 0x20]
lea rcx, [0x14062d4c0]
call fcn.1401f7520
nop
lea rcx, [rbp - 0x20]
call fcn.140278190
mov byte [rax], dil
lea ecx, [rdi + 8]
call fcn.140283d70
test rax, rax
je 0x14027915d
lea rcx, [0x1402794c0]
mov qword [rax], rcx
jmp 0x140279160
mov rax, rdi
mov qword [rbp + 0x10], rax
mov ebx, 2
mov dword [rbp - 0x40], ebx
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140277030]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x30], rax
test rax, rax
je 0x140279276
mov qword [rbp + 0x10], rdi
and ebx, 0xfffffffd
mov dword [rbp - 0x40], ebx
cmp dword [0x14062d288], 0
je 0x1402791b4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
xorps xmm0, xmm0
movaps xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
movups xmmword [0x14062d280], xmm1
cmp dword [rbp - 0x28], 0
je 0x1402791d4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov byte [rbp + 0x10], 0
lea rax, [rbp + 0x10]
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x28], rax
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
lea rcx, [rbp + 0x18]
call fcn.140146e40
movabs rcx, 0x7ffffffc81ee29ff
mov rax, qword [rbp + 0x18]
cmp rax, rcx
jge 0x140279220
movabs rcx, 0x37e11d600
add rcx, rax
mov qword [rbp + 0x18], rcx
jmp 0x14027922e
movabs rax, 0x7fffffffffffffff
mov qword [rbp + 0x18], rax
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x18]
lea rdx, [rbp - 0x10]
lea rcx, [0x14062d200]
call fcn.1402777a0
lea rcx, [rbp - 0x20]
call fcn.140278190
movzx ebx, byte [rax]
cmp byte [rbp - 8], 0
je 0x140279261
mov rcx, qword [rbp - 0x10]
call fcn.1402836b4
movzx eax, bl
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov dword [rbp - 0x28], edi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14027f500
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0xe8
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rbx, r9
mov rdi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rbp - 0x79], xmm0
movups xmmword [rbp - 0x69], xmm0
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
mov dword [rsp + 0x20], reloc.WS2_32.dll_WSASetLastError
mov rax, rcx
cmp qword [rcx + 0x18], 7
jbe 0x14027f55a
mov rax, qword [rcx]
mov qword [rbp - 0x71], rax
cmp qword [rdx + 0x18], 7
jbe 0x14027f568
mov rdx, qword [rdx]
mov qword [rbp - 0x69], rdx
xor esi, esi
cmp qword [r8 + 0x10], rsi
jne 0x14027f57a
mov qword [rbp - 0x61], rsi
jmp 0x14027f588
cmp qword [r8 + 0x18], 7
jbe 0x14027f584
mov r8, qword [r8]
mov qword [rbp - 0x61], r8
lea rax, str.open
mov qword [rbp - 0x79], rax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x24], 0x440
mov dword [rbp - 0x59], 1
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14027f5d2
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x14027f5d2
mov qword [rbx], rcx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rbx + 0x10], eax
mov al, 1
jmp 0x14027f6c2
mov rbx, qword [0x140627790]
test rbx, rbx
je 0x14027f6c0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x30]
test al, al
je 0x14027f6c0
mov rdx, rdi
lea rcx, [rbp + 7]
call fcn.14024bc00
nop
mov r8, rax
lea rdx, str.Failed_to_execute_application_process___
lea rcx, [rbp - 0x19]
call fcn.1400267c0
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x14027f64f
inc rdx
mov rcx, qword [rbp + 7]
cmp rdx, 0x1000
jb 0x14027f64a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14027f6da
mov rcx, r8
call fcn.140283db0
mov qword [rbp + 0x17], rsi
mov qword [rbp + 0x1f], reloc.WS2_32.dll_ntohs
mov byte [rbp + 7], 0
mov rax, qword [rbx]
lea r9, [rbp - 0x19]
lea r8, str.eax::services::process::_anonymous_namespace::executeApplication
mov edx, 1
mov rcx, rbx
call qword [rax + gethostname]
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14027f6b0
inc rdx
mov rcx, qword [rbp - 0x19]
cmp rdx, 0x1000
jb 0x14027f6ab
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14027f6e1
mov rcx, r8
call fcn.140283db0
mov qword [rbp - 9], rsi
mov qword [rbp - 1], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x19], 0
xor al, al
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140284180
add rsp, 0xe8
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140283944
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14028397e
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140283983
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1402839cc
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14047ae50]
cmp byte [rcx + rax], 0
je 0x1402839cc
dec r8
sub rdx, 1
jne 0x1402839b2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140284a24
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140284a6e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140284a6e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140284a6e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140284a6e
cmp dword [rcx + 0x84], 0xe
jbe 0x140284a6e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140284a70
xor al, al
add rsp, 0x28
ret
Function at 0x1402862d0
Capabilities:
Get local ipv4 addresses

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x40
mov rdi, qword [0x14062e010]
mov ebp, r9d
mov dword [rsp + 0x20], r9d
mov r15, r8
mov r9, r8
mov esi, edx
mov r8d, edx
mov ebx, ecx
mov edx, ecx
mov rcx, rdi
call fcn.1402a0830
test eax, eax
jne 0x1402864ca
cmp ebx, 0x61646472
jne 0x140286322
call fcn.14029db40
jmp 0x1402864ca
cmp ebx, 0x62626e64
jne 0x140286334
mov eax, 1
jmp 0x1402864ca
cmp ebx, 0x63686174
jne 0x140286348
movzx eax, byte [rdi + 0xcc]
jmp 0x1402864ca
cmp ebx, 0x65746872
je 0x1402863c7
cmp ebx, 0x6d616378
je 0x1402863c7
cmp ebx, 0x74797065
jne 0x14028636a
mov eax, 4
jmp 0x1402864ca
cmp ebx, 0x6c6f636c
jne 0x14028637c
call fcn.1402864e0
jmp 0x1402864ca
cmp ebx, 0x6c6f636e
jne 0x14028638e
call fcn.140286b70
jmp 0x1402864ca
cmp ebx, 0x6f70656e
jne 0x1402863ae
test rdi, rdi
jne 0x1402863a2
xor eax, eax
jmp 0x1402864ca
movzx eax, byte [rdi + 0xcd]
jmp 0x1402864ca
mov r9, r15
mov dword [rsp + 0x20], ebp
mov r8d, esi
mov edx, ebx
mov rcx, rdi
call fcn.1402a06b0
jmp 0x1402864ca
mov edx, ebp
mov qword [rsp + 0x60], r14
mov rcx, r15
call fcn.140295260
mov r14, qword [0x14062e010]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x30], 1
xor edx, edx
xor ecx, ecx
xor ebx, ebx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
je 0x140286411
mov ebx, 0xffffffff
jmp 0x1402864c3
mov r9, qword [r14 + 8]
mov edx, 0x6e636f6e
mov r8d, dword [r14]
mov ecx, dword [rsp + 0x30]
call fcn.140251930
mov rdi, rax
test rax, rax
jne 0x140286436
lea ebx, [rax - 2]
jmp 0x1402864c3
lea rax, [rsp + 0x30]
mov r9, rdi
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x1402864aa
mov r9, rdi
cmp dword [r9 + 0x64], 6
je 0x140286464
cmp dword [r9 + 0x64], 0x47
jne 0x140286487
cmp dword [r9 + 0x58], 6
jne 0x140286487
test esi, esi
je 0x140286496
mov rax, qword [r9 + 0x18]
test rax, rax
je 0x140286487
test byte [rax + 4], 1
jne 0x140286496
mov rax, qword [rax + 8]
test rax, rax
jne 0x140286478
mov r9, qword [r9 + 8]
test r9, r9
jne 0x140286456
lea ebx, [r9 - 3]
jmp 0x1402864af
lea r8, [r9 + 0x50]
mov edx, ebp
mov r9d, dword [r9 + 0x58]
mov rcx, r15
call fcn.140295280
jmp 0x1402864af
mov ebx, 0xfffffffc
mov r9, qword [r14 + 8]
mov edx, 0x6e636f6e
mov r8d, dword [r14]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov r14, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop rdi
pop rsi
ret
Function at 0x14029bdb0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov eax, 1
mov word [rcx + 0x100], 0
cmp r9d, eax
mov edi, r8d
mov rsi, rdx
mov r10, rcx
cmovl r9d, eax
xor ebx, ebx
mov eax, ebx
nop dword [rax]
nop word [rax + rax]
mov byte [r10], al
lea r10, [r10 + 1]
inc eax
cmp eax, 0x100
jb 0x14029bdf0
test edi, edi
jle 0x14029bebc
test r9d, r9d
jle 0x14029bebc
xor r11b, r11b
mov r10, rcx
nop word [rax + rax]
movzx r8d, byte [r10]
lea r10, [r10 + 1]
xor edx, edx
mov eax, ebx
div edi
inc ebx
movzx eax, byte [rdx + rsi]
add al, byte [r10 - 1]
add r11b, al
movzx eax, r11b
movzx edx, byte [rax + rcx]
mov byte [r10 - 1], dl
movzx eax, r11b
mov byte [rax + rcx], r8b
cmp ebx, 0x100
jb 0x14029be20
cmp r9d, 1
jle 0x14029bebc
movzx r10d, byte [rcx + 0x100]
movzx r11d, byte [rcx + 0x101]
shl r9d, 8
test r9d, r9d
jle 0x14029beae
nop word [rax + rax]
lea eax, [r10 + 1]
dec r9d
movzx r10d, al
movzx edx, byte [r10 + rcx]
movzx r8d, byte [r10 + rcx]
add edx, r11d
movzx r11d, dl
movzx eax, byte [r11 + rcx]
mov byte [r10 + rcx], al
mov byte [r11 + rcx], r8b
test r9d, r9d
jg 0x14029be80
mov byte [rcx + 0x100], r10b
mov byte [rcx + 0x101], r11b
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x14029bed0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r10d, r9d
mov rax, r8
mov edi, edx
mov rbx, rcx
mov r8d, r10d
lea rcx, [rsp + 0x20]
mov rdx, rax
mov r9d, 0xc00
call fcn.14029bdb0
movzx r8d, byte [rsp + 0x120]
movzx r9d, byte [rsp + 0x121]
test edi, edi
jle 0x14029bf73
nop word [rax + rax]
lea eax, [r8 + 1]
dec edi
movzx r8d, al
lea rbx, [rbx + 1]
movzx ecx, byte [rsp + r8 + 0x20]
movzx edx, byte [rsp + r8 + 0x20]
add ecx, r9d
movzx r9d, cl
movzx ecx, byte [rsp + r9 + 0x20]
mov byte [rsp + r8 + 0x20], cl
mov byte [rsp + r9 + 0x20], dl
lea eax, [rcx + rdx]
movzx ecx, al
movzx eax, byte [rsp + rcx + 0x20]
xor byte [rbx - 1], al
test edi, edi
jg 0x14029bf30
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140284180
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rdi
ret
Function at 0x14029d090
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ebx, reloc.WS2_32.dll_recv
mov dword [rsp + 0x20], r8d
mov rbp, rdx
mov rdi, rcx
mov r8, rdx
xor esi, esi
mov byte [rcx + 0x24], sil
mov r9d, ebx
lea edx, [rbx + 0x70]
add rcx, 0xb0
call fcn.140295280
cmp dword [rdi + 0x18], 2
jne 0x14029d0f9
mov edx, ebx
lea rcx, [rsp + 0x28]
call fcn.140295260
mov eax, 2
lea rsi, [rsp + 0x28]
mov word [rsp + 0x28], ax
jmp 0x14029d11f
cmp dword [rdi + 0x18], 0x17
jne 0x14029d16a
mov ebx, 0x1c
lea rcx, [rsp + 0x38]
mov edx, ebx
call fcn.140295260
mov eax, reloc.WS2_32.dll_socket
lea rsi, [rsp + 0x38]
mov word [rsp + 0x38], ax
mov r8d, ebx
mov rdx, rsi
mov rcx, rdi
call fcn.14029cdf0
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x14029d143
cmp eax, 0xfffffff5
je 0x14029d143
mov dword [rdi + 0x28], eax
jmp 0x14029d1b4
cmp dword [rdi + 0x18], 0x17
jne 0x14029d16a
mov rcx, qword [0x14062e6a8]
lea r9, [rsp + 0x20]
add rcx, 0x90
mov r8, rbp
mov rdx, rsi
call fcn.1402a1920
mov rbp, rax
mov r8d, dword [rsp + 0x20]
mov rdx, rbp
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.WS2_32.dll_connect]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov ecx, ebx
call fcn.14029fbb0
mov ebx, eax
test eax, eax
jne 0x14029d1af
cmp byte [rdi + 0x132], al
je 0x14029d1af
mov rcx, qword [0x14062e6a8]
mov rcx, qword [rcx + 0x80]
call qword [sym.imp.WS2_32.dll_WSASetEvent]
mov dword [rdi + 0x28], ebx
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140284180
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x14029d770
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x200
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov rbx, qword [0x14062e6a8]
mov ebp, edx
mov edi, ecx
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x20]
mov esi, r8d
call fcn.1402956f0
test rbx, rbx
je 0x14029d7bd
mov eax, 0xffffffff
jmp 0x14029d971
mov r9, qword [rsp + 0x28]
mov edx, 0x64736f63
mov r8d, dword [rsp + 0x20]
mov ecx, 0x138
call fcn.140251930
mov rbx, rax
test rax, rax
jne 0x14029d7e6
lea eax, [rbx - 2]
jmp 0x14029d971
mov edx, 0x138
mov rcx, rbx
call fcn.140295260
mov eax, dword [rsp + 0x20]
mov r8d, esi
mov dword [rbx + 0x64], eax
mov edx, ebp
mov rax, qword [rsp + 0x28]
mov ecx, edi
mov qword [rbx + 0x68], rax
mov dword [rbx + 0x58], 0x4f0
mov dword [rbx + 0x5c], reloc.WS2_32.dll_socket
mov dword [rbx + 0x74], 1
mov byte [rbx + 0x60], 0
mov qword [0x14062e6a8], rbx
call fcn.1402a3c10
mov edx, 0x198
lea rcx, [rsp + 0x50]
call fcn.140295260
mov ecx, 0x202
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14029d866
mov ecx, 0xffffffff
call fcn.14029d9a0
mov eax, 0xfffffffd
jmp 0x14029d971
movzx ecx, word [rsp + 0x50]
movzx eax, cx
shr ax, 8
movzx edx, al
movzx eax, cl
shl eax, 8
or edx, eax
mov dword [rbx + 0x70], edx
mov rdx, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x20]
call fcn.1402a1fd0
mov qword [rbx + 0xb0], rax
test rax, rax
jne 0x14029d8ae
mov ecx, 0xffffffff
call fcn.14029d9a0
mov eax, 0xfffffffc
jmp 0x14029d971
mov rdx, rbx
lea rcx, [fcn.14029ec50]
call fcn.14029b7c0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x80], rax
test rax, rax
jne 0x14029d8ec
xor ecx, ecx
call fcn.14029d9a0
mov eax, 0xfffffffb
jmp 0x14029d971
lea rcx, [rbx + 0x88]
lea rdx, str.recv_event_crit
call fcn.14029bb00
mov edx, 0x18
mov dword [rbx + 0x7c], 1
lea rcx, [rsp + 0x30]
call fcn.140295260
lea rax, str.SocketRecv
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x30]
mov dword [rsp + 0x34], esi
lea rcx, [0x14029f670]
mov eax, dword [rbx + 0x74]
xor edx, edx
mov dword [rsp + 0x40], eax
call fcn.1402b29b0
test eax, eax
je 0x14029d95c
xor ecx, ecx
mov dword [rbx + 0x7c], 0
call fcn.14029d9a0
mov eax, 0xfffffffa
jmp 0x14029d971
mov r8, qword [rbx + 0x68]
lea rcx, [rbx + 0x90]
mov edx, dword [rbx + 0x64]
call fcn.1402a18b0
xor eax, eax
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.140284180
mov rbx, qword [rsp + 0x238]
add rsp, 0x200
pop rdi
pop rsi
pop rbp
ret
Function at 0x14029e430
Capabilities:
Set socket configuration

Disassembly:
cmp ecx, 1
je 0x14029e43f
mov rax, qword [0x14062e6a8]
mov ecx, dword [rax + 0x5c]
mov r9d, r8d
mov r8d, edx
mov edx, ecx
mov rcx, 0xffffffffffffffff
jmp 0x14029f180
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, qword [0x14062e6a8]
mov eax, 1
xor r13d, r13d
mov dword [r11 + 0x18], eax
cmp r8d, eax
mov dword [r11 - 0x38], r13d
mov r12d, r9d
mov ebp, r8d
mov r9, qword [rsi + 0x68]
mov r14d, edx
mov r8d, dword [rsi + 0x64]
mov rdi, rcx
mov r15d, 8
mov edx, 0x64736f63
mov ecx, 0x330
cmovne r15d, eax
call fcn.140251930
mov rbx, rax
test rax, rax
je 0x14029f25e
mov edx, 0x330
mov rcx, rax
call fcn.140295260
cmp rdi, 0xffffffffffffffff
jne 0x14029f225
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov r8d, r12d
mov dword [rsp + 0x20], r13d
mov edx, ebp
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14029f249
mov r8, qword [rsi + 0x68]
mov ecx, r15d
mov edx, dword [rsi + 0x64]
call fcn.1402a27e0
mov qword [rbx + 0x320], rax
mov rcx, rdi
test rax, rax
jne 0x14029f265
call qword [sym.imp.WS2_32.dll_closesocket]
mov r9, qword [rsi + 0x68]
mov edx, 0x64736f63
mov r8d, dword [rsi + 0x64]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
xor eax, eax
jmp 0x14029f37d
lea r8, [rsp + 0x80]
mov dword [rbx + 0x318], 0xffffffff
mov edx, 0x8004667e
mov qword [rbx + 0x10], rdi
mov dword [rbx + 0x28], r13d
mov byte [rbx + 0x133], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp ebp, 2
jne 0x14029f2a1
mov edx, 0xffff
lea r8d, [rbp + 0x1e]
jmp 0x14029f2ac
cmp ebp, 3
jne 0x14029f2c5
xor edx, edx
lea r8d, [rbp - 1]
lea r9, [rsp + 0x80]
mov dword [rsp + 0x20], 4
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp r14d, 0x17
jne 0x14029f2e9
lea r9, [rsp + 0x30]
mov dword [rsp + 0x20], 4
lea edx, [r14 + 0x12]
mov rcx, rdi
lea r8d, [r14 + 4]
call qword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [rbp - 2]
mov dword [rbx + 0x18], r14d
cmp eax, 1
mov dword [rbx + 0x1c], ebp
mov dword [rbx + 0x20], r12d
setbe cl
mov byte [rbx + 0x134], 1
mov byte [rbx + 0x132], cl
cmp ebp, 2
jne 0x14029f327
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
mov edx, 0x75637274
mov rcx, rbx
call fcn.14029d1e0
lea rcx, [rbx + 0x2b8]
mov edx, 0x20
call fcn.140295260
call qword [sym.imp.WS2_32.dll_WSACreateEvent]
lea rcx, [rbx + 0x2d8]
mov qword [rbx + 0x2d0], rax
lea rdx, [0x14047d1f0]
call fcn.14029bb00
call fcn.1402a3cf0
xor ecx, ecx
mov dword [rbx + 0x28c], eax
call fcn.14029bad0
mov rax, qword [rsi]
xor ecx, ecx
mov qword [rbx], rax
mov qword [rsi], rbx
call fcn.14029bd50
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret