joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140267c00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0xb36], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x140267cb6
cmp qword [rcx + 0x278], 0
je 0x140267c6b
mov dl, 1
call fcn.1402573e0
mov rax, qword [rdi + 0x1d8]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x278]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.1402573e0
mov eax, ebx
jmp 0x140267cb8
mov edx, ebx
test ebx, ebx
je 0x140267c7b
sub edx, 1
je 0x140267c7b
cmp edx, 1
jne 0x140267cb6
mov r9, qword [rdi + 0x1d0]
lea rax, [0x140422cf8]
mov edx, 2
lea rcx, [rbx + rbx*2]
add rcx, rax
lea r8d, [rdx - 1]
call fcn.1403d85e0
mov r9, qword [rdi + 0x1d0]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call fcn.1403d85e0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140267cd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x160
mov rax, qword [0x1404f2b48]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xb36], 0
mov rbx, rcx
jne 0x140267d13
cmp qword [rcx + 0x1e0], 0
je 0x140267de0
mov r8, rdx
mov qword [rsp + 0x158], rdi
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.14026ce20
mov rdx, qword [rbx + 0x1e0]
movsxd rdi, eax
test rdx, rdx
je 0x140267d78
cmp byte [rbx + 0x12eb], 0
jne 0x140267d78
lea rcx, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140267d60
mov byte [rbx + 0x12eb], 1
mov byte [rsp + rdi + 0x30], 0xa
inc rdi
cmp rdi, 0x102
jae 0x140267e31
cmp byte [rbx + 0xb36], 0
mov byte [rsp + rdi + 0x30], 0
je 0x140267dd8
cmp qword [rbx + 0x278], 0
je 0x140267df9
mov dl, 1
mov rcx, rbx
call fcn.1402573e0
mov rax, qword [rbx + 0x1d8]
lea r8, [rsp + 0x30]
mov r9, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rbx
call qword [rbx + 0x278]
xor edx, edx
mov rcx, rbx
call fcn.1402573e0
mov rdi, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1403cb150
add rsp, 0x160
pop rbx
ret
mov r9, qword [rbx + 0x1d0]
lea rcx, [0x140422cf8]
mov edx, 2
lea r8d, [rdx - 1]
call fcn.1403d85e0
mov r9, qword [rbx + 0x1d0]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rdi
call fcn.1403d85e0
jmp 0x140267dd8
call fcn.1403cb370
int3

Function at 0x140267f60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x140267fa2
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ecx, 0x38
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140268140
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x1404f2b48]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rsi, qword [rsp + 0x190]
mov rbp, rcx
mov rcx, qword [rcx + 0x18]
mov r15, r8
movsxd r8, edx
mov r12, r9
mov rax, r8
shl rax, 5
lea rbx, [rcx + 0x230]
mov r14, qword [rcx + r8*8 + 0x1e8]
add rbx, rax
mov rax, qword [rcx + 0x418]
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x84], 3
je 0x14026824c
lea rax, [0x140267ff0]
cmp qword [rcx + r8*8 + 0x210], rax
jne 0x14026824c
cmp qword [rbx], 0
je 0x1402681d1
test rdi, rdi
je 0x14026824c
mov rdx, 0xffffffffffffffff
xor r9d, r9d
mov r8, rdx
mov rcx, r14
call fcn.1402a1360
cmp eax, 0xffffffff
je 0x14026824c
test al, 1
je 0x14026824c
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14026822b
mov eax, dword [rbp + 0x734]
add eax, eax
movsxd rcx, eax
mov qword [rbx + 8], rcx
call qword [section._________1]
mov qword [rbx], rax
mov rcx, rax
test rax, rax
je 0x140268286
mov rdi, qword [rbx + 8]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rcx
mov r8d, edi
mov rcx, r14
call qword [sym.imp.ws2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x14026824c
add qword [rbx + 0x10], rcx
xor r9d, r9d
mov r8d, r12d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.ws2_32.dll_send]
movsxd rbx, eax
mov dword [rsi], 0
cmp rbx, 0xffffffffffffffff
jne 0x1402682c5
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov edi, eax
cmp eax, 0x2733
jne 0x140268295
xor ebx, ebx
mov dword [rsi], 0x51
jmp 0x1402682c5
mov dword [rsi], 0x1b
mov rax, 0xffffffffffffffff
jmp 0x1402682c8
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov ecx, edi
call fcn.14024b0a0
mov r8, rax
lea rdx, [0x140422d10]
mov rcx, rbp
call fcn.140267cd0
mov dword [rbp + 0xdec], edi
mov dword [rsi], 0x37
mov rax, rbx
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1403cb150
add rsp, 0x130
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140268750
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x280], 0
je 0x14026876d
call fcn.140261810
test eax, eax
jne 0x140268793
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x1e8]
cmp rcx, 0xffffffffffffffff
je 0x140268766
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.ws2_32.dll_recv]
test eax, eax
je 0x140268766
mov al, 1
add rsp, 0x28
ret
Function at 0x1402689e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x1404f2b48]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x80
mov rax, rdx
mov rbx, r8
mov rsi, rcx
lea r8, [rsp + 0x20]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov rdi, r9
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.ws2_32.dll_getsockname]
test eax, eax
je 0x140268a93
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, eax
mov ebx, eax
call fcn.14024b0a0
mov r9, rax
lea rdx, [0x140422ec0]
mov r8d, ebx
mov rcx, rsi
call fcn.140267cd0
jmp 0x140268b63
movzx ecx, word [rsp + 0x30]
sub ecx, 1
je 0x140268b38
sub ecx, 1
je 0x140268add
cmp ecx, 0x15
jne 0x140268ae9
lea rdx, [rsp + 0x38]
mov ecx, 0x17
mov r8, rbx
mov r9d, 0x2e
call fcn.1402be330
test rax, rax
je 0x140268ae9
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.ws2_32.dll_htons_1]
movzx eax, ax
mov dword [rdi], eax
jmp 0x140268b63
lea rdx, [rsp + 0x34]
mov ecx, 2
jmp 0x140268ab5
mov byte [rbx], 0
mov dword [rdi], 0
call fcn.1403dfed0
mov dword [rax], 0x273f
call fcn.1403dfed0
mov ebx, dword [rax]
call fcn.1403dfed0
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.14024b0a0
mov r8d, dword [rdi]
lea rdx, [0x140422fa0]
mov r9, rax
mov rcx, rsi
call fcn.140267cd0
jmp 0x140268b63
cmp dword [rsp + 0x20], 2
jle 0x140268b5a
lea r9, [rsp + 0x32]
mov edx, 0x2e
lea r8, [0x1404ca228]
mov rcx, rbx
call fcn.14026cd00
jmp 0x140268b5d
mov byte [rbx], 0
mov dword [rdi], 0
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1403cb150
add rsp, 0x1c0
pop rdi
pop rsi
pop rbx
ret

Function at 0x1402693a0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x140545200]
mov rbx, rcx
mov dword [rsp + 0x50], 0x4020
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x58], 4
test eax, eax
jne 0x140269404
lea r9d, [rax + 2]
mov dword [rsp + 0x20], 3
xor r8d, r8d
lea ecx, [rax + 6]
xor edx, edx
call fcn.1402bea40
test al, al
je 0x1402693f8
mov dword [0x140545200], 2
add rsp, 0x30
pop rbx
ret
mov dword [0x140545200], 1
jmp 0x140269409
cmp eax, 2
je 0x14026945b
lea rax, [rsp + 0x58]
mov edx, 0xffff
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.ws2_32.dll_getsockopt]
test eax, eax
jne 0x14026943a
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x14026945b
lea r9, [rsp + 0x50]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.ws2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret
Function at 0x14026a880
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call fcn.1403edff0
cdqe
add rsp, 0x28
ret

Function at 0x14026ab80
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, [0x140423180]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x14026abaa
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, [0x1404ce678]
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
lea rdx, [0x14042318c]
mov rcx, rbx
mov r14, rax
call fcn.1403e2630
test rax, rax
je 0x14026ac0d
mov rcx, rbx
test r14, r14
je 0x14026abf7
xor edx, edx
lea r8d, [rdx + 8]
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test r14, r14
je 0x14026ac45
lea rdx, [0x140423190]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14026ac45
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x14026ad08
mov qword [rsp + 0x40], rsi
mov rsi, 0xffffffffffffffff
mov rdx, rsi
nop
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x14026ac70
lea ecx, [rax + 1]
add rcx, rdx
call qword [section._________1]
mov rdi, rax
test rax, rax
je 0x14026acfa
mov edx, r15d
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x14026acfa
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x14026aca0
mov ecx, 0x5c
mov word [rax + rdi], cx
inc rsi
cmp byte [rdi + rsi], bpl
jne 0x14026acb4
mov rcx, rdi
sub rcx, rbx
add rcx, rsi
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x14026acd0
mov rcx, rdi
test r14, r14
je 0x14026acf1
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x14026acf7
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [fcn.1403d8820]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x14026ad70
Capabilities:
Get common file path
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x1404f2b48]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
test cl, 2
je 0x14026add6
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.ws2_32.dll_WSAStartup]
test eax, eax
jne 0x14026adb9
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x14026adb3
shr ax, 8
cmp al, 2
je 0x14026add6
call qword [sym.imp.ws2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1403cb150
add rsp, 0x1e8
ret
call fcn.1402bfba0
test eax, eax
jne 0x14026afe0
mov qword [rsp + 0x200], rsi
lea rcx, [0x140423180]
mov qword [rsp + 0x208], rdi
xor esi, esi
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x14026ae16
mov qword [0x140545210], rsi
jmp 0x14026af9d
mov qword [rsp + 0x1f0], rbx
lea rdx, [0x1404ce678]
mov rcx, rdi
mov qword [rsp + 0x1f8], rbp
call qword [sym.imp.kernel32.dll_GetProcAddress]
lea rbx, [0x1404ce478]
mov rbp, rax
mov rcx, rbx
lea rdx, [0x14042318c]
call fcn.1403e2630
test rax, rax
je 0x14026ae7a
mov rcx, rbx
test rbp, rbp
je 0x14026ae6c
xor edx, edx
lea r8d, [rdx + 8]
call rbp
mov rsi, rax
jmp 0x14026af5c
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov rsi, rax
jmp 0x14026af5c
test rbp, rbp
je 0x14026aea9
lea rdx, [0x140423190]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14026aea9
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call rbp
mov rsi, rax
jmp 0x14026af5c
xor edx, edx
mov qword [rsp + 0x1e0], r14
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetSystemDirectoryA]
mov r14d, eax
test eax, eax
je 0x14026af54
lea ecx, [rax + 1]
add rcx, 0xc
call qword [section._________1]
mov rdi, rax
test rax, rax
je 0x14026af4b
mov edx, r14d
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x14026af4b
mov rcx, 0xffffffffffffffff
mov rax, rcx
cmp byte [rdi + rax + 1], sil
lea rax, [rax + 1]
jne 0x14026aef5
mov edx, 0x5c
mov word [rax + rdi], dx
nop dword [rax]
inc rcx
cmp byte [rdi + rcx], sil
jne 0x14026af10
mov rdx, rdi
sub rdx, rbx
add rdx, rcx
movzx eax, byte [rbx]
mov byte [rdx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x14026af22
mov rcx, rdi
test rbp, rbp
je 0x14026af42
xor edx, edx
lea r8d, [rdx + 8]
call rbp
jmp 0x14026af48
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov rsi, rax
mov rcx, rdi
call qword [fcn.1403d8820]
mov r14, qword [rsp + 0x1e0]
mov rbp, qword [rsp + 0x1f8]
mov rbx, qword [rsp + 0x1f0]
mov qword [0x140545210], rsi
test rsi, rsi
je 0x14026af9d
lea rdx, [0x140423170]
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, qword [0x140545208]
test rax, rax
cmovne rcx, rax
mov qword [0x140545208], rcx
xor edx, edx
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.1402bea40
test al, al
lea rcx, [0x1405497c8]
setne byte [0x1405497c0]
call qword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
mov rdi, qword [rsp + 0x208]
xor eax, eax
mov rsi, qword [rsp + 0x200]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1403cb150
add rsp, 0x1e8
ret
Function at 0x14026eb60
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1403cb200
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.kernel32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x140279bb0
Capabilities:
Encode data using xor

Disassembly:
cmp rdx, r8
je 0x140279c50
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea rbx, [rcx - 1]
movsxd rdi, r9d
not rcx
shr rbx, 0x3f
shr rcx, 0x3f
xor r9d, r9d
and rbx, rcx
mov r10, r8
mov ecx, dword [rdx + 8]
dec rbx
xor ecx, dword [r8 + 8]
mov r11, rdx
and ecx, ebx
xor dword [rdx + 8], ecx
xor dword [r8 + 8], ecx
mov ecx, dword [rdx + 0x10]
xor ecx, dword [r8 + 0x10]
and ecx, ebx
xor dword [rdx + 0x10], ecx
xor dword [r8 + 0x10], ecx
mov ecx, dword [rdx + 0x14]
xor ecx, dword [r8 + 0x14]
and ecx, ebx
and ecx, 4
xor dword [rdx + 0x14], ecx
xor dword [r8 + 0x14], ecx
test rdi, rdi
jle 0x140279c46
mov rax, qword [r10]
mov r8, qword [r11]
mov rcx, qword [r8 + r9*8]
mov rdx, rcx
xor rdx, qword [rax + r9*8]
and rdx, rbx
xor rcx, rdx
mov qword [r8 + r9*8], rcx
mov rax, qword [r10]
xor qword [rax + r9*8], rdx
inc r9
cmp r9, rdi
jl 0x140279c1c
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x14027a440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x20
call fcn.1403cb200
sub rsp, rax
xor r14d, r14d
movsxd rsi, edx
xor ebx, ebx
xor ebp, ebp
mov r12d, r9d
mov rdi, r8
mov r15, rcx
test r8, r8
jne 0x14027a494
call fcn.140279f20
mov rbp, rax
mov rdi, rax
test rax, rax
jne 0x14027a494
xor eax, eax
jmp 0x14027a5e9
mov r11d, 1
cmp r12d, r11d
jne 0x14027a4a8
lea rdx, [r15 - 1]
add rdx, rsi
jmp 0x14027a4b4
lea eax, [rsi - 1]
mov rdx, r15
movsxd rcx, eax
add r15, rcx
or rcx, 0xffffffffffffffff
mov r13, r11
cmp r12d, r11d
mov r8d, 0xff
cmovne r13, rcx
cmovne rcx, r11
xor r12d, r12d
cmp dword [rsp + 0x70], ebx
jne 0x14027a501
movzx r14d, byte [rdx]
shr r14d, 7
mov eax, r14d
neg eax
mov eax, r14d
sbb ebx, ebx
and ebx, r8d
neg eax
sbb r12, r12
and r12, r8
jmp 0x14027a501
movzx eax, byte [rdx]
cmp eax, ebx
jne 0x14027a505
add rdx, rcx
sub esi, r11d
test esi, esi
jg 0x14027a4f4
cmp ebx, r8d
jne 0x14027a516
test esi, esi
je 0x14027a513
cmp byte [rdx], 0
jl 0x14027a522
add esi, r11d
test esi, esi
jne 0x14027a522
and dword [rdi + 8], esi
jmp 0x14027a5e6
lea eax, [rsi - 1]
cdq
and edx, 7
lea ebx, [rdx + rax]
sar ebx, 3
add ebx, r11d
cmp ebx, dword [rdi + 0xc]
jg 0x14027a53c
mov rax, rdi
jmp 0x14027a54c
mov edx, ebx
mov rcx, rdi
call fcn.14027a8d0
mov r11d, 1
test rax, rax
jne 0x14027a55e
mov rcx, rbp
call fcn.140279d50
jmp 0x14027a48d
xor r9d, r9d
mov dword [rdi + 8], ebx
mov dword [rdi + 0x10], r14d
test ebx, ebx
je 0x14027a5e2
dec ebx
xor r10d, r10d
xor r8d, r8d
jmp 0x14027a5a7
cmp r8d, 0x40
jae 0x14027a5ab
movzx ecx, byte [r15]
xor rcx, r12
lea rax, [rcx + r14]
xor r14d, r14d
movzx edx, al
cmp rcx, rdx
mov ecx, r8d
seta r14b
shl rdx, cl
or r10, rdx
sub esi, r11d
add r15, r13
add r8d, 8
test esi, esi
jg 0x14027a576
mov rax, qword [rdi]
mov qword [rax + r9*8], r10
add r9d, r11d
test ebx, ebx
jne 0x14027a56c
mov ebx, dword [rdi + 8]
test ebx, ebx
jle 0x14027a5e0
mov rax, qword [rdi]
movsxd rcx, ebx
lea rdx, [rax + rcx*8]
lea rdx, [rdx - 8]
cmp qword [rdx], 0
jne 0x14027a5db
sub ebx, r11d
test ebx, ebx
jg 0x14027a5ca
mov dword [rdi + 8], ebx
test ebx, ebx
jne 0x14027a5e6
and dword [rdi + 0x10], 0
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14027a610
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.1403cb200
sub rsp, rax
mov r12d, r9d
mov ebx, r8d
mov r14, rdx
mov rsi, rcx
xor r15d, r15d
xor ebp, ebp
xor edi, edi
call fcn.140279f80
mov r8d, eax
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp dword [rsp + 0x90], edi
jne 0x14027a68d
mov ebp, dword [rsi + 0x10]
mov ecx, ebp
neg ecx
lea ecx, [rax*8]
sbb r15d, r15d
movzx r15d, r15b
cmp ecx, r8d
jne 0x14027a68b
test ebp, ebp
sete dil
jmp 0x14027a68d
mov edi, ebp
add eax, edi
or r13, 0xffffffffffffffff
cmp ebx, r13d
jne 0x14027a6c8
mov ebx, eax
mov dword [rsp + 0x80], eax
mov eax, dword [rsi + 0xc]
shl eax, 3
movsxd rdx, eax
test eax, eax
jne 0x14027a70d
test ebx, ebx
je 0x14027a79e
movsxd r8, ebx
xor edx, edx
mov rcx, r14
call fcn.1403ccc50
jmp 0x14027a79e
cmp ebx, eax
jge 0x14027a6a1
movups xmm0, xmmword [rsi]
lea rcx, [rsp + 0x28]
movsd xmm1, qword [rsi + 0x10]
movups xmmword [rsp + 0x28], xmm0
movsd qword [rsp + 0x38], xmm1
call fcn.14027a8a0
lea rcx, [rsp + 0x28]
call fcn.140279f80
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, edi
cmp ebx, eax
jge 0x14027a6a1
mov eax, r13d
jmp 0x14027a7a0
cmp r12d, 1
je 0x14027a71c
lea eax, [rbx - 1]
movsxd rcx, eax
add r14, rcx
mov eax, dword [rsi + 8]
mov r10d, 1
cmp r12d, r10d
movsxd rdi, ebx
cmovne r10, r13
shl eax, 3
xor r11d, r11d
cdqe
xor r12d, r12d
lea r13, [rdx - 1]
test ebx, ebx
je 0x14027a79e
mov rbx, rax
mov rdx, qword [rsi]
mov r8, r11
shr r8, 3
mov cl, r11b
and cl, 7
mov rax, r12
sub rax, rbx
shl cl, 3
shr rax, 0x3f
mov r9, qword [rdx + r8*8]
neg al
shr r9, cl
and r9b, al
xor r9b, r15b
lea eax, [r9 + rbp]
cmp r9b, al
mov byte [r14], al
mov rax, r11
seta bpl
sub rax, r13
shr rax, 0x3f
add r14, r10
add r11, rax
inc r12
cmp r12, rdi
jb 0x14027a745
mov ebx, dword [rsp + 0x80]
mov eax, ebx
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x14027e1f0
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x28
call fcn.1403cb200
sub rsp, rax
cmp dword [0x1405452c0], 0
jne 0x14027e29f
xor edx, edx
mov dword [0x1405452c0], 1
mov r8d, 0x198
lea rcx, [0x1405452d0]
call fcn.1403ccc50
mov ecx, 0x202
lea rdx, [0x1405452d0]
call qword [sym.imp.ws2_32.dll_WSAStartup]
test eax, eax
je 0x14027e29f
call fcn.140273ec0
lea r8, [0x14043e8e8]
xor edx, edx
lea rcx, [0x1404c05a8]
call fcn.140273fd0
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
lea r8, [0x14043e8f8]
mov ecx, 2
mov edx, eax
call fcn.1402740c0
call fcn.140273ec0
lea r8, [0x14043e8e8]
xor edx, edx
lea rcx, [0x1404c05a8]
call fcn.140273fd0
xor r8d, r8d
lea edx, [r8 + 0x7a]
lea ecx, [rdx - 0x5a]
call fcn.1402740c0
or eax, 0xffffffff
jmp 0x14027e2a4
mov eax, 1
add rsp, 0x28
ret
Function at 0x14027e2b0
Capabilities:
Set socket configuration

Disassembly:
push rbx
mov eax, 0x20
call fcn.1403cb200
sub rsp, rax
movsxd rcx, ecx
call qword [sym.imp.ws2_32.dll_ioctlsocket]
mov ebx, eax
test eax, eax
jns 0x14027e301
call fcn.140273ec0
lea r8, [0x14043e910]
xor edx, edx
lea rcx, [0x1404c05a8]
call fcn.140273fd0
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
lea r8, [0x14043e928]
mov ecx, 2
mov edx, eax
call fcn.1402740c0
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x14027ff50
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x198]
mov eax, 0x280
call fcn.1403cb200
sub rsp, rax
mov rax, qword [0x1404f2b48]
xor rax, rsp
mov qword [rbp + 0x170], rax
lea rax, [0x14027f920]
movzx r12d, cx
mov qword [rsp + 0x28], rax
lea r14, [0x14043e9c0]
lea rax, [0x14043e9d0]
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x30], rax
xor ebx, ebx
cmp dword [0x1405455a8], ebx
lea rax, [0x14027fd20]
mov qword [rsp + 0x38], rax
lea rax, [0x14043e9e0]
mov qword [rsp + 0x40], rax
lea rax, [0x14027f8c0]
mov qword [rsp + 0x48], rax
je 0x14027ffef
lea rsi, [0x1404f00a8]
jmp 0x140280106
mov edx, 0x104
lea rcx, [rbp + 0x60]
call qword [sym.imp.kernel32.dll_GetSystemDirectoryA]
lea rsi, [0x1404f00a8]
test eax, eax
je 0x1402800fc
mov r15d, 0x10c
lea r8, [rbp + 0x60]
mov edx, r15d
lea rcx, [rsp + 0x50]
call fcn.1403e1f90
lea r8, [0x14043e9f0]
mov edx, r15d
lea rcx, [rsp + 0x50]
call fcn.1403e31e0
lea rcx, [rsp + 0x50]
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140280065
mov rdx, r14
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
jne 0x1402800ae
mov rcx, rdi
call qword [sym.imp.kernel32.dll_FreeLibrary]
lea r8, [rbp + 0x60]
mov rdx, r15
lea rcx, [rsp + 0x50]
call fcn.1403e1f90
lea r8, [0x14043e9f8]
mov rdx, r15
lea rcx, [rsp + 0x50]
call fcn.1403e31e0
lea rcx, [rsp + 0x50]
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1402800fc
mov rdx, r14
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1402800f3
mov r15d, ebx
lea r14, [rsp + 0x28]
mov rdx, qword [r14 - 8]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov qword [r14], rax
test rax, rax
je 0x1402800f3
inc r15d
add r14, 0x10
cmp r15d, 3
jl 0x1402800b6
test rdi, rdi
je 0x1402800fc
mov rax, qword [rsp + rbx + 0x28]
mov qword [rbx + rsi + 8], rax
add rbx, 0x10
cmp rbx, 0x30
jl 0x1402800dd
jmp 0x1402800fc
mov rcx, rdi
call qword [sym.imp.kernel32.dll_FreeLibrary]
mov dword [0x1405455a8], 1
mov rax, r12
add rax, rax
mov rax, qword [rsi + rax*8 + 8]
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1403cb150
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret