joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f0b44
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1400f0770
call fcn.1400bb440
mov dword [rax], socket
call fcn.1400bb1dc
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400f0758
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1400f0758
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1400f07a2
lock or dword [rax + 0x14], 0x10
jmp 0x1400f0758
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1400f07bf
mov rcx, qword [rbp + 0x10]
call fcn.1400feab8
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400ecbf4
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1400e8d1c
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1400f0816
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1400f0758
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1400f0882
mov rcx, qword [rbp + 0x10]
call fcn.1400ecbf4
cmp eax, 0xffffffff
je 0x1400f0869
mov rcx, qword [rbp + 0x10]
call fcn.1400ecbf4
cmp eax, 0xfffffffe
je 0x1400f0869
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400ecbf4
movsxd rdi, eax
lea rsi, [0x140149030]
mov rcx, rbx
sar rdi, 6
call fcn.1400ecbf4
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1400f0870
lea rax, [0x1401471f0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400f0882
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1400f08b8
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1400f08b4
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1400f08b4
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1400f075b
jmp 0x1400f0728
Function at 0x1400fbc4c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400fbc6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400bb3d0
or eax, 0xffffffff
jmp 0x1400fbc6e
xor eax, eax
add rsp, 0x28
ret
Function at 0x140106a14
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x5c]
call fcn.1400ad640
mov eax, 1
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
add rsp, 0x20
pop rbx
ret

Function at 0x140112808
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov ebx, 0x104
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x60]
call fcn.1400ad640
lea rdx, [rbp + 0x60]
call fcn.1401156c8
mov r8d, ebx
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.1400ad640
lea rcx, [rbp + 0x60]
call fcn.140115750
mov r8, rax
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.1400c7950
lea rcx, [rsp + 0x50]
call fcn.1401157dc
lea rdx, [rsp + 0x50]
call fcn.1400034e8
mov dword [rsp + 0x3f], 0x5c7365
mov word [rsp + 0x30], 0x746e
mov dword [rsp + 0x20], 0x54535953
mov word [rsp + 0x33], 0x6c6f
mov dword [rsp + 0x2b], 0x43746e65
mov word [rsp + 0x3d], 0x6369
mov dword [rsp + 0x26], 0x7275435c
mov dword [rsp + 0x36], 0x735c7465
mov byte [rsp + 0x32], WSAStartup
mov word [rsp + 0x3a], 0x7265
mov word [rsp + 0x24], 0x4d45
mov byte [rsp + 0x35], 0x53
mov byte [rsp + 0x3c], 0x76
mov byte [rsp + 0x2f], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x2a], WSAStartup
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x188]
call fcn.14001227c
mov rdx, rax
lea rcx, [0x1401499d0]
call fcn.140001afc
mov r8, rax
lea rcx, [rbp + 0x180]
call fcn.140002d1c
nop
mov rdx, rax
lea rcx, [0x1401499c8]
call fcn.140003378
nop
lea rcx, [rbp + 0x180]
call fcn.140012648
nop
lea rcx, [rbp + 0x188]
call fcn.140012648
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rbp
ret

Function at 0x1401134a4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov al, byte [rcx]
mov r8, rcx
or edx, 0xffffffff
jmp 0x1401134da
movzx eax, al
mov r9d, 7
xor edx, eax
mov ecx, edx
mov eax, edx
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov edx, ecx
xor edx, eax
sub r9d, 1
jns 0x1401134b9
inc r8
mov al, byte [r8]
test al, al
jne 0x1401134ae
not edx
mov eax, edx
ret

Function at 0x14011838c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x10], rdx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdi, rdx
and dword [rbp - 0x30], 0
lea rdx, [rbp - 0x28]
call fcn.140118320
mov rcx, rdi
call fcn.140001564
mov dword [rbp - 0x30], 1
call fcn.1400404cc
xor esi, esi
mov dword [rbp - 0xd], 0x65646362
mov dword [rbp - 0x18], 0x33323130
mov word [rbp - 9], 0x66
mov word [rbp - 0x10], 0x3938
mov word [rbp - 0x13], 0x3635
mov byte [rbp - 0x11], 0x37
mov byte [rbp - 0xe], 0x61
mov byte [rbp - 0x14], 0x34
movzx ebx, byte [rbp + rsi - 0x28]
mov eax, ebx
shr rax, 4
mov dl, byte [rbp + rax - 0x18]
mov rcx, rdi
call fcn.1400034d0
and ebx, 0xf
mov dl, byte [rbp + rbx - 0x18]
mov rcx, rdi
call fcn.1400034d0
inc rsi
cmp rsi, 0x10
jl 0x1401183cd
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x14011a924
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
movups xmm0, xmmword [rcx]
mov rdi, rdx
mov rbx, rcx
movups xmm1, xmmword [rcx + 0x10]
mov word [rbp - 0x36], 0x3433
movups xmmword [rbp + 0x37], xmm0
mov dword [rbp - 0x2c], 0x666564
movups xmmword [rbp + 0x47], xmm1
mov word [rbp - 0x39], 0x3130
mov word [rbp - 0x31], 0x3938
mov word [rbp - 0x2e], 0x6362
mov word [rbp - 0x33], 0x3736
mov byte [rbp - 0x2f], 0x61
mov byte [rbp - 0x37], 0x32
mov byte [rbp - 0x34], 0x35
call fcn.14011aa5c
xor ecx, ecx
lea r8, [rbp + 0x37]
sub r8, rbx
lea r9d, [rcx + 8]
mov edx, dword [rbx]
lea rcx, [rcx + 8]
mov eax, edx
shr rax, 0x1c
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x21], al
mov eax, edx
shr rax, 0x18
and eax, 0xf
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x20], al
mov eax, edx
shr rax, 0x14
and eax, 0xf
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x1f], al
mov eax, edx
shr rax, 0x10
and eax, 0xf
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x1e], al
mov eax, edx
shr rax, 0xc
and eax, 0xf
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x1d], al
mov eax, edx
shr rax, 8
and eax, 0xf
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x1c], al
mov eax, edx
shr rax, 4
and edx, 0xf
and eax, 0xf
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x1b], al
mov al, byte [rbp + rdx - 0x39]
mov byte [rbp + rcx - 0x1a], al
mov eax, dword [r8 + rbx]
mov dword [rbx], eax
lea rbx, [rbx + 4]
sub r9, 1
jne 0x14011a993
mov byte [rbp + rcx - 0x19], r9b
lea rdx, [rbp - 0x19]
mov rcx, rdi
call fcn.14000153c
lea r11, [rsp + 0xb0]
mov rax, rdi
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14011bf84
Capabilities:
Hash data using sha256

Disassembly:
and qword [rcx + 0x20], 0
and qword [rcx + 0x28], 0
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
ret

Function at 0x14011c1e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xcc0
lea rbp, [rsp + 0x30]
mov r13d, WSAStartup
mov qword [rbp + 0xcd0], rbx
xor ebx, ebx
mov dword [rbp + 0x6e], 0x720075
mov rsi, rcx
mov dword [rbp + 0x56], 0x690057
mov r14d, 0x800
mov dword [rbp + 0x44], 0x630069
lea eax, [r13 - 0x2f]
mov dword [rbp + 0x38], 0x410057
mov word [rbp + 0x6c], ax
lea r11d, [r13 - 0xd]
lea eax, [rbx + 0x52]
mov dword [rbp + 0x3e], 0x5c0045
mov word [rbp + 0x3c], ax
lea r10d, [r13 - 3]
lea eax, [rbx + 0x4d]
mov dword [rbp + 0x30], 0x4f0053
mov r8d, r14d
mov word [rbp + 0x42], ax
xor edx, edx
mov dword [rbp + 0x4a], 0x73006f
lea rcx, [rbp + 0x490]
mov dword [rbp + 0x4e], 0x66006f
mov dword [rbp + 0x7e], 0x730072
mov dword [rbp + 0x34], 0x540046
mov dword [rbp + 0x64], 0x4e0020
mov dword [rbp + 0x74], 0x6e0065
mov dword [rbp + 0x82], 0x6f0069
mov dword [rbp + 0x52], 0x5c0074
mov dword [rbp + 0x68], 0x5c0054
mov dword [rbp + 0x78], 0x560074
mov dword [rbp + 0x60], 0x730077
mov dword [rbp + 0x5a], 0x64006e
mov word [rbp + 0x72], r13w
mov word [rbp + 0x48], r13w
mov dword [rbp + 0x86], WSAStartup
mov word [rbp + 0x5e], r10w
mov word [rbp + 0x7c], r11w
mov dword [rbp + 0x12], 0x64006f
mov dword [rbp + 0x16], 0x630075
mov dword [rbp + 0xc], 0x50006c
mov dword [rbp + 8], 0x610074
mov dword [rbp + 0x1a], 0x490074
mov dword [rbp + 4], 0x690067
mov dword [rbp + 0x1e], 0x64
mov dword [rbp], 0x690044
mov word [rbp + 0x10], r13w
call fcn.1400ad640
lea rax, [rbp + 0xce0]
mov dword [rbp + 0xcd8], r14d
mov r9d, 0x101
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x30]
call fcn.1401142ec
test eax, eax
jne 0x14011c427
mov rcx, qword [rbp + 0xce0]
lea rax, [rbp + 0xcd8]
mov qword [rsp + 0x28], rax
lea rdx, [rbp]
lea rax, [rbp + 0x490]
xor r9d, r9d
mov qword [rsp + 0x20], rax
call fcn.140114224
test eax, eax
jne 0x14011c41b
xor edx, edx
lea rcx, [rbp + 0x90]
mov r8d, 0x400
call fcn.1400ad640
mov r8d, dword [rbp + 0xcd8]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x490]
call fcn.14011c448
call fcn.140011fd0
lea rcx, [rbp + 0x90]
mov edi, eax
call fcn.1400bb2e0
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x14011c409
movsxd rax, edx
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14011c3e0
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400ab780
sub rsp, rcx
mov r8d, edx
mov r9d, edi
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.140040b2c
mov rbx, rax
or r9, 0xffffffffffffffff
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call fcn.1400cbcd4
mov rcx, qword [rbp + 0xce0]
call fcn.140115638
mov rbx, qword [rbp + 0xcd0]
lea rsp, [rbp + 0xc90]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14011c500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rbx, rcx
mov edi, 0x200
mov r8d, edi
lea rcx, [rbp - 0x70]
xor edx, edx
call fcn.1400ad640
mov r10d, reloc.WS2_32.dll_WSAGetLastError
mov dword [rbp + 0x1d8], edi
lea rax, [rbp + 0x1e8]
mov dword [rsp + 0x70], 0x740066
mov r9d, 0x20019
mov dword [rbp - 0x7a], 0x700061
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x74], 0x43005c
lea r8d, [r10 + 3]
mov dword [rsp + 0x6a], 0x73006f
lea r13d, [r10 - 7]
mov word [rsp + 0x68], r8w
mov word [rbp - 0x7c], r8w
lea r15d, [r10 - 0x22]
mov word [rbp - 0x76], r13w
mov dword [rsp + 0x58], 0x410057
mov dword [rsp + 0x78], 0x790072
mov dword [rsp + 0x60], 0x4d005c
mov dword [rsp + 0x7c], 0x740070
mov dword [rsp + 0x64], 0x630069
mov dword [rbp - 0x80], 0x67006f
mov dword [rsp + 0x5c], 0x450052
mov dword [rsp + 0x50], 0x4f0053
mov dword [rsp + 0x54], 0x540046
mov dword [rbp - 0x74], 0x79
mov word [rsp + 0x6e], r10w
mov qword [rsp + 0x20], rax
call fcn.1401142ec
test eax, eax
jne 0x14011c6cf
mov rcx, qword [rbp + 0x1e8]
lea rax, [rbp + 0x1d8]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x1e0]
lea rax, [rbp - 0x70]
mov dword [rsp + 0x38], 0x6e0069
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], 0x64
mov dword [rsp + 0x3c], 0x470065
mov dword [rsp + 0x32], 0x630061
mov dword [rsp + 0x40], 0x690075
mov word [rsp + 0x30], r15w
mov word [rsp + 0x36], r13w
call fcn.140114224
test eax, eax
je 0x14011c6ae
lea rax, [rbp + 0x1e8]
mov r9d, 0x20119
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.1401142ec
test eax, eax
jne 0x14011c6cf
mov rcx, qword [rbp + 0x1e8]
lea rax, [rbp + 0x1d8]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x1e0]
lea rax, [rbp - 0x70]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140114224
test eax, eax
jne 0x14011c6cf
or r9, 0xffffffffffffffff
lea r8, [rbp - 0x70]
mov edx, 0x800
mov rcx, rbx
call fcn.1400cbcd4
mov rcx, qword [rbp + 0x1e8]
call fcn.140115638
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x004d1710]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x004d1720]
mov dword [rax], 1
mov rax, qword [0x004d1730]
mov dword [rax], 1
mov rax, qword [0x004d1700]
mov dword [rax], 1
mov rax, qword [0x004d1490]
cmp word [rax], 0x5a4d
je 0x4010d0
mov rax, qword [0x004d16f0]
mov dword [0x004d6008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010c2
mov ecx, 2
call sym.__set_app_type
mov rcx, 0xffffffffffffffff
call sym._encode_pointer
mov rdx, qword [0x004d1530]
mov qword [rdx], rax
mov rdx, qword [0x004d1520]
mov qword [rdx], rax
mov rax, qword [0x004d15b0]
mov edx, dword [rax]
mov rax, qword [sym.imp.msvcrt.dll__fmode]
mov rax, qword [rax]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x004d1420]
cmp dword [rax], 1
je 0x401120
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401133
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058
Function at 0x4419d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x838
mov rbx, qword [0x004d1950]
mov edx, 0xa
mov rdi, qword [rbx + 0x128]
mov rcx, rdi
call sym.strchr
test rax, rax
mov rbp, rax
je 0x441ae0
mov rcx, rdi
call sym.strlen
lea rdx, [0x004c3f7a]
mov rcx, rdi
mov rsi, rax
call sub.msvcrt.dll_strtok
test rax, rax
mov rbp, rax
je 0x441c6c
mov rcx, rax
call sym.strdup
mov rbp, rax
mov r8, rax
mov edx, dword [r8]
add r8, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x441a3e
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r8 + 2]
mov edi, eax
cmove r8, rdx
add dil, al
sbb r8, 3
sub r8, rbp
lea rdx, [r8 + 1]
cmp rsi, rdx
jg 0x441ac0
mov rax, qword [rbx + 0x128]
mov byte [rax], 0
cmp byte [0x004d6040], 0
je 0x441aa7
lea rdx, str.___s
mov r8, rbp
mov ecx, 4
call dbg.applog
mov rax, rbp
add rsp, 0x838
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rbx + 0x128]
sub rsi, r8
lea r8, [rsi + 1]
add rdx, rcx
call sym.memmove
jmp 0x441a8a
lea rcx, [rsp + 0x28]
mov r12, qword [sym.imp.msvcrt.dll__time64]
call r12
mov rcx, qword [rbx + 0x118]
mov edx, 0x3c
call dbg.socket_full.lto_priv.89
test al, al
je 0x441c7f
lea rsi, [rsp + 0x30]
mov r14, qword [sym.imp.WS2_32.dll_recv]
xor r13d, r13d
jmp 0x441be1
mov rdi, qword [rbx + 0x128]
mov rcx, rdi
call sym.strlen
mov r8, rsi
mov r15, rax
mov eax, dword [r8]
add r8, 4
lea edx, [rax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x441b35
mov eax, edx
shr eax, 0x10
test edx, 0x8080
cmove edx, eax
lea rax, [r8 + 2]
cmove r8, rax
mov eax, edx
add al, dl
sbb r8, 3
sub r8, rsi
lea rdx, [r8 + r15 + 1]
cmp rdx, qword [rbx + 0x120]
jb 0x441ba4
and rdx, 0xfffffffffffff800
mov rcx, rdi
add rdx, 0x800
mov qword [rbx + 0x120], rdx
call sym.realloc
mov qword [rbx + 0x128], rax
mov rdi, rax
lea rcx, [rdi + r15]
mov rdx, rsi
call sym.strcpy
xor ecx, ecx
call r12
sub rax, qword [rsp + 0x28]
cmp rax, 0x3b
jg 0x441c60
mov rdi, qword [rbx + 0x128]
mov edx, 0xa
mov rcx, rdi
call sym.strchr
test rax, rax
jne 0x441a0a
mov rax, r13
mov ecx, 0x100
mov rdi, rsi
rep stosq qword [rdi], rax
xor r9d, r9d
mov rcx, qword [rbx + 0x118]
mov r8d, 0x7fc
mov rdx, rsi
call r14
cdqe
test rax, rax
je 0x441c40
jns 0x441b20
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x441c40
mov rcx, qword [rbx + 0x118]
mov edx, 1
call dbg.socket_full.lto_priv.89
test al, al
jne 0x441bb0
nop dword [rax + rax]
lea rdx, str.stratum_recv_line_failed
xor ecx, ecx
call dbg.applog
jmp 0x441aa7
mov rdi, qword [rbx + 0x128]
jmp 0x441a0a
lea rdx, str.stratum_recv_line_failed_to_parse_a_newline_terminated_string
xor ecx, ecx
call dbg.applog
jmp 0x441aa7
lea rdx, str.stratum_recv_line_timed_out
xor ecx, ecx
call dbg.applog
jmp 0x441aa7
Function at 0x44c720
Capabilities:
Hash data using sha512

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov rdi, qword [rcx + 0x80]
mov rbx, rcx
mov rsi, rdx
mov rdx, qword [rbx + 0xe8]
mov rbp, qword [rbx + 0xf0]
lea ecx, [rdi*8]
test rdi, rdi
mov byte [rsp + rdi + 0x20], pe_nt_image_headers64
mov rax, rcx
lea r12, [rcx + rdx]
jne 0x44c960
mov qword [rbx + 0xe8], 0xfffffffffffffc00
mov qword [rbx + 0xf0], 0xffffffffffffffff
lea r13, [rsp + 0x20]
cmp eax, 0x37e
lea rcx, [r13 + rdi + 1]
ja 0x44c8e0
mov r8d, 0x6f
xor edx, edx
sub r8, rdi
call sym.memset
or byte [rsp + 0x8f], 1
bswap rbp
mov qword [rsp + 0x90], rbp
bswap r12
mov r8d, pe_nt_image_headers64
lea rdx, [r13 + rdi]
mov rcx, rbx
sub r8, rdi
mov qword [rsp + 0x98], r12
call dbg.blake64.lto_priv.145
xor edx, edx
nop word [rax + rax]
mov rax, qword [rbx + rdx*8 + 0x88]
bswap rax
mov qword [rsi + rdx*8], rax
add rdx, 1
cmp rdx, 8
jne 0x44c7e0
mov rax, qword [global_iv.2]
mov qword [rbx + 0xf0], 0
mov qword [rbx + 0xe8], 0
mov qword [rbx + 0x80], 0
mov qword [rbx + 0x88], rax
mov rax, qword [0x004cca88]
mov qword [rbx + 0x90], rax
mov rax, qword [0x004cca90]
mov qword [rbx + 0x98], rax
mov rax, qword [0x004cca98]
mov qword [rbx + 0xa0], rax
mov rax, qword [0x004ccaa0]
mov qword [rbx + 0xa8], rax
mov rax, qword [0x004ccaa8]
mov qword [rbx + 0xb0], rax
mov rax, qword [0x004ccab0]
mov qword [rbx + 0xb8], rax
mov rax, qword [0x004ccab8]
mov qword [rbx + 0xc0], rax
mov rax, qword [global_salt]
mov qword [rbx + 0xc8], rax
mov rax, qword [0x004cca68]
mov qword [rbx + 0xd0], rax
mov rax, qword [0x004cca70]
mov qword [rbx + 0xd8], rax
mov rax, qword [0x004cca78]
mov qword [rbx + 0xe0], rax
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r8d, 0x7f
xor edx, edx
sub r8, rdi
call sym.memset
lea rdx, [r13 + rdi]
mov r8d, pe_nt_image_headers64
mov rcx, rbx
sub r8, rdi
mov rdi, r13
call dbg.blake64.lto_priv.145
xor eax, eax
mov ecx, 0xe
mov qword [rbx + 0xe8], 0xfffffffffffffc00
rep stosq qword [rdi], rax
mov qword [rbx + 0xf0], 0xffffffffffffffff
mov byte [rsp + 0x8f], 1
bswap rbp
mov qword [rsp + 0x90], rbp
bswap r12
mov r8d, pe_nt_image_headers64
mov rdx, r13
mov rcx, rbx
mov qword [rsp + 0x98], r12
call dbg.blake64.lto_priv.145
jmp 0x44c7d5
test rdx, rdx
jne 0x44c990
lea rdx, [rbp - 1]
sub rcx, 0x400
mov qword [rbx + 0xe8], rcx
mov qword [rbx + 0xf0], rdx
jmp 0x44c77c
mov ecx, 0x400
sub ecx, eax
sub rdx, rcx
mov qword [rbx + 0xe8], rdx
jmp 0x44c77c
Function at 0x4555a0
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x120
cmp r8d, 0x3f
mov rbx, rcx
mov r12, rdx
mov r14d, r8d
jle 0x455795
lea rsi, [rsp + 0xe0]
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0xa0]
lea r13, [rsp + 0x60]
nop
xor eax, eax
nop dword [rax]
nop word cs:[rax + rax]
mov edx, dword [r12 + rax]
mov dword [rsi + rax], edx
xor edx, dword [rbx + rax]
mov dword [rbp + rax], edx
add rax, 4
cmp rax, 0x40
jne 0x4555f0
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call dbg.RND512Q.lto_priv.97
mov r8d, 0x1000000
mov rdx, rsi
mov rcx, rdi
call dbg.RND512Q.lto_priv.97
mov r8d, 0x2000000
mov rdx, rdi
mov rcx, rsi
call dbg.RND512Q.lto_priv.97
mov r8d, 0x3000000
mov rdx, rsi
mov rcx, rdi
call dbg.RND512Q.lto_priv.97
mov r8d, 0x4000000
mov rdx, rdi
mov rcx, rsi
call dbg.RND512Q.lto_priv.97
mov r8d, 0x5000000
mov rdx, rsi
mov rcx, rdi
call dbg.RND512Q.lto_priv.97
mov r8d, 0x6000000
mov rdx, rdi
mov rcx, rsi
call dbg.RND512Q.lto_priv.97
mov r8d, 0x7000000
mov rdx, rsi
mov rcx, rdi
call dbg.RND512Q.lto_priv.97
mov r8d, 0x8000000
mov rdx, rdi
mov rcx, rsi
call dbg.RND512Q.lto_priv.97
mov r8d, 0x9000000
mov rdx, r13
mov rcx, rdi
call dbg.RND512Q.lto_priv.97
xor r8d, r8d
mov rdx, rdi
mov rcx, rbp
call dbg.RND512P.lto_priv.96
mov r8d, 1
mov rdx, rsi
mov rcx, rdi
call dbg.RND512P.lto_priv.96
mov r8d, 2
mov rdx, rdi
mov rcx, rsi
call dbg.RND512P.lto_priv.96
mov r8d, 3
mov rdx, rsi
mov rcx, rdi
call dbg.RND512P.lto_priv.96
mov r8d, 4
mov rdx, rdi
mov rcx, rsi
call dbg.RND512P.lto_priv.96
mov r8d, 5
mov rdx, rsi
mov rcx, rdi
call dbg.RND512P.lto_priv.96
mov r8d, 6
mov rdx, rdi
mov rcx, rsi
call dbg.RND512P.lto_priv.96
mov r8d, 7
mov rdx, rsi
mov rcx, rdi
call dbg.RND512P.lto_priv.96
mov r8d, 8
mov rdx, rdi
mov rcx, rsi
call dbg.RND512P.lto_priv.96
mov r8d, 9
mov rdx, rbp
mov rcx, rdi
call dbg.RND512P.lto_priv.96
xor eax, eax
nop dword [rax + rax]
mov edx, dword [rbx + rax]
xor edx, dword [rbp + rax]
xor edx, dword [r13 + rax]
mov dword [rbx + rax], edx
add rax, 4
cmp rax, 0x40
jne 0x455760
add dword [rbx + 0x40], 1
jne 0x455783
add dword [rbx + 0x44], 1
sub r14d, 0x40
add r12, 0x40
cmp r14d, 0x3f
jg 0x4555e0
add rsp, 0x120
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret