joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a8d4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
and qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000000
lea rdx, [0x140015c50]
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000a9a1
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
and qword [rbp + 0x28], 0
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000a992
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rdx, str.InsecureQI
lea rax, [rbp + 0x20]
mov dword [rbp + 0x18], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000a992
cmp dword [rbp + 0x18], 4
jne 0x14000a992
mov ebx, dword [rbp + 0x20]
cmp ebx, 3
ja 0x14000a992
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x14000a9a3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000a9a3
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x14000a9a1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14000a9b2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000ad94
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
mov rbp, rsp
sub rsp, 0x30
cmp byte [0x14001fed0], 0
je 0x14000adba
mov eax, dword [0x14001fed4]
jmp 0x14000aebe
and qword [rbp + 0x18], 0
lea rax, [rbp + 0x18]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwarePoliciesMicrosoftSecurity
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, 4
lea rsi, [0x14001fed4]
test eax, eax
jne 0x14000ae26
mov rcx, qword [rbp + 0x18]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea rdx, str.CLSIDInterfaceTest
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov dword [rbp + 0x10], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000ae26
cmp dword [rbp + 0x10], ebx
je 0x14000ae95
mov rcx, qword [rbp + 0x18]
and qword [rbp + 0x18], 0
test rcx, rcx
je 0x14000ae3a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x18]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftSecurity
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000ae9d
mov rcx, qword [rbp + 0x18]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea rdx, str.CLSIDInterfaceTest
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov dword [rbp + 0x10], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000ae9d
cmp dword [rbp + 0x10], ebx
jne 0x14000ae9d
mov ebx, dword [0x14001fed4]
jmp 0x14000aea6
and dword [0x14001fed4], 0
xor ebx, ebx
mov rcx, qword [rbp + 0x18]
mov byte [0x14001fed0], 1
test rcx, rcx
je 0x14000aebc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
Function at 0x14000b964
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x14001e048]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rdx
mov r8, rcx
or rdi, 0xffffffffffffffff
lea rcx, [rsp + 0x20]
mov r9, rdi
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea edx, [rdi + 0x5d]
lea rcx, [rsp + 0x20]
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
lea rdx, [rsp + 0x228]
mov r9, rdi
add rax, 2
mov r8, rbx
sub rdx, rax
mov rcx, rax
sar rdx, 1
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea rcx, [rsp + 0x20]
call fcn.14000b2d0
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x14000b9e7
mov eax, ebx
jmp 0x14000b9ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x14001fee4], eax
test rdi, rdi
je 0x14000ba00
mov dword [0x14001fee0], ebx
jmp 0x14000ba1e
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [0x14001fee0], eax
cmp eax, 0xffffffff
jne 0x14000ba1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x14001fedc], ebx
mov rax, rdi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140010d90
mov rbx, qword [rsp + 0x260]
add rsp, 0x240
pop rdi
ret

Function at 0x14000ba48
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x14001e048]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor ebx, ebx
mov dword [rsp + 0x40], 0x208
lea rax, [rsp + 0x40]
mov rdi, rcx
mov qword [rsp + 0x30], rax
lea r8, str.CommonFilesDir
lea rax, [rsp + 0x50]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x28], rax
lea esi, [rbx + 2]
mov r9d, esi
mov qword [rsp + 0x20], rbx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000bafb
cmp dword [rsp + 0x40], 4
jb 0x14000bafb
mov eax, dword [rsp + 0x40]
lea r8, str.Microsoft_SharedOffice16_
shr rax, 1
lea rcx, [rsp + 0x50]
mov edx, 0x104
cmp word [rsp + rax*2 + 0x4c], 0x5c
cmove ebx, esi
or r9, 0xffffffffffffffff
add r8, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.14000b964
jmp 0x14000bafd
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140010d90
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000bb24
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x14001e048]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x30], rax
lea rdx, str.SoftwareMicrosoftOffice16.0CommonFilesPaths
lea rax, [rsp + 0x50]
mov rbx, rcx
mov r8, rcx
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov r9d, 2
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000bb9b
cmp dword [rsp + 0x40], 4
jb 0x14000bb9b
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.14000b964
jmp 0x14000bb9d
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140010d90
add rsp, 0x270
pop rbx
ret

Function at 0x17646dc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x17646e6
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x176470f
pop rbp
sub rbp, 0x33
sub rbp, 0x13646dc
sub rsp, 0x20
jmp 0x176472e
mov rax, 0x13646dc
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x1c09cd6c
xor byte [rax], dl
inc rax
dec rcx
jne 0x176474d
jmp 0x1764764
and al, 0xe5
test edi, esp
in eax, 0x50
insb byte [rdi], dx
insb byte [rdi], dx
insb byte [rdi], dx
and al, 0xed
lodsd eax, dword [rsi]
insd dword [rdi], dx
insb byte [rdi], dx
insb byte [rdi], dx
and al, 0x6d
test dword [rbx + rbp*4], esp
lodsb al, byte [rsi]
imul ebp, dword [rsp + rbp*2 + 0x6c], 0x44aeab24
insb byte [rdi], dx
insb byte [rdi], dx
insb byte [rdi], dx
and al, 0xab
scasb al, byte [rdi]
insb byte [rdi], dx
insb byte [rdi], dx
insb byte [rdi], dx
and al, 0x9b
mov fs, word [rbp*2 + 0x60ede7ad]
insb byte [rdi], dx
insb byte [rdi], dx
insb byte [rdi], dx
and al, 0x6d
test byte [rsp + rdi], bh
and al, 0xd4
test al, 0xfe
insb byte [rdi], dx
insb byte [rdi], dx
insb byte [rdi], dx
insb byte [rdi], dx
insb byte [rdi], dx
and al, 0xd5
je 0x176477c
invalid
Function at 0x1400d9e90
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
mov rdx, rcx
cmp rbx, 0x20
jb 0x1400d9fd6
mov qword [rsp + 0x30], rsi
lea r11, [rcx - 0x1f]
mov qword [rsp + 0x38], rdi
add r11, rbx
movabs rdi, 0xc2b2ae3d27d4eb4f
xor r9d, r9d
mov r8, rdi
movabs rcx, 0x60ea27eeadc0b5d6
movabs rsi, 0x9e3779b185ebca87
movabs r10, 0x61c8864e7a143579
nop word [rax + rax]
mov rax, qword [rdx]
imul rax, rdi
add rcx, rax
mov rax, qword [rdx + 8]
imul rax, rdi
rol rcx, 0x1f
add r8, rax
mov rax, qword [rdx + 0x10]
imul rax, rdi
imul rcx, rsi
add r9, rax
rol r8, 0x1f
mov rax, qword [rdx + 0x18]
add rdx, 0x20
imul rax, rdi
imul r8, rsi
add r10, rax
rol r9, 0x1f
rol r10, 0x1f
imul r10, rsi
imul r9, rsi
cmp rdx, r11
jb 0x1400d9ef0
mov r11, r10
mov rax, r9
rol r11, 0x12
rol rax, 0xc
add r11, rax
mov rax, r8
rol rax, 7
add r11, rax
mov rax, rcx
imul rcx, rdi
imul r8, rdi
imul r9, rdi
imul r10, rdi
mov rdi, qword [rsp + 0x38]
rol rax, 1
add r11, rax
rol rcx, 0x1f
movabs rax, 0x7a1435883d4d519d
rol r8, 0x1f
imul rcx, rsi
imul r8, rsi
xor r11, rcx
rol r9, 0x1f
imul r11, rsi
imul r9, rsi
sub r11, rax
rol r10, 0x1f
xor r11, r8
imul r11, rsi
imul r10, rsi
sub r11, rax
xor r11, r9
imul r11, rsi
sub r11, rax
xor r11, r10
imul r11, rsi
mov rsi, qword [rsp + 0x30]
sub r11, rax
jmp 0x1400d9fe0
movabs r11, 0x27d4eb2f165667c5
lea rcx, [r11 + rbx]
mov r9d, 1
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400d9d90
Function at 0x1400da1d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov rbx, qword [rcx]
mov rdi, rcx
movabs rbp, 0xc2b2ae3d27d4eb4f
movabs rsi, 0x9e3779b185ebca87
movabs r14, 0x27d4eb2f165667c5
movabs r15, 0x7a1435883d4d519d
cmp rbx, 0x20
jb 0x1400da2b8
mov r8, qword [rcx + 8]
mov r10, qword [rcx + 0x20]
mov rdx, r8
mov r9, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov rax, r9
rol rax, 0xc
mov r11, rcx
rol r11, 7
add r11, rax
rol r8, 1
mov rax, r10
imul rdx, rbp
imul rcx, rbp
imul r9, rbp
imul r10, rbp
rol rax, 0x12
add r11, rax
rol rdx, 0x1f
add r11, r8
rol rcx, 0x1f
imul rdx, rsi
imul rcx, rsi
rol r9, 0x1f
movabs rax, 0x85ebca77c2b2ae63
xor r11, rdx
rol r10, 0x1f
imul r11, rsi
imul r9, rsi
imul r10, rsi
sub r11, r15
xor r11, rcx
imul r11, rsi
sub r11, r15
xor r11, r9
imul r11, rsi
sub r11, r15
xor r11, r10
imul r11, rsi
add rax, r11
jmp 0x1400da2bf
mov rax, qword [rcx + 0x18]
add rax, r14
add rax, rbx
lea r8, [rdi + 0x28]
and ebx, 0x1f
cmp rbx, 8
jb 0x1400da307
mov edx, ebx
shr rdx, 3
imul rcx, rdx, 0xfffffffffffffff8
add rbx, rcx
nop dword [rax]
mov rcx, qword [r8]
add r8, 8
imul rcx, rbp
rol rcx, 0x1f
imul rcx, rsi
xor rax, rcx
rol rax, 0x1b
imul rax, rsi
sub rax, r15
sub rdx, 1
jne 0x1400da2e0
movabs r9, 0x165667b19e3779f9
cmp rbx, 4
jb 0x1400da334
mov edx, dword [r8]
add r8, 4
imul rdx, rsi
xor rax, rdx
rol rax, 0x17
imul rax, rbp
add rax, r9
sub rbx, 4
test rbx, rbx
je 0x1400da35d
nop dword [rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
imul rcx, r14
xor rax, rcx
rol rax, 0xb
imul rax, rsi
sub rbx, 1
jne 0x1400da340
mov rbx, qword [rsp + 0x18]
mov rcx, rax
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
shr rcx, 0x21
xor rcx, rax
imul rcx, rbp
mov rbp, qword [rsp + 0x20]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r9
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
ret
Function at 0x1400fe720
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, 0x20
call fcn.140293a60
sub rsp, rax
mov rbx, r8
call fcn.1400fe980
test eax, eax
js 0x1400fe974
mov eax, dword [rbx + 0xf0]
shl eax, 2
movsxd r9, eax
test eax, eax
jle 0x1400fe7ad
lea r8, [rbx + 8]
xor r10d, r10d
lea r8, [r8 + r9*4]
lea rax, [rbx + 8]
nop
mov edx, dword [rax - 8]
add r10, 4
mov ecx, dword [r8 - 8]
lea r8, [r8 - 0x10]
mov dword [rax - 8], ecx
lea rax, [rax + 0x10]
mov ecx, dword [r8 + 0xc]
sub r9, 4
mov dword [r8 + 8], edx
mov edx, dword [rax - 0x14]
mov dword [rax - 0x14], ecx
mov ecx, dword [r8 + 0x10]
mov dword [r8 + 0xc], edx
mov edx, dword [rax - 0x10]
mov dword [rax - 0x10], ecx
mov ecx, dword [r8 + 0x14]
mov dword [r8 + 0x10], edx
mov edx, dword [rax - 0xc]
mov dword [rax - 0xc], ecx
mov dword [r8 + 0x14], edx
cmp r10, r9
jl 0x1400fe760
mov r11d, 1
cmp dword [rbx + 0xf0], r11d
jle 0x1400fe972
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 4]
lea rdi, [0x140000000]
mov r9d, dword [r10 + 0x10]
lea r10, [r10 + 0x10]
mov edx, dword [r10 - 4]
inc r11d
movzx eax, byte [r10 - 3]
movzx ecx, byte [rdi + rax*4 + 0x2d5ea0]
mov eax, edx
shr rax, 0x18
mov r8d, dword [rdi + rcx*4 + 0x2d72a0]
movzx eax, byte [rdi + rax*4 + 0x2d5ea0]
xor r8d, dword [rdi + rax*4 + 0x2d6aa0]
movzx eax, dl
movzx ecx, byte [rdi + rax*4 + 0x2d5ea0]
movzx eax, byte [r10 - 2]
xor r8d, dword [rdi + rcx*4 + 0x2d76a0]
movzx ecx, byte [rdi + rax*4 + 0x2d5ea0]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x2d6ea0]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10 - 4], r8d
movzx edx, byte [rdi + rcx*4 + 0x2d5ea0]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x2d6ea0]
movzx eax, byte [rdi + rcx*4 + 0x2d5ea0]
xor r8d, dword [rdi + rax*4 + 0x2d72a0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x2d5ea0]
movzx eax, r9b
mov r9d, dword [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0x2d6aa0]
movzx ecx, byte [rdi + rax*4 + 0x2d5ea0]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x2d76a0]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10], r8d
movzx edx, byte [rdi + rcx*4 + 0x2d5ea0]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x2d6ea0]
movzx eax, byte [rdi + rcx*4 + 0x2d5ea0]
xor r8d, dword [rdi + rax*4 + 0x2d72a0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x2d5ea0]
movzx eax, r9b
mov r9d, dword [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0x2d6aa0]
movzx ecx, byte [rdi + rax*4 + 0x2d5ea0]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x2d76a0]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10 + 4], r8d
movzx edx, byte [rdi + rcx*4 + 0x2d5ea0]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x2d6ea0]
movzx eax, byte [rdi + rcx*4 + 0x2d5ea0]
xor r8d, dword [rdi + rax*4 + 0x2d72a0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x2d5ea0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x2d6aa0]
movzx ecx, byte [rdi + rax*4 + 0x2d5ea0]
xor r8d, dword [rdi + rcx*4 + 0x2d76a0]
mov dword [r10 + 8], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x1400fe7d0
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140100710
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140293a60
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x14010a6c0
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x14010a6e7
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x14010a6d0
movzx eax, r9b
ret

Function at 0x140116030
Capabilities:
Encode data using add xor sub operations

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x14011609c
movzx ecx, byte [rcx]
test cl, cl
je 0x14011609c
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
or r9d, r11d
mov r8d, eax
mov edx, r9d
mov ecx, 0x20
shr edx, 2
add r11d, 0x100
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x140116050
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret

Function at 0x1401160a0
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x20
call fcn.140293a60
sub rsp, rax
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
je 0x140116133
movzx eax, byte [rcx]
test al, al
je 0x140116133
mov qword [rsp + 0x30], rsi
mov esi, 0x100
nop
movsx ecx, al
call fcn.1401095a0
mov r9d, eax
mov edx, ebx
or r9d, esi
lea rdi, [rdi + 1]
mov eax, ebx
mov r8d, r9d
shr r8d, 2
mov ecx, 0x20
xor r8d, r9d
add esi, 0x100
and r8d, 0xf
imul r9d, r9d
sub ecx, r8d
shr rdx, cl
mov ecx, r8d
shl eax, cl
mov ebx, edx
or ebx, eax
movzx eax, byte [rdi]
xor ebx, r9d
test al, al
jne 0x1401160d0
mov rsi, qword [rsp + 0x30]
mov eax, ebx
shr eax, 0x10
xor eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1401198f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
movsxd rbx, r9d
mov r10, r8
mov r11, rdx
cmp rdx, r8
je 0x140119a52
mov qword [rsp + 0x10], rsi
lea rsi, [rcx - 1]
not rcx
shr rsi, 0x3f
shr rcx, 0x3f
and rsi, rcx
mov ecx, dword [rdx + 8]
xor ecx, dword [r8 + 8]
dec rsi
and ecx, esi
xor dword [rdx + 8], ecx
xor dword [r8 + 8], ecx
mov ecx, dword [rdx + 0x10]
movq xmm4, rsi
xor ecx, dword [r8 + 0x10]
and ecx, esi
punpcklqdq xmm4, xmm4
xor dword [rdx + 0x10], ecx
xor dword [r8 + 0x10], ecx
mov edx, dword [rdx + 0x14]
mov ecx, dword [r8 + 0x14]
xor rcx, rdx
and ecx, 4
and rcx, rsi
mov eax, ecx
xor eax, edx
mov dword [r11 + 0x14], eax
xor dword [r8 + 0x14], ecx
xor ecx, ecx
mov edx, ecx
test r9d, r9d
jle 0x140119a0e
cmp ebx, 2
jb 0x140119a0e
mov r9, qword [r8]
lea rax, [rbx - 1]
mov r8, qword [r11]
mov qword [rsp + 0x18], rdi
lea rdi, [rbx - 1]
lea rdi, [r9 + rdi*8]
lea rax, [r8 + rax*8]
cmp r9, rax
ja 0x14011999e
cmp rdi, r8
jae 0x140119a09
cmp r9, r10
ja 0x1401199a8
cmp rdi, r10
jae 0x140119a09
cmp r9, r11
ja 0x1401199b2
cmp rdi, r11
jae 0x140119a09
cmp r8, r10
ja 0x1401199bc
cmp rax, r10
jae 0x140119a09
cmp r8, r11
ja 0x1401199c6
cmp rax, r11
jae 0x140119a09
mov eax, ebx
and eax, 0xfffffffe
nop dword [rax + rax]
movdqu xmm2, xmmword [rcx + r9]
add edx, 2
movdqu xmm1, xmmword [rcx + r8]
lea rcx, [rcx + 0x10]
movdqa xmm3, xmm2
xorps xmm3, xmm1
andps xmm3, xmm4
movdqa xmm0, xmm3
xorps xmm3, xmm2
xorps xmm0, xmm1
movdqu xmmword [rcx + r8 - 0x10], xmm0
movdqu xmmword [rcx + r9 - 0x10], xmm3
cmp edx, eax
jl 0x1401199d0
mov rdi, qword [rsp + 0x18]
movsxd rax, edx
cmp rax, rbx
jge 0x140119a4d
nop word [rax + rax]
mov rcx, qword [r11]
mov rdx, qword [rcx + rax*8]
lea r8, [rcx + rax*8]
mov rcx, qword [r10]
mov r9, rdx
xor r9, qword [rcx + rax*8]
and r9, rsi
xor rdx, r9
mov qword [r8], rdx
mov rcx, qword [r10]
xor qword [rcx + rax*8], r9
inc rax
cmp rax, rbx
jl 0x140119a20
mov rsi, qword [rsp + 0x10]
pop rbx
ret
Function at 0x140123710
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x28
call fcn.140293a60
sub rsp, rax
cmp dword [0x1404285e0], 0
jne 0x1401237ca
xor edx, edx
mov dword [0x1404285e0], 1
mov r8d, 0x198
lea rcx, [0x1404285f0]
call fcn.1402d2f00
mov ecx, 0x202
lea rdx, [0x1404285f0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1401237ca
call fcn.140102060
lea r8, str.BIO_sock_init
mov edx, __WSAFDIsSet
lea rcx, str.crypto_bio_bio_sock.c
call fcn.140102180
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_wsastartup__
mov ecx, 2
mov edx, eax
call fcn.140102280
call fcn.140102060
lea r8, str.BIO_sock_init
mov edx, __WSAFDIsSet
lea rcx, str.crypto_bio_bio_sock.c
call fcn.140102180
xor r8d, r8d
lea edx, [r8 + 0x7a]
lea ecx, [rdx - 0x5a]
call fcn.140102280
mov eax, 0xffffffff
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret

Function at 0x1401237e0
Capabilities:
Set socket configuration

Disassembly:
push rbx
mov eax, 0x20
call fcn.140293a60
sub rsp, rax
mov dword [rsp + 0x30], edx
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
movsxd rcx, ecx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov ebx, eax
test eax, eax
jns 0x140123842
call fcn.140102060
lea r8, str.BIO_socket_ioctl
mov edx, 0xd1
lea rcx, str.crypto_bio_bio_sock.c
call fcn.140102180
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_ioctlsocket__
mov ecx, 2
mov edx, eax
call fcn.140102280
xor eax, eax
test ebx, ebx
sete al
add rsp, 0x20
pop rbx
ret

Function at 0x140123850
Capabilities:
Get socket status

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x260
call fcn.140293a60
sub rsp, rax
mov rax, qword [0x140423a40]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov edi, ecx
mov rbx, r8
mov esi, edx
cmp ecx, 0x3f
ja 0x1401238e2
test rbx, rbx
jne 0x14012388a
lea eax, [r8 + 1]
jmp 0x1401238e7
xor ecx, ecx
call fcn.1402a2a48
mov rcx, rax
cmp rbx, rax
jge 0x14012389d
xor eax, eax
jmp 0x1401238e7
xor eax, eax
mov qword [rsp + 0x48], rdi
sub ebx, ecx
mov dword [rsp + 0x34], eax
test esi, esi
mov dword [rsp + 0x40], 1
lea r8, [rsp + 0x40]
mov dword [rsp + 0x30], ebx
cmovne r8, rax
lea rdx, [rsp + 0x40]
cmove rdx, rax
lea ecx, [rdi + 1]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
jmp 0x1401238e7
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140293710
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret
Function at 0x140124620
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov eax, 0x280
call fcn.140293a60
sub rsp, rax
mov rax, qword [0x140423a40]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [0x140428790], 0
lea rax, [0x140123fa0]
mov qword [rsp + 0x28], rax
lea rbx, [0x1402f5e40]
lea rax, str.getnameinfo
movzx ebp, cx
mov qword [rsp + 0x30], rax
lea rax, [0x1401243e0]
mov qword [rsp + 0x38], rax
lea rax, [0x1402f5e60]
mov qword [rsp + 0x40], rax
lea rax, [0x140123f40]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rbx
jne 0x1401247f9
mov edx, 0x104
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1401247ef
lea r8, [rsp + 0x160]
mov qword [rsp + 0x290], rsi
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.1402ac570
lea r8, str.ws2_32
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.1402ac5d0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14012471a
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14012477a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.1402ac570
lea r8, str.wship6
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.1402ac5d0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1401247e7
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14012477a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1401247e7
mov qword [rsp + 0x298], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
nop dword [rax]
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
je 0x1401247d6
inc edi
add rbx, 0x10
cmp edi, 3
jl 0x140124790
mov rax, qword [rsp + 0x28]
mov qword [0x1404218d8], rax
mov rax, qword [rsp + 0x38]
mov qword [0x1404218e8], rax
mov rax, qword [rsp + 0x48]
mov qword [0x1404218f8], rax
jmp 0x1401247df
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov dword [0x140428790], 1
mov rax, rbp
lea rcx, [0x1404218d0]
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140293710
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rbp
ret