joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100025c68
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov ebx, r8d
mov r12, rdx
mov r13, rcx
call fcn.100021450
xor ebp, ebp
and dword [rsp + 0x88], ebp
and dword [rsp + 0x30], ebp
mov rdi, rax
cmp qword [0x100032e88], rbp
jne 0x100025da0
lea rcx, [0x100011028]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x100025ccc
xor eax, eax
jmp 0x100025e80
lea rdx, [0x100011018]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x100025cc5
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x100011008]
mov rcx, rsi
mov qword [0x100032e88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x100010ff0]
mov rcx, rsi
mov qword [0x100032e90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rcx, [rsp + 0x88]
mov qword [0x100032e98], rax
call fcn.100020560
test eax, eax
je 0x100025d53
and qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.10002274c
cmp dword [rsp + 0x88], 2
jne 0x100025da0
lea rdx, [0x100010fd0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x100032ea8], rax
test rax, rax
je 0x100025da0
lea rdx, [0x100010fb8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x100032ea0], rax
mov rcx, qword [0x100032ea0]
cmp rcx, rdi
je 0x100025e32
cmp qword [0x100032ea8], rdi
je 0x100025e32
call sub.KERNEL32.dll_DecodePointer
call rax
mov rsi, rax
test rax, rax
je 0x100025dfd
mov rcx, qword [0x100032ea8]
call sub.KERNEL32.dll_DecodePointer
lea rcx, [rsp + 0x34]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x38]
mov rcx, rsi
call rax
test eax, eax
je 0x100025dfd
test byte [rsp + 0x40], 1
jne 0x100025e32
lea rcx, [rsp + 0x30]
call fcn.1000205ac
test eax, eax
je 0x100025e1f
and qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.10002274c
cmp dword [rsp + 0x30], 4
jb 0x100025e2c
bts ebx, 0x15
jmp 0x100025e66
bts ebx, 0x12
jmp 0x100025e66
mov rcx, qword [0x100032e90]
cmp rcx, rdi
je 0x100025e66
call sub.KERNEL32.dll_DecodePointer
call rax
mov rbp, rax
test rax, rax
je 0x100025e66
mov rcx, qword [0x100032e98]
cmp rcx, rdi
je 0x100025e66
call sub.KERNEL32.dll_DecodePointer
mov rcx, rbp
call rax
mov rbp, rax
mov rcx, qword [0x100032e88]
call sub.KERNEL32.dll_DecodePointer
mov r9d, ebx
mov r8, r12
mov rdx, r13
mov rcx, rbp
call rax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1800111a9
Capabilities:
Create thread

Disassembly:
jmp 0x180011c80
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
lea rcx, [0x180023007]
call fcn.180011339
mov eax, dword [rbp + 0x108]
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 1
je 0x180011cbf
jmp 0x180011cf2
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x18001129e]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x1800111e0
Capabilities:
Terminate process

Disassembly:
jmp 0x180012010
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14048f12b
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
not eax
call fcn.140471715
mov r11d, 0x1b2fa29d
lea rsi, [rsi + r11 - 0x1b2fa29f]
and r11, r11
neg r11d
movzx r11d, word [rsi]
xor r11w, r8w
push 0xfffffffffe9b3c1c
sub r11w, 0xb706
neg r11w
call fcn.14046ba36
sub r11, 2
movzx esi, word [r11]
xor si, r9w
mov r10d, 0x7593d18d
add si, 0xe5be
xor r10w, 0x2634
rol si, 1
inc r10
inc si
sal r10d, 0xaf
shl r10d, 0x39
shr r10b, 0xc1
neg si
not si
bswap r10d
lea r10, [r10*4 - 0x2eefc676]
xor r9w, si
shr r10b, 0x85
add r10d, r10d
ror r10w, 0xcc
adc rsi, rsp
jmp 0x14046f036
lea r11, [0x1404721c0]
lea rsp, [rsp + 8]
mov ebx, 0xe038fa8f
inc bl
add bl, bh
movzx ebx, byte [r8]
push 0xffffffffa9afe59f
sar byte [rsp + 2], 4
xor ebx, eax
and ebx, 0xff
mov ebx, dword [r11 + rbx*4]
sub qword [rsp], 0xffffffffbf3fc583
shr eax, 8
xor eax, ebx
inc r8
xor eax, 0xd12dfdbc
dec rcx
lea rsp, [rsp + 8]
jne 0x14048f137
mov ebx, 0xa83fdc12
pop rbx
push 0x2e96d70c
jmp 0x140475829
Function at 0x140b1c160
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140b1c2e7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140b1c191
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b1c177
add dl, dl
jne 0x140b1c19e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b1c1fe
xor eax, eax
add dl, dl
jne 0x140b1c1ad
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b1c2b5
add dl, dl
jne 0x140b1c1be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b1c1cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b1c1d8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b1c1e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140b1c1f2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140b1c186
mov eax, 1
add dl, dl
jne 0x140b1c20e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b1c21b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b1c203
sub eax, ebx
mov ebx, 1
jne 0x140b1c254
mov ecx, 1
add dl, dl
jne 0x140b1c236
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b1c243
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b1c22b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b1c186
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140b1c270
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b1c27d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b1c265
cmp eax, 0x7d00
jae 0x140b1c2a3
cmp eax, 0x500
jb 0x140b1c29e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b1c186
cmp eax, 0x7f
ja 0x140b1c2a6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b1c186
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140b1c2da
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140b1c186
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140004210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x60
xor r12d, r12d
lea r15, [0x140130310]
mov esi, r12d
lea r14, [0x14012fde0]
cmp byte [r15], r12b
je 0x1400042e4
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], reloc.WSOCK32.dll_gethostbyname
mov ecx, esi
mov dword [rsp + 0x24], 0x80
call qword [sym.imp.WINMM.dll_joyGetPosEx]
test eax, eax
jne 0x1400042e4
mov eax, dword [rsp + 0x40]
mov ebp, eax
xor ebp, dword [r14]
mov dword [r14], eax
and ebp, eax
je 0x1400042e4
movzx edx, word [0x1401301b4]
mov ebx, r12d
cmp r12w, dx
jae 0x1400042e4
mov rdi, r12
nop
mov rax, qword [0x140130330]
mov rax, qword [rdi + rax]
cmp byte [rax + 0x12], 4
jne 0x1400042d7
movzx ecx, byte [rax + 0x10]
cmp ecx, esi
jne 0x1400042d7
movzx ecx, word [rax + 8]
sub ecx, 0xc
movzx eax, cl
bt ebp, eax
jae 0x1400042d7
mov rcx, qword [0x14012fec8]
xor r9d, r9d
movsxd r8, ebx
mov edx, 0x312
call qword [sym.imp.USER32.dll_PostMessageW]
movzx edx, word [0x1401301b4]
inc ebx
movzx eax, dx
add rdi, 8
cmp ebx, eax
jl 0x140004290
inc esi
inc r15
add r14, 4
cmp esi, 0x10
jl 0x140004242
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140007640
Capabilities:
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x230
xor ecx, ecx
mov rbx, r8
mov edi, edx
test r8, r8
je 0x14000765c
mov dword [r8], ecx
lea eax, [rdx - 0xc000]
cmp eax, 0x3fff
ja 0x14000773b
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov ecx, edi
call qword [sym.imp.USER32.dll_GetClipboardFormatNameW]
mov r8d, reloc.WSOCK32.dll_inet_ntoa
lea rdx, str.Link_Source
lea rcx, [rsp + 0x20]
call fcn.1400c8430
test eax, eax
je 0x140007728
lea rdx, str.ObjectLink
lea rcx, [rsp + 0x20]
call fcn.1400c8244
test eax, eax
je 0x140007728
lea rdx, str.OwnerLink
lea rcx, [rsp + 0x20]
call fcn.1400c8244
test eax, eax
je 0x140007728
lea rdx, str.Native
lea rcx, [rsp + 0x20]
call fcn.1400c8244
test eax, eax
je 0x140007728
lea rdx, str.Embed_Source
lea rcx, [rsp + 0x20]
call fcn.1400c8244
test eax, eax
je 0x140007728
lea rdx, str.MSDEVColumnSelect
lea rcx, [rsp + 0x20]
call fcn.1400c8244
test eax, eax
je 0x14000771d
lea rdx, str.MSDEVLineSelect
lea rcx, [rsp + 0x20]
call fcn.1400c8244
test eax, eax
jne 0x140007740
test rbx, rbx
je 0x140007728
mov dword [rbx], 1
xor eax, eax
mov rbx, qword [rsp + 0x240]
add rsp, 0x230
pop rdi
ret
mov word [rsp + 0x20], cx
mov ecx, edi
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, qword [rsp + 0x240]
add rsp, 0x230
pop rdi
ret

Function at 0x140007760
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
sub rsp, 0x28
cmp dword [0x14013221c], 0
je 0x140007777
mov eax, 1
add rsp, 0x28
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14012fec8]
mov ebx, eax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1400077f4
xor edi, edi
nop dword [rax]
mov ecx, dword [0x1401293ac]
cmp ecx, 0xffffffff
je 0x1400077c4
test ecx, ecx
je 0x140007812
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x1401293ac]
add edx, ebx
sub edx, eax
cmp edx, 5
jle 0x140007812
mov edx, 1
mov dword [0x140129390], edi
mov ecx, 0x8000012f
call fcn.140001800
mov rcx, qword [0x14012fec8]
mov dword [0x140129390], 1
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400077a0
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rdi, qword [rsp + 0x20]
mov dword [0x14013221c], 1
add rsp, 0x28
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x140007d60
Capabilities:
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov word [rax + 0x20], r9w
mov dword [rax + 0x18], r8d
mov dword [rax + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x840
mov r13, rcx
xor edi, edi
mov r14d, 0x400
mov byte [rsp + 0x20], dil
mov r8d, r14d
lea rcx, [rsp + 0x21]
xor edx, edx
mov ebp, edi
call fcn.1400e61b0
mov r8d, r14d
mov byte [rsp + 0x430], dil
xor edx, edx
lea rcx, [rsp + 0x431]
call fcn.1400e61b0
mov r9d, r14d
lea edx, [r14 + 1]
mov r8, r13
lea rcx, [rsp + 0x20]
lea r12, [rsp + 0x20]
lea rbx, [rsp + 0x430]
call fcn.1400cd760
mov r14, qword [rsp + 0x8a8]
mov rcx, r13
mov qword [r14], rdi
mov r15, r14
mov byte [rbx], dil
call qword [sym.imp.WSOCK32.dll_gethostbyname]
mov rdi, rax
test rax, rax
je 0x140007eff
cmp word [rax + 0x10], 2
jne 0x140007e56
cmp word [rax + 0x12], 4
jne 0x140007e56
mov rsi, qword [rax + 0x18]
jmp 0x140007e4e
mov r9d, dword [rax]
movzx r8d, word [rsp + 0x898]
mov edx, dword [rsp + 0x890]
mov ecx, dword [rsp + 0x888]
call fcn.140007cc0
mov qword [r15], rax
test rax, rax
je 0x140007ef8
lea r15, [rax + 0x28]
add rsi, 8
mov rax, qword [rsi]
test rax, rax
jne 0x140007e1b
mov r8, qword [rdi]
mov r9d, 0x400
mov rcx, rbx
lea edx, [r9 + 1]
call fcn.1400cd760
xor edi, edi
cmp qword [r14], rdi
jne 0x140007eab
mov rcx, rbx
call fcn.1400cd650
test rax, rax
je 0x140007f18
mov rdx, rbx
mov rcx, r12
call fcn.1400cd860
test eax, eax
je 0x140007f18
inc ebp
cmp ebp, 0x10
je 0x140007f18
mov rax, r12
mov r12, rbx
mov rbx, rax
jmp 0x140007de9
mov ecx, edi
cmp dword [rsp + 0x8a0], edi
je 0x140007f24
mov rcx, rbx
call fcn.1400cd650
mov ecx, 1
mov rsi, rax
lea rdx, [rax + 1]
call fcn.1400cd6f8
mov rdi, rax
test rax, rax
je 0x140007ee6
mov r8, rbx
lea rdx, [rsi + 1]
mov rcx, rax
call fcn.1400cd700
mov rax, qword [r14]
xor ecx, ecx
mov qword [rax + 0x18], rdi
mov rax, qword [r14]
cmp qword [rax + 0x18], rcx
jne 0x140007f24
mov ecx, 8
jmp 0x140007f24
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov ecx, 0x2af9
sub eax, ecx
je 0x140007f24
sub eax, 1
je 0x140007f1f
sub eax, 1
jne 0x140007f24
mov ecx, 0x2afb
jmp 0x140007f24
mov ecx, 0x2afa
mov rbx, qword [rsp + 0x880]
mov eax, ecx
add rsp, 0x840
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400085b4
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x188]
sub rsp, 0x270
lea rax, [0x140007f94]
movzx r12d, cx
mov qword [rsp + 0x28], rax
lea r14, str.getaddrinfo
lea rax, str.getnameinfo
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x30], rax
xor ebx, ebx
cmp dword [0x14012fe58], ebx
lea rax, [0x140008394]
mov qword [rsp + 0x38], rax
lea rax, str.freeaddrinfo
mov qword [rsp + 0x40], rax
lea rax, [0x140007f44]
mov qword [rsp + 0x48], rax
je 0x14000863c
lea rsi, str.getaddrinfo
jmp 0x140008753
mov edx, 0x104
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rsi, str.getaddrinfo
test eax, eax
je 0x140008749
mov r15d, 0x10c
lea r8, [rbp + 0x60]
mov edx, r15d
lea rcx, [rsp + 0x50]
call fcn.1400cd700
lea r8, str.ws2_32
mov edx, r15d
lea rcx, [rsp + 0x50]
call fcn.1400ce9b0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1400086b2
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400086fb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rbp + 0x60]
mov rdx, r15
lea rcx, [rsp + 0x50]
call fcn.1400cd700
lea r8, str.wship6
mov rdx, r15
lea rcx, [rsp + 0x50]
call fcn.1400ce9b0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140008749
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008740
mov r15d, ebx
lea r14, [rsp + 0x28]
mov rdx, qword [r14 - 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r14], rax
test rax, rax
je 0x140008740
inc r15d
add r14, 0x10
cmp r15d, 3
jl 0x140008703
test rdi, rdi
je 0x140008749
mov rax, qword [rsp + rbx + 0x28]
mov qword [rbx + rsi + 8], rax
add rbx, 0x10
cmp rbx, 0x30
jl 0x14000872a
jmp 0x140008749
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x14012fe58], 1
lea r11, [rsp + 0x270]
mov rax, r12
mov rbx, qword [r11 + 0x20]
add rax, rax
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rax, qword [rsi + rax*8 + 8]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140008848
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rcx
push rsi
sub rsp, 0x20
mov qword [0x14012bcf8], rdx
mov r8, rdx
mov r9, qword [rdx + 0x38]
test r9, r9
je 0x1400088e1
cmp byte [r9 + 5], 1
jne 0x1400088e1
cmp byte [r9 + 6], 0
je 0x1400088d0
mov rcx, qword [rdx + 0x18]
jmp 0x140008894
mov eax, dword [r8 + 4]
cmp dword [rcx + 4], eax
jne 0x140008899
movzx eax, word [r8 + 2]
cmp word [rcx + 2], ax
jne 0x140008899
mov r8, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
jne 0x140008879
mov eax, dword [r8 + 4]
movzx ecx, word [r8 + 2]
cmp byte [r8], 3
je 0x1400088ad
and qword [r8 + 0x38], 0
mov r8, qword [r8 + 0x20]
test r8, r8
je 0x1400088c3
cmp dword [r8 + 4], eax
jne 0x1400088c3
cmp word [r8 + 2], cx
je 0x1400088a2
mov edx, 8
mov rcx, r9
call fcn.1400c243c
lea rdx, [0x140104fec]
add rsp, 0x20
pop rsi
jmp fcn.140008a38
mov r9d, dword [0x14012bd50]
cmp r9d, 3
je 0x14000895d
mov r11, qword [0x14012bd5c]
movabs rsi, 0x2aaaaaaaaaaaaaab
mov r10, qword [0x14012bcd8]
cmp r9d, 4
jne 0x140008933
mov rcx, r10
mov rax, rsi
sub rcx, qword [0x14012bcd0]
add rcx, 0x18
imul rcx
sar rdx, 2
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
cmp edx, r11d
jle 0x14000895d
cmp r9d, 5
jne 0x140008986
sub r10, qword [0x14012bcd0]
mov rax, rsi
add r10, 0x18
imul r10
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp edx, r11d
jge 0x140008986
mov al, byte [r8]
cmp al, 0x18
jb 0x14000896c
cmp al, 0x1a
jbe 0x140008986
cmp al, 0x1c
jmp 0x140008979
cmp al, 3
je 0x140008986
cmp al, 4
jne 0x14000897b
cmp qword [r8 + 0x10], 0
je 0x140008986
cmp dword [r8 + 4], 0
jne 0x1400088d0
mov rcx, qword [0x14012bcf0]
lea r8, [rsp + 0x30]
mov edx, 0x4004667f
call qword [sym.imp.WSOCK32.dll_ioctlsocket]
test eax, eax
jne 0x1400089b3
cmp dword [rsp + 0x30], eax
seta al
test al, al
je 0x1400089b3
xor edx, edx
jmp 0x1400088d7
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x14000ce58
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test rdx, rdx
jne 0x14000ceab
mov edx, dword [rcx + 0x80]
sub edx, 1
je 0x14000cea4
sub edx, 2
je 0x14000ce9b
sub edx, 1
je 0x14000ce92
cmp edx, 1
je 0x14000ce89
lea rdx, [0x14010509e]
jmp 0x14000ceab
lea rdx, str.step_out
jmp 0x14000ceab
lea rdx, str.step_over
jmp 0x14000ceab
lea rdx, str.step_into
jmp 0x14000ceab
lea rdx, [0x140107194]
mov rcx, qword [rcx + 0x98]
lea rax, [0x14010509e]
test rcx, rcx
je 0x14000cec6
cmp qword [rcx], 0
cmovne rax, qword [rcx]
mov qword [rsp + 0x28], rax
lea rcx, [rbx + 0x60]
mov qword [rsp + 0x20], r9
mov r9, r8
mov r8, rdx
lea rdx, str._response_command__s__status__s__reason__s__transaction_id__e___
call fcn.14000d914
xor edx, edx
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.14000cef8

Function at 0x14000cef8
Capabilities:
Send data
Send data on socket

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x60
mov r8, qword [rcx + 0x70]
mov rsi, rdx
mov rax, qword [rcx + 0x60]
mov rbp, r8
sub rbp, rdx
mov rdi, rcx
lea rdx, [r11 - 0x48]
mov byte [r8 + rax], 0
mov r8d, 0xa
lea rcx, [rbp + 0x26]
call fcn.1400cd50c
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400c4330
lea r8, str.__xml_version_1.0__encoding_UTF_8___
lea rdx, [0x140107ee0]
lea rbx, [rax + 1]
mov rcx, rbx
call fcn.14000ee08
mov rcx, qword [rdi + 0x20]
lea rdx, [rsp + 0x20]
movsxd r8, eax
xor r9d, r9d
add r8, rbx
lea rax, [rsp + 0x20]
sub r8d, eax
call qword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
je 0x14000cfa8
mov rdx, qword [rdi + 0x60]
lea r8d, [rbp + 1]
mov rcx, qword [rdi + 0x20]
add rdx, rsi
xor r9d, r9d
call qword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
je 0x14000cfa8
mov qword [rdi + 0x70], rsi
xor eax, eax
jmp 0x14000cfb4
lea rcx, str.An_internal_error_has_occurred_in_the_debugger_engine._nContinue_running_the_script_without_the_debugger_
call fcn.14000d504
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000d558
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rsi, rdx
mov rdi, rcx
cmp r8, 0xffffffffffffffff
jne 0x14000d580
mov rcx, rdx
call fcn.1400cd650
mov r8, rax
lea r10, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
cmp r8, 2
jbe 0x14000d61f
lea rcx, [r8 - 3]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
lea r9, [rdi + 2]
shr rdx, 1
inc rdx
imul rax, rdx, 0xfffffffffffffffd
lea rbx, [rdx*4]
add r8, rax
movzx eax, byte [rsi]
movzx ecx, byte [rsi + 1]
shl rax, 8
or rcx, rax
movzx eax, byte [rsi + 2]
shl rcx, 8
add rsi, 3
or rcx, rax
mov rax, rcx
shr rax, 0x12
mov al, byte [rax + r10]
mov byte [r9 - 2], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
mov al, byte [rax + r10]
mov byte [r9 - 1], al
mov rax, rcx
shr rax, 6
and ecx, 0x3f
and eax, 0x3f
mov al, byte [rax + r10]
mov byte [r9], al
lea r9, [r9 + 4]
mov al, byte [rcx + r10]
mov byte [r9 - 3], al
sub rdx, 1
jne 0x14000d5bb
test r8, r8
je 0x14000d67e
movzx ecx, byte [rsi]
shl rcx, 0x10
cmp r8, 1
jbe 0x14000d63c
movzx eax, byte [rsi + 1]
shl rax, 8
or rcx, rax
mov rax, rcx
shr rax, 0x12
mov al, byte [rax + r10]
mov byte [rbx + rdi], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
mov al, byte [rax + r10]
mov byte [rbx + rdi + 1], al
cmp r8, 1
jbe 0x14000d66f
shr rcx, 6
and ecx, 0x3f
mov al, byte [rcx + r10]
jmp 0x14000d671
mov al, 0x3d
mov byte [rbx + rdi + 2], al
mov byte [rbx + rdi + 3], 0x3d
add rbx, 4
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov byte [rbx + rdi], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000eaf4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
mov rcx, rsi
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x14000eb57
mov rdi, qword [rbx + 8]
test rdi, rdi
je 0x14000eb8a
mov eax, dword [rdi + 0x20]
sub eax, 1
mov dword [rdi + 0x20], eax
jne 0x14000eb4c
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000eb3f
call fcn.1400c83c0
mov edx, 0x28
mov rcx, rdi
call fcn.1400c243c
and qword [rbx + 8], 0
mov byte [rbx + 0x10], 0
jmp 0x14000eb8a
xor edx, edx
mov rcx, rbx
call fcn.14000f020
mov rcx, qword [rbx + 8]
mov rdx, rdi
call fcn.14000ee60
mov rax, qword [rbx + 8]
mov r8d, edi
mov rcx, rsi
mov rdx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, eax
mov rax, qword [rbx + 8]
mov qword [rax + 0x10], rcx
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret