joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2c9639b40
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x2c9639c15
movdqa xmm0, xmmword [0x2c970b4a0]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x2c9639b81
movdqa xmm0, xmmword [0x2c970b4b0]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x2c9639c97
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x2c9639c6b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x2c970b1f0]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x2c970b8c0]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x2c964c200
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x2c964c35b
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x2c97cb2a8]
call dbg.internal/godebug.(*Setting).Value
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x2c964c380]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call dbg.internal/bytealg.IndexByteString
xorps xmm15, xmm15
mov r14, qword [0x2c981f6f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x2c964c31b
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x2c964c355
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x2c964c34a
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rbx
sar rbx, 0x3f
and rcx, rbx
mov r8, qword [rsp + 0x38]
lea rax, [r8 + rcx]
mov rbx, rdi
lea rdx, [rsp + 0x50]
nop
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rbx
call dbg.runtime.panicSliceB
call dbg.runtime.panicSliceAlen
nop
nop dword [rax + rax]
call dbg.runtime.morestack_noctxt
jmp dbg.net.goDebugNetDNS
Function at 0x2c96677a0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x2c9667a01
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x2c96679e5
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x2c96677ed
xor ebx, ebx
xor ecx, ecx
jmp 0x2c9667800
mov rax, rdx
call dbg.net.IP.String
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x2c9667918
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call dbg.internal/itoa.Itoa
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x2c970a248]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call dbg.runtime.concatstring3
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call dbg.internal/bytealg.IndexByteString
xorps xmm15, xmm15
mov r14, qword [0x2c981f6f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x2c96678db
xor eax, eax
lea rbx, [0x2c96d7b64]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x2c96d7bea]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call dbg.runtime.concatstring4
jmp 0x2c9667908
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x2c970a2e0]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call dbg.runtime.concatstring3
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop dword [rax]
call dbg.internal/itoa.Itoa
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call dbg.internal/bytealg.IndexByteString
xorps xmm15, xmm15
mov r14, qword [0x2c981f6f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x2c96679a8
xor eax, eax
lea rbx, [0x2c96d7b64]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x2c96d7bea]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call dbg.runtime.concatstring4
jmp 0x2c96679d5
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x2c970a2e0]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call dbg.runtime.concatstring3
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x2c96d7fa0]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
jmp dbg.net.(*UDPAddr).String
Function at 0x2c966d000
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x2c966d133
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], r8
mov byte [rsp + 0xa8], r9b
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
call dbg.net.IP.String
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
mov rdx, qword [rsp + 0xa0]
mov rax, rdx
mov ebx, 0xa
call dbg.strconv.FormatInt
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
mov rdx, qword [rsp + 0x60]
mov qword [rsp], rdx
mov rsi, qword [rsp + 0x50]
mov qword [rsp + 8], rsi
mov byte [rsp + 0x10], 0x3a
call dbg.internal/bytealg.IndexByteString
xorps xmm15, xmm15
mov r14, qword [0x2c981f6f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x2c966d102
xor eax, eax
lea rbx, [0x2c96d7b64]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
lea r8, [0x2c96d7bea]
mov r9d, 2
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
call dbg.runtime.concatstring4
nop
jmp 0x2c966d129
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x2c970a2e0]
mov esi, 1
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
call dbg.runtime.concatstring3
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov byte [rsp + 0x38], r9b
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
movzx r9d, byte [rsp + 0x38]
nop
jmp dbg.infatica_agent/serveraddr.ServerAddr.IpPort
Function at 0x2c9679500
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x2c96795f9
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
lea rcx, [rbx + 1]
test rcx, rcx
jle 0x2c96795e5
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x58], rax
mov qword [rsp], rcx
nop dword [rax]
call dbg.main._cgo_cmalloc
xorps xmm15, xmm15
mov r14, qword [0x2c981f6f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x18]
cmp rcx, rdx
mov rbx, rdx
cmovl rdx, rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x58]
cmp rdi, rsi
jne 0x2c9679593
cmp rcx, rbx
jmp 0x2c96795c8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov rax, rsi
mov rbx, rdi
mov rcx, rdx
call dbg.runtime.memmove
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x18]
cmp rax, rcx
mov rbx, rcx
mov rsi, qword [rsp + 0x28]
mov rcx, rax
mov rax, qword [rsp + 0x20]
jae 0x2c96795d8
mov byte [rsi + rcx], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, rcx
mov rcx, rbx
nop
call dbg.runtime.panicIndex
lea rax, [0x2c96adfa0]
lea rbx, [0x2c970b418]
call dbg.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp dbg.main._Cfunc_CString

Function at 0x2c9679da0
Capabilities:
Create thread

Disassembly:
mov rdx, rcx
lea rcx, [dbg.threadentry]
jmp sym._cgo_beginthread

Function at 0x2c967e900
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]
Function at 0x2c967e970
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x2c9824114]
test esi, esi
mov rdi, rcx
mov rbp, rdx
mov rbx, r8
jle 0x2c967eb00
mov rax, qword [0x2c9824118]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rdi, rdx
jb 0x2c967e9bc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rdi, rdx
jb 0x2c967ea45
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x2c967e9a0
mov rcx, rdi
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x2c967eb52
mov rax, qword [0x2c9824118]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x2c9824118]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x2c967eb35
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x2c967ea3e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x2c967eab0
add dword [0x2c9824114], 1
cmp ebx, 8
jae 0x2c967ea71
test bl, 4
jne 0x2c967eb10
test ebx, ebx
je 0x2c967ea66
movzx eax, byte [rbp]
test bl, 2
mov byte [rdi], al
jne 0x2c967eb24
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, ebx
sub ebx, 1
mov rdx, qword [rbp + rax - 8]
cmp ebx, 8
mov qword [rdi + rax - 8], rdx
jb 0x2c967ea66
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, ebx
mov qword [rdi + rdx], rcx
jb 0x2c967ea8a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov r8d, 4
mov eax, 0x40
mov rcx, qword [rsp + 0x20]
cmovne r8d, eax
mov rdx, qword [rsp + 0x38]
add rsi, qword [0x2c9824118]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x2c967ea3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
xor esi, esi
jmp 0x2c967e9c7
mov eax, dword [rbp]
mov ebx, ebx
mov dword [rdi], eax
mov eax, dword [rbp + rbx - 4]
mov dword [rdi + rbx - 4], eax
jmp 0x2c967ea66
mov ebx, ebx
movzx eax, word [rbp + rbx - 2]
mov word [rdi + rbx - 2], ax
jmp 0x2c967ea66
mov rax, qword [0x2c9824118]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rdi
call sym.__report_error
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x2c967eee0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x2c9824140]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x2c9824120]
test rbx, rbx
je 0x2c967ef34
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x2c967ef2b
test rsi, rsi
je 0x2c967ef2b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x2c967ef10
lea rcx, [0x2c9824140]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x2c967f180
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x2c967f190
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x2c967f1a0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x2c967f1e1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x2c967f1d8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x2c967f1e3
add rax, 0x28
cmp rax, r9
jne 0x2c967f1c4
xor eax, eax
ret

Function at 0x2c967f290
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x2c97c7f70]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x2c967f2ff
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x2c967f2ff
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x2c967f2fd
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x2c967f2f4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x2c967f2ff
add rdx, 0x28
cmp rdx, r9
jne 0x2c967f2e0
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x2c967f400
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x2c97c7f70]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x2c967f46f
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x2c967f46f
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x2c967f46d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x2c967f464
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x2c967f474
add rax, 0x28
cmp rax, r9
jne 0x2c967f450
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x2c967f490
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x2c97c7f70]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x2c967f503
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x2c967f503
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x2c967f503
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x2c967f503
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
mov r9d, dword [rdx + 0xc]
cmp rax, r9
mov rcx, r9
jb 0x2c967f4f7
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x2c967f510
add rdx, 0x28
cmp rdx, r10
jne 0x2c967f4e3
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jne 0x2c967f528
jmp 0x2c967f500
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x2c967f536
mov edx, dword [rax + 0xc]
test edx, edx
je 0x2c967f500
test r8d, r8d
jg 0x2c967f520
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x14000dc50
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, rdx
mov r13d, ecx
lea rdx, [rsp + 0x20]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r14d, dword [rsp + 0x28]
mov r15d, dword [rsp + 0x2c]
sub r14d, dword [rsp + 0x20]
sub r15d, dword [rsp + 0x24]
mov ebx, 1
mov edi, ebx
mov esi, ebx
lea ebp, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x60], eax
nop word [rax + rax]
add edi, ebp
add ebx, esi
js 0x14000dcbb
cmp ebx, r14d
jle 0x14000dcbd
neg esi
test edi, edi
js 0x14000dcc6
cmp edi, r15d
jle 0x14000dcc8
neg ebp
movzx r9d, di
movzx eax, bx
xor r8d, r8d
shl r9d, 0x10
mov edx, 0x200
mov rcx, r12
or r9, rax
call qword [sym.imp.USER32.dll_PostMessageA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsp + 0x60]
cmp eax, r13d
jae 0x14000dd29
cmp ebx, 0x1f4
jne 0x14000dd09
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, 0x1f4
jne 0x14000dd1c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000dcb0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x14000dd50
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, rdx
mov r13d, ecx
lea rdx, [rsp + 0x20]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r14d, dword [rsp + 0x28]
mov r15d, dword [rsp + 0x2c]
sub r14d, dword [rsp + 0x20]
sub r15d, dword [rsp + 0x24]
mov ebx, 1
mov edi, ebx
mov esi, ebx
lea ebp, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x60], eax
nop word [rax + rax]
add edi, ebp
add ebx, esi
js 0x14000ddbb
cmp ebx, r14d
jle 0x14000ddbd
neg esi
test edi, edi
js 0x14000ddc6
cmp edi, r15d
jle 0x14000ddc8
neg ebp
movzx r9d, di
movzx eax, bx
xor r8d, r8d
shl r9d, 0x10
mov edx, 0x200
mov rcx, r12
or r9, rax
call qword [sym.imp.USER32.dll_PostMessageA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsp + 0x60]
cmp eax, r13d
jae 0x14000de03
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000ddb0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000e0c0
Capabilities:
Encode data using xor
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x500
mov ebx, edx
lea rcx, [rsp + 0x41]
mov r8d, 0x103
xor edx, edx
mov byte [rsp + 0x40], 0
call fcn.1400033f0
lea rcx, [rsp + 0x152]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x150], di
call fcn.1400033f0
lea rcx, [rsp + 0x150]
mov edx, ebx
call fcn.14000e270
mov r9d, edi
cmp word [rsp + 0x150], di
je 0x14000e13c
lea rax, [rsp + 0x150]
nop dword [rax]
lea rax, [rax + 2]
inc r9d
cmp word [rax], di
jne 0x14000e130
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
mov ebx, 0x104
lea r8, [rsp + 0x150]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, ebx
cmovge eax, edi
cmp dword [0x140044b24], edi
cdqe
mov byte [rsp + rax + 0x40], dil
jne 0x14000e19c
lea rdx, [rsp + 0x360]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [0x140044b24], 1
movdqa xmm1, xmmword [0x14001f2e0]
lea rax, [rsp + 0x40]
mov ecx, 8
nop
movdqu xmm0, xmmword [rax]
lea rax, [rax + 0x20]
pxor xmm0, xmm1
movdqu xmmword [rax - 0x20], xmm0
movdqu xmm0, xmmword [rax - 0x10]
pxor xmm0, xmm1
movdqu xmmword [rax - 0x10], xmm0
dec rcx
jne 0x14000e1b0
lea rax, [rsp + 0x140]
mov ecx, 3
xor byte [rax], 0x65
lea rax, [rax + 1]
dec rcx
jne 0x14000e1e1
lea rdx, [rsp + 0x40]
call fcn.14000e6d0
cmp eax, 1
jne 0x14000e234
nop dword [rax]
dec rbx
mov byte [rsp + rbx + 0x40], dil
jne 0x14000e200
cmp dword [0x140044b24], edi
je 0x14000e21e
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [0x140044b24], edi
mov eax, 1
mov rbx, qword [rsp + 0x510]
add rsp, 0x500
pop rdi
ret
dec rbx
mov byte [rsp + rbx + 0x40], dil
jne 0x14000e234
cmp dword [0x140044b24], edi
je 0x14000e252
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [0x140044b24], edi
xor eax, eax
mov rbx, qword [rsp + 0x510]
add rsp, 0x500
pop rdi
ret
Function at 0x14000e6d0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edi, 2
mov rbx, rdx
lea r8d, [rdi + 0xf]
mov edx, edi
mov ecx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov qword [0x140044b90], rax
cmp rax, 0xffffffffffffffff
je 0x14000e776
lea ecx, [rdi + 0x33]
mov word [0x140044b80], di
call qword [sym.imp.WS2_32.dll_htons]
lea rcx, [0x140048a30]
mov word [0x140044b82], ax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [0x140044b84], eax
cmp byte [rbx], 0
mov rax, rbx
je 0x14000e738
nop
inc rax
cmp byte [rax], 0
jne 0x14000e730
lea rcx, [0x140044b80]
sub eax, ebx
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rcx
mov rcx, qword [0x140044b90]
xor r9d, r9d
mov r8d, eax
mov rdx, rbx
call qword [sym.imp.WS2_32.dll_sendto]
mov rcx, qword [0x140044b90]
cmp eax, 0xffffffff
jne 0x14000e79f
call qword [sym.imp.WS2_32.dll_closesocket]
cmp dword [0x140044b24], 0
je 0x14000e78f
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [0x140044b24], 0
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
je 0x14000e776
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret