joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a8b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x53e0], 0
lea rbx, [rcx + 0x53e8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001a957
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001a90a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001ca00
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140006df0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x53e0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x53f0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1402179a0]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001a95f
mov rcx, rbx
call fcn.140006df0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001aed0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140217990]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14001af33
mov qword [rsp], rbx
lea rbx, [0x1400aae50]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001af13
cmp byte [r8], r9b
jne 0x14001af13
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14001af00
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5390]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x14001af67
mov r10, qword [r10 + 0x5398]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14001af6e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x14001af54
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x140042e90
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x270
mov rbx, rdx
mov rdi, rcx
xor esi, esi
mov edx, 0x100
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140042ee0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call fcn.14004e680
nop
mov r8d, shutdown
lea rdx, str.InputMethodCHT_
lea rcx, [rsp + 0x28]
call fcn.14004c850
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x140042f88
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042f83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140042f83
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009ced8
movdqa xmm0, xmmword [0x140117b80]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], si
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140042fa8
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rsp + 0x48]
call fcn.14004c850
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x140043027
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043021
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140043021
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009ced8
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x140043062
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14004305d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140043089
mov rcx, r8
call fcn.14009ced8
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rax, rdi
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140043090
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
lea r14, [rcx + 0x18]
cmp qword [r14], 7
mov rdi, rcx
mov dword [rsp + 0x60], r15d
jbe 0x1400430c1
mov rcx, qword [rcx]
lea rsi, [rdi + 0x18]
jmp 0x1400430c4
mov rsi, r14
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x140043145
mov rdx, qword [r14]
cmp rdx, 7
jbe 0x140043139
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140043131
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004323b
mov rcx, r8
call fcn.14009ced8
mov r14, rsi
mov qword [r14], 7
jmp 0x14004321d
cmp rbp, 0xffffffffffffffff
jne 0x14004319b
mov rdx, qword [r14]
cmp rdx, 7
jbe 0x14004318d
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140043188
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004323b
mov rcx, r8
lea rsi, [rdi + 0x18]
call fcn.14009ced8
mov qword [rsi], 7
xor al, al
jmp 0x14004321f
lea r9, [rsp + 0x60]
mov qword [rsp + 0x68], rbx
mov r8d, 0x21a00
mov qword [rsp + 0x20], r15
lea rdx, [0x1401b8e20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [r14]
test bl, bl
mov rbx, qword [rsp + 0x68]
je 0x14004314e
cmp rdx, 7
jbe 0x140043216
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140043211
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004323b
mov rcx, r8
lea rsi, [rdi + 0x18]
call fcn.14009ced8
mov qword [rsi], 7
mov al, 1
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov word [rdi], r15w
mov qword [rdi + 0x10], r15
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140043250
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
lea r14, [rcx + 0x18]
cmp qword [r14], 7
mov rdi, rcx
mov dword [rsp + 0x60], r15d
jbe 0x140043281
mov rcx, qword [rcx]
lea rsi, [rdi + 0x18]
jmp 0x140043284
mov rsi, r14
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x140043305
mov rdx, qword [r14]
cmp rdx, 7
jbe 0x1400432f9
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400432f1
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400433fb
mov rcx, r8
call fcn.14009ced8
mov r14, rsi
mov qword [r14], 7
jmp 0x1400433dd
cmp rbp, 0xffffffffffffffff
jne 0x14004335b
mov rdx, qword [r14]
cmp rdx, 7
jbe 0x14004334d
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140043348
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400433fb
mov rcx, r8
lea rsi, [rdi + 0x18]
call fcn.14009ced8
mov qword [rsi], 7
xor al, al
jmp 0x1400433df
lea r9, [rsp + 0x60]
mov qword [rsp + 0x68], rbx
mov r8d, 0x2200
mov qword [rsp + 0x20], r15
lea rdx, [0x1401b64f0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [r14]
test bl, bl
mov rbx, qword [rsp + 0x68]
je 0x14004330e
cmp rdx, 7
jbe 0x1400433d6
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400433d1
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400433fb
mov rcx, r8
lea rsi, [rdi + 0x18]
call fcn.14009ced8
mov qword [rsi], 7
mov al, 1
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov word [rdi], r15w
mov qword [rdi + 0x10], r15
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140043710
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
xor r8d, r8d
mov dword [rbp - 0x30], 0x9c809cf
mov word [rbp - 8], r8w
mov eax, r8d
mov dword [rbp - 0x2c], 0x9ca09bb
mov edx, 0x993
mov dword [rbp - 0x28], 0x9ff09d1
mov dword [rbp - 0x24], 0x9a909fe
mov dword [rbp - 0x20], 0x9f609c8
mov dword [rbp - 0x1c], 0x9a909af
mov dword [rbp - 0x18], 0x99309a8
mov dword [rbp - 0x14], 0x9ec09c9
mov dword [rbp - 0x10], 0x9f509f0
mov dword [rbp - 0xc], 0x9e309f2
mov byte [rbp - 6], 1
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + rax]
xor word [rbp + rax*2 - 0x30], cx
inc rax
cmp rax, 0x14
jb 0x140043780
mov qword [rsp + 0x30], r8
lea rcx, [rbp - 0x30]
mov dword [rsp + 0x28], r8d
xor r9d, r9d
mov byte [rbp - 6], r8b
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1402179d0], rax
test rax, rax
je 0x1400437d6
cmp rax, 0xffffffffffffffff
setne al
add rsp, 0x70
pop rbp
ret
add rsp, 0x70
pop rbp
ret

Function at 0x1400438a0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140043904
nop dword [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x140043920
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400438e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov rbx, qword [rsp + 0x270]
mov dword [0x1402179c8], eax
add rsp, 0x260
pop rdi
ret
Function at 0x14004b880
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x40
mov rax, qword [0x140217990]
xor edi, edi
test rax, rax
je 0x14004b89d
mov rcx, qword [rax + 0xa0]
jmp 0x14004b8a0
mov rcx, rdi
cmp qword [rcx + 0x18], rdi
jne 0x14004b8c1
test rax, rax
je 0x14004b8c1
mov rcx, qword [rax + 0xa0]
test rcx, rcx
je 0x14004b8c1
cmp qword [rcx], rdi
je 0x14004b8c1
call fcn.140002500
call fcn.140002ed0
call fcn.14000af40
mov rax, qword [0x140217990]
mov ecx, 0x2d
or dword [rax + 0x3f90], 2
mov dword [rax + 0x3fb0], 0x44160000
mov dword [rax + 0x3fb4], 0x43eb0000
mov dword [rax + 0x3f98], 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14004b918
cmp byte [0x14017433c], dil
sete al
mov byte [0x14017433c], al
jmp 0x14004b91f
movzx eax, byte [0x14017433c]
test al, al
mov rax, qword [0x140217990]
je 0x14004b952
xor edx, edx
mov byte [rax + 0x78], 1
mov r8d, 0xab
lea rcx, [0x1400a9ee6]
call fcn.140010da0
test al, al
je 0x14004b94b
call fcn.140043950
call fcn.140013130
jmp 0x14004b956
mov byte [rax + 0x78], dil
call fcn.140049760
mov rcx, qword [0x140217c38]
mov r9d, 1
movss xmm0, dword [0x140117968]
xor r8d, r8d
mov dword [rsp + 0x30], edi
xor edx, edx
movss dword [rsp + 0x28], xmm0
mov rax, qword [rcx]
mov dword [rsp + 0x20], edi
call qword [rax + 0x158]
mov rcx, qword [0x140217c38]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14004b9d6
call fcn.14000daf0
mov rax, qword [0x140217990]
mov rcx, qword [rax + 0x4090]
mov rcx, qword [rcx]
add rcx, 0x48
cmp byte [rcx], dil
cmove rcx, rdi
call fcn.140001f30
mov rcx, qword [0x140217c38]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x140217c38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x14004bac3
mov rcx, qword [0x140217c38]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x14004bac3
mov qword [rsp + 0x50], rbx
mov rbx, qword [0x140217990]
test rbx, rbx
je 0x14004ba80
mov rbx, qword [rbx + 0xa0]
test rbx, rbx
je 0x14004ba80
cmp qword [rbx], rdi
je 0x14004ba80
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14004ba4b
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbx + 8], rdi
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14004ba5e
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rbx + 0x10], rdi
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14004ba80
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [0x140217990]
mov qword [rbx + 0x18], rdi
mov rcx, qword [rax + 0x58]
mov qword [rcx + 8], rdi
mov rcx, qword [0x140217c38]
lea rdx, [0x140217a00]
mov rax, qword [rcx]
call qword [rax + 0x80]
mov rax, qword [0x140217990]
mov rbx, qword [rsp + 0x50]
test rax, rax
je 0x14004bac3
mov rax, qword [rax + 0xa0]
test rax, rax
je 0x14004bac3
cmp qword [rax], rdi
je 0x14004bac3
add rsp, 0x40
pop rdi
jmp fcn.140002500
add rsp, 0x40
pop rdi
ret
Function at 0x14004c5f0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140116698]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x14004c661
lea rdx, str.failed_to_get_hwid
lea rcx, [rsp + 0x50]
call fcn.140042220
lea rdx, [0x14012d780]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll__CxxThrowException
mov edx, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x80]
call fcn.1400420f0
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
or eax, 1
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x80]
add rsp, 0x78
ret

Function at 0x14004c690
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xc8
lea rdx, str.cltlj97t4006dns01d1xgtu1n
lea rcx, [rsp + 0x80]
call fcn.140044660
nop
lea rcx, [rsp + 0x80]
call fcn.1400788cc
nop
lea rcx, [rsp + 0x80]
call fcn.14004cb50
lea rcx, [rsp + 0x60]
call fcn.140048550
nop
lea rdx, str.Enter_your_license:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004d890
lea rdx, [rsp + 0x60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14004df70
nop
lea rcx, [rsp + 0xa0]
call fcn.14004c5f0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x60]
call fcn.14006e284
nop
lea rcx, [rsp + 0xa0]
call fcn.14004cb50
lea rdx, str.Authenticated_successfully
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004d890
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rdx, [0x14004d850]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
jmp 0x14004c77a
call fcn.140043710
movzx eax, al
test eax, eax
je 0x14004c795
lea rcx, [0x140116654]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x14004c7a5
call fcn.140043410
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14004c260
nop
lea rcx, [rsp + 0x60]
call fcn.14004cb50
jmp 0x14004c7b9
xor eax, eax
add rsp, 0xc8
ret
Function at 0x140050f20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140050f81
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140050f40
mov ecx, dword [r9]
jmp 0x14005106b
cmp ecx, 0x4e0
jb 0x14005106b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140050fa0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140050ff0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140059244
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov r9d, dword [rdi]
mov r8d, dword [rsi]
mov rdx, qword [r14]
mov rcx, qword [r15]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x140059290
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14005926c
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x1400592b0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, qword [rcx + 8]
mov r14, qword [rcx]
mov ecx, dword [r14]
xor r9d, r9d
inc ecx
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x1400592fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x1400592d0
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x140059314
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, qword [rcx + 8]
mov r14, qword [rcx]
mov ecx, dword [r14]
xor r9d, r9d
inc ecx
mov qword [rsp + 0x20], rdi
mov r8, rsi
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x14005935e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x140059334
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x140059378
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov r9d, dword [rdi]
mov r8d, dword [rsi]
mov rdx, qword [r14]
mov rcx, qword [r15]
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
test eax, eax
jns 0x1400593c4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x1400593a0
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
Function at 0x1400593e4
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, qword [rcx + 0x20]
mov rsi, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov ecx, dword [r15]
mov r9, rsi
inc ecx
mov qword [rsp + 0x20], rdi
mov r8, rbp
mov rdx, r14
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x14005943a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x14005940f
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x140065fb4
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rsi, rdx
mov dword [rax + 8], 1
mov rbx, r8
mov rdi, rcx
mov rcx, rsi
lea r8, [rax + 8]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov r8d, dword [rbx + 0x10]
mov rcx, rsi
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x140066045
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x14006601e
mov rax, qword [rdi + 8]
mov dword [rax], 2
xor al, al
jmp 0x140066109
mov r8, qword [rdi + 0x18]
mov rcx, rsi
mov rdx, qword [rdi + 0x10]
mov r8, qword [r8]
mov rdx, qword [rdx]
call fcn.1400791ec
mov ecx, eax
mov rax, qword [rdi + 8]
mov dword [rax], ecx
mov rax, qword [rdi + 8]
cmp dword [rax], 0
jne 0x140066017
and dword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
mov edx, 0x8004667e
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rax, qword [rdi + 0x28]
lea r9, [rsp + 0x40]
movabs r14, 0x20c49ba5e353f7cf
mov dword [rsp + 0x20], 4
mov ebx, 0xffff
mov r8d, 0x1006
mov rcx, qword [rax]
mov rax, r14
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rdi + 0x20]
imul ecx, dword [rax], 0x3e8
add edx, ecx
mov rcx, rsi
mov dword [rsp + 0x40], edx
mov edx, ebx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rdi + 0x38]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov rcx, qword [rax]
mov rax, r14
imul rcx
sar rdx, 7
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
mov rcx, qword [rdi + 0x30]
imul r8d, dword [rcx], 0x3e8
mov rcx, rsi
add edx, r8d
mov r8d, 0x1005
mov dword [rsp + 0x40], edx
mov edx, ebx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rdi + 8]
mov al, 1
and dword [rcx], 0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret