joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4392b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, r9d
mov byte [rbp + 0x28], al
mov byte [rbp - 0x19], 0
mov byte [rbp - 0x1a], 0
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x10]
mov rcx, rax
call sym.strlen
mov qword [rbp - 0x28], rax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 8]
mov rcx, rax
call sym.strlen
mov qword [rbp - 0x30], rax
mov rax, qword [0x00514cc0]
mov rax, qword [rax]
sub rax, 0x10
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
sub rax, 0x10
mov qword [rbp - 0x10], rax
jmp 0x439451
mov rax, qword [rbp - 8]
mov rax, qword [rax]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov edx, 0x3a
mov rcx, rax
call sym.strchr
mov qword [rbp - 0x38], rax
cmp qword [rbp - 0x38], 0
je 0x4393d1
mov rax, qword [rbp - 0x38]
add rax, 1
movzx eax, byte [rax]
test al, al
je 0x4393d1
mov rax, qword [rbp - 0x38]
sub rax, qword [rbp - 0x18]
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
cmp rax, qword [rbp - 0x28]
jne 0x439394
mov rax, qword [rbp + 0x10]
mov rdx, qword [rax + 0x10]
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x18]
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__strnicmp]
call rax
test eax, eax
je 0x4393c5
mov rax, qword [rbp - 0x40]
cmp rax, qword [rbp - 0x30]
jne 0x439438
mov rax, qword [rbp + 0x10]
mov rdx, qword [rax + 8]
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x18]
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__strnicmp]
call rax
test eax, eax
jne 0x439438
mov rax, qword [rbp - 0x38]
add rax, 1
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
lea rdx, str.auto
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x4393ee
mov byte [rbp + 0x28], 1
jmp 0x439439
mov rax, qword [rbp - 0x18]
lea rdx, str.noauto
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x43940b
mov byte [rbp - 0x19], 1
jmp 0x439439
mov rax, qword [rbp - 0x18]
mov rdx, qword [rbp + 0x18]
mov rcx, rax
call rdx
test al, al
je 0x439439
mov rax, qword [rbp - 8]
mov rcx, rax
call dbg.string_elist_del
mov byte [rbp - 0x19], 1
movzx eax, byte [rbp - 0x1a]
add eax, 1
mov byte [rbp - 0x1a], al
jmp 0x439439
nop
mov rax, qword [rbp - 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x10]
sub rax, 0x10
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 8]
lea rdx, [rax + 0x10]
mov rax, qword [0x00514cc0]
cmp rdx, rax
jne 0x439321
cmp byte [rbp + 0x28], 0
jne 0x43947a
movzx eax, byte [rbp - 0x19]
xor eax, 1
test al, al
je 0x439492
cmp qword [rbp + 0x20], 0
je 0x439492
mov rax, qword [rbp + 0x20]
call rax
mov edx, eax
movzx eax, byte [rbp - 0x1a]
add eax, edx
mov byte [rbp - 0x1a], al
movsx eax, byte [rbp - 0x1a]
add rsp, 0x60
pop rbp
ret
Function at 0x4394a0
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov qword [rbp - 8], 0
jmp 0x439525
cmp qword [rbp + 0x28], 0
jne 0x4394d0
mov rax, qword [rbp + 0x20]
mov edx, eax
jmp 0x4394d5
mov edx, 1
mov rax, qword [rbp + 0x18]
mov r8d, edx
mov rdx, rax
mov ecx, dword [rbp + 0x10]
call sym.read
cdqe
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0xffffffffffffffff
je 0x43952e
mov rax, qword [rbp - 0x10]
add qword [rbp - 8], rax
cmp qword [rbp + 0x28], 0
je 0x439515
mov rax, qword [rbp + 0x28]
movzx edx, byte [rax]
mov rax, qword [rbp + 0x18]
movzx eax, byte [rax]
cmp dl, al
je 0x439531
mov rax, qword [rbp - 0x10]
add qword [rbp + 0x18], rax
mov rax, qword [rbp - 0x10]
sub qword [rbp + 0x20], rax
cmp qword [rbp + 0x20], 0
jne 0x4394c1
jmp 0x439532
nop
jmp 0x439532
nop
mov rax, qword [rbp - 8]
add rsp, 0x30
pop rbp
ret
Function at 0x448450
Capabilities:
Hash data using sha256

Disassembly:
push rbp
mov rbp, rsp
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov dword [rax], 0x6a09e667
mov rax, qword [rbp + 0x10]
mov dword [rax + 4], 0xbb67ae85
mov rax, qword [rbp + 0x10]
mov dword [rax + 8], 0x3c6ef372
mov rax, qword [rbp + 0x10]
mov dword [rax + 0xc], 0xa54ff53a
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x10], 0x510e527f
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x14], 0x9b05688c
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x18], 0x1f83d9ab
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x1c], 0x5be0cd19
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0
nop
pop rbp
ret
Function at 0x449860
Capabilities:
Hash data using sha512

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
cmp qword [rbp + 0x18], 0
je 0x44988d
cmp qword [rbp + 0x18], 0x40
ja 0x44988d
cmp qword [rbp + 0x28], 0x40
jbe 0x449897
mov eax, 0xffffffff
jmp 0x449994
mov qword [rbp - 8], 0
jmp 0x4498cd
mov rax, qword [rbp - 8]
lea rdx, [rax*8]
lea rax, [0x004f3c20]
mov rdx, qword [rdx + rax]
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp - 8]
add rcx, 0x10
mov qword [rax + rcx*8], rdx
add qword [rbp - 8], 1
cmp qword [rbp - 8], 7
jbe 0x4498a1
mov rax, qword [rbp + 0x10]
mov rdx, qword [rax + 0x80]
mov rax, qword [rbp + 0x28]
shl rax, 8
xor rax, qword [rbp + 0x18]
xor rax, rdx
xor rax, 0x1010000
mov rdx, rax
mov rax, qword [rbp + 0x10]
mov qword [rax + 0x80], rdx
mov rax, qword [rbp + 0x10]
mov qword [rax + 0xc0], 0
mov rax, qword [rbp + 0x10]
mov qword [rax + 0xc8], 0
mov rax, qword [rbp + 0x10]
mov qword [rax + 0xd0], 0
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
mov qword [rax + 0xd8], rdx
mov rax, qword [rbp + 0x28]
mov qword [rbp - 8], rax
jmp 0x44995b
mov rdx, qword [rbp + 0x10]
mov rax, qword [rbp - 8]
add rax, rdx
mov byte [rax], 0
add qword [rbp - 8], 1
cmp qword [rbp - 8], 0x7f
jbe 0x449948
cmp qword [rbp + 0x28], 0
je 0x44998f
mov rdx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov r8, rdx
mov rdx, rax
mov rcx, qword [rbp + 0x10]
call dbg.blake2b_update
mov rax, qword [rbp + 0x10]
mov qword [rax + 0xd0], pe_nt_image_headers64
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x449fe0
Capabilities:
Set socket configuration

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp - 4], 0
lea rax, [rbp - 4]
mov r8, rax
mov edx, 0x8004667e
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.WSOCK32.dll_ioctlsocket]
call rax
nop
add rsp, 0x30
pop rbp
ret
Function at 0x44b4a0
Capabilities:
Resolve dns

Disassembly:
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov byte [rbp - 1], 0
mov ecx, 0x41
call sym.malloc
mov rdx, rax
mov rax, qword [rbp + 0x18]
mov qword [rax], rdx
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x41
mov r8, rax
mov edx, pe_nt_image_headers64
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.WS2_32.dll_getnameinfo]
call rax
mov rax, qword [rbp + 0x10]
movzx eax, word [rax]
cmp ax, 2
jne 0x44b54b
mov rax, qword [rbp + 0x18]
mov rdx, qword [rax]
lea rax, [rbp - 0x30]
mov r8, rdx
lea rdx, str.::ffff:_s
mov rcx, rax
call sym.sprintf
lea rdx, [rbp - 0x40]
lea rax, [rbp - 0x30]
mov r8, rdx
mov rdx, rax
mov ecx, 0x17
call dbg.Inet_Pton
jmp 0x44b566
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
lea rdx, [rbp - 0x40]
mov r8, rdx
mov rdx, rax
mov ecx, 0x17
call dbg.Inet_Pton
mov ecx, 0x52
mov rax, qword [sym.imp.msvcrt.dll_toupper]
call rax
mov edx, eax
mov rax, qword [rbp + 0x20]
mov byte [rax], dl
mov rax, qword [0x005148f0]
mov rax, qword [rax]
test rax, rax
je 0x44b663
mov dword [rbp - 8], 0
jmp 0x44b652
mov byte [rbp - 0xd], 1
mov dword [rbp - 0xc], 0
jmp 0x44b615
mov eax, dword [rbp - 0xc]
cdqe
movzx ecx, byte [rbp + rax - 0x40]
mov r8, qword [0x00526a20]
mov eax, dword [rbp - 8]
movsxd rdx, eax
mov rax, rdx
shl rax, 4
add rax, rdx
add rax, rax
lea rdx, [r8 + rax]
mov eax, dword [rbp - 0xc]
cdqe
movzx eax, byte [rdx + rax + 0x10]
and ecx, eax
mov r8d, ecx
mov rcx, qword [0x00526a20]
mov eax, dword [rbp - 8]
movsxd rdx, eax
mov rax, rdx
shl rax, 4
add rax, rdx
add rax, rax
lea rdx, [rcx + rax]
mov eax, dword [rbp - 0xc]
cdqe
movzx eax, byte [rdx + rax]
cmp r8b, al
je 0x44b611
mov byte [rbp - 0xd], 0
jmp 0x44b61b
add dword [rbp - 0xc], 1
cmp dword [rbp - 0xc], 0xf
jle 0x44b5a8
cmp byte [rbp - 0xd], 0
je 0x44b64e
mov byte [rbp - 1], 1
mov rcx, qword [0x00526a20]
mov eax, dword [rbp - 8]
movsxd rdx, eax
mov rax, rdx
shl rax, 4
add rax, rdx
add rax, rax
add rax, rcx
movzx edx, byte [rax + 0x20]
mov rax, qword [rbp + 0x20]
mov byte [rax], dl
jmp 0x44b6b4
add dword [rbp - 8], 1
mov eax, dword [0x00526a28]
cmp dword [rbp - 8], eax
jl 0x44b59b
jmp 0x44b6b4
mov rax, qword [0x00514990]
movzx eax, byte [rax]
test al, al
je 0x44b677
mov byte [rbp - 1], 1
jmp 0x44b6b4
mov rdx, qword [str.127.0.0.1]
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x44b6a1
lea rax, [rbp - 0x40]
mov rcx, rax
call dbg.IN6_IS_ADDR_LOOPBACK
test eax, eax
je 0x44b6a8
mov eax, 1
jmp 0x44b6ad
mov eax, 0
mov byte [rbp - 1], al
and byte [rbp - 1], 1
movzx eax, byte [rbp - 1]
sub rsp, 0xffffffffffffff80
pop rbp
ret
Function at 0x44c5a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
add rax, 0x2b8
mov r9d, 0x6e3
lea r8, str.clear_sock
lea rdx, str..._.._cgminer_4.9.1_util.c
mov rcx, rax
call dbg._mutex_lock
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x228]
test rax, rax
je 0x44c618
mov rax, qword [rbp + 0x10]
mov rdx, qword [rax + 0x230]
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x228]
mov r9d, 0
mov r8d, 0x1ffc
mov rcx, rax
mov rax, qword [sym.imp.WSOCK32.dll_recv]
call rax
cdqe
mov qword [rbp - 8], rax
jmp 0x44c620
mov qword [rbp - 8], 0
cmp qword [rbp - 8], 0
jg 0x44c5d2
mov rax, qword [rbp + 0x10]
add rax, 0x2b8
mov r9d, 0x6ea
lea r8, str.clear_sock
lea rdx, str..._.._cgminer_4.9.1_util.c
mov rcx, rax
call dbg._mutex_unlock
mov rcx, qword [rbp + 0x10]
call dbg.clear_sockbuf
nop
add rsp, 0x30
pop rbp
ret

Function at 0x450500
Capabilities:
Manipulate console buffer

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
call dbg.curses_active_forcelocked
test al, al
je 0x45058e
mov byte [0x004ef2b0], 0
mov byte [0x00526fd0], 0
call dbg.disable_curses_windows
lea rax, [0x0052bfd8]
mov rax, qword [rax]
mov rcx, rax
call sym.delwin
call sym.endwin
mov ecx, 0xfffffff5
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
call rax
mov qword [rbp - 8], rax
lea rdx, [rbp - 0x20]
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
call rax
test eax, eax
je 0x450589
mov word [rbp - 0x24], 0
movzx eax, word [rbp - 0x1e]
sub eax, 1
mov word [rbp - 0x22], ax
mov edx, dword [rbp - 0x24]
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
call rax
call dbg.unlock_curses
nop
add rsp, 0x50
pop rbp
ret
Function at 0x47fbe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
sub rsp, 0x240
lea rbp, [rsp + 0x80]
mov eax, edx
mov qword [rbp + 0x1e0], r8
mov qword [rbp + 0x1e8], r9
mov edx, ecx
mov byte [rbp + 0x1d0], dl
mov byte [rbp + 0x1d8], al
mov byte [rbp + 0x1b7], 0
mov byte [rbp + 0x1b6], 0
mov r9d, 0x612
lea r8, str.in_use_get_ress
lea rdx, str..._.._cgminer_4.9.1_usbutils.c
lea rcx, [0x00528d70]
call sym._mutex_lock_3
mov rax, qword [0x00528eb8]
mov qword [rbp + 0x1b8], rax
jmp 0x47fd0d
mov rax, qword [rbp + 0x1b8]
mov edx, dword [rax]
movzx eax, byte [rbp + 0x1d0]
cmp edx, eax
jne 0x47fcfb
mov rax, qword [rbp + 0x1b8]
mov edx, dword [rax + 4]
movzx eax, byte [rbp + 0x1d8]
cmp edx, eax
jne 0x47fcfb
mov byte [rbp + 0x1b7], 1
mov rax, qword [rbp + 0x1b8]
mov rax, qword [rax + 8]
test rax, rax
jne 0x47fc9a
mov byte [rbp + 0x1b6], 1
mov rax, qword [rbp + 0x1b8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp + 0x1e0]
mov qword [rax], rdx
mov rax, qword [rbp + 0x1b8]
mov qword [rax + 8], 0
mov rax, qword [rbp + 0x1b8]
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x47fcd5
mov byte [rbp + 0x1b6], 1
mov rax, qword [rbp + 0x1b8]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp + 0x1e8]
mov qword [rax], rdx
mov rax, qword [rbp + 0x1b8]
mov qword [rax + 0x10], 0
jmp 0x47fd1b
mov rax, qword [rbp + 0x1b8]
mov rax, qword [rax + 0x20]
mov qword [rbp + 0x1b8], rax
cmp qword [rbp + 0x1b8], 0
jne 0x47fc4f
mov r9d, 0x627
lea r8, str.in_use_get_ress
lea rdx, str..._.._cgminer_4.9.1_usbutils.c
lea rcx, [0x00528d70]
call sym._mutex_unlock_3
movzx eax, byte [rbp + 0x1b7]
xor eax, 1
test al, al
je 0x47fdb6
mov rax, qword [0x00514e80]
movzx eax, byte [rax]
test al, al
jne 0x47fd72
mov rax, qword [0x00514ac0]
movzx eax, byte [rax]
test al, al
jne 0x47fd72
mov rax, qword [0x00514ab0]
mov eax, dword [rax]
test eax, eax
js 0x47fdb6
movzx edx, byte [rbp + 0x1d8]
movzx ecx, byte [rbp + 0x1d0]
lea rax, [rbp - 0x50]
mov dword [rsp + 0x20], edx
mov r9d, ecx
lea r8, str.FAIL:_USB_get_lock_not_found___d:_d_
mov edx, 0x200
mov rcx, rax
call sym.snprintf_4
lea rax, [rbp - 0x50]
mov r8d, 0
mov rdx, rax
mov ecx, 0
call dbg._applog
cmp byte [rbp + 0x1b6], 0
je 0x47fe2c
mov rax, qword [0x00514e80]
movzx eax, byte [rax]
test al, al
jne 0x47fde8
mov rax, qword [0x00514ac0]
movzx eax, byte [rax]
test al, al
jne 0x47fde8
mov rax, qword [0x00514ab0]
mov eax, dword [rax]
test eax, eax
js 0x47fe2c
movzx edx, byte [rbp + 0x1d8]
movzx ecx, byte [rbp + 0x1d0]
lea rax, [rbp - 0x50]
mov dword [rsp + 0x20], edx
mov r9d, ecx
lea r8, str.FAIL:_USB_get_lock_empty___d:_d_
mov edx, 0x200
mov rcx, rax
call sym.snprintf_4
lea rax, [rbp - 0x50]
mov r8d, 0
mov rdx, rax
mov ecx, 0
call dbg._applog
nop
add rsp, 0x240
pop rbp
ret
Function at 0x4a1ee0
Capabilities:
Set socket configuration

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov dword [rbp - 4], 1
mov dword [rbp - 8], 1
lea rax, [rbp - 8]
mov r8, rax
mov edx, 0x8004667e
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.WSOCK32.dll_ioctlsocket]
call rax
lea rax, [rbp - 4]
mov dword [rsp + 0x20], 4
mov r9, rax
mov r8d, 8
mov edx, 0xffff
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.WSOCK32.dll_setsockopt]
call rax
mov rax, qword [0x00514a00]
movzx eax, byte [rax]
xor eax, 1
test al, al
je 0x4a1f72
lea rax, [rbp - 4]
mov dword [rsp + 0x20], 4
mov r9, rax
mov r8d, 1
mov edx, 6
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.WSOCK32.dll_setsockopt]
call rax
nop
add rsp, 0x40
pop rbp
ret
Function at 0x4af760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
lea rax, [rbp - 0x50]
mov r8d, 0x40
mov edx, 0
mov rcx, rax
call sym.memset
mov byte [rbp - 0x50], 0x20
lea rax, [rbp - 0x50]
mov r8d, 0xa1
mov rdx, rax
mov rcx, qword [rbp + 0x10]
call dbg.mcp2210_send_recv
xor eax, 1
test al, al
je 0x4af7b2
mov eax, 0
jmp 0x4af860
mov dword [rbp - 4], 0
jmp 0x4af828
mov eax, dword [rbp - 4]
add eax, 4
cdqe
movzx eax, byte [rbp + rax - 0x50]
mov ecx, eax
mov rdx, qword [rbp + 0x18]
mov eax, dword [rbp - 4]
cdqe
mov byte [rdx + rax], cl
movzx eax, byte [rbp - 0x43]
movsx edx, al
mov eax, dword [rbp - 4]
mov ecx, eax
shr edx, cl
mov eax, edx
and eax, 1
test eax, eax
setne al
mov ecx, eax
mov rdx, qword [rbp + 0x18]
mov eax, dword [rbp - 4]
cdqe
mov byte [rdx + rax + 9], cl
movzx eax, byte [rbp - 0x41]
movsx edx, al
mov eax, dword [rbp - 4]
mov ecx, eax
shr edx, cl
mov eax, edx
and eax, 1
test eax, eax
setne al
mov ecx, eax
mov rdx, qword [rbp + 0x18]
mov eax, dword [rbp - 4]
cdqe
mov byte [rdx + rax + 0x12], cl
add dword [rbp - 4], 1
cmp dword [rbp - 4], 7
jle 0x4af7bb
movzx eax, byte [rbp - 0x44]
mov edx, eax
mov rax, qword [rbp + 0x18]
mov byte [rax + 8], dl
movzx eax, byte [rbp - 0x42]
and eax, 1
mov edx, eax
mov rax, qword [rbp + 0x18]
mov byte [rax + 0x11], dl
movzx eax, byte [rbp - 0x40]
and eax, 1
mov edx, eax
mov rax, qword [rbp + 0x18]
mov byte [rax + 0x1a], dl
mov eax, 1
add rsp, 0x70
pop rbp
ret
Function at 0x4afe30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
lea rax, [rbp - 0x50]
mov r8d, 0x40
mov edx, 0
mov rcx, rax
call sym.memset
mov byte [rbp - 0x50], 0x20
lea rax, [rbp - 0x50]
mov r8d, 0xa1
mov rdx, rax
mov rcx, qword [rbp + 0x10]
call dbg.mcp2210_send_recv
xor eax, 1
test al, al
je 0x4afe82
mov eax, 0
jmp 0x4aff58
movzx eax, byte [rbp - 0x3f]
mov byte [rbp - 5], al
lea rax, [rbp - 0x50]
mov r8d, 0x40
mov edx, 0
mov rcx, rax
call sym.memset
mov byte [rbp - 0x50], 0x21
movzx eax, byte [rbp - 5]
mov byte [rbp - 0x3f], al
mov dword [rbp - 4], 0
jmp 0x4aff1b
mov rdx, qword [rbp + 0x18]
mov eax, dword [rbp - 4]
cdqe
movzx edx, byte [rdx + rax]
mov eax, dword [rbp - 4]
add eax, 4
cdqe
mov byte [rbp + rax - 0x50], dl
movzx r8d, byte [rbp - 0x43]
mov rdx, qword [rbp + 0x18]
mov eax, dword [rbp - 4]
cdqe
movzx eax, byte [rdx + rax + 9]
movzx edx, al
mov eax, dword [rbp - 4]
mov ecx, eax
shl edx, cl
mov eax, edx
or eax, r8d
mov byte [rbp - 0x43], al
movzx r8d, byte [rbp - 0x41]
mov rdx, qword [rbp + 0x18]
mov eax, dword [rbp - 4]
cdqe
movzx eax, byte [rdx + rax + 0x12]
movzx edx, al
mov eax, dword [rbp - 4]
mov ecx, eax
shl edx, cl
mov eax, edx
or eax, r8d
mov byte [rbp - 0x41], al
add dword [rbp - 4], 1
cmp dword [rbp - 4], 7
jle 0x4afeb4
mov rax, qword [rbp + 0x18]
movzx eax, byte [rax + 8]
mov byte [rbp - 0x44], al
mov rax, qword [rbp + 0x18]
movzx eax, byte [rax + 0x11]
mov byte [rbp - 0x42], al
mov rax, qword [rbp + 0x18]
movzx eax, byte [rax + 0x1a]
mov byte [rbp - 0x40], al
lea rax, [rbp - 0x50]
mov r8d, 0xa2
mov rdx, rax
mov rcx, qword [rbp + 0x10]
call dbg.mcp2210_send_recv
add rsp, 0x70
pop rbp
ret

Function at 0x4b2d20
Capabilities:
Set socket configuration

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp - 4], 1
lea rax, [rbp - 4]
mov r8, rax
mov edx, 0x8004667e
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.WSOCK32.dll_ioctlsocket]
call rax
nop
add rsp, 0x30
pop rbp
ret
Function at 0x4bf0a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp + 0x10], ecx
mov eax, dword [rbp + 0x10]
cdqe
lea rdx, [rbp - 1]
mov r9d, 0
mov r8d, 1
mov rcx, rax
mov rax, qword [sym.imp.WSOCK32.dll_recv]
call rax
cmp eax, 0xffffffff
je 0x4bf0da
movzx eax, byte [rbp - 1]
movsx eax, al
jmp 0x4bf0df
mov eax, 0xffffffff
add rsp, 0x30
pop rbp
ret
Function at 0x4c9a50
Capabilities:
Hash data using sha256

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov dword [rbp - 4], 0
jmp 0x4c9a92
mov eax, dword [rbp - 4]
cdqe
lea rdx, [rax*4]
lea rax, [0x004f0d60]
mov edx, dword [rdx + rax]
mov rax, qword [rbp + 0x10]
mov ecx, dword [rbp - 4]
movsxd rcx, ecx
add rcx, 0x20
mov dword [rax + rcx*4 + 8], edx
add dword [rbp - 4], 1
cmp dword [rbp - 4], 7
jle 0x4c9a65
mov rax, qword [rbp + 0x10]
mov dword [rax + 4], 0
mov rax, qword [rbp + 0x10]
mov dword [rax], 0
nop
add rsp, 0x10
pop rbp
ret
Function at 0x4d2c80
Capabilities:
Get socket status

Disassembly:
push rbp
sub rsp, 0x250
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1e0], rcx
mov dword [rbp + 0x1e8], edx
mov rax, qword [rbp + 0x1e0]
mov rax, qword [rax + 0x228]
mov qword [rbp + 0x1c0], rax
cmp dword [rbp + 0x1e8], 0
jns 0x4d2cc5
mov dword [rbp + 0x1e8], 0
mov dword [rbp - 0x50], 0
mov dword [rbp + 0x1cc], 0
jmp 0x4d2cf3
mov eax, dword [rbp + 0x1cc]
mov rax, qword [rbp + rax*8 - 0x48]
cmp qword [rbp + 0x1c0], rax
je 0x4d2d00
add dword [rbp + 0x1cc], 1
mov eax, dword [rbp - 0x50]
cmp dword [rbp + 0x1cc], eax
jb 0x4d2cd8
jmp 0x4d2d01
nop
mov eax, dword [rbp - 0x50]
cmp dword [rbp + 0x1cc], eax
jne 0x4d2d2f
mov eax, dword [rbp - 0x50]
cmp eax, 0x3f
ja 0x4d2d2f
mov eax, dword [rbp + 0x1cc]
mov rdx, qword [rbp + 0x1c0]
mov qword [rbp + rax*8 - 0x48], rdx
mov eax, dword [rbp - 0x50]
add eax, 1
mov dword [rbp - 0x50], eax
mov dword [rbp + 0x1bc], 0
mov eax, dword [rbp + 0x1e8]
mov dword [rbp + 0x1b8], eax
mov rax, qword [rbp + 0x1c0]
add eax, 1
mov ecx, eax
lea rax, [rbp - 0x50]
lea rdx, [rbp + 0x1b8]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov rax, qword [sym.imp.WSOCK32.dll_select]
call rax
test eax, eax
jle 0x4d2d84
mov eax, 1
jmp 0x4d2d89
mov eax, 0
add rsp, 0x250
pop rbp
ret
Function at 0x4d7820
Capabilities:
Hash data using sha256

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
add rax, 0x40
mov r8d, 0x20
lea rdx, [0x0050b960]
mov rcx, rax
call sym.memcpy
mov rax, qword [rbp - 8]
mov qword [rax + 0x60], 0
nop
add rsp, 0x30
pop rbp
ret
Function at 0x2fc4df400
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4dfe02
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc504108]
test eax, eax
je 0x2fc4dfe9a
lea rax, [0x2fc5040e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc504110]
mov qword [rbp - 8], rax
jmp 0x2fc4dfe7e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4dfe72
cmp qword [rbp - 0x10], 0
je 0x2fc4dfe72
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4dfe38
lea rax, [0x2fc5040e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4dfe9b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4dffa0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4dffc8
mov eax, 0
jmp 0x2fc4e0016
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4dfff1
mov eax, 0
jmp 0x2fc4e0016
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4e0011
mov eax, 0
jmp 0x2fc4e0016
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4e001c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4e009a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4e0091
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4e0091
mov rax, qword [rbp - 8]
jmp 0x2fc4e00af
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4e0064
mov eax, 0
add rsp, 0x20
pop rbp
ret