joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014650
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x140250340]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], 0
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x4c], eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.WS2_32.dll_WSARecv]
mov dword [rsp + 0x40], eax
mov dl, 1
mov rcx, qword [rsp + 0x90]
call fcn.140013bd0
mov rcx, qword [rsp + 0x90]
call fcn.140010580
cmp eax, 0x40
jne 0x140014704
mov edx, 0x2746
mov rcx, qword [rsp + 0x90]
call fcn.140064bf0
jmp 0x14001475c
mov rcx, qword [rsp + 0x90]
call fcn.140010580
cmp eax, 0x4d2
jne 0x14001472c
mov edx, 0x274d
mov rcx, qword [rsp + 0x90]
call fcn.140064bf0
jmp 0x14001475c
mov rcx, qword [rsp + 0x90]
call fcn.140010580
cmp eax, 0x2738
je 0x140014754
mov rcx, qword [rsp + 0x90]
call fcn.140010580
cmp eax, 0xea
jne 0x14001475c
mov dword [rsp + 0x40], 0
cmp dword [rsp + 0x40], 0
je 0x14001476a
mov eax, 0xffffffff
jmp 0x14001477b
mov rcx, qword [rsp + 0x90]
call fcn.1400125f0
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401ea170
add rsp, 0x68
ret

Function at 0x140014a00
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x140250340]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x4c], 0
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x4c]
mov r8d, dword [rsp + 0x44]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.WS2_32.dll_WSASend]
mov dword [rsp + 0x48], eax
mov dl, 1
mov rcx, qword [rsp + 0x90]
call fcn.140013bd0
mov rcx, qword [rsp + 0x90]
call fcn.140010580
cmp eax, 0x40
jne 0x140014ab2
mov edx, 0x2746
mov rcx, qword [rsp + 0x90]
call fcn.140064bf0
jmp 0x140014ad8
mov rcx, qword [rsp + 0x90]
call fcn.140010580
cmp eax, 0x4d2
jne 0x140014ad8
mov edx, 0x274d
mov rcx, qword [rsp + 0x90]
call fcn.140064bf0
cmp dword [rsp + 0x48], 0
je 0x140014ae6
mov eax, 0xffffffff
jmp 0x140014af7
mov rcx, qword [rsp + 0x90]
call fcn.1400125f0
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401ea170
add rsp, 0x68
ret
Function at 0x140014b90
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov rax, qword [0x140250340]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, dword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0xffffffffffffffff
jne 0x140014bef
mov byte [rsp + 0x30], 1
jmp 0x140014bf4
mov byte [rsp + 0x30], 0
movzx edx, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
call fcn.140013bd0
cmp qword [rsp + 0x38], 0xffffffffffffffff
jne 0x140014c12
mov rax, qword [rsp + 0x38]
jmp 0x140014c49
cmp dword [rsp + 0x60], 0x17
jne 0x140014c44
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x40]
mov r8d, 0x1b
mov edx, 0x29
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401ea170
add rsp, 0x58
ret

Function at 0x140014fe0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
cmp qword [rsp + 0x40], 0xffffffffffffffff
jne 0x140015016
mov edx, 0x2719
mov rcx, qword [rsp + 0x60]
call fcn.140064bf0
mov eax, 0xffffffff
jmp 0x140015095
mov r8, qword [rsp + 0x58]
mov edx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jge 0x14001503c
mov byte [rsp + 0x20], 1
jmp 0x140015041
mov byte [rsp + 0x20], 0
movzx edx, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x60]
call fcn.140013bd0
cmp dword [rsp + 0x24], 0
jl 0x140015091
cmp dword [rsp + 0x50], 0x8004667e
jne 0x140015091
mov rax, qword [rsp + 0x58]
cmp dword [rax], 0
je 0x14001507f
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
or eax, 1
mov rcx, qword [rsp + 0x48]
mov byte [rcx], al
jmp 0x140015091
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
and eax, 0xfffffffc
mov rcx, qword [rsp + 0x48]
mov byte [rcx], al
mov eax, dword [rsp + 0x24]
add rsp, 0x38
ret
Function at 0x1400150a0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
cmp qword [rsp + 0x58], 0
jne 0x14001512c
cmp qword [rsp + 0x60], 0
jne 0x14001512c
cmp qword [rsp + 0x68], 0
jne 0x14001512c
cmp qword [rsp + 0x70], 0
je 0x14001512c
mov rax, qword [rsp + 0x70]
imul eax, dword [rax], 0x3e8
mov dword [rsp + 0x3c], eax
mov rcx, qword [rsp + 0x70]
mov eax, dword [rcx + 4]
cdq
mov ecx, 0x3e8
idiv ecx
mov ecx, dword [rsp + 0x3c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x140015111
mov dword [rsp + 0x34], 1
mov ecx, dword [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x78]
call fcn.1400125f0
xor eax, eax
jmp 0x1400151b0
cmp qword [rsp + 0x70], 0
je 0x140015163
mov rax, qword [rsp + 0x70]
cmp dword [rax], 0
jne 0x140015163
mov rax, qword [rsp + 0x70]
cmp dword [rax + 4], 0
jle 0x140015163
mov rax, qword [rsp + 0x70]
cmp dword [rax + 4], 0x3e8
jge 0x140015163
mov rax, qword [rsp + 0x70]
mov dword [rax + 4], 0x3e8
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_select]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jge 0x140015198
mov byte [rsp + 0x30], 1
jmp 0x14001519d
mov byte [rsp + 0x30], 0
movzx edx, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
call fcn.140013bd0
mov eax, dword [rsp + 0x38]
add rsp, 0x48
ret
Function at 0x1400151c0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x278
mov rax, qword [0x140250340]
xor rax, rsp
mov qword [rsp + 0x260], rax
cmp qword [rsp + 0x280], 0xffffffffffffffff
jne 0x140015213
mov edx, 0x2719
mov rcx, qword [rsp + 0x298]
call fcn.140064bf0
mov eax, 0xffffffff
jmp 0x140015377
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x34], 0
jmp 0x14001522f
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x34], eax
jae 0x140015250
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x280]
cmp qword [rsp + rax*8 + 0x58], rcx
jne 0x14001524e
jmp 0x140015250
jmp 0x140015225
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x34], eax
jne 0x14001527c
cmp dword [rsp + 0x50], 0x40
jae 0x14001527c
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x280]
mov qword [rsp + rax*8 + 0x58], rcx
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
xor eax, eax
test eax, eax
jne 0x14001521b
movzx eax, byte [rsp + 0x288]
and eax, 1
test eax, eax
je 0x1400152ad
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x4c], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
jmp 0x1400152fa
cmp dword [rsp + 0x290], 0
jl 0x1400152f1
mov eax, dword [rsp + 0x290]
cdq
mov ecx, 0x3e8
idiv ecx
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x290]
cdq
mov ecx, 0x3e8
idiv ecx
mov eax, edx
imul eax, eax, 0x3e8
mov dword [rsp + 0x4c], eax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
jmp 0x1400152fa
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x280]
inc rax
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_select]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jge 0x140015334
mov byte [rsp + 0x30], 1
jmp 0x140015339
mov byte [rsp + 0x30], 0
movzx edx, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x298]
call fcn.140013bd0
cmp dword [rsp + 0x38], 0
jne 0x140015373
movzx eax, byte [rsp + 0x288]
and eax, 1
test eax, eax
je 0x140015373
mov edx, 0x2733
mov rcx, qword [rsp + 0x298]
call fcn.140064bf0
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401ea170
add rsp, 0x278
ret
Function at 0x140015540
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
cmp qword [rsp + 0x78], 0
je 0x14001557a
mov rax, qword [rsp + 0x78]
movsx eax, byte [rax]
test eax, eax
je 0x14001557a
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
jmp 0x140015583
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x80], 0
je 0x1400155b6
mov rax, qword [rsp + 0x80]
movsx eax, byte [rax]
test eax, eax
je 0x1400155b6
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
jmp 0x1400155bf
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x80], rax
call fcn.140013bb0
mov r9, qword [rsp + 0x90]
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [rsp + 0x20], eax
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140015390
mov rdi, qword [rsp + 0x98]
mov rsi, rax
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x98]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x70]
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x140017a20
Capabilities:
Initialize winsock library

Disassembly:
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x1e8
mov rax, qword [0x140250340]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rax, qword [rsp + 0x1f0]
mov ecx, 1
lock xadd dword [rax], ecx
inc ecx
mov eax, ecx
cmp eax, 1
jne 0x140017aad
movzx eax, byte [rsp + 0x1f8]
and rax, 0xff
movzx eax, al
movzx ecx, byte [rsp + 0x200]
and rcx, 0xff
movzx ecx, cl
shl ecx, 8
or eax, ecx
lea rdx, [rsp + 0x30]
movzx ecx, ax
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x1f0]
add rax, 4
mov ecx, dword [rsp + 0x20]
xchg dword [rax], ecx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401ea170
add rsp, 0x1e8
ret
Function at 0x14001af90
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [0x140250340]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.1400099e0
mov rax, qword [rsp + 0x90]
mov rcx, qword [rax + 8]
call fcn.140016200
movzx eax, byte [rsp + 0xb8]
test eax, eax
je 0x14001b01a
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 8]
mov qword [rsp + 0x48], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x48]
call fcn.140017150
jmp 0x14001b139
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.14001a640
movzx eax, al
test eax, eax
jne 0x14001b067
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 8]
mov qword [rsp + 0x50], rax
xor r9d, r9d
mov r8d, 0x2719
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x50]
call fcn.140017150
jmp 0x14001b139
mov dword [rsp + 0x68], 0
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x68]
mov r8d, dword [rsp + 0xa8]
mov rdx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_WSASend]
mov dword [rsp + 0x44], eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x4d2
jne 0x14001b0d6
mov dword [rsp + 0x40], 0x274d
cmp dword [rsp + 0x44], 0
je 0x14001b116
cmp dword [rsp + 0x40], 0x3e5
je 0x14001b116
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 8]
mov qword [rsp + 0x58], rax
mov r9d, dword [rsp + 0x68]
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x58]
call fcn.140017150
jmp 0x14001b139
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 8]
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x60]
call fcn.140017080
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401ea170
add rsp, 0x88
ret
Function at 0x14001b150
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [0x140250340]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.1400099e0
mov rax, qword [rsp + 0x90]
mov rcx, qword [rax + 8]
call fcn.140016200
movzx eax, byte [rsp + 0xb8]
test eax, eax
je 0x14001b1da
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 8]
mov qword [rsp + 0x48], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x48]
call fcn.140017150
jmp 0x14001b314
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.14001a640
movzx eax, al
test eax, eax
jne 0x14001b227
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 8]
mov qword [rsp + 0x50], rax
xor r9d, r9d
mov r8d, 0x2719
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x50]
call fcn.140017150
jmp 0x14001b314
mov dword [rsp + 0x68], 0
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x6c], eax
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
mov r8d, dword [rsp + 0xa8]
mov rdx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_WSARecv]
mov dword [rsp + 0x44], eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x40
jne 0x14001b29f
mov dword [rsp + 0x40], 0x2746
jmp 0x14001b2b1
cmp dword [rsp + 0x40], 0x4d2
jne 0x14001b2b1
mov dword [rsp + 0x40], 0x274d
cmp dword [rsp + 0x44], 0
je 0x14001b2f1
cmp dword [rsp + 0x40], 0x3e5
je 0x14001b2f1
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 8]
mov qword [rsp + 0x58], rax
mov r9d, dword [rsp + 0x68]
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x58]
call fcn.140017150
jmp 0x14001b314
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 8]
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x60]
call fcn.140017080
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401ea170
add rsp, 0x88
ret

Function at 0x140024700
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov qword [rax], 0
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x10], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x10], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x10], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x10], 0x10325476
mov eax, 4
imul rax, rax, 4
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x10], 0xc3d2e1f0
ret
Function at 0x140031530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x98
cmp dword [rsp + 0xa8], 0
jne 0x14003155a
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 9]
test eax, eax
jne 0x14003157c
cmp dword [rsp + 0xa8], 1
jne 0x140031756
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 8]
test eax, eax
je 0x140031756
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x28]
test eax, eax
je 0x140031756
mov rax, qword [rsp + 0xa0]
add rax, 0x28
mov rcx, rax
call fcn.140026ea0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x68], rax
mov ecx, 0x32e8
call fcn.1401ea2b0
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400315d9
mov rcx, qword [rsp + 0x50]
call fcn.140031760
mov qword [rsp + 0x58], rax
jmp 0x1400315e2
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call fcn.140052630
cmp dword [rsp + 0xa8], 0
jne 0x1400316ac
mov rax, qword [rsp + 0xa0]
mov rcx, rax
call fcn.14000b2d0
add rax, 0x1728
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0x30], eax
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
call fcn.140031220
mov rax, qword [rsp + 0xa0]
mov rcx, rax
call fcn.14000b2d0
add rax, 8
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0x1c]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0x30]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x38]
mov edx, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x78]
call fcn.14002cf20
jmp 0x140031756
mov rax, qword [rsp + 0xa0]
mov rcx, rax
call fcn.14000b2d0
add rax, 0x1728
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0x30]
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call fcn.140031220
mov rax, qword [rsp + 0xa0]
mov rcx, rax
call fcn.14000b2d0
add rax, 8
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0x1c]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
mov edx, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x88]
call fcn.14002cf20
add rsp, 0x98
ret
Function at 0x140036ea0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140250340]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx eax, byte [0x1403356b0]
test eax, eax
jne 0x140036ed2
mov rcx, qword [rsp + 0x60]
call fcn.140037080
jmp 0x140037062
lea rcx, [rsp + 0x40]
call fcn.14000a4a0
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x108], 0
ja 0x140036f0c
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x108], 0xffff
jbe 0x140036f0c
mov rcx, qword [rsp + 0x60]
call fcn.140037080
jmp 0x140037062
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x108], 0x81
jne 0x140036f2e
mov rax, qword [rsp + 0x60]
mov qword [rax + 0x108], 0x82
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x108]
dec rax
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x60]
add rax, qword [rcx + 0x110]
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [0x14032b1f0]
call fcn.14000bac0
movzx eax, al
test eax, eax
jne 0x140036f77
mov rcx, qword [rsp + 0x60]
call fcn.140037080
jmp 0x140037062
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0xf8], 1
jbe 0x14003704c
movss xmm0, dword [rsp + 0x40]
subss xmm0, dword [0x140333d80]
mulss xmm0, dword [0x140231b78]
movss dword [rsp + 0x34], xmm0
movss xmm0, dword [rsp + 0x44]
subss xmm0, dword [0x140333d84]
mulss xmm0, dword [0x140231b78]
movss dword [rsp + 0x30], xmm0
movss xmm0, dword [rsp + 0x30]
mulss xmm0, dword [0x1402318c8]
mov rax, qword [rsp + 0x60]
divss xmm0, dword [rax + 0x150]
divss xmm0, dword [0x140231b58]
cvttss2si eax, xmm0
mov dword [rsp + 0x3c], eax
movss xmm0, dword [rsp + 0x34]
mulss xmm0, dword [0x1402318c8]
mov rax, qword [rsp + 0x60]
divss xmm0, dword [rax + 0x150]
divss xmm0, dword [0x140231544]
cvttss2si eax, xmm0
mov dword [rsp + 0x38], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14003704c
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, dword [rsp + 0x38]
mov edx, dword [rsp + 0x3c]
mov ecx, 1
call qword [sym.imp.USER32.dll_mouse_event]
mov rax, qword [rsp + 0x40]
mov qword [0x140333d80], rax
mov rcx, qword [rsp + 0x60]
call fcn.140037080
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401ea170
add rsp, 0x58
ret
Function at 0x14003d160
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov byte [0x140333996], 1
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
add rsp, 0x28
ret

Function at 0x14004c920
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
movsx eax, byte [rax]
test eax, eax
je 0x14004c95f
mov rax, qword [rsp + 0x40]
movsx eax, byte [rax]
mov dword [rsp + 0x24], eax
mov rcx, qword [rsp + 0x40]
inc rcx
call fcn.14004c920
imul eax, eax, 0x21
mov ecx, dword [rsp + 0x24]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
jmp 0x14004c967
mov dword [rsp + 0x20], 0x1505
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x140059920
Capabilities:
Contain obfuscated stackstrings
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov dword [rsp + 0x30], 0x61707865
mov dword [rsp + 0x34], 0x3320646e
mov dword [rsp + 0x38], 0x79622d32
mov dword [rsp + 0x3c], 0x6b206574
mov dword [rsp + 0x24], 0
jmp 0x140059960
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 4
jge 0x14005997b
movsxd rax, dword [rsp + 0x24]
movsxd rcx, dword [rsp + 0x24]
mov eax, dword [rsp + rax*4 + 0x30]
mov dword [rsp + rcx*4 + 0x40], eax
jmp 0x140059956
mov dword [rsp + 0x28], 0
jmp 0x14005998f
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 8
jge 0x1400599b7
movsxd rax, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x28]
add ecx, 4
movsxd rcx, ecx
mov rdx, qword [rsp + 0x90]
mov eax, dword [rdx + rax*4 + 0x40]
mov dword [rsp + rcx*4 + 0x40], eax
jmp 0x140059985
xor edx, edx
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x60]
mov ecx, select
div rcx
mov ecx, 0xffffffff
and rax, rcx
mov ecx, 4
imul rcx, rcx, 0xc
mov dword [rsp + rcx + 0x40], eax
xor edx, edx
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x60]
mov ecx, select
div rcx
shr rax, 0x20
mov ecx, 4
imul rcx, rcx, 0xd
mov dword [rsp + rcx + 0x40], eax
mov eax, 4
imul rax, rax, 0xf
mov dword [rsp + rax + 0x40], 0xdeadbeef
mov eax, 4
imul rax, rax, 0xe
mov dword [rsp + rax + 0x40], 0xdeadbeef
mov dword [rsp + 0x2c], 0
jmp 0x140059a3f
mov eax, dword [rsp + 0x2c]
inc eax
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0x10
jge 0x140059a61
movsxd rax, dword [rsp + 0x2c]
movsxd rcx, dword [rsp + 0x2c]
mov rdx, qword [rsp + 0x90]
mov eax, dword [rsp + rax*4 + 0x40]
mov dword [rdx + rcx*4], eax
jmp 0x140059a35
mov rcx, qword [rsp + 0x90]
call fcn.14005ed30
mov dword [rsp + 0x20], 0
jmp 0x140059a82
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x10
jge 0x140059ab6
movsxd rax, dword [rsp + 0x20]
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x90]
mov ecx, dword [rdx + rcx*4]
add ecx, dword [rsp + rax*4 + 0x40]
mov eax, ecx
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x90]
mov dword [rdx + rcx*4], eax
jmp 0x140059a78
add rsp, 0x88
ret