joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401d5160
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor eax, eax
mov r10, rcx
mov r9d, eax
test r8d, r8d
jle 0x1401d523c
cmp r8d, 8
jb 0x1401d523c
mov ecx, r8d
mov qword [rsp], rbx
xorps xmm4, xmm4
xorps xmm3, xmm3
and ecx, 0x80000007
jge 0x1401d519b
dec ecx
or ecx, 0xfffffff8
inc ecx
mov eax, r8d
mov r11, rdx
sub eax, ecx
mov rcx, r10
sub rcx, rdx
movsxd rbx, eax
nop dword [rax]
movd xmm2, dword [rcx + r11]
xorps xmm0, xmm0
movd xmm1, dword [r11]
add r9d, 8
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [r11 + 4]
por xmm2, xmm4
punpcklbw xmm1, xmm0
movdqa xmm4, xmm2
punpcklwd xmm1, xmm0
movd xmm2, dword [rcx + r11 + 4]
add r11, 8
punpcklbw xmm2, xmm0
mov rax, r11
punpcklwd xmm2, xmm0
sub rax, rdx
pxor xmm2, xmm1
por xmm2, xmm3
movdqa xmm3, xmm2
cmp rax, rbx
jl 0x1401d51b0
mov rbx, qword [rsp]
por xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd eax, xmm3
movsxd r11, r9d
movsxd r9, r8d
cmp r11, r9
jge 0x1401d5269
sub r10, rdx
lea rcx, [r11 + rdx]
sub r9, r11
movzx r8d, byte [rcx + r10]
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
xor r8d, edx
or eax, r8d
sub r9, 1
jne 0x1401d5251
add rsp, 8
ret

Function at 0x1401dc5c0
Capabilities:
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x78], 0
mov rbx, rcx
je 0x1401dc5d5
call fcn.1401daf70
mov ecx, 0x470
call fcn.1401c5b90
mov qword [rbx + 0x78], rax
test rax, rax
jne 0x1401dc5f3
mov eax, 0xffffff83
add rsp, 0x20
pop rbx
ret
xor edx, edx
mov r8d, 0x470
mov rcx, rax
call fcn.140285450
mov rcx, qword [rbx + 0x78]
mov r8d, dword [rbx + 0x14e4]
add rcx, 0x1d0
mov rdx, qword [rbx + 0xa8]
call fcn.1401c7790
test eax, eax
jne 0x1401dc6b2
mov rcx, qword [rbx + 0x78]
mov r8d, dword [rbx + 0x14e4]
add rcx, 0x168
mov rdx, qword [rbx + 0xa8]
call fcn.1401c8de0
test eax, eax
jne 0x1401dc6b2
mov rcx, qword [rbx + 0x78]
mov r8d, dword [rbx + 0x14e4]
add rcx, 0x238
mov rdx, qword [rbx + 0xa8]
call fcn.1401c6ba0
test eax, eax
jne 0x1401dc6b2
mov rcx, qword [rbx + 0x78]
mov r8d, dword [rbx + 0x14e4]
add rcx, 0x2b0
mov rdx, qword [rbx + 0xa8]
call fcn.1401cc250
test eax, eax
jne 0x1401dc6b2
mov rcx, qword [rbx + 0x78]
mov r8d, dword [rbx + 0x14e4]
add rcx, 0x390
mov rdx, qword [rbx + 0xa8]
add rsp, 0x20
pop rbx
jmp fcn.1401cc310
add rsp, 0x20
pop rbx
ret
Function at 0x1401e6080
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe8
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rdi, rcx
mov ebp, r8d
mov rcx, qword [rsp + 0x150]
mov r12, rdx
xor edx, edx
mov dword [rsp + 0x40], r9d
mov r10d, r9d
mov qword [rsp + 0x48], rcx
movzx eax, byte [rdi + 0x3c5]
mov r8d, edx
movzx r14d, byte [rdi + 0x3c9]
mov r15d, edx
mov r13d, edx
cmp al, 1
jne 0x1401e6287
test byte [rdi + 0x4fa], al
je 0x1401e60f6
movzx r8d, word [rdi + 0x3c0]
mov eax, r8d
mov rcx, rbp
sub rcx, rax
mov r13d, 1
mov rbx, rbp
mov dword [rsp + 0x44], r13d
movzx eax, byte [rcx + r12 - 1]
mov r15d, eax
mov esi, eax
cmp word [rdi + 0x4f8], dx
jge 0x1401e61fa
sub ebp, r8d
lea r8, [r12 - 1]
movsxd rax, ebp
add r8, rax
mov eax, 0xff
lea ecx, [rbp - 1]
movzx r10d, byte [r8]
mov esi, r10d
mov r11d, r10d
sub esi, ebp
add esi, r14d
shr esi, 0x1f
dec sil
cmp ecx, eax
cmovg ecx, eax
movsxd r9, ecx
test ecx, ecx
jle 0x1401e6181
nop dword [rax]
movzx eax, byte [r8]
lea r8, [r8 - 1]
xor al, r10b
mov ecx, r11d
sub ecx, edx
inc edx
shr ecx, 0x1f
dec cl
and cl, al
or sil, cl
sub r9, r13
jne 0x1401e6160
mov eax, dword [rsp + 0x40]
lea rdx, [rsp + 0x90]
mov dword [rsp + 0x38], r13d
mov r9d, ebp
sub r9d, r14d
mov dword [rsp + 0x30], r13d
sub r9d, r15d
mov dword [rsp + 0x28], eax
dec r9d
mov dword [rsp + 0x20], r15d
mov r8, r12
mov rcx, rdi
call qword [rdi + 0x208]
movzx r8d, byte [rdi + 0x3c9]
lea r9, [rsp + 0x90]
mov edx, ebp
mov rcx, r12
mov ebx, eax
call fcn.1401dda00
or al, sil
not al
movzx ecx, al
shr cl, 4
and al, cl
movzx ecx, al
mov edx, ecx
shr edx, 2
and edx, ecx
mov eax, edx
shr eax, 1
and eax, edx
dec eax
add eax, ebx
jmp 0x1401e62dd
sub ebp, r14d
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
mov r8, r12
mov dword [rsp + 0x28], r10d
mov rcx, rdi
lea r13d, [rbp - 1]
cmp r15d, r13d
cmova r15d, edx
cmp esi, r13d
cmovbe edx, eax
sub ebp, edx
mov dword [rsp + 0x20], edx
lea rdx, [rsp + 0x50]
lea r9d, [rbp - 1]
call qword [rdi + 0x208]
mov ecx, r15d
lea rdx, [r12 - 1]
sub rbx, r14
mov r8d, r14d
sub rbx, rcx
mov ebp, eax
add rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1401d5160
test eax, eax
jne 0x1401e62df
test ebp, ebp
jne 0x1401e62df
cmp esi, r13d
ja 0x1401e62df
mov r13d, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x48]
cmp byte [rdi + 0x3c5], 2
jne 0x1401e62e6
movzx eax, word [rdi + 0x3c2]
jmp 0x1401e62ed
test al, al
jne 0x1401e6275
mov dword [rsp + 0x38], 1
lea rdx, [rsp + 0x50]
mov r9d, ebp
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], r10d
sub r9d, r14d
mov r8, r12
mov dword [rsp + 0x20], 0xffffffff
mov rcx, rdi
call qword [rdi + 0x208]
mov rdx, rbp
lea rcx, [rsp + 0x50]
sub rdx, r14
mov r8d, r14d
add rdx, r12
mov ebx, eax
call fcn.1401d5160
test eax, eax
jne 0x1401e62df
test ebx, ebx
je 0x1401e6270
mov eax, 0xfffffecf
jmp 0x1401e62f1
lea eax, [r14 + r13]
add eax, r15d
mov dword [rcx], eax
xor eax, eax
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140283120
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401f0980
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x30
mov r14, r8
mov rbp, rdx
mov rdi, rcx
test r8, r8
je 0x1401f099e
mov qword [r8], 0
test rdi, rdi
je 0x1401f0af8
test rbp, rbp
je 0x1401f0af8
mov qword [rsp + 0x50], rbx
xor edx, edx
mov r8d, 0x278
mov qword [rsp + 0x58], rsi
call fcn.140285450
mov rsi, 0xffffffffffffffff
mov rbx, rsi
inc rbx
cmp byte [rbx + rbp], 0
jne 0x1401f09d1
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
cmp ebx, 0xfd
jg 0x1401f0aee
lea r15, [rdi + 0x178]
mov r8d, 0xfd
mov rcx, r15
mov rdx, rbp
call fcn.1402a0660
mov eax, 0x100
movsxd r13, ebx
sub eax, ebx
lea rcx, [rdi + 0x178]
movsxd r8, eax
lea rdx, [0x1403116b4]
add rcx, r13
call fcn.1402a0660
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rdi + 0x140], rax
cmp rax, rsi
je 0x1401f0aee
nop dword [rax]
test byte [rdi], 0x10
je 0x1401f0a95
mov rcx, qword [rdi + 0x140]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1401f0a50
mov rcx, rdi
call fcn.1401f0940
mov eax, esi
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x60]
mov r15, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret
inc rsi
cmp byte [rdi + rsi + 0x2c], 0
jne 0x1401f0a95
lea eax, [rbx + 2]
add eax, esi
cmp eax, 0x100
jg 0x1401f0aee
lea eax, [rbx + 1]
mov rdx, rbp
movsxd r8, eax
mov rcx, r15
call fcn.1402a0660
mov eax, 0xff
mov byte [r13 + rdi + 0x178], 0x5c
sub eax, ebx
lea rcx, [rdi + 0x179]
movsxd r8, eax
lea rdx, [rdi + 0x2c]
add rcx, r13
call fcn.1402a0660
test r14, r14
je 0x1401f0aea
mov qword [r14], r15
xor eax, eax
jmp 0x1401f0a73
mov eax, 0xffffff0c
jmp 0x1401f0a73
mov eax, 0xffffff53
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret

Function at 0x1401f1bd0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov edi, r8d
mov dword [rsp + 0x20], 0xf0000000
mov rsi, rdx
xor r8d, r8d
xor edx, edx
mov r9d, 1
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1401f1c1a
mov eax, 0xffffff99
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx]
mov r8, rsi
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x1401f1c41
mov eax, 0xffffff98
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1401f2040
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
xor ebx, ebx
lea edi, [rdx - 4]
xor r11d, r11d
mov esi, edx
mov rbp, rcx
test edi, edi
je 0x1401f20cb
mov qword [rsp + 0x10], r14
mov r14d, 4
cmp edi, r14d
mov r9d, r14d
cmovbe r9d, edi
xor r8d, r8d
test r9d, r9d
jle 0x1401f20ac
mov eax, r11d
add rax, rbp
mov r10d, r9d
nop word [rax + rax]
movzx edx, byte [r10 + rax]
movzx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r8d, edx
sub r9, 1
jne 0x1401f2090
test r8d, r8d
jne 0x1401f20b1
mov ebx, 3
add r11d, r14d
mov r9d, esi
sub r9d, r11d
cmp r9d, r14d
cmova r9d, r14d
cmp r11d, edi
jb 0x1401f2076
mov r14, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x20]
mov eax, ebx
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x28]
pop rdi
ret
Function at 0x14020a0a0
Capabilities:
Encode data using xor

Disassembly:
test rcx, rcx
je 0x14020a0c4
mov r10d, dword [rsp + 0x40]
cmp r10d, 0x10
ja 0x14020a0c4
mov r11d, dword [rsp + 0x30]
test r11d, r11d
je 0x14020a0c4
cmp r10d, 0xc
jae fcn.140207470
mov eax, 0xffffff53
ret
Function at 0x14020b5e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov eax, r9d
xor r11d, r11d
or al, cl
mov r10, rdx
or al, dl
or al, r8b
test al, 7
jne 0x14020b700
shr r9d, 3
test r9d, r9d
je 0x14020b7e4
cmp r9d, 8
jb 0x14020b6b9
lea eax, [r9 - 1]
mov edx, eax
lea rbx, [rcx + rax*8]
lea rax, [r8 + rax*8]
cmp rcx, rax
ja 0x14020b635
cmp rbx, r8
jae 0x14020b6b9
lea rax, [r10 + rdx*8]
cmp rcx, rax
ja 0x14020b643
cmp rbx, r10
jae 0x14020b6b9
mov ebx, r9d
and ebx, 0xfffffff8
mov edi, 4
nop
movdqu xmm0, xmmword [r8 + r11*8]
lea eax, [rdi - 2]
movdqu xmm1, xmmword [r10 + r11*8]
pxor xmm1, xmm0
movdqu xmm0, xmmword [r8 + rax*8]
movdqu xmmword [rcx + r11*8], xmm1
add r11d, 8
movdqu xmm1, xmmword [r10 + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
mov eax, edi
movdqu xmm0, xmmword [r8 + rax*8]
movdqu xmm1, xmmword [r10 + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
lea eax, [rdi + 2]
add edi, 8
movdqu xmm1, xmmword [r10 + rax*8]
movdqu xmm0, xmmword [r8 + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
cmp r11d, ebx
jb 0x14020b650
cmp r11d, r9d
jae 0x14020b7e4
sub r10, r8
lea rdx, [r8 + r11*8]
sub rcx, r8
sub r9d, r11d
mov r8d, r9d
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + rdx]
xor rax, qword [rdx]
mov qword [rcx + rdx], rax
lea rdx, [rdx + 8]
sub r8, 1
jne 0x14020b6e0
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
test r9d, r9d
je 0x14020b7e4
cmp r9d, 0x40
jb 0x14020b7b9
lea eax, [r9 - 1]
mov edx, eax
lea rbx, [rax + rcx]
add rax, r10
cmp rcx, rax
ja 0x14020b72e
cmp rbx, r10
jae 0x14020b7b9
lea rax, [rdx + r8]
cmp rcx, rax
ja 0x14020b740
cmp rbx, r8
jae 0x14020b7b9
mov edi, r9d
and edi, 0xffffffc0
mov ebx, 0x20
nop dword [rax + rax]
movdqu xmm0, xmmword [r11 + r8]
lea eax, [rbx - 0x10]
movdqu xmm1, xmmword [r11 + r10]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax + r8]
movdqu xmmword [r11 + rcx], xmm1
add r11d, 0x40
movdqu xmm1, xmmword [rax + r10]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
mov eax, ebx
movdqu xmm0, xmmword [rax + r8]
movdqu xmm1, xmmword [rax + r10]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
lea eax, [rbx + 0x10]
add ebx, 0x40
movdqu xmm1, xmmword [rax + r10]
movdqu xmm0, xmmword [rax + r8]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
cmp r11d, edi
jb 0x14020b750
cmp r11d, r9d
jae 0x14020b7e4
sub r8, r10
mov edx, r11d
add rdx, r10
sub rcx, r10
sub r9d, r11d
mov r10d, r9d
movzx eax, byte [r8 + rdx]
xor al, byte [rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
sub r10, 1
jne 0x14020b7d0
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x140213c10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rcx
xor ecx, ecx
test r9, r9
je 0x140213d15
cmp r9, 0x40
jb 0x140213cec
lea r11, [r9 - 1]
lea rax, [rdx - 1]
add r11, r10
add rax, r9
cmp r10, rax
ja 0x140213c48
cmp r11, rdx
jae 0x140213cec
lea rax, [r8 - 1]
add rax, r9
cmp r10, rax
ja 0x140213c5d
cmp r11, r8
jae 0x140213cec
mov qword [rsp + 0x10], rbx
mov qword [rsp], rdi
mov rdi, r9
and rdi, 0xffffffffffffffc0
mov r11, r8
mov rbx, r10
sub r11, rdx
mov rax, rdx
sub rbx, rdx
nop dword [rax]
movdqu xmm0, xmmword [rax]
add rcx, 0x40
movdqu xmm1, xmmword [r11 + rax]
movdqu xmm2, xmmword [r11 + rax + 0x10]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [r11 + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm2, xmmword [r11 + rax - 0x10]
movdqu xmmword [rbx + rax - 0x20], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x10], xmm2
cmp rcx, rdi
jb 0x140213c80
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp rcx, r9
jae 0x140213d15
sub r8, rdx
lea rax, [rcx + rdx]
sub r10, rdx
sub r9, rcx
nop
movzx ecx, byte [rax + r8]
xor cl, byte [rax]
mov byte [rax + r10], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x140213d00
add rsp, 8
ret
Function at 0x14021a4c0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rdi, qword [rdx + 0x88]
mov rcx, r8
mov qword [rsp + 0x30], rdi
mov rbx, r9
mov r15, r8
call fcn.14021a320
xor r9d, r9d
lea rdx, [r15 + 0x20]
mov rcx, rdi
lea r8d, [r9 + 0x12]
call fcn.14013afc0
cmp rax, 0x12
jne 0x14021a74a
mov rax, qword [rsp + 0xa0]
xor r14d, r14d
xor esi, esi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
add qword [rax], 0x12
mov rax, qword [r15 + 8]
mov rcx, qword [r15 + 0x10]
cmp rax, rcx
je 0x14021a552
nop dword [rax + rax]
add r14, qword [rax + 8]
add rax, 0x18
cmp rax, rcx
jne 0x14021a540
mov qword [rsp + 0x28], r14
call fcn.1400303b0
xorps xmm2, xmm2
xorps xmm0, xmm0
mov rbp, rax
mov rdi, rax
cvtsi2sd xmm2, r14
cvtsi2sd xmm0, rbx
divsd xmm2, xmm0
movaps xmm1, xmm2
mulsd xmm2, qword [0x1402d9d58]
addsd xmm1, qword [0x1402d22e8]
cvttsd2si r8, xmm2
cvttsd2si r12, xmm1
mov qword [rsp + 0x88], r8
cmp rbx, 0x1388
jl 0x14021a5a7
mov r13d, 0x3e8
jmp 0x14021a5d0
movabs rax, 0x6666666666666667
imul rbx
mov r13, rdx
sar r13, 1
mov rax, r13
shr rax, 0x3f
add r13, rax
mov eax, 0xc8
cmp r13d, eax
cmovl r13d, eax
mov rbx, qword [r15 + 8]
cmp rbx, qword [r15 + 0x10]
je 0x14021a73f
mov rax, qword [rsp + 0x90]
mov r9d, 0x400
nop dword [rax]
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x38], rcx
test rcx, rcx
je 0x14021a743
xor r14d, r14d
lea r15d, [r14 + 5]
test rcx, rcx
jle 0x14021a71e
mov rax, rcx
mov edx, ecx
sub rax, r14
sub edx, r14d
cmp rax, r9
mov rcx, rdi
cmovg edx, r9d
sub rcx, rbp
imul rcx, r12
movsxd rax, edx
sub rcx, r14
sub rcx, rsi
test rcx, rcx
jle 0x14021a641
cmp rax, rcx
jg 0x14021a64a
cmp rax, r8
cmovg edx, r8d
mov ecx, edx
cmp r15d, 0x2800
jg 0x14021a6f7
mov rdx, qword [rbx]
mov r8d, ecx
mov rcx, qword [rsp + 0x30]
add rdx, r14
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x14021a68c
call fcn.14013ae10
test al, al
je 0x14021a74a
mov ecx, r15d
call sub.KERNEL32.dll_Sleep
add r15d, r15d
jmp 0x14021a6d9
cdqe
mov r15d, 5
add r14, rax
call fcn.1400303b0
add rsi, r14
mov rdi, rax
cmp rsi, qword [rsp + 0x28]
je 0x14021a703
mov rcx, rax
sub rcx, rbp
imul rcx, r12
cmp rsi, rcx
jle 0x14021a6d4
mov ecx, r13d
call sub.KERNEL32.dll_Sleep
call fcn.1400303b0
mov rdi, rax
sub rax, rbp
imul rax, r12
cmp rsi, rax
jg 0x14021a6b8
mov rsi, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov r9d, 0x400
mov r8, qword [rsp + 0x88]
cmp r14, rcx
jl 0x14021a612
jmp 0x14021a70e
mov rcx, qword [rsp + 0x30]
call fcn.14013b1c0
jmp 0x14021a708
mov rsi, qword [rsp + 0x20]
mov r9d, 0x400
mov r8, qword [rsp + 0x88]
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0xa0]
add rsi, r14
add rbx, 0x18
mov qword [rsp + 0x20], rsi
add qword [rcx], r14
cmp rbx, qword [rax + 0x10]
jne 0x14021a5f0
xor eax, eax
jmp 0x14021a74f
mov eax, 0xffffffff
jmp 0x14021a74f
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140224fc0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdx, qword [rcx + 0x68]
mov rbx, rcx
cmp rdx, 0xffffffffffffffff
je 0x140224ff0
add rcx, 0x78
call fcn.14013b990
mov rcx, qword [rbx + 0x68]
mov dl, 1
call fcn.14013b0f0
mov rdx, qword [rbx + 0x70]
cmp rdx, 0xffffffffffffffff
je 0x14022500e
lea rcx, [rbx + 0x78]
call fcn.14013b990
mov rcx, qword [rbx + 0x70]
mov dl, 1
call fcn.14013b0f0
mov rcx, qword [rbx + 0x50]
xor esi, esi
cmp byte [rcx + 8], sil
jne 0x1402250ab
nop
cmp byte [rcx + 9], sil
jne 0x1402250ab
mov rax, qword [rcx]
call qword [rax + reloc.ODBC32.dll_SQLAllocHandle]
lea rcx, [rbx + 0x78]
mov qword [rsp + 0x40], 3
call fcn.14013ba50
mov rdx, qword [rbx + 0x90]
lea rax, [rsp + 0x40]
mov ecx, dword [rbx + 0x98]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x14022509d
mov rdx, qword [rbx + 0x68]
lea rcx, [rbx + 0x78]
call fcn.14013ba30
test al, al
je 0x140225084
mov rcx, rbx
call fcn.1402242d0
jmp 0x14022509d
mov rdx, qword [rbx + 0x70]
lea rcx, [rbx + 0x78]
call fcn.14013ba30
test al, al
je 0x14022509d
mov rcx, rbx
call fcn.140224510
mov rcx, qword [rbx + 0x50]
cmp byte [rcx + 8], sil
je 0x140225020
mov rcx, qword [rbx + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x1402250c3
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx + 0x68], 0xffffffffffffffff
mov rcx, qword [rbx + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x1402250db
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx + 0x70], 0xffffffffffffffff
mov rax, qword [rbx + 0x50]
mov rbx, qword [rsp + 0x48]
mov qword [rax + 0x158], rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14022a010
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0xb11], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x14022a0b7
cmp qword [rcx + 0x278], 0
je 0x14022a077
mov dl, 1
call fcn.14022cba0
mov rax, qword [rdi + 0x1d8]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x278]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.14022cba0
mov eax, ebx
jmp 0x14022a0b9
cmp ebx, 2
ja 0x14022a0b7
mov r9, qword [rdi + 0x1d0]
lea rdx, [0x140317540]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call fcn.14028d3c8
mov r9, qword [rdi + 0x1d0]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call fcn.14028d3c8
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14022a0d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x160
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xb11], 0
mov rbx, rcx
jne 0x14022a113
cmp qword [rcx + 0x1e0], 0
je 0x14022a1e0
mov r8, rdx
mov qword [rsp + 0x158], rdi
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.14022c3c0
mov rdx, qword [rbx + 0x1e0]
movsxd rdi, eax
test rdx, rdx
je 0x14022a178
cmp byte [rbx + 0x134b], 0
jne 0x14022a178
lea rcx, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14022a160
mov byte [rbx + 0x134b], 1
mov byte [rsp + rdi + 0x30], 0xa
inc rdi
cmp rdi, 0x102
jae 0x14022a231
cmp byte [rbx + 0xb11], 0
mov byte [rsp + rdi + 0x30], 0
je 0x14022a1d8
cmp qword [rbx + 0x278], 0
je 0x14022a1f9
mov dl, 1
mov rcx, rbx
call fcn.14022cba0
mov rax, qword [rbx + 0x1d8]
lea r8, [rsp + 0x30]
mov r9, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rbx
call qword [rbx + 0x278]
xor edx, edx
mov rcx, rbx
call fcn.14022cba0
mov rdi, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140283120
add rsp, 0x160
pop rbx
ret
mov r9, qword [rbx + 0x1d0]
lea rcx, [0x140317540]
mov edx, 2
lea r8d, [rdx - 1]
call fcn.14028d3c8
mov r9, qword [rbx + 0x1d0]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rdi
call fcn.14028d3c8
jmp 0x14022a1d8
call fcn.14028394c
int3
Function at 0x14022a240
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x14022a31f
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
sub rsp, 0x860
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0x840], rax
cmp byte [rcx + 0xb11], 0
mov rbx, rcx
je 0x14022a307
mov r8, rdx
mov qword [r11 - 0x10], rdi
mov edx, 0x800
lea r9, [r11 + 0x18]
lea rcx, [rsp + 0x30]
call fcn.14022c3c0
movsxd rdi, eax
mov byte [rsp + rdi + 0x30], 0xa
inc rdi
cmp rdi, 0x802
jae 0x14022a358
cmp byte [rbx + 0xb11], 0
mov byte [rsp + rdi + 0x30], 0
je 0x14022a2ff
cmp qword [rbx + 0x278], 0
je 0x14022a320
mov dl, 1
mov rcx, rbx
call fcn.14022cba0
mov rax, qword [rbx + 0x1d8]
lea r8, [rsp + 0x30]
mov r9, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rbx
call qword [rbx + 0x278]
xor edx, edx
mov rcx, rbx
call fcn.14022cba0
mov rdi, qword [rsp + 0x858]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140283120
add rsp, 0x860
pop rbx
ret
mov r9, qword [rbx + 0x1d0]
lea rcx, [0x140317540]
mov edx, 2
lea r8d, [rdx - 1]
call fcn.14028d3c8
mov r9, qword [rbx + 0x1d0]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rdi
call fcn.14028d3c8
jmp 0x14022a2ff
call fcn.14028394c
int3

Function at 0x14022a249
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x14022a31f
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
sub rsp, 0x860
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0x840], rax
cmp byte [rcx + 0xb11], 0
mov rbx, rcx
je 0x14022a307
mov r8, rdx
mov qword [r11 - 0x10], rdi
mov edx, 0x800
lea r9, [r11 + 0x18]
lea rcx, [rsp + 0x30]
call fcn.14022c3c0
movsxd rdi, eax
mov byte [rsp + rdi + 0x30], 0xa
inc rdi
cmp rdi, 0x802
jae 0x14022a358
cmp byte [rbx + 0xb11], 0
mov byte [rsp + rdi + 0x30], 0
je 0x14022a2ff
cmp qword [rbx + 0x278], 0
je 0x14022a320
mov dl, 1
mov rcx, rbx
call fcn.14022cba0
mov rax, qword [rbx + 0x1d8]
lea r8, [rsp + 0x30]
mov r9, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rbx
call qword [rbx + 0x278]
xor edx, edx
mov rcx, rbx
call fcn.14022cba0
mov rdi, qword [rsp + 0x858]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140283120
add rsp, 0x860
pop rbx
ret
mov r9, qword [rbx + 0x1d0]
lea rcx, [0x140317540]
mov edx, 2
lea r8d, [rdx - 1]
call fcn.14028d3c8
mov r9, qword [rbx + 0x1d0]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rdi
call fcn.14028d3c8
jmp 0x14022a2ff
call fcn.14028394c
int3

Function at 0x14022a3e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x14022a422
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret