joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140081a20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
xor esi, esi
movsxd r15, edx
mov r12d, r8d
mov rbx, rcx
test rdi, rdi
jne 0x140081a8e
call fcn.140065af0
mov qword [rbx + 0x10], rax
mov rdi, rax
test rax, rax
je 0x140081a6f
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
mov edx, 0x99
mov rcx, rax
call fcn.140065c50
cmp qword [rbx + 0x1c0], rsi
jne 0x140081a85
mov rax, qword [rbx]
test byte [rax + 0x4c], 8
jne 0x140081a85
mov byte [rbx + 0x23], 1
test rdi, rdi
je 0x140081c22
movzx eax, byte [rbx + 0x1f]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], r14
test al, al
jne 0x140081aaf
inc dword [rbx + 0x54]
mov r14d, dword [rbx + 0x54]
inc dword [rbx + 0x54]
mov ebp, dword [rbx + 0x54]
jmp 0x140081ad4
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov r14d, dword [rbx + rax*4 + 0x24]
test al, al
jne 0x140081ac8
inc dword [rbx + 0x54]
mov ebp, dword [rbx + 0x54]
jmp 0x140081ad4
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov ebp, dword [rbx + rax*4 + 0x24]
mov r9d, r14d
mov dword [rsp + 0x20], 2
mov r8d, r15d
mov edx, 0x33
mov rcx, rdi
call fcn.140065c50
mov eax, dword [rdi + 0x94]
bts eax, r15d
mov dword [rdi + 0x94], eax
cmp r15d, 1
je 0x140081b2e
mov rax, qword [rdi]
mov rdx, r15
shl rdx, 5
mov rcx, qword [rax + 0x20]
mov rax, qword [rdx + rcx + 8]
cmp byte [rax + 0x11], sil
je 0x140081b2e
mov eax, dword [rdi + 0x98]
bts eax, r15d
mov dword [rdi + 0x98], eax
mov r9d, ebp
mov dword [rsp + 0x20], esi
mov r8d, r12d
mov edx, 0x19
mov rcx, rdi
call fcn.140065c50
xor r9d, r9d
mov dword [rsp + 0x20], r14d
mov r8d, ebp
mov rcx, rdi
lea edx, [r9 + 0x53]
call fcn.140065c50
mov r12d, eax
mov rax, qword [rdi + 8]
test rax, rax
je 0x140081b75
movsxd rcx, dword [rdi + 0x3c]
lea rdx, [rcx + rcx*2]
mov byte [rax + rdx*8 - 0x15], 0x90
mov r9d, 2
mov dword [rsp + 0x20], ebp
mov r8d, r15d
mov rcx, rdi
lea edx, [r9 + 0x32]
call fcn.140065c50
mov edx, dword [rdi + 0x3c]
cmp edx, r12d
jbe 0x140081ba5
mov rax, qword [rdi + 8]
lea rcx, [r12 + r12*2]
mov dword [rax + rcx*8 + 8], edx
mov edx, dword [rdi + 0x3c]
mov rax, qword [rdi + 0x30]
lea ecx, [rdx - 1]
mov dword [rax + 0x64], ecx
test r14d, r14d
je 0x140081be5
movzx edx, byte [rbx + 0x1f]
cmp dl, 8
jae 0x140081be5
mov ecx, esi
lea rax, [rbx + 0x88]
cmp dword [rax + 0xc], r14d
je 0x140081be1
inc ecx
add rax, 0x14
cmp ecx, 0xa
jl 0x140081bc6
mov dword [rbx + rdx*4 + 0x24], r14d
inc byte [rbx + 0x1f]
jmp 0x140081be5
mov byte [rax + 6], 1
mov r14, qword [rsp + 0x58]
test ebp, ebp
je 0x140081c1d
movzx ecx, byte [rbx + 0x1f]
cmp cl, 8
jae 0x140081c1d
lea rax, [rbx + 0x88]
nop
cmp dword [rax + 0xc], ebp
je 0x140081c19
inc esi
add rax, 0x14
cmp esi, 0xa
jl 0x140081c00
mov dword [rbx + rcx*4 + 0x24], ebp
inc byte [rbx + 0x1f]
jmp 0x140081c1d
mov byte [rax + 6], 1
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r12
pop rdi
ret
Function at 0x1400859c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14d, dword [rcx + 0x28]
xor edi, edi
xor ebx, ebx
mov rsi, r8
mov r15, rdx
mov rbp, rcx
test r14d, r14d
jle 0x140085ad4
mov qword [rsp + 0x58], r12
lea r12, [0x1401be3b0]
nop word [rax + rax]
mov r11d, ebx
xor r11d, 1
cmp ebx, 2
cmovge r11d, ebx
test rsi, rsi
je 0x140085a7d
mov rax, qword [rbp + 0x20]
movzx r9d, byte [rsi]
movsxd rcx, r11d
shl rcx, 5
mov r8, qword [rcx + rax]
test r9b, r9b
je 0x140085a67
mov r10, rsi
movzx eax, r9b
sub r10, r8
nop word [rax + rax]
movzx edx, byte [r8]
movzx r9d, al
movzx ecx, al
movzx eax, byte [rdx + r12]
cmp byte [rcx + r12], al
jne 0x140085a67
movzx eax, byte [r10 + r8 + 1]
inc r8
movzx r9d, al
test al, al
jne 0x140085a40
movzx eax, byte [r8]
movzx ecx, byte [rax + r12]
movzx eax, r9b
movzx eax, byte [rax + r12]
cmp eax, ecx
jne 0x140085ab0
mov rax, qword [rbp + 0x20]
lea r8, [rsp + 0x50]
movsxd rcx, r11d
mov rdx, r15
shl rcx, 5
mov rcx, qword [rcx + rax + 0x18]
add rcx, 8
call fcn.140049a30
test rax, rax
je 0x140085aae
mov rdi, qword [rax + 0x10]
test rdi, rdi
jne 0x140085abb
jmp 0x140085ab0
xor edi, edi
inc ebx
cmp ebx, r14d
jl 0x140085a00
mov r12, qword [rsp + 0x58]
mov rax, rdi
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x60]
mov rax, rdi
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140085bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rdi
push r14
sub rsp, 0x28
mov ebp, dword [rcx + 0x28]
xor r11d, r11d
xor ebx, ebx
mov rdi, r8
mov r14, rdx
test ebp, ebp
jle 0x140085cc7
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r12
lea r12, [0x1401be3b0]
mov qword [rsp + 0x20], r15
mov r15, qword [rcx + 0x20]
nop word [rax + rax]
mov eax, ebx
xor eax, 1
cmp ebx, 2
cmovge eax, ebx
cdqe
shl rax, 5
mov rsi, qword [rax + r15 + 0x18]
test rdi, rdi
je 0x140085c7d
movzx r9d, byte [rdi]
mov r8, qword [rax + r15]
test r9b, r9b
je 0x140085c67
mov r10, rdi
movzx eax, r9b
sub r10, r8
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r8]
movzx r9d, al
movzx ecx, al
movzx eax, byte [rdx + r12]
cmp byte [rcx + r12], al
jne 0x140085c67
movzx eax, byte [r10 + r8 + 1]
inc r8
movzx r9d, al
test al, al
jne 0x140085c40
movzx eax, byte [r8]
movzx ecx, byte [rax + r12]
movzx eax, r9b
movzx eax, byte [rax + r12]
cmp eax, ecx
jne 0x140085ca1
lea rcx, [rsi + 0x20]
mov rdx, r14
lea r8, [rsp + 0x50]
call fcn.140049a30
test rax, rax
je 0x140085c9e
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x140085cab
jmp 0x140085ca1
xor r11d, r11d
inc ebx
cmp ebx, ebp
jl 0x140085c00
mov r12, qword [rsp + 0x60]
mov rax, r11
mov rsi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rdi
pop rbp
pop rbx
ret
mov rax, r11
add rsp, 0x28
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400972d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
push r13
push r14
sub rsp, 0x38
mov r14, qword [rcx + 0x1b8]
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
mov r13, qword [rcx]
test r14, r14
je 0x1400974e0
mov qword [rsp + 0x60], rbp
xor ebp, ebp
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x30], r15
nop dword [rax + rax]
movsxd r9, dword [r14 + 0x10]
movzx eax, byte [rdi + 0x1f]
mov r15d, dword [r14 + 0x14]
shl r9, 5
add r9, qword [r13 + 0x20]
test al, al
jne 0x140097330
inc dword [rdi + 0x54]
mov esi, dword [rdi + 0x54]
jmp 0x14009733c
dec al
movzx eax, al
mov byte [rdi + 0x1f], al
mov esi, dword [rdi + rax*4 + 0x24]
mov r9, qword [r9 + 0x18]
xor edx, edx
mov r8d, dword [r14 + 0x10]
mov rcx, rdi
mov dword [rsp + 0x20], gethostname
mov r9, qword [r9 + 0x68]
call fcn.140096c50
xor r9d, r9d
mov dword [rsp + 0x20], ebp
lea r12d, [r15 + 1]
mov rcx, rbx
mov r8d, r12d
lea edx, [r9 + 0x4d]
call fcn.140065c50
xor r8d, r8d
mov ebp, eax
mov r9d, r12d
mov dword [rsp + 0x20], 0
mov rcx, rbx
lea edx, [r8 + 0x4a]
call fcn.140065c50
mov edx, dword [rbx + 0x3c]
cmp edx, ebp
jbe 0x1400973ad
mov rax, qword [rbx + 8]
lea rcx, [rbp*2]
add rcx, rbp
mov dword [rax + rcx*8 + 8], edx
mov edx, dword [rbx + 0x3c]
mov rax, qword [rbx + 0x30]
lea ecx, [rdx - 1]
mov dword [rax + 0x64], ecx
movsxd rbp, dword [rbx + 0x3c]
mov rax, qword [rbx + 0x30]
mov ecx, ebp
cmp dword [rax + 0x60], ebp
jg 0x1400973d5
mov rcx, rbx
call fcn.140065ba0
test eax, eax
jne 0x140097413
mov ecx, dword [rbx + 0x3c]
lea eax, [rcx + 1]
mov dword [rbx + 0x3c], eax
lea rcx, [rbp*2]
mov rax, qword [rbx + 8]
add rcx, rbp
mov word [rax + rcx*8], 0x31
mov byte [rax + rcx*8 + 3], 0
mov dword [rax + rcx*8 + 8], 2
lea rdx, [rax + rcx*8]
lea eax, [r15 - 1]
mov dword [rdx + 0xc], esi
mov dword [rdx + 4], eax
mov qword [rdx + 0x10], 0
mov rax, qword [rbx + 0x30]
movsxd rbp, dword [rbx + 0x3c]
cmp dword [rax + 0x60], ebp
jg 0x14009742c
mov rcx, rbx
call fcn.140065ba0
test eax, eax
jne 0x14009745f
inc dword [rbx + 0x3c]
lea rcx, [rbp*2]
mov rax, qword [rbx + 8]
add rcx, rbp
xor ebp, ebp
mov word [rax + rcx*8], 0x4b
mov byte [rax + rcx*8 + 3], 0
mov dword [rax + rcx*8 + 4], ebp
mov dword [rax + rcx*8 + 8], esi
mov dword [rax + rcx*8 + 0xc], r12d
mov qword [rax + rcx*8 + 0x10], rbp
jmp 0x140097461
xor ebp, ebp
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x140097477
movsxd rax, dword [rbx + 0x3c]
lea rcx, [rax + rax*2]
mov byte [rdx + rcx*8 - 0x15], 8
xor r9d, r9d
mov dword [rsp + 0x20], ebp
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 + 0x3d]
call fcn.140065c50
test esi, esi
je 0x1400974c0
movzx edx, byte [rdi + 0x1f]
cmp dl, 8
jae 0x1400974c0
mov ecx, ebp
lea rax, [rdi + 0x88]
cmp dword [rax + 0xc], esi
je 0x1400974bc
inc ecx
add rax, 0x14
cmp ecx, 0xa
jl 0x1400974a3
mov dword [rdi + rdx*4 + 0x24], esi
inc byte [rdi + 0x1f]
jmp 0x1400974c0
mov byte [rax + 6], 1
mov r14, qword [r14]
test r14, r14
jne 0x140097310
mov r15, qword [rsp + 0x30]
mov r12, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
add rsp, 0x38
pop r14
pop r13
pop rdi
pop rbx
ret
Function at 0x1400df6e0
Capabilities:
Encode data using xor

Disassembly:
mov r9, r8
xor r11d, r11d
mov r10, rdx
mov r8d, r11d
cmp r9, 8
jb 0x1400df717
mov rdx, r9
shr rdx, 3
imul rax, rdx, 0xfffffffffffffff8
add r9, rax
mov rax, qword [rcx]
add rcx, 8
xor rax, qword [r10]
add r10, 8
or r8, rax
sub rdx, 1
jne 0x1400df700
mov rdx, r8
shr rdx, 0x20
or edx, r8d
mov r8d, edx
mov eax, edx
shr r8d, 8
or r8d, edx
shr eax, 0x10
and r8d, 0xff00
or r8d, eax
movzx eax, dl
shr r8d, 8
or r8d, eax
test r9, r9
je 0x1400df818
sub rcx, r10
cmp r9, 8
jb 0x1400df7f0
mov rax, r9
lea rdx, [r10 + 4]
and rax, 0xfffffffffffffff8
xorps xmm4, xmm4
xorps xmm3, xmm3
nop dword [rax + rax]
movd xmm2, dword [rcx + rdx - 4]
xorps xmm0, xmm0
movd xmm1, dword [rdx - 4]
lea rdx, [rdx + 8]
punpcklbw xmm2, xmm0
add r11, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [rdx - 8]
punpcklbw xmm1, xmm0
por xmm4, xmm2
movd xmm2, dword [rcx + rdx - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp r11, rax
jb 0x1400df770
por xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd eax, xmm3
or r8d, eax
cmp r11, r9
jae 0x1400df818
add r10, r11
sub r9, r11
nop word [rax + rax]
movzx edx, byte [rcx + r10]
movzx eax, byte [r10]
lea r10, [r10 + 1]
xor edx, eax
or r8d, edx
sub r9, 1
jne 0x1400df800
test r8d, r8d
sete al
ret
Function at 0x1400df820
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x1400df9c4
cmp r9, 4
jb 0x1400df86a
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x1400df850
xor r11d, r11d
test r9, r9
je 0x1400df9c4
cmp r9, 8
jb 0x1400df99e
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x1400df89c
cmp rdx, r8
jae 0x1400df99e
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x1400df8b1
cmp rdx, r10
jae 0x1400df99e
mov rdx, r10
mov qword [rsp + 0x10], rbx
sub rdx, r8
mov qword [rsp], rdi
cmp r9, 0x40
jb 0x1400df95b
mov rdi, r9
mov qword [rsp + 0x18], rsi
and edi, 0x3f
mov rsi, r9
sub rsi, rdi
mov rbx, rcx
lea rax, [r8 + 0x10]
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rsi
jb 0x1400df8f0
mov rsi, qword [rsp + 0x18]
cmp rdi, 8
jb 0x1400df990
mov rbx, r9
and rbx, 0xfffffffffffffff8
mov rdi, rcx
lea rax, [r11 + r8]
sub rdi, r8
nop dword [rax]
movq xmm1, qword [rax + rdx]
add r11, 8
movq xmm0, qword [rax]
lea rax, [rax + 8]
pxor xmm1, xmm0
movq qword [rax + rdi - 8], xmm1
cmp r11, rbx
jb 0x1400df970
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
jae 0x1400df9c4
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
nop dword [rax + rax]
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x1400df9b0
add rsp, 8
ret
Function at 0x1400e81c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x1401eb9a0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
mov rcx, qword [0x1401f2898]
mov rax, qword [rcx + 8]
cmp byte [rax + 0x19], 0
jne 0x1400e8208
nop dword [rax]
cmp dword [rax + 0x20], 4
jge 0x1400e81fc
mov rax, qword [rax + 0x10]
jmp 0x1400e8202
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400e81f0
cmp byte [rcx + 0x19], 0
jne 0x1400e82e4
cmp dword [rcx + 0x20], 4
jg 0x1400e82e4
lea r8, [rcx + 0x28]
mov r10, qword [r8 + 0x10]
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x1400e8231
mov rdx, qword [r8]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x1400e8263
movabs r11, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r11
inc rcx
cmp rcx, r10
jb 0x1400e8250
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400e7b80
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400e829e
cmp rcx, qword [rbx + 8]
je 0x1400e829e
cmp qword [rbx + 0x10], 1
jne 0x1400e82a2
mov al, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14014fd10
add rsp, 0x80
pop rbx
ret
xor al, al
jmp 0x1400e8288
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.1400e8310
nop
mov r8, rax
lea rdx, str.AcceptEncoding_does_not_accept_any_other_values_if_disabled_is_present._You_set_the_following_encodings:
lea rcx, [rsp + 0x58]
call fcn.14001d460
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400e8160
lea rdx, [0x1401e7fc0]
lea rcx, [rsp + 0x20]
call fcn.140151f08
nop
lea rcx, str.invalid_map_K__T__key
call fcn.14014c00c
int3
Function at 0x1400f3670
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbx, rdx
mov edx, 0x2b
mov rsi, r8
mov rbp, rcx
test r8, r8
je 0x1400f374b
xor r14d, r14d
nop dword [rax]
mov edi, 4
lea rdx, [rsp + 0x50]
cmp rsi, rdi
mov r8d, 4
mov rcx, rbp
cmovb rdi, rsi
call fcn.1400f5d40
cmp eax, 4
je 0x1400f36c8
mov edx, eax
jmp 0x1400f36f5
cmp byte [0x1401f2b84], r14b
jne 0x1400f36ff
mov r9d, 2
mov dword [rsp + 0x50], r14d
lea rdx, [rsp + 0x50]
xor ecx, ecx
lea r8d, [r9 + 2]
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb edx, edx
and edx, 2
mov eax, edx
test eax, eax
jne 0x1400f374d
mov eax, dword [rsp + 0x50]
jmp 0x1400f371e
imul eax, dword [0x1401f2b80], 0x41c64e6d
mov edx, r14d
add eax, 0x3039
mov dword [0x1401f2b80], eax
ror eax, 0x10
mov dword [rsp + 0x50], eax
test rdi, rdi
je 0x1400f3742
sub rsi, rdi
nop word [rax + rax]
mov byte [rbx], al
inc rbx
shr eax, 8
sub rdi, 1
jne 0x1400f3730
mov dword [rsp + 0x50], eax
test rsi, rsi
jne 0x1400f36a0
mov eax, edx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x1400f3760
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
sub rdi, 1
je 0x1400f3803
xor ebp, ebp
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
nop
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400f5d40
cmp eax, 4
jne 0x1400f37cf
cmp byte [0x1401f2b84], bpl
jne 0x1400f381b
lea r9d, [rax - 2]
mov dword [rsp + 0x50], ebp
mov r8d, eax
lea rdx, [rsp + 0x50]
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
test eax, eax
jne 0x1400f3808
mov ecx, dword [rsp + 0x50]
cmp ecx, 0xfffffffc
jae 0x1400f3790
mov eax, 0x8421085
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
imul eax, eax, 0x3e
sub ecx, eax
movzx eax, byte [rcx + r14]
mov byte [rsi], al
inc rsi
sub rdi, 1
jne 0x1400f3790
mov byte [rsi], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
imul ecx, dword [0x1401f2b80], 0x41c64e6d
add ecx, 0x3039
mov dword [0x1401f2b80], ecx
ror ecx, 0x10
mov dword [rsp + 0x50], ecx
jmp 0x1400f37d7
Function at 0x1400f59f0
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1401eb9a0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, qword [rdx + 0x10]
mov rbx, rcx
mov rax, qword [rdx + 0x18]
lea rcx, str.SSL_PROXY
cmp qword [rdx], rcx
jne 0x1400f5a37
mov rdi, qword [rax + 0x128]
mov rsi, qword [rax + 0x130]
mov ebp, dword [rax + 0x138]
jmp 0x1400f5a4b
mov rdi, qword [rax + 0xa0]
mov rsi, qword [rax + 0xa8]
mov ebp, dword [rax + 0x728]
mov qword [rsp + 0x80], r15
test rdi, rdi
je 0x1400f5c0b
mov r9, qword [rbx]
test r9, r9
je 0x1400f5a8b
mov r8, r9
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400f5a83
inc rax
test ecx, ecx
jne 0x1400f5a70
test edx, edx
je 0x1400f5c0b
mov rcx, qword [rbx + 8]
cmp rcx, r9
je 0x1400f5a9a
call qword [fcn.140168c60]
mov rcx, qword [rbx + 0x10]
call qword [fcn.140168c60]
mov rcx, qword [rbx]
call qword [fcn.140168c60]
xor r15d, r15d
mov rcx, rdi
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov qword [rbx], r15
mov byte [rbx + 0x18], r15b
call qword [case.0x1400fa7ff.1]
mov qword [rbx], rax
mov rcx, rax
test rax, rax
jne 0x1400f5b0e
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400f5ae2
call qword [fcn.140168c60]
mov rcx, qword [rbx + 0x10]
call qword [fcn.140168c60]
mov rcx, qword [rbx]
call qword [fcn.140168c60]
mov eax, 0x1b
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov qword [rbx], r15
mov byte [rbx + 0x18], r15b
jmp 0x1400f5c11
test rsi, rsi
je 0x1400f5b52
mov r8, rsi
sub r8, rdi
nop dword [rax]
movzx edx, byte [rdi]
movzx eax, byte [rdi + r8]
sub edx, eax
jne 0x1400f5b33
inc rdi
test eax, eax
jne 0x1400f5b20
test edx, edx
je 0x1400f5b52
mov rcx, rsi
call qword [case.0x1400fa7ff.1]
mov qword [rbx + 8], rax
test rax, rax
jne 0x1400f5b56
cmp qword [rbx], r15
je 0x1400f5ae2
xor ecx, ecx
jmp 0x1400f5adc
mov qword [rbx + 8], rcx
mov rdi, qword [rbx]
mov qword [rbx + 0x10], r15
test rdi, rdi
je 0x1400f5b97
cmp byte [rdi], r15b
je 0x1400f5b97
lea r8, [rsp + 0x20]
mov rdx, rdi
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jne 0x1400f5b93
lea r8, [rsp + 0x20]
mov rdx, rdi
lea ecx, [rax + 0x17]
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x1400f5b97
mov cl, 1
jmp 0x1400f5b99
xor cl, cl
mov rax, qword [rbx]
mov byte [rbx + 0x18], cl
cmp byte [rax], r15b
je 0x1400f5c0b
test cl, cl
jne 0x1400f5c0b
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp byte [rax + rdi], r15b
jne 0x1400f5bb0
test rdi, rdi
je 0x1400f5bc8
cmp byte [rax + rdi - 1], 0x2e
jne 0x1400f5bc8
dec rdi
cmp rdi, 0xffff
jae 0x1400f5c0b
lea rdx, [rdi + 1]
mov ecx, 1
call qword [fcn.140169898]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1400f5bf5
mov rcx, qword [rbx + 8]
cmp rcx, qword [rbx]
jmp 0x1400f5ada
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, rax
call fcn.1400f1b80
mov rax, qword [rbx + 0x10]
mov byte [rdi + rax], r15b
mov dword [r14 + 0x50], ebp
xor eax, eax
mov r15, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14014fd10
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400f85d0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400f86b2
call fcn.14010f3b0
test al, al
jne 0x1400f86b2
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x1400f8602
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.140110990
test rax, rax
je 0x1400f8647
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.140110990
mov rsi, rax
test rax, rax
je 0x1400f8647
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x1400f867b
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.1400f1b30
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x1400f8660
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14010a1e0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x14010a20a
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, [0x14019b258]
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x14019b268]
mov rcx, rbx
mov r14, rax
call fcn.140172164
test rax, rax
je 0x14010a269
mov rcx, rbx
test r14, r14
je 0x14010a256
xor edx, edx
lea r8d, [rdx + 8]
mov rax, r14
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp rax
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test r14, r14
je 0x14010a2a0
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14010a2a0
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
mov rax, r14
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp rax
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r15d, eax
test eax, eax
je 0x14010a36a
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x40], rsi
mov rdx, rdi
nop dword [rax]
inc rdx
cmp word [rbx + rdx*2], bp
jne 0x14010a2d0
lea ecx, [rax + 1]
add rcx, rdx
add rcx, rcx
call qword [fcn.140169890]
mov rsi, rax
test rax, rax
je 0x14010a35c
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14010a35c
mov rax, rdi
cmp word [rsi + rax*2 + 2], bp
lea rax, [rax + 1]
jne 0x14010a303
mov dword [rsi + rax*2], 0x5c
cmp word [rsi + rdi*2 + 2], bp
lea rdi, [rdi + 1]
jne 0x14010a315
lea rcx, [rdi + rdi]
sub rcx, rbx
add rcx, rsi
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x14010a330
mov rcx, rsi
test r14, r14
je 0x14010a353
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x14010a359
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbp, rax
mov rcx, rsi
call qword [fcn.140168c60]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret