joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18022e720
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbx, rcx
mov ebp, 1
call fcn.18022e430
mov edi, eax
test eax, eax
jns 0x18022e769
lea edx, [rbp + 0x69]
lea ecx, [rbp + 0x1f]
lea r8d, [rbp + 0x6b]
xor r9d, r9d
mov dword [rsp + 0x20], 0
call sym.VBoxRT.dll_ERR_put_error
jmp 0x18022e83c
call sym.VBoxRT.dll_BIO_sock_init
cmp eax, ebp
jne 0x18022e850
test edi, edi
jle 0x18022e781
mov eax, ebp
jmp 0x18022e859
mov r9d, 0x87
lea r8, str.D:_tinderboxwin_4.2_srclibsopenssl_0.9.8ycrypto_bio_b_sock.c
lea edx, [r9 - 0x71]
lea ecx, [rdx - 0xd]
call sym.VBoxRT.dll_CRYPTO_lock
mov rcx, rbx
call fcn.180175598
mov r11, rax
test rax, rax
jne 0x18022e7c2
lea edx, [rax + 0x6a]
lea ecx, [rax + 0x20]
lea r8d, [rax + 0x66]
xor r9d, r9d
mov dword [rsp + 0x20], eax
call sym.VBoxRT.dll_ERR_put_error
jmp 0x18022e81e
cmp word [rax + 0x10], 2
je 0x18022e7e6
xor r9d, r9d
mov dword [rsp + 0x20], 0
lea edx, [r9 + 0x6a]
lea r8d, [r9 + 0x6b]
lea ecx, [rdx - 0x4a]
call sym.VBoxRT.dll_ERR_put_error
jmp 0x18022e81e
mov rax, qword [rax + 0x18]
xor ebp, ebp
mov rcx, qword [rax]
movzx eax, byte [rcx]
mov byte [rsi], al
mov rax, qword [r11 + 0x18]
mov rcx, qword [rax]
movzx eax, byte [rcx + 1]
mov byte [rsi + 1], al
mov rax, qword [r11 + 0x18]
mov rcx, qword [rax]
movzx eax, byte [rcx + 2]
mov byte [rsi + 2], al
mov rax, qword [r11 + 0x18]
mov rcx, qword [rax]
movzx eax, byte [rcx + 3]
mov byte [rsi + 3], al
mov edx, reloc.WS2_32.dll_shutdown
lea r8, str.D:_tinderboxwin_4.2_srclibsopenssl_0.9.8ycrypto_bio_b_sock.c
mov r9d, 0x9c
lea ecx, [rdx - 0xc]
call sym.VBoxRT.dll_CRYPTO_lock
test ebp, ebp
je 0x18022e854
lea rdx, str.host
mov r8, rbx
mov ecx, 2
call sym.VBoxRT.dll_ERR_add_error_data
xor eax, eax
jmp 0x18022e859
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180230ca0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x188
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x168], rax
mov rdi, qword [rsp + 0x1f0]
mov r12, rcx
lea rcx, [rsp + 0x60]
movsxd rbx, r9d
mov qword [rsp + 0x48], r8
mov esi, edx
mov r14d, 1
call sym.VBoxRT.dll_HMAC_CTX_init
mov r13d, dword [rsp + 0x1e8]
test r12, r12
jne 0x180230cf9
xor esi, esi
jmp 0x180230d26
cmp esi, 0xffffffff
jne 0x180230d26
xor esi, esi
mov rax, r12
cmp byte [r12], sil
je 0x180230d22
nop dword [rax]
cmp esi, 0x80000000
jae 0x180230d22
inc rax
inc esi
cmp byte [rax], 0
jne 0x180230d10
btr esi, 0x1f
test r13d, r13d
je 0x180230ea2
mov qword [rsp + 0x180], rbp
mov qword [rsp + 0x178], r15
mov r15d, dword [rsp + 0x1e0]
mov rbp, rbx
mov qword [rsp + 0x50], rbx
mov eax, reloc.WS2_32.dll_sendto
nop word [rax + rax]
mov ebx, r13d
cmp r13d, 0x14
mov byte [rsp + 0x43], r14b
cmovg ebx, eax
mov eax, r14d
shr eax, 0x18
mov dword [rsp + 0x44], ebx
mov byte [rsp + 0x40], al
mov eax, r14d
shr eax, 0x10
mov byte [rsp + 0x41], al
mov eax, r14d
shr eax, 8
mov byte [rsp + 0x42], al
call sym.VBoxRT.dll_EVP_sha1
lea rcx, [rsp + 0x60]
mov r8d, esi
mov rdx, r12
mov r9, rax
mov qword [rsp + 0x20], 0
call sym.VBoxRT.dll_HMAC_Init_ex
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
mov r8, rbp
call sym.VBoxRT.dll_HMAC_Update
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
mov r8d, 4
call sym.VBoxRT.dll_HMAC_Update
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x60]
xor r8d, r8d
call sym.VBoxRT.dll_HMAC_Final
movsxd rbp, ebx
lea rdx, [rsp + 0x150]
mov r8, rbp
mov rcx, rdi
call sub.MSVCR100.dll_memcpy
cmp r15d, 1
jle 0x180230e79
lea ebx, [r15 - 1]
nop
call sym.VBoxRT.dll_EVP_sha1
mov qword [rsp + 0x30], 0
lea r9, [rsp + 0x150]
mov rcx, rax
lea rax, [rsp + 0x150]
mov r8d, esi
mov qword [rsp + 0x28], rax
mov rdx, r12
mov qword [rsp + 0x20], reloc.WS2_32.dll_sendto
call sym.VBoxRT.dll_HMAC
test rbp, rbp
jle 0x180230e70
lea r8, [rsp + 0x150]
mov rcx, rdi
mov rdx, rbp
sub r8, rdi
movzx eax, byte [r8 + rcx]
inc rcx
xor byte [rcx - 1], al
dec rdx
jne 0x180230e60
dec rbx
jne 0x180230e10
mov ebx, dword [rsp + 0x44]
add rdi, rbp
mov rbp, qword [rsp + 0x50]
inc r14d
sub r13d, ebx
mov eax, reloc.WS2_32.dll_sendto
jne 0x180230d60
mov r15, qword [rsp + 0x178]
mov rbp, qword [rsp + 0x180]
lea rcx, [rsp + 0x60]
call sym.VBoxRT.dll_HMAC_CTX_cleanup
mov eax, 1
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.180227610
add rsp, 0x188
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x180233620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov r12d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r15]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r14, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r13d, r13d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r15
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r12d, r12d
je 0x1802337d9
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx edx, r8b
movzx r9d, r10b
dec r12d
test ebx, ebx
jne 0x180233776
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.180232440
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r13d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x180233713
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x1802337d9
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180227610
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180233800
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
mov rsi, r8
lea rdx, [0x180354630]
mov r8d, 0x1048
mov rdi, rcx
call sub.MSVCR100.dll_memcpy
mov eax, 0x48
mov rdx, rsi
cmp ebx, eax
cmovg ebx, eax
movsxd r8, ebx
add r8, rsi
xor ebx, ebx
mov r9d, ebx
nop word [rax + rax]
movzx ecx, byte [rdx]
inc rdx
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
xor dword [rdi + r9*4], ecx
inc r9
cmp r9, 0x12
jl 0x180233850
mov qword [rsp + 0x30], rbx
mov rsi, rbx
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.180232440
mov eax, dword [rsp + 0x30]
add rsi, 2
mov dword [rdi + rsi*4 - 8], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rsi*4 - 4], eax
cmp rsi, 0x12
jl 0x1802338b0
nop word [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.180232440
mov eax, dword [rsp + 0x30]
add rbx, 2
mov dword [rdi + rbx*4 + 0x40], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rbx*4 + 0x44], eax
cmp rbx, 0x400
jl 0x1802338e0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x140007ac0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140024020]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rdx
mov rbp, rcx
xor ecx, ecx
mov qword [rdx + 0x10], rcx
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x140007afa
mov rax, qword [rdx]
mov word [rax], cx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], rcx
mov word [rsp + 0x20], cx
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r14d, eax
test eax, eax
jne 0x140007b5e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x140007c0e
test eax, eax
jle 0x140007b47
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
mov rdx, rbp
lea rcx, str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
call fcn.140006e10
jmp 0x140007c0e
mov eax, 2
mul r14
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.1400139dc
mov rsi, rax
mov r8d, r14d
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140007b2a
nop
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x140007b90
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.1400051b0
mov rcx, rsi
call fcn.140013710
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14000f680
test al, al
je 0x140007bee
lea rax, [rsp + 0x20]
cmp rdi, rax
je 0x140007bea
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
mov rcx, rdi
call fcn.1400051b0
mov bl, 1
jmp 0x140007c10
lea r8, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae r8, qword [rsp + 0x20]
mov rdx, rbp
lea rcx, [0x14001d610]
call fcn.140006a90
xor bl, bl
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140007c55
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007c50
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007c50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140013710
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400136f0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400f68d9
Capabilities:
Create directory

Disassembly:
jmp 0x14015c840
push rbp
push rdi
sub rsp, 0x408
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x96
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x141206200]
xor rax, rbp
mov qword [rbp + 0x3c8], rax
lea rcx, [0x14122924d]
call fcn.1400fd2fb
nop
lea rdx, str.C:WindowsLogsDPX
lea rcx, [rbp + 8]
call fcn.1400f86a7
nop
lea r8, str._setuparr.log
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x48]
call fcn.1400fc3b5
nop
lea rcx, [rbp + 8]
call fcn.1400f875b
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14015c8fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0xb7
je 0x14015c8fc
mov dword [rbp + 0x354], 1
lea rcx, [rbp + 0x48]
call fcn.1400fc1e9
nop
lea rcx, [rbp + 8]
call fcn.1400fc1e9
mov eax, dword [rbp + 0x354]
jmp 0x14015ca26
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xb0]
call fcn.1400f8d91
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x20
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0xb0]
call fcn.1400f7973
nop
mov rax, qword [rbp + 0xb0]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0xb0]
mov rcx, rax
call fcn.1400f929b
movzx eax, al
test eax, eax
je 0x14015c9c4
mov r8d, 0xc30e00
lea rdx, [0x140365020]
lea rcx, [rbp + 0xb0]
call fcn.1400f9c19
nop
mov rax, qword [rbp + 0xb0]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0xb0]
mov rcx, rax
call fcn.1400fd6e8
movzx eax, al
test eax, eax
je 0x14015c9c2
mov dword [rbp + 0x374], 1
lea rcx, [rbp + 0xb0]
call fcn.1400f7c39
nop
lea rcx, [rbp + 0x48]
call fcn.1400fc1e9
nop
lea rcx, [rbp + 8]
call fcn.1400fc1e9
mov eax, dword [rbp + 0x374]
jmp 0x14015ca26
jmp 0x14015c9f6
mov dword [rbp + 0x394], 1
lea rcx, [rbp + 0xb0]
call fcn.1400f7c39
nop
lea rcx, [rbp + 0x48]
call fcn.1400fc1e9
nop
lea rcx, [rbp + 8]
call fcn.1400fc1e9
mov eax, dword [rbp + 0x394]
jmp 0x14015ca26
mov dword [rbp + 0x3b4], 0
lea rcx, [rbp + 0xb0]
call fcn.1400f7c39
nop
lea rcx, [rbp + 0x48]
call fcn.1400fc1e9
nop
lea rcx, [rbp + 8]
call fcn.1400fc1e9
mov eax, dword [rbp + 0x3b4]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1403078c0]
call fcn.1400fbf05
mov rax, rdi
mov rcx, qword [rbp + 0x3c8]
xor rcx, rbp
call fcn.1400f976e
lea rsp, [rbp + 0x3d8]
pop rdi
pop rbp
ret
Function at 0x1400f725c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
jmp 0x140165a90
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x698
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x10e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x6b8]
mov rax, qword [0x141206200]
xor rax, rbp
mov qword [rbp + 0x660], rax
mov dword [rbp + 0x644], 0
lea rcx, [0x14122924f]
call fcn.1400fd2fb
nop
lea rdx, [rbp + 0x10]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
nop
mov edx, 0x100
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.WS2_32.dll_gethostname]
nop
mov rcx, qword [rbp + 0x690]
call fcn.1400fd260
mov qword [rbp + 0x658], rax
mov eax, dword [rbp + 0x644]
or eax, 1
mov dword [rbp + 0x644], eax
mov r8d, 0x30
xor edx, edx
lea rcx, [rbp + 0x2e8]
call fcn.1400fb5aa
nop
mov dword [rbp + 0x2ec], 2
mov dword [rbp + 0x2f0], 2
lea r9, [rbp + 0x338]
lea r8, [rbp + 0x2e8]
xor edx, edx
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x140165c0d
mov rax, qword [rbp + 0x338]
mov qword [rbp + 0x398], rax
jmp 0x140165b98
mov rax, qword [rbp + 0x398]
mov rax, qword [rax + 0x28]
mov qword [rbp + 0x398], rax
cmp qword [rbp + 0x398], 0
je 0x140165bff
mov rax, qword [rbp + 0x398]
cmp dword [rax + 4], 2
jne 0x140165bfd
mov rax, qword [rbp + 0x398]
mov rax, qword [rax + 0x20]
mov qword [rbp + 0x3b8], rax
mov rax, qword [rbp + 0x3b8]
add rax, 4
mov r9d, 0x16
lea r8, [rbp + 0x3d8]
mov rdx, rax
mov ecx, 2
call fcn.1400fa03d
nop
lea rdx, [rbp + 0x3d8]
mov rcx, qword [rbp + 0x690]
call fcn.1400f6429
nop
jmp 0x140165bff
jmp 0x140165b86
mov rcx, qword [rbp + 0x338]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
nop
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
mov rax, qword [rbp + 0x690]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140309310]
call fcn.1400fbf05
mov rax, rdi
mov rcx, qword [rbp + 0x660]
xor rcx, rbp
call fcn.1400f976e
lea rsp, [rbp + 0x678]
pop rdi
pop rbp
ret

Function at 0x1400f73dd
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1401ae4a0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x1401ae4c8
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x1401ae512
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x1401ae4bd
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret
Function at 0x1400f79ff
Capabilities:
Terminate process

Disassembly:
jmp 0x14015c6a0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x14122924e]
call fcn.1400fd2fb
nop
cmp qword [rbp + 0xe8], 0
je 0x14015c6f2
cmp qword [rbp + 0xe8], 0xffffffffffffffff
je 0x14015c6f2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0xe8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rax, qword [rbp + 0xe0]
cmp qword [rax + 8], 0
je 0x14015c712
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0xe0]
cmp qword [rax], 0
je 0x14015c746
mov edx, 0xffffffff
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1400f935e
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140259110
mov rax, rcx
neg rcx
test rax, 7
je 0x14025912d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140259188
test al, 7
jne 0x140259120
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x140259141
mov rdx, qword [rax - 8]
test dl, dl
je 0x1402591b2
test dh, dh
je 0x1402591ac
shr rdx, 0x10
test dl, dl
je 0x1402591a6
test dh, dh
je 0x1402591a0
shr rdx, 0x10
test dl, dl
je 0x14025919a
test dh, dh
je 0x140259194
shr edx, 0x10
test dl, dl
je 0x14025918e
test dh, dh
jne 0x140259141
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400f93c2
Capabilities:
Query environment variable

Disassembly:
jmp 0x1402c4a40
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1402c45c0
lea rcx, [rsp + 0x20]
call fcn.1402c4610
movzx eax, al
test eax, eax
jne 0x1402c4a85
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.1402c45f0
mov rax, qword [rsp + 0x40]
jmp 0x1402c4b7f
lea rcx, [rsp + 0x20]
call fcn.1402c4710
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.1402c46b0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400f98a9
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400f8ab7
lea rcx, [rsp + 0x28]
call fcn.1400f9f57
movzx eax, al
test eax, eax
jne 0x1402c4b1f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1400fbbae
lea rcx, [rsp + 0x20]
call fcn.1402c45f0
mov rax, qword [rsp + 0x50]
jmp 0x1402c4b7f
lea rcx, [rsp + 0x20]
call fcn.1402c4710
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.1400fd193
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400f97af
lea rcx, [rsp + 0x28]
call fcn.1400fdf30
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1400fbbae
lea rcx, [rsp + 0x20]
call fcn.1402c45f0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x1400f9ae3
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1401ff7a0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1401ff120
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401ff7df
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14122a020]
jmp 0x1401ff7e9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x1400f9e44
Capabilities:
Query environment variable

Disassembly:
jmp 0x1402c4790
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1402c45c0
lea rcx, [rsp + 0x40]
call fcn.1402c4740
movzx eax, al
test eax, eax
jne 0x1402c47d8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1402c45f0
mov rax, qword [rsp + 0x70]
jmp 0x1402c49a9
lea rcx, [rsp + 0x40]
call fcn.1402c4710
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1402c46b0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.1402c4710
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1400fb686
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1402c487e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1402c45f0
mov rax, qword [rsp + 0x80]
jmp 0x1402c49a9
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400f98a9
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400f95bb
lea rcx, [rsp + 0x48]
call fcn.1400f8d96
movzx eax, al
test eax, eax
jne 0x1402c48e5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1400f71f3
lea rcx, [rsp + 0x40]
call fcn.1402c45f0
mov rax, qword [rsp + 0x88]
jmp 0x1402c49a9
lea rcx, [rsp + 0x48]
call fcn.1400fa51a
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.1402c4710
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1400fb686
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1402c497b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1400f71f3
lea rcx, [rsp + 0x40]
call fcn.1402c45f0
mov rax, qword [rsp + 0xa0]
jmp 0x1402c49a9
lea rcx, [rsp + 0x48]
call fcn.1400f955c
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1400f71f3
lea rcx, [rsp + 0x40]
call fcn.1402c45f0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x1400f9e67
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1401ff6d0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1401ff0a0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401ff711
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14122a020]
jmp 0x1401ff717
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret