joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400500d0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
sub rsp, 0xe0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x58], 0xfffffffffffffffe
mov qword [rbp + 0x48], r8
mov qword [rbp + 0x40], rdx
mov qword [rbp + 0x38], rcx
mov rax, qword [rbp + 0x38]
mov qword [rbp - 0x18], rax
mov rcx, qword [rbp + 0x40]
call fcn.140053ff0
test al, 1
jne 0x140050112
jmp 0x1400501d9
xorps xmm0, xmm0
movaps xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x20], 2
mov rcx, qword [rbp + 0x40]
add rcx, 0x10
call fcn.1400023e0
mov ax, word [rax]
mov word [rbp + 0x22], ax
mov rcx, qword [rbp + 0x40]
lea rdx, [rbp + 0x18]
mov qword [rbp - 0x30], rdx
call fcn.140054020
mov rcx, qword [rbp - 0x30]
call fcn.1400023e0
mov eax, dword [rax]
mov dword [rbp + 0x24], eax
mov rcx, qword [rbp + 0x48]
call fcn.1400029f0
mov dword [rbp - 0x20], eax
mov rcx, qword [rbp + 0x48]
call fcn.140002a00
mov rcx, qword [rbp - 0x18]
mov qword [rbp - 0x28], rax
add rcx, 0x30
call fcn.1400023e0
mov rdx, qword [rbp - 0x28]
mov r8d, dword [rbp - 0x20]
mov rcx, qword [rax]
mov rax, rsp
lea r9, [rbp + 0x20]
mov qword [rax + 0x20], r9
mov dword [rax + 0x28], reloc.WS2_32.dll_recv
mov rax, qword [sym.imp.WS2_32.dll_sendto]
xor r9d, r9d
call rax
mov dword [rbp - 0x1c], eax
jmp 0x1400501a9
mov eax, dword [rbp - 0x1c]
cdqe
mov qword [rbp - 0x38], rax
mov rcx, qword [rbp + 0x48]
call fcn.1400029f0
mov rcx, rax
mov rax, qword [rbp - 0x38]
cmp rax, rcx
je 0x1400501d4
mov byte [rbp + 0x57], 0
jmp 0x140050294
jmp 0x140050290
xorps xmm0, xmm0
movups xmmword [rbp - 4], xmm0
movaps xmmword [rbp - 0x10], xmm0
mov word [rbp - 0x10], reloc.WS2_32.dll_socket
mov rax, qword [rbp + 0x40]
movups xmm0, xmmword [rax]
movups xmmword [rbp - 8], xmm0
mov rcx, qword [rbp + 0x40]
add rcx, 0x10
call fcn.1400023e0
mov ax, word [rax]
mov word [rbp - 0xe], ax
mov rcx, qword [rbp + 0x48]
call fcn.1400029f0
mov dword [rbp - 0x40], eax
mov rcx, qword [rbp + 0x48]
call fcn.140002a00
mov rcx, qword [rbp - 0x18]
mov qword [rbp - 0x48], rax
add rcx, 0x30
call fcn.1400023e0
mov rdx, qword [rbp - 0x48]
mov r8d, dword [rbp - 0x40]
mov rcx, qword [rax]
mov rax, rsp
lea r9, [rbp - 0x10]
mov qword [rax + 0x20], r9
mov dword [rax + 0x28], 0x1c
mov rax, qword [sym.imp.WS2_32.dll_sendto]
xor r9d, r9d
call rax
mov dword [rbp - 0x3c], eax
jmp 0x140050260
mov eax, dword [rbp - 0x3c]
cdqe
mov qword [rbp - 0x50], rax
mov rcx, qword [rbp + 0x48]
call fcn.1400029f0
mov rcx, rax
mov rax, qword [rbp - 0x50]
cmp rax, rcx
je 0x14005028b
mov byte [rbp + 0x57], 0
jmp 0x140050294
jmp 0x140050290
mov byte [rbp + 0x57], 1
mov al, byte [rbp + 0x57]
and al, 1
movzx eax, al
add rsp, 0xe0
pop rbp
ret

Function at 0x140050ce0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x30]
add rcx, 0x30
call fcn.1400023e0
mov rcx, qword [rax]
lea rdx, [rsp + 0x2f]
mov r8d, 1
mov r9d, 2
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
sete al
and al, 1
movzx eax, al
add rsp, 0x38
ret
Function at 0x140050d30
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov dword [rbp - 0xc], r8d
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x20], rcx
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0xc]
mov dword [rbp - 0x28], eax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x30], rax
add rcx, 0x30
call fcn.1400023e0
mov rdx, qword [rbp - 0x30]
mov r8d, dword [rbp - 0x28]
mov rcx, qword [rax]
mov rax, qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
call rax
mov dword [rbp - 0x24], eax
jmp 0x140050d88
mov eax, dword [rbp - 0x24]
cmp eax, dword [rbp - 0xc]
sete al
and al, 1
movzx eax, al
add rsp, 0x50
pop rbp
ret

Function at 0x140050dc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
sub rsp, 0x90
lea rbp, [rsp + 0x80]
mov qword [rbp + 8], 0xfffffffffffffffe
mov qword [rbp - 0x50], rdx
mov rax, rdx
mov qword [rbp - 0x48], rax
mov qword [rbp], rdx
mov dword [rbp - 4], r8d
mov qword [rbp - 0x10], rcx
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x40], rax
movsxd rdx, dword [rbp - 4]
xor eax, eax
mov r8b, al
lea rcx, [rbp - 0x30]
call fcn.140007ef0
jmp 0x140050e0e
mov eax, dword [rbp - 4]
mov dword [rbp - 0x58], eax
lea rcx, [rbp - 0x30]
call fcn.140002a00
mov rcx, qword [rbp - 0x40]
mov qword [rbp - 0x60], rax
add rcx, 0x30
call fcn.1400023e0
mov rdx, qword [rbp - 0x60]
mov r8d, dword [rbp - 0x58]
mov rcx, qword [rax]
mov rax, qword [sym.imp.WS2_32.dll_recv]
xor r9d, r9d
call rax
mov dword [rbp - 0x54], eax
jmp 0x140050e4d
mov eax, dword [rbp - 0x54]
mov dword [rbp - 0x34], eax
cmp dword [rbp - 0x34], 0
jle 0x140050e8d
movsxd rdx, dword [rbp - 0x34]
xor eax, eax
mov r8b, al
lea rcx, [rbp - 0x30]
call fcn.140009970
jmp 0x140050e74
mov rcx, qword [rbp - 0x50]
lea rdx, [rbp - 0x30]
call fcn.140004760
mov dword [rbp - 0x38], 1
jmp 0x140050e9d
mov rcx, qword [rbp - 0x50]
call fcn.140009830
mov dword [rbp - 0x38], 1
lea rcx, [rbp - 0x30]
call fcn.140002220
mov rax, qword [rbp - 0x48]
add rsp, 0x90
pop rbp
ret
Function at 0x140052e10
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
sub rsp, 0xf0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x68], 0xfffffffffffffffe
mov qword [rbp + 0x60], r8
mov qword [rbp + 0x58], rdx
mov qword [rbp + 0x50], rcx
mov rax, qword [rbp + 0x58]
mov byte [rax + 0xa], 0
mov rcx, qword [rbp + 0x60]
call fcn.140002560
mov qword [rbp + 0x48], rax
xor eax, eax
mov r8b, al
lea rcx, [rbp + 0x28]
mov edx, 0x1000
call fcn.140007ef0
jmp 0x140052e61
mov dword [rbp + 4], 0x1c
lea rcx, [rbp + 0x28]
call fcn.140002a00
mov qword [rbp - 0x50], rax
mov rcx, qword [rbp + 0x58]
add rcx, 0x30
call fcn.1400023e0
mov rdx, qword [rbp - 0x50]
mov rcx, qword [rax]
mov rax, rsp
lea r8, [rbp + 4]
mov qword [rax + 0x28], r8
lea r8, [rbp + 8]
mov qword [rax + 0x20], r8
mov rax, qword [sym.imp.WS2_32.dll_recvfrom]
mov r8d, 0x1000
xor r9d, r9d
call rax
mov dword [rbp - 0x44], eax
jmp 0x140052eb6
mov eax, dword [rbp - 0x44]
movsxd rdx, eax
xor eax, eax
mov r8b, al
lea rcx, [rbp + 0x28]
call fcn.140009970
jmp 0x140052ecf
lea rcx, [rbp - 0x18]
call fcn.140053cd0
movsxd rax, dword [rbp + 4]
cmp rax, 0x1c
jne 0x140052f21
lea rdx, [rbp + 8]
add rdx, 8
lea rcx, [rbp - 0x28]
call fcn.14005c520
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x10], rax
mov dx, word [rbp + 0xa]
lea rcx, [rbp - 0x30]
call fcn.140053f60
mov ax, word [rbp - 0x30]
mov word [rbp - 8], ax
jmp 0x140052f4f
mov edx, dword [rbp + 0xc]
lea rcx, [rbp - 0x38]
call fcn.14002ae90
lea rcx, [rbp - 0x18]
lea rdx, [rbp - 0x38]
call fcn.140033670
mov dx, word [rbp + 0xa]
lea rcx, [rbp - 0x40]
call fcn.140053f60
mov ax, word [rbp - 0x40]
mov word [rbp - 8], ax
mov r9, qword [rbp + 0x48]
mov rax, qword [r9]
add r9, 8
mov rcx, qword [rbp + 0x58]
lea rdx, [rbp - 0x18]
lea r8, [rbp + 0x28]
call rax
jmp 0x140052f6d
lea rcx, [rbp + 0x28]
call fcn.140002220
nop
add rsp, 0xf0
pop rbp
ret

Function at 0x140054110
Capabilities:
Set socket configuration

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rbp - 0x10], r8
mov dword [rbp - 0x14], edx
mov qword [rbp - 0x20], rcx
mov rcx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x30], rax
mov eax, dword [rbp - 0x14]
mov dword [rbp - 0x34], eax
add rcx, 0x30
call fcn.1400023e0
mov r8d, dword [rbp - 0x34]
mov r9, qword [rbp - 0x30]
mov rcx, qword [rax]
mov rax, rsp
mov dword [rax + 0x20], 4
mov rax, qword [sym.imp.WS2_32.dll_setsockopt]
mov edx, 0xffff
call rax
mov dword [rbp - 0x24], eax
jmp 0x140054173
mov eax, dword [rbp - 0x24]
cmp eax, 0xffffffff
setne al
and al, 1
movzx eax, al
add rsp, 0x60
pop rbp
ret
Function at 0x140054d40
Capabilities:
Set socket configuration

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rbp - 0x10], r8
mov dword [rbp - 0x14], edx
mov qword [rbp - 0x20], rcx
mov rcx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x30], rax
mov eax, dword [rbp - 0x14]
mov dword [rbp - 0x34], eax
add rcx, 0x30
call fcn.1400023e0
mov r8d, dword [rbp - 0x34]
mov r9, qword [rbp - 0x30]
mov rcx, qword [rax]
mov rax, rsp
mov dword [rax + 0x20], 1
mov rax, qword [sym.imp.WS2_32.dll_setsockopt]
mov edx, 0xffff
call rax
mov dword [rbp - 0x24], eax
jmp 0x140054da3
mov eax, dword [rbp - 0x24]
cmp eax, 0xffffffff
setne al
and al, 1
movzx eax, al
add rsp, 0x60
pop rbp
ret
Function at 0x14006c840
Capabilities:
Create thread

Disassembly:
push rbp
sub rsp, 0xc0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x38], 0xfffffffffffffffe
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x20], rcx
mov rcx, qword [rbp + 0x20]
mov qword [rbp - 0x48], rcx
call fcn.140002b20
test al, 1
jne 0x14006c87e
jmp 0x14006c883
call fcn.14001da50
mov rcx, qword [rbp - 0x48]
mov rax, qword [rbp + 0x28]
mov qword [rcx + 0x10], rax
mov rdx, qword [rbp + 0x30]
add rcx, 0x18
call fcn.14005e4a0
mov rax, qword [rbp - 0x48]
mov rcx, 0xffffffffffffffff
cmp qword [rax], rcx
je 0x14006c8bd
mov rax, qword [rbp - 0x48]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9, qword [rbp - 0x48]
xor eax, eax
mov edx, eax
lea r8, [0x14006c9e0]
xor eax, eax
mov rcx, rdx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov rax, qword [rbp - 0x48]
mov qword [rax], rcx
cmp qword [rax], 0
jne 0x14006c964
mov rax, qword [rbp - 0x48]
mov qword [rax], 0xffffffffffffffff
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp - 0x1c], eax
lea rdx, str.Failed_to_create_thread:_
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x50], rcx
call fcn.140003660
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x18]
lea r8, [rbp - 0x1c]
call fcn.14006cd10
jmp 0x14006c93d
lea rcx, [rbp + 8]
lea rdx, [rbp - 0x18]
call fcn.14001dc10
jmp 0x14006c94f
lea rdx, [0x1401421a0]
lea rcx, [rbp + 8]
call fcn.1400c6fc0
jmp 0x14006c975
mov rax, qword [rbp - 0x48]
mov byte [rax + 8], 1
add rsp, 0xc0
pop rbp
ret
int3
Function at 0x1400740b0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x78], r8
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x68], rcx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x78], 0
jg 0x1400740ed
mov qword [rsp + 0x80], 0
jmp 0x1400742b9
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x68], 0
je 0x14007411e
mov rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
call fcn.140074dd0
mov qword [rsp + 0x80], rax
jmp 0x1400742b9
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x58], rax
call fcn.140075120
mov qword [rsp + 0x50], rax
xor eax, eax
cmp rax, qword [rsp + 0x50]
jae 0x1400741bd
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x50]
call fcn.140003b60
mov rcx, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
call fcn.140075170
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.140003a00
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
add rax, qword [rsp + 0x70]
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x60]
sub rax, rdx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x48]
mov edx, eax
call fcn.140075190
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x80], 0
je 0x1400742a7
mov rcx, qword [rsp + 0x30]
call fcn.140073590
mov qword [rsp + 0x40], 0xfff
mov eax, 0xfff
cmp rax, qword [rsp + 0x60]
jae 0x140074265
mov rax, qword [rsp + 0x30]
mov r9, qword [rax + 0x80]
mov rcx, qword [rsp + 0x70]
mov edx, 1
mov r8d, 0xfff
call fcn.1400d95ac
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
add rax, qword [rsp + 0x70]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x60]
sub rax, rcx
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x38], 0xfff
je 0x140074260
mov rax, qword [rsp + 0x58]
sub rax, qword [rsp + 0x60]
mov qword [rsp + 0x80], rax
jmp 0x1400742b9
jmp 0x1400741e3
xor eax, eax
cmp rax, qword [rsp + 0x60]
jae 0x1400742a2
mov rax, qword [rsp + 0x30]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
mov edx, 1
call fcn.1400d95ac
mov rcx, rax
mov rax, qword [rsp + 0x60]
sub rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x1400742a7
mov rax, qword [rsp + 0x58]
sub rax, qword [rsp + 0x60]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
add rsp, 0x88
ret

Function at 0x14007bd50
Capabilities:
Reference cloudflare dns server

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rbp - 0x10], rcx
mov rcx, qword [rbp - 0x10]
mov qword [rbp - 0x18], rcx
call fcn.14007b4a0
mov rcx, qword [rbp - 0x18]
lea rax, [0x1400fa4c0]
mov qword [rcx], rax
add rcx, 0x10
lea rdx, str.1.1.1.1
call fcn.140003660
jmp 0x14007bd96
mov rax, qword [rbp - 0x18]
mov qword [rax + 0x30], 0
add rsp, 0x40
pop rbp
ret
Function at 0x14007d3e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rbp - 0x10], rdx
mov qword [rbp - 0x18], rcx
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400c2b50
mov qword [rbp - 0x30], rax
jmp 0x14007d415
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x10]
call fcn.14007e720
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x20], rax
call fcn.140016a70
mov qword [rbp - 0x28], rax
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
call fcn.14002a890
mov rcx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x20]
lea rdx, [rbp - 0x28]
call fcn.14007e760
xor al, 0xff
test al, 1
jne 0x14007d437
mov rax, qword [rbp - 0x20]
add rsp, 0x60
pop rbp
ret

Function at 0x140080690
Capabilities:
Convert ip address from string

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x20], rcx
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x28], rax
mov rcx, qword [rbp - 0x18]
mov edx, 0x3a
xor eax, eax
mov r8d, eax
call fcn.14005f520
cmp rax, 0xffffffffffffffff
je 0x140080708
mov rcx, qword [rbp - 0x18]
call fcn.140002a00
mov r8, qword [rbp - 0x28]
mov rdx, rax
mov rax, qword [sym.imp.WS2_32.dll_inet_pton]
mov ecx, reloc.WS2_32.dll_socket
call rax
mov dword [rbp - 0x2c], eax
jmp 0x1400806f5
mov eax, dword [rbp - 0x2c]
cmp eax, 1
sete al
and al, 1
mov byte [rbp - 9], al
jmp 0x140080751
mov rcx, qword [rbp - 0x28]
call fcn.140033710
mov rax, qword [rbp - 0x28]
add rax, 0xc
mov qword [rbp - 0x38], rax
mov rcx, qword [rbp - 0x18]
call fcn.140002a00
mov r8, qword [rbp - 0x38]
mov rdx, rax
mov rax, qword [sym.imp.WS2_32.dll_inet_pton]
mov ecx, 2
call rax
mov dword [rbp - 0x30], eax
jmp 0x140080743
mov eax, dword [rbp - 0x30]
cmp eax, 1
sete al
and al, 1
mov byte [rbp - 9], al
mov al, byte [rbp - 9]
and al, 1
movzx eax, al
add rsp, 0x60
pop rbp
ret
Function at 0x140086db0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x30], rdx
mov rax, rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x78], rcx
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x4e], 0x67
mov byte [rsp + 0x4d], 0xe8
mov byte [rsp + 0x4c], 0x64
mov byte [rsp + 0x4b], WSAStartup
mov byte [rsp + 0x4a], 0x52
mov byte [rsp + 0x49], 0x53
mov byte [rsp + 0x48], 0x49
mov byte [rsp + 0x47], 0xe3
mov byte [rsp + 0x46], 0x2e
mov byte [rsp + 0x45], 0x76
mov byte [rsp + 0x44], recv
mov byte [rsp + 0x43], 0xa2
mov byte [rsp + 0x42], 0xfb
mov byte [rsp + 0x41], 0xc1
mov byte [rsp + 0x40], 0x32
mov dword [rsp + 0x4f], 0x6adbee2c
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x58]
call fcn.140064460
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
lea r8, [rsp + 0x58]
call fcn.140086e70
lea rcx, [rsp + 0x58]
call fcn.140002220
mov rax, qword [rsp + 0x38]
add rsp, 0x88
ret

Function at 0x140086f30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x30], rdx
mov rax, rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x78], rcx
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x4e], WSAStartup
mov byte [rsp + 0x4d], 0xe3
mov byte [rsp + 0x4c], 0x77
mov byte [rsp + 0x4b], 0x69
mov byte [rsp + 0x4a], 0x41
mov byte [rsp + 0x49], 0x51
mov byte [rsp + 0x48], 0x49
mov byte [rsp + 0x47], 0xe3
mov byte [rsp + 0x46], 0x2e
mov byte [rsp + 0x45], 0x76
mov byte [rsp + 0x44], recv
mov byte [rsp + 0x43], 0xa2
mov byte [rsp + 0x42], 0xfb
mov byte [rsp + 0x41], 0xc1
mov byte [rsp + 0x40], 0x32
mov dword [rsp + 0x4f], 0x6adbee2c
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x58]
call fcn.140064460
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
lea r8, [rsp + 0x58]
call fcn.140086e70
lea rcx, [rsp + 0x58]
call fcn.140002220
mov rax, qword [rsp + 0x38]
add rsp, 0x88
ret
Function at 0x140087640
Capabilities:
Authenticate hmac

Disassembly:
push rbp
sub rsp, 0xf0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x68], 0xfffffffffffffffe
mov qword [rbp - 0x50], r8
mov rax, rcx
mov rcx, qword [rbp - 0x50]
mov qword [rbp - 0x48], rax
mov r8, rax
mov qword [rbp - 0x40], r8
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x58], rdx
call fcn.1400029f0
cmp rax, 0x40
jbe 0x1400876a8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp + 0x38]
call fcn.1400afcb0
mov rcx, qword [rbp - 0x50]
lea rdx, [rbp + 0x38]
call fcn.14000ab70
lea rcx, [rbp + 0x38]
call fcn.140002220
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp + 0x18]
call fcn.140004550
jmp 0x1400876ba
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 8]
call fcn.140004550
jmp 0x1400876cc
mov qword [rbp - 0x10], 0
mov rcx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x58], rax
call fcn.1400029f0
mov rcx, rax
mov rax, qword [rbp - 0x58]
cmp rax, rcx
je 0x140087730
mov rdx, qword [rbp - 0x10]
lea rcx, [rbp + 0x18]
call fcn.140007fa0
movsx ecx, byte [rax]
xor ecx, 0x36
mov byte [rax], cl
mov rdx, qword [rbp - 0x10]
lea rcx, [rbp - 8]
call fcn.140007fa0
movsx ecx, byte [rax]
xor ecx, 0x5c
mov byte [rax], cl
mov rax, qword [rbp - 0x10]
add rax, 1
mov qword [rbp - 0x10], rax
jmp 0x1400876d4
mov rcx, qword [rbp - 0x50]
call fcn.1400029f0
mov rcx, rax
mov eax, 0x40
sub rax, rcx
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
je 0x140087782
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp + 0x18]
mov r8b, 0x36
call fcn.14000a4c0
jmp 0x140087768
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 8]
mov r8b, 0x5c
call fcn.14000a4c0
jmp 0x14008777d
jmp 0x140087782
mov rdx, qword [rbp + 0x58]
lea rcx, [rbp + 0x18]
call fcn.1400046b0
jmp 0x140087794
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x60], rcx
lea rdx, [rbp + 0x18]
call fcn.1400afcb0
mov rdx, qword [rbp - 0x60]
lea rcx, [rbp - 8]
call fcn.1400046b0
jmp 0x1400877b7
lea rcx, [rbp - 0x38]
call fcn.140002220
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 8]
call fcn.1400afcb0
lea rcx, [rbp - 8]
call fcn.140002220
lea rcx, [rbp + 0x18]
call fcn.140002220
mov rcx, qword [rbp - 0x50]
call fcn.140002220
mov rax, qword [rbp - 0x40]
add rsp, 0xf0
pop rbp
ret
Function at 0x140094f80
Capabilities:
Encrypt data using curve25519

Disassembly:
push rax
mov qword [rsp], rcx
mov rax, qword [rsp]
movzx ecx, byte [rax]
and ecx, 0xf8
mov byte [rax], cl
mov rax, qword [rsp]
movzx ecx, byte [rax + 0x1f]
and ecx, 0x7f
mov byte [rax + 0x1f], cl
mov rax, qword [rsp]
movzx ecx, byte [rax + 0x1f]
or ecx, 0x40
mov byte [rax + 0x1f], cl
pop rax
ret
Function at 0x14009ee00
Capabilities:
Authenticate hmac

Disassembly:
push rbp
sub rsp, 0xf0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x68], 0xfffffffffffffffe
mov qword [rbp - 0x50], r8
mov rax, rcx
mov rcx, qword [rbp - 0x50]
mov qword [rbp - 0x48], rax
mov r8, rax
mov qword [rbp - 0x40], r8
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x58], rdx
call fcn.1400029f0
cmp rax, 0x40
jbe 0x14009ee68
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp + 0x38]
call fcn.1400b3150
mov rcx, qword [rbp - 0x50]
lea rdx, [rbp + 0x38]
call fcn.14000ab70
lea rcx, [rbp + 0x38]
call fcn.140002220
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp + 0x18]
call fcn.140004550
jmp 0x14009ee7a
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 8]
call fcn.140004550
jmp 0x14009ee8c
mov qword [rbp - 0x10], 0
mov rcx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x58], rax
call fcn.1400029f0
mov rcx, rax
mov rax, qword [rbp - 0x58]
cmp rax, rcx
je 0x14009eef0
mov rdx, qword [rbp - 0x10]
lea rcx, [rbp + 0x18]
call fcn.140007fa0
movsx ecx, byte [rax]
xor ecx, 0x36
mov byte [rax], cl
mov rdx, qword [rbp - 0x10]
lea rcx, [rbp - 8]
call fcn.140007fa0
movsx ecx, byte [rax]
xor ecx, 0x5c
mov byte [rax], cl
mov rax, qword [rbp - 0x10]
add rax, 1
mov qword [rbp - 0x10], rax
jmp 0x14009ee94
mov rcx, qword [rbp - 0x50]
call fcn.1400029f0
mov rcx, rax
mov eax, 0x40
sub rax, rcx
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
je 0x14009ef42
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp + 0x18]
mov r8b, 0x36
call fcn.14000a4c0
jmp 0x14009ef28
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 8]
mov r8b, 0x5c
call fcn.14000a4c0
jmp 0x14009ef3d
jmp 0x14009ef42
mov rdx, qword [rbp + 0x58]
lea rcx, [rbp + 0x18]
call fcn.1400046b0
jmp 0x14009ef54
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x60], rcx
lea rdx, [rbp + 0x18]
call fcn.1400b3150
mov rdx, qword [rbp - 0x60]
lea rcx, [rbp - 8]
call fcn.1400046b0
jmp 0x14009ef77
lea rcx, [rbp - 0x38]
call fcn.140002220
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 8]
call fcn.1400b3150
lea rcx, [rbp - 8]
call fcn.140002220
lea rcx, [rbp + 0x18]
call fcn.140002220
mov rcx, qword [rbp - 0x50]
call fcn.140002220
mov rax, qword [rbp - 0x40]
add rsp, 0xf0
pop rbp
ret
Function at 0x1400a1700
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x18], rcx
mov dword [rsp + 0x14], 0
cmp dword [rsp + 0x14], 4
jge 0x1400a17bd
mov dword [rsp + 0x10], 0
cmp dword [rsp + 0x10], 4
jge 0x1400a17a8
mov rax, qword [rsp + 0x18]
movsxd rcx, dword [rsp + 0x14]
mov rax, qword [rax + rcx*8]
movsxd rcx, dword [rsp + 0x10]
mov al, byte [rax + rcx]
mov byte [rsp + 0xf], al
movzx eax, byte [rsp + 0xf]
mov ecx, reloc.WS2_32.dll_recv
cdq
idiv ecx
movsxd rcx, eax
lea rax, [0x14012b780]
shl rcx, 4
add rax, rcx
mov qword [rsp], rax
movzx eax, byte [rsp + 0xf]
mov ecx, reloc.WS2_32.dll_recv
cdq
idiv ecx
mov rax, qword [rsp]
movsxd rcx, edx
mov dl, byte [rax + rcx]
mov rax, qword [rsp + 0x18]
movsxd rcx, dword [rsp + 0x14]
mov rax, qword [rax + rcx*8]
movsxd rcx, dword [rsp + 0x10]
mov byte [rax + rcx], dl
mov eax, dword [rsp + 0x10]
add eax, 1
mov dword [rsp + 0x10], eax
jmp 0x1400a1724
jmp 0x1400a17ad
mov eax, dword [rsp + 0x14]
add eax, 1
mov dword [rsp + 0x14], eax
jmp 0x1400a1711
add rsp, 0x20
ret

Function at 0x1400a1a10
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x18], rcx
mov dword [rsp + 0x14], 0
cmp dword [rsp + 0x14], 4
jge 0x1400a1acd
mov dword [rsp + 0x10], 0
cmp dword [rsp + 0x10], 4
jge 0x1400a1ab8
mov rax, qword [rsp + 0x18]
movsxd rcx, dword [rsp + 0x14]
mov rax, qword [rax + rcx*8]
movsxd rcx, dword [rsp + 0x10]
mov al, byte [rax + rcx]
mov byte [rsp + 0xf], al
movzx eax, byte [rsp + 0xf]
mov ecx, reloc.WS2_32.dll_recv
cdq
idiv ecx
movsxd rcx, eax
lea rax, [0x14012c790]
shl rcx, 4
add rax, rcx
mov qword [rsp], rax
movzx eax, byte [rsp + 0xf]
mov ecx, reloc.WS2_32.dll_recv
cdq
idiv ecx
mov rax, qword [rsp]
movsxd rcx, edx
mov dl, byte [rax + rcx]
mov rax, qword [rsp + 0x18]
movsxd rcx, dword [rsp + 0x14]
mov rax, qword [rax + rcx*8]
movsxd rcx, dword [rsp + 0x10]
mov byte [rax + rcx], dl
mov eax, dword [rsp + 0x10]
add eax, 1
mov dword [rsp + 0x10], eax
jmp 0x1400a1a34
jmp 0x1400a1abd
mov eax, dword [rsp + 0x14]
add eax, 1
mov dword [rsp + 0x14], eax
jmp 0x1400a1a21
add rsp, 0x20
ret