joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003f00
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x128
mov r8, rcx
test rcx, rcx
je 0x18000401b
mov eax, 0xff
lea rdx, [rsp + 0x20]
nop dword [rax]
mov byte [rdx], 0
lea rdx, [rdx + 1]
sub rax, 1
jne 0x180003f20
movzx eax, byte [rcx]
xor edx, edx
mov r9d, edx
test al, al
je 0x180003f57
lea r10, [rsp + 0x20]
sub r10, r8
cmp al, 0x2e
je 0x180003f57
mov byte [r10 + rcx], al
inc r9d
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x180003f41
movsxd rax, r9d
add r8, rax
je 0x18000401b
mov word [rsp + rax + 0x20], 0x642e
inc r8
lea eax, [r9 + 2]
movsxd rcx, eax
movzx eax, byte [r8]
mov word [rsp + rcx + 0x20], 0x6c6c
cmp al, 0x23
jne 0x180003fe6
movzx eax, byte [r8 + 1]
mov r10d, 1
cmp al, 0x2d
jne 0x180003f9d
movzx eax, byte [r8 + 2]
mov r10d, 0xffffffff
mov r9, rdx
sete r9b
inc r9
add r9, r8
cmp al, 0x30
jl 0x180003fcb
nop
cmp al, 0x39
ja 0x180003fcb
movzx eax, al
lea edx, [rdx + rdx*4]
inc r9
lea edx, [rdx - 0x18]
lea edx, [rax + rdx*2]
movzx eax, byte [r9]
cmp al, 0x30
jge 0x180003fb0
imul r10d, edx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, r10d
call fcn.180004030
add rsp, 0x128
ret
test al, al
je 0x180004004
nop word [rax + rax]
rol edx, 7
lea r8, [r8 + 1]
movsx eax, al
xor edx, eax
movzx eax, byte [r8]
test al, al
jne 0x180003ff0
mov r8d, edx
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.180004030
add rsp, 0x128
ret
xor eax, eax
add rsp, 0x128
ret
Function at 0x180004430
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
mov rax, qword [0x18000a4e0]
test rax, rax
je 0x18000447c
cmp r9d, 0x2bc
jg 0x18000447c
mov qword [rsp + 0x20], rbx
movsxd rbx, r9d
mov rax, qword [rax + rbx*8]
test rax, rax
jne 0x180004472
xor ecx, ecx
call fcn.180004030
mov rcx, rax
mov rax, qword [0x18000a4e0]
mov qword [rax + rbx*8], rcx
mov rax, rcx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
xor ecx, ecx
add rsp, 0x28
jmp fcn.180004030
Function at 0x180005030
Capabilities:
Access peb ldr_data

Disassembly:
mov r9, rcx
mov edx, 0x208
test rcx, rcx
je 0x18000504d
mov rax, rcx
mov byte [rax], 0
lea rax, [rax + 1]
sub rdx, 1
jne 0x180005040
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
add rdx, 0x20
mov r8, qword [rdx]
cmp r8, rdx
je 0x18000508d
lea r10, [0x18000a568]
nop dword [rax]
mov rcx, qword [r8 + 0x20]
cmp r10, rcx
jb 0x180005085
mov eax, dword [r8 + 0x30]
add rax, rcx
cmp r10, rax
jb 0x180005090
mov r8, qword [r8]
cmp r8, rdx
jne 0x180005070
xor eax, eax
ret
mov r8, qword [r8 + 0x40]
lea rdx, [0x180009090]
mov rcx, r9
jmp qword [sym.imp.USER32.dll_wsprintfW]
Function at 0x1800050b0
Capabilities:
Get hostname
Get user security identifier

Disassembly:
mov rax, rsp
mov dword [rax + 8], ecx
push rbx
push rsi
push rdi
sub rsp, 0xa0
mov rbx, rdx
mov dword [rax + 8], 0x2f
lea rdx, [rax - 0x78]
xor ecx, ecx
lea r8, [rax + 8]
mov esi, 5
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x1800052e4
lea rax, [rsp + 0xd8]
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0xd0]
lea rax, [rsp + 0xc0]
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1800052e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1800052e4
mov eax, dword [rsp + 0xd0]
test eax, eax
je 0x1800052e4
mov r10, qword [0x18000a4e0]
mov edi, eax
test r10, r10
jne 0x18000516c
lea edx, [rsi - 4]
xor ecx, ecx
mov r8d, 0x697a6afe
call fcn.180004030
mov r10, rax
jmp 0x180005194
mov r10, qword [r10 + 0x48]
test r10, r10
jne 0x180005194
lea edx, [r10 + 1]
xor ecx, ecx
mov r8d, 0x697a6afe
call fcn.180004030
mov r10, rax
mov rax, qword [0x18000a4e0]
mov qword [rax + 0x48], r10
mov r9d, 4
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
call r10
mov rdi, rax
test rax, rax
je 0x1800052e4
lea rax, [rsp + 0xd8]
mov r8, rdi
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0xd0]
lea rax, [rsp + 0xc0]
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x18000528c
movzx eax, byte [rdi + 1]
lea r8, [rdi + 8]
cmp eax, esi
cmovb esi, eax
lea ecx, [rsi*4]
test rbx, rbx
je 0x180005230
test r8, r8
je 0x180005230
test ecx, ecx
je 0x180005230
sub r8, rbx
nop dword [rax]
movzx eax, byte [r8 + rbx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub ecx, 1
jne 0x180005220
mov rax, qword [0x18000a4e0]
test rax, rax
jne 0x18000524e
lea edx, [rax + 1]
xor ecx, ecx
mov r8d, 0x3a35705f
call fcn.180004030
jmp 0x180005272
mov rax, qword [rax + 0x58]
test rax, rax
jne 0x180005272
lea edx, [rax + 1]
xor ecx, ecx
mov r8d, 0x3a35705f
call fcn.180004030
mov rcx, qword [0x18000a4e0]
mov qword [rcx + 0x58], rax
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call rax
mov eax, esi
add rsp, 0xa0
pop rdi
pop rsi
pop rbx
ret
mov r9, qword [0x18000a4e0]
test r9, r9
jne 0x1800052ae
lea edx, [r9 + 1]
xor ecx, ecx
mov r8d, 0x3a35705f
call fcn.180004030
mov r9, rax
jmp 0x1800052d6
mov r9, qword [r9 + 0x58]
test r9, r9
jne 0x1800052d6
lea edx, [r9 + 1]
xor ecx, ecx
mov r8d, 0x3a35705f
call fcn.180004030
mov r9, rax
mov rax, qword [0x18000a4e0]
mov qword [rax + 0x58], r9
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call r9
xor eax, eax
add rsp, 0xa0
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800055f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movzx eax, word [rdx]
xor ebp, ebp
mov rdi, r9
mov rsi, r8
mov rbx, rcx
mov r10d, ebp
test ax, ax
je 0x180005634
mov r11, rcx
sub r11, rdx
mov word [r11 + rdx], ax
lea rdx, [rdx + 2]
movzx eax, word [rdx]
inc r10
test ax, ax
jne 0x180005620
mov r9, rbp
test rdi, rdi
je 0x180005736
movzx edx, r9b
add dl, byte [r9 + rsi]
mov byte [rsp], bpl
mov dword [rsp + 4], 0xf7e76bb
mov dword [rsp + 8], 0xb7a72bf
mov dword [rsp + 0xc], 0x7e0d7eb3
mov dword [rsp + 0x10], 0x7a0903c8
mov dword [rsp + 0x14], 0x3c4c478b
mov eax, dword [rsp + 4]
movzx eax, byte [rsp]
rol dl, 3
test al, al
jne 0x1800056a7
mov rax, rbp
nop word [rax + rax]
mov ecx, dword [rsp + rax*4 + 4]
xor ecx, 0x3c4c478b
mov dword [rsp + rax*4 + 4], ecx
inc rax
cmp rax, 5
jb 0x180005690
movzx r8d, dl
mov eax, r8d
shr rax, 4
movsx eax, byte [rsp + rax + 4]
mov word [rbx + r10*2], ax
mov byte [rsp + 0x18], bpl
mov dword [rsp + 0x1c], 0xdec79e
mov dword [rsp + 0x20], 0x4dac39a
mov dword [rsp + 0x24], 0x71adcf96
mov dword [rsp + 0x28], 0x75a9b2ed
mov dword [rsp + 0x2c], 0x33ecf6ae
mov eax, dword [rsp + 0x1c]
movzx eax, byte [rsp + 0x18]
test al, al
jne 0x180005716
mov rcx, rbp
nop dword [rax]
mov eax, dword [rsp + rcx*4 + 0x1c]
xor eax, 0x33ecf6ae
mov dword [rsp + rcx*4 + 0x1c], eax
inc rcx
cmp rcx, 5
jb 0x180005700
and r8d, 0xf
inc r9
movsx ecx, byte [rsp + r8 + 0x1c]
mov word [rbx + r10*2 + 2], cx
add r10, 2
cmp r9, rdi
jb 0x180005640
mov rsi, qword [rsp + 0x50]
mov rax, r10
mov word [rbx + r10*2], bp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180007150
Capabilities:
Create thread
Terminate process

Disassembly:
sub rsp, 0x38
call fcn.180004490
xor eax, eax
lea r8, [0x1800070b0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [section.bss], 0
jne 0x180007195
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [section.bss], 0
je 0x180007181
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1400055e0
Capabilities:
Hide graphical window

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x298
xor eax, eax
mov rbx, rcx
mov qword [0x1400340f0], rcx
lea rdi, [rsp + 0x90]
mov ecx, 0x40
rep stosq qword [rdi], rax
mov rdi, qword [rbx + 0x70]
lea rsi, [rsp + 0x90]
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov r8, rdi
mov qword [rsp + 0x20], rsi
xor edx, edx
mov r9d, eax
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0xff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8, rsi
mov r9d, 0x80000
xor ecx, ecx
mov r12, qword [0x14002da90]
mov rax, qword [r12]
mov qword [rsp + 0x58], rbx
mov rdx, qword [rax]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rdx
mov rax, qword [rax + 0xa0]
lea rdx, str.ew::editAccount
mov dword [rsp + 0x38], 0xf8
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0x14b
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
xor edx, edx
mov r13, qword [sym.imp.USER32.dll_EnableWindow]
mov rbx, rax
mov rax, qword [r12]
mov rcx, qword [rax + 0x58]
call r13
mov rax, qword [r12]
mov rcx, rbx
lea rbx, [rsp + 0x60]
mov edx, dword [rax + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rsi, qword [sym.imp.USER32.dll_GetMessageW]
mov rbp, qword [sym.imp.USER32.dll_TranslateMessage]
mov rdi, qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1400056fa
mov rcx, rbx
call rbp
mov rcx, rbx
call rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call rsi
test eax, eax
jne 0x1400056f0
mov rax, qword [r12]
mov edx, 1
mov rcx, qword [rax + 0x58]
call r13
nop
add rsp, 0x298
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x140005ce0
Capabilities:
Hide graphical window

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x298
xor eax, eax
mov rbx, rcx
mov qword [0x140034110], rcx
lea rdi, [rsp + 0x90]
mov ecx, 0x40
rep stosq qword [rdi], rax
mov rsi, qword [rbx + 0x70]
lea rdi, [rsp + 0x90]
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov r8, rsi
mov qword [rsp + 0x20], rdi
xor edx, edx
mov r9d, eax
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0xff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8, rdi
mov r9d, 0x80000
xor ecx, ecx
mov rsi, qword [0x14002da90]
mov rax, qword [rsi]
mov qword [rsp + 0x58], rbx
lea rbx, [rsp + 0x60]
mov rdx, qword [rax]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rdx
mov rax, qword [rax + 0xa0]
lea rdx, str.ew::editWorkHours
mov dword [rsp + 0x38], 0x118
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0xbe
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, rax
mov rax, qword [rsi]
mov edx, dword [rax + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rsi, qword [sym.imp.USER32.dll_GetMessageW]
mov rbp, qword [sym.imp.USER32.dll_TranslateMessage]
mov rdi, qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x140005dda
mov rcx, rbx
call rbp
mov rcx, rbx
call rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call rsi
test eax, eax
jne 0x140005dd0
add rsp, 0x298
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x1400096c0
Capabilities:
Hide graphical window

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rbx, rcx
mov esi, edx
mov edi, r8d
mov ebp, r9d
test rcx, rcx
je 0x140009828
cmp word [rcx + 0x1e], 0
jne 0x1400097a0
mov rsi, qword [0x14002da90]
mov rax, qword [rsi]
mov rcx, qword [rax + 0x58]
call qword [sym.imp.USER32.dll_IsWindowVisible]
mov rdi, qword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x140009810
mov rax, qword [rsi]
mov edx, 1
mov rcx, qword [rax + 0x58]
call rdi
mov rax, qword [rsi]
lea rdx, [rsp + 0x60]
mov rcx, qword [rax + 0x58]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov qword [rsp + 0x58], rbx
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x50], 0
mov r9d, 0x40800000
lea rdx, str.ew::orderView
mov qword [rsp + 0x48], 0
mov rax, qword [rsi]
mov rax, qword [rax + 0x58]
mov dword [rsp + 0x28], 0x7d
mov dword [rsp + 0x20], 0x82
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x6c]
sub eax, dword [rsp + 0x64]
sub eax, 0x7d
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x68]
sub eax, dword [rsp + 0x60]
sub eax, 0x82
mov dword [rsp + 0x30], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, str.Creating_completed_order_view__n
call fcn.1400095e0
mov qword [rsp + 0x58], rbx
xor r8d, r8d
xor ecx, ecx
mov rax, qword [rsp + 0xc8]
mov dword [rsp + 0x30], ebp
mov r9d, 0x50800000
lea rdx, str.ew::orderView
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xc0]
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_CreateWindowExW]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rax, qword [rsi]
mov edx, 6
mov rcx, qword [rax + 0x58]
call rdi
jmp 0x14000970a
xor eax, eax
jmp 0x1400097ff

Function at 0x14000b1d0
Capabilities:
Hide graphical window

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov r12, qword [0x14002da90]
mov r9d, 0x80000
xor ecx, ecx
lea r8, [0x14002b658]
mov rax, qword [r12]
mov qword [rsp + 0x58], 0
mov rdx, qword [rax]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rdx
mov rax, qword [rax + 0x58]
lea rdx, str.ew::requestDelivery
mov dword [rsp + 0x38], 0x8b
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0x14b
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
xor edx, edx
mov r13, qword [sym.imp.USER32.dll_EnableWindow]
mov rbx, rax
mov rax, qword [r12]
mov rcx, qword [rax + 0x58]
call r13
mov rax, qword [r12]
mov rcx, rbx
lea rbx, [rsp + 0x60]
mov edx, dword [rax + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rsi, qword [sym.imp.USER32.dll_GetMessageW]
mov rbp, qword [sym.imp.USER32.dll_TranslateMessage]
mov rdi, qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x14000b29a
mov rcx, rbx
call rbp
mov rcx, rbx
call rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call rsi
test eax, eax
jne 0x14000b290
mov rax, qword [r12]
mov edx, 1
mov rcx, qword [rax + 0x58]
call r13
nop
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x14000e25f
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x230
mov rsi, rcx
mov edi, edx
test rcx, rcx
je 0x14000e3fb
cmp qword [rcx], 0
je 0x14000e3fb
cmp qword [rcx + 0x38], 0
je 0x14000e3fb
cmp qword [rcx + 0x40], 0
je 0x14000e3fb
lea r14, [0x14002bd5c]
mov edx, 0x2707
mov rcx, r14
call fcn.1400105a9
mov ebx, eax
test eax, eax
js 0x14000e3fb
test edi, edi
lea r13, [0x14002bce7]
lea r12, [0x14002bd76]
je 0x14000e39f
call fcn.140014ca0
mov rdi, rax
mov rax, qword [rsi]
mov rcx, qword [rax + 0x50]
call fcn.140015200
mov rdx, r13
mov rcx, rdi
mov r8, rax
call fcn.140015d70
lea rcx, str.update_check
call fcn.140015200
mov rdx, r12
mov rcx, rdi
mov r8, rax
call fcn.140015d70
mov rcx, qword [rsi + 0x40]
call fcn.140015200
lea rdx, str.currentVersion
mov rcx, rdi
mov r8, rax
call fcn.140015d70
mov ecx, ebx
mov rdx, rdi
call fcn.14001089e
mov rcx, rdi
mov ebp, eax
test eax, eax
jne 0x14000e3ef
call fcn.14000dc72
mov ecx, ebx
call fcn.140010687
mov ecx, ebx
mov rdi, rax
call fcn.140010664
test rdi, rdi
je 0x14000e3fb
lea rdx, [0x14002bd89]
mov rcx, rdi
call fcn.140014d40
mov rcx, rax
call fcn.1400156b0
mov rcx, rdi
dec eax
je 0x14000e387
call fcn.14000dc72
jmp 0x14000e491
call fcn.14000dc72
mov edx, 0x2707
mov rcx, r14
call fcn.1400105a9
mov ebx, eax
test eax, eax
js 0x14000e3fb
call fcn.140014ca0
mov rdi, rax
mov rax, qword [rsi]
mov rcx, qword [rax + 0x50]
call fcn.140015200
mov rdx, r13
mov rcx, rdi
mov r8, rax
call fcn.140015d70
lea rcx, str.update_request
call fcn.140015200
mov rdx, r12
mov rcx, rdi
mov r8, rax
call fcn.140015d70
mov ecx, ebx
mov rdx, rdi
call fcn.14001089e
mov rcx, rdi
mov r12d, eax
test eax, eax
je 0x14000e403
call fcn.14000dc72
mov ecx, ebx
call fcn.140010664
push 0xffffffffffffffff
pop rbp
jmp 0x14000e491
call fcn.14000dc72
lea rdx, [rsp + 0x2c]
mov ecx, ebx
and dword [rsp + 0x2c], 0
call fcn.1400107ad
mov rbp, rax
test rax, rax
je 0x14000e3fb
and qword [rsp + 0x30], 0
lea rdi, [rsp + 0x40]
mov eax, r12d
and qword [rsp + 0x38], 0
lea rdx, str._s_e_wings_new.exe
push 0x7c
pop rcx
rep stosd dword [rdi], eax
mov r8, qword [rsi + 0x38]
lea rbx, [rsp + 0x30]
mov rcx, rbx
call fcn.14000dc50
mov rcx, rbx
lea rdx, [0x14002bdb2]
call sub.msvcrt.dll_fopen
mov rbx, rax
test rax, rax
jne 0x14000e473
mov rcx, rbp
call sub.msvcrt.dll_free
jmp 0x14000e3fb
movsxd r8, dword [rsp + 0x2c]
push 1
mov rcx, rbp
mov r9, rax
pop rdx
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fclose
push 1
pop rbp
mov eax, ebp
add rsp, 0x230
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x1400105a9
Capabilities:
Connect socket
Initialize winsock library

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x1c0
mov rdi, rcx
mov esi, edx
test rcx, rcx
je 0x1400105de
test edx, edx
je 0x1400105de
cmp dword [0x140034280], 0
jne 0x1400105ed
lea rdx, [rsp + 0x28]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1400105e3
push 0xffffffffffffffff
pop rax
jmp 0x14001064c
mov dword [0x140034280], 1
push 1
xor r8d, r8d
pop rdx
push 2
pop rcx
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400105de
mov word [rsp + 0x28], 2
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_inet_addr]
movzx ecx, si
mov dword [rsp + 0x2c], eax
call qword [sym.imp.WS2_32.dll_htons]
lea rdx, [rsp + 0x28]
mov rcx, rbx
mov word [rsp + 0x2a], ax
push 0x10
pop r8
call qword [sym.imp.WS2_32.dll_connect]
mov edx, eax
mov eax, ebx
inc edx
jne 0x14001064c
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x1400105de
add rsp, 0x1c0
pop rbx
pop rsi
pop rdi
ret

Function at 0x140010687
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x130
xor r9d, r9d
mov r13, qword [sym.imp.WS2_32.dll_recv]
lea rdi, [rsp + 0x2a]
movsxd rbp, ecx
and qword [rsp + 0x2a], 0
and word [rsp + 0x32], 0
mov rdx, rdi
mov rcx, rbp
push 9
pop r8
call r13
test eax, eax
jle 0x140010799
cmp byte [rsp + 0x2a], 0x45
jne 0x140010799
push 1
pop rax
cmp byte [rdi + rax], 0x20
jne 0x1400106eb
mov r12d, eax
cdqe
mov byte [rsp + rax + 0x2a], 0
jmp 0x1400106f8
inc rax
cmp rax, 9
jne 0x1400106d9
push 9
pop r12
lea rcx, [rsp + 0x2b]
call sub.msvcrt.dll_atoi
mov r14d, eax
test eax, eax
jle 0x140010799
push 1
lea ecx, [rax + 1]
pop rdx
xor ebx, ebx
movsxd rcx, ecx
call sub.msvcrt.dll_calloc
mov rsi, rax
cmp r12d, 9
je 0x14001075d
lea eax, [r12 + 1]
cdqe
cmp byte [rsp + rax + 0x2a], 0
je 0x14001075d
lea rdx, [rdi + rax]
mov rcx, rsi
call sub.msvcrt.dll_strcpy
push 8
pop rbx
sub ebx, r12d
jmp 0x14001075d
movsxd rdx, ebx
xor r9d, r9d
mov rcx, rbp
add rdx, rsi
call r13
test eax, eax
jle 0x140010768
add ebx, eax
mov r8d, r14d
sub r8d, ebx
test r8d, r8d
jg 0x140010748
xor edx, edx
lea r8, [rsp + 0x34]
mov rcx, rsi
call fcn.140013a80
test rax, rax
je 0x140010799
cmp dword [rax], 0
je 0x14001079b
mov rdx, qword [rax + 8]
inc rdx
je 0x140010799
lock dec qword [rax + 8]
jne 0x140010799
mov rcx, rax
call fcn.1400158a0
xor eax, eax
add rsp, 0x130
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x1400107ad
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
xor r9d, r9d
mov r13, qword [sym.imp.WS2_32.dll_recv]
lea rsi, [rsp + 0x26]
movsxd rdi, ecx
and qword [rsp + 0x26], 0
mov r12, rdx
and word [rsp + 0x2e], 0
mov rdx, rsi
mov rcx, rdi
push 9
pop r8
call r13
test eax, eax
jne 0x1400107f7
xor r14d, r14d
jmp 0x14001088a
cmp byte [rsp + 0x26], 0x45
jne 0x1400107ef
push 1
pop rax
cmp byte [rsi + rax], 0x20
jne 0x140010812
mov ebp, eax
cdqe
mov byte [rsp + rax + 0x26], 0
jmp 0x14001081e
inc rax
cmp rax, 9
jne 0x140010801
push 9
pop rbp
lea rcx, [rsp + 0x27]
call sub.msvcrt.dll_atoi
mov r15d, eax
test eax, eax
jle 0x1400107ef
push 1
lea ecx, [rax + 1]
pop rdx
xor ebx, ebx
movsxd rcx, ecx
call sub.msvcrt.dll_calloc
mov r14, rax
cmp ebp, 9
je 0x14001087b
lea eax, [rbp + 1]
cdqe
cmp byte [rsp + rax + 0x26], 0
je 0x14001087b
lea rdx, [rsi + rax]
mov rcx, r14
call sub.msvcrt.dll_strcpy
push 8
pop rbx
sub ebx, ebp
jmp 0x14001087b
movsxd rdx, ebx
xor r9d, r9d
mov rcx, rdi
add rdx, r14
call r13
test eax, eax
jle 0x140010886
add ebx, eax
mov r8d, r15d
sub r8d, ebx
test r8d, r8d
jg 0x140010866
mov dword [r12], ebx
mov rax, r14
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14001089e
Capabilities:
Send data
Send data on socket

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
movsxd rsi, ecx
mov rcx, rdx
test rdx, rdx
je 0x140010925
mov edx, 0x1820
call fcn.140011760
mov rbx, rax
test rax, rax
je 0x140010925
mov rcx, rax
lea r12, [rsp + 0x26]
call sub.msvcrt.dll_strlen
lea rdx, str.E_d
mov rcx, r12
and qword [rsp + 0x26], 0
mov r8d, eax
and word [rsp + 0x2e], 0
mov rdi, rax
call fcn.140010580
mov rcx, r12
call sub.msvcrt.dll_strlen
xor r9d, r9d
mov rdx, r12
mov rcx, rsi
mov r12, qword [sym.imp.WS2_32.dll_send]
mov rbp, rax
mov r8d, eax
call r12
cmp eax, 0xffffffff
je 0x14001091d
cmp eax, ebp
jge 0x14001092a
mov rcx, rbx
call sub.msvcrt.dll_free
push 0xffffffffffffffff
pop rax
jmp 0x14001094c
xor r9d, r9d
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call r12
cmp eax, 0xffffffff
je 0x14001091d
cmp eax, edi
jl 0x14001091d
mov rcx, rbx
call sub.msvcrt.dll_free
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1400118c0
Capabilities:
Encode data using xor

Disassembly:
mov r9, rdx
lea edx, [r8 + rdx - 0x21524111]
mov r8d, edx
mov eax, edx
cmp r9, 0xc
jbe 0x1400119cc
nop word [rax + rax]
movzx r10d, byte [rcx + 5]
movzx r11d, byte [rcx + 6]
shl r10d, 8
shl r11d, 0x10
add r10d, r11d
movzx r11d, byte [rcx + 4]
add r10d, r11d
movzx r11d, byte [rcx + 7]
shl r11d, 0x18
add r10d, r11d
movzx r11d, byte [rcx + 0xa]
add r10d, eax
movzx eax, byte [rcx + 9]
shl r11d, 0x10
shl eax, 8
add eax, r11d
movzx r11d, byte [rcx + 8]
add eax, r11d
movzx r11d, byte [rcx + 0xb]
shl r11d, 0x18
add eax, r11d
movzx r11d, byte [rcx + 2]
add eax, edx
movzx edx, byte [rcx + 1]
shl r11d, 0x10
shl edx, 8
add edx, r11d
movzx r11d, byte [rcx]
add edx, r11d
movzx r11d, byte [rcx + 3]
shl r11d, 0x18
add edx, r11d
sub edx, eax
add edx, r8d
mov r8d, eax
add eax, r10d
rol r8d, 4
xor r8d, edx
mov edx, r8d
sub r10d, r8d
add r8d, eax
rol edx, 6
xor edx, r10d
sub eax, edx
mov r10d, eax
mov eax, edx
rol eax, 8
xor eax, r10d
add edx, r8d
sub r9, 0xc
add rcx, 0xc
mov r10d, eax
sub r8d, eax
add eax, edx
rol r10d, 0x10
xor r8d, r10d
mov r10d, r8d
sub edx, r8d
add r8d, eax
ror r10d, 0xd
xor r10d, edx
mov edx, r10d
sub eax, r10d
rol edx, 4
xor edx, eax
lea eax, [r10 + r8]
cmp r9, 0xc
ja 0x1400118e0
lea r10, [0x14002c6c0]
movsxd r9, dword [r10 + r9*4]
add r9, r10
notrack jmp r9
movzx r9d, byte [rcx + 0xb]
shl r9d, 0x18
add edx, r9d
movzx r9d, byte [rcx + 0xa]
shl r9d, 0x10
add edx, r9d
movzx r9d, byte [rcx + 9]
shl r9d, 8
add edx, r9d
movzx r9d, byte [rcx + 8]
add edx, r9d
movzx r9d, byte [rcx + 7]
shl r9d, 0x18
add eax, r9d
movzx r9d, byte [rcx + 6]
shl r9d, 0x10
add eax, r9d
movzx r9d, byte [rcx + 5]
shl r9d, 8
add eax, r9d
movzx r9d, byte [rcx + 4]
add eax, r9d
movzx r9d, byte [rcx + 3]
shl r9d, 0x18
add r8d, r9d
movzx r9d, byte [rcx + 2]
shl r9d, 0x10
add r8d, r9d
movzx r9d, byte [rcx + 1]
shl r9d, 8
add r8d, r9d
movzx ecx, byte [rcx]
xor edx, eax
add ecx, r8d
mov r8d, eax
rol r8d, 0xe
sub edx, r8d
mov r8d, edx
xor ecx, edx
rol r8d, 0xb
sub ecx, r8d
xor eax, ecx
mov r10d, eax
mov eax, ecx
ror eax, 7
sub r10d, eax
mov eax, r10d
xor edx, r10d
rol eax, 0x10
sub edx, eax
mov eax, edx
xor ecx, edx
rol eax, 4
sub ecx, eax
xor r10d, ecx
rol ecx, 0xe
sub r10d, ecx
xor edx, r10d
ror r10d, 8
sub edx, r10d
mov eax, edx
ret

Function at 0x140016f20
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140022ad0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.140022ad0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]