joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c2390
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400cdaf0
mov rax, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x1400c2451
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov r8b, 1
call fcn.1400c5040
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
cmp rdi, rbx
je 0x1400c2451
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400c2425
test rdi, rdi
je 0x1400c2421
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.140015df0
xor esi, esi
jmp 0x1400c2451
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rdi, rdi
je 0x1400c244e
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.140015df0
mov rsi, rbx
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400c2ab0
Capabilities:
Copy file

Disassembly:
push rbp
push r15
push rdi
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r9
mov rsi, rcx
lea rcx, [rbp - 0x18]
invalid
call fcn.1400cdaf0
mov rax, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
movabs r14, 0x8000000000000000
cmp rax, r14
je 0x1400c2b1c
invalid
mov rcx, qword [rbp - 8]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x18]
lea edx, [rbp - 0x18]
mov r8b, 1
call fcn.1400c5040
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
cmp rax, r14
Function at 0x1400c3040
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14010c078]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x1400c3084
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x1400c30e3
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x1400c30f2
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x1400c312a
cmp eax, 0x103
je 0x1400c3134
test eax, eax
js 0x1400c310f
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x1400c312a
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x14010c0e0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1400baa80
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.1400b0760
mov ecx, 7
int 0x29
ud2

Function at 0x1400c31a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14010c078]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x1400c31e4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1400c324a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x1400c3281
test eax, eax
js 0x1400c325b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400c3274
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x14010c0e0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1400baa80
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.1400b0760
mov ecx, 7
int 0x29
ud2
Function at 0x1400c5800
Capabilities:
Create pipe
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x148
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xb0], xmm6
mov qword [rbp + 0xa8], 0xfffffffffffffffe
mov qword [rbp + 0x28], rcx
mov byte [rbp + 0xa5], dl
movzx eax, dl
mov ecx, 0x40080002
sub ecx, eax
mov dword [rbp + 0x24], ecx
xor edi, edi
mov r15d, 8
mov sil, 1
xorps xmm6, xmm6
mov r12, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
xor eax, eax
mov qword [rbp - 0x10], rax
nop

Function at 0x1400c6200
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x78
sub esp, 0x78

Function at 0x1400c6bd0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
cmp qword [rdx], 0
jne 0x1400c6d23
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx]
test rax, rax
jne 0x1400c6c07
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x1400c6ce8
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x1400c6d06
sub rax, rdx
add rdx, qword [rbx + 8]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x2c], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x2c]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400c6c69
mov ecx, dword [rsp + 0x2c]
mov eax, 2
test rcx, rcx
je 0x1400c6c9b
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov byte [rsi + 1], 1
jmp 0x1400c6c9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rax
shl rcx, 0x20
or rcx, 2
mov qword [rsp + 0x40], rcx
cmp eax, 0x3e5
je 0x1400c6ca3
cmp eax, 0x6d
jne 0x1400c6cce
mov qword [rsp + 0x30], 1
lea rax, [rsp + 0x38]
jmp 0x1400c6ca8
mov byte [rsi + 1], 0
xor eax, eax
jmp 0x1400c6cd4
lea rax, [rsp + 0x30]
mov qword [rax], 0
lea rcx, [rsp + 0x40]
call fcn.1400b00d0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x1400c6cde
cmp rax, 1
je 0x1400c6c52
mov qword [rsi + 8], rcx
mov al, 1
mov byte [rsi], al
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov eax, 1
jmp 0x1400c6c5c
mov r8d, 0x10
mov rcx, rbx
call fcn.1400e81e0
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
jne 0x1400c6c14
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.1400e81e0
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x10]
jmp 0x1400c6c14
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400e8090
int3
Function at 0x1400cba90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.1400cdaf0

Function at 0x1400cc9f0
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x1400cca28
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x38
ret
call fcn.1400cca40
nop
add rsp, 0x38
ret

Function at 0x1400cca40
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x1400cca83
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, case.0x1400b783b.114
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.1400e8d00
ud2

Function at 0x1400cd0e0
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x14013a181]
mov ecx, 0x10
mov edx, 8
call fcn.140015de0
test rax, rax
je 0x1400cd1bf
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400cd270]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne case.0x1400c2d60.616
mov rcx, qword [rbx]
mov qword [rbp - 0x18], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x10], rax
call qword [rax]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + 8]
test rdx, rdx
invalid
je 0x1400cd188
mov r8, qword [rax + 0x10]
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], rdi
mov dword [rbp - 0x10], edi
Function at 0x1400e1c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x1400e1c9a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x1400e1c90
cmp r11, r10
ja 0x1400e1d31
cmp r10, rdx
ja 0x1400e1d43
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x1400e1c92
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x1400e1c70
jmp 0x1400e1d07
ja 0x1400e1c9a
mov r11, r10
cmp rax, r8
jne 0x1400e1c42
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1400e1d0b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1400e1ce0
mov r8, r10
sub ecx, r9d
jns 0x1400e1cfe
jmp 0x1400e1d0d
cmp r10, rdx
je 0x1400e1d19
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x1400e1d0d
xor al, 1
cmp r8, rdx
jne 0x1400e1cc0
jmp 0x1400e1d0d
xor eax, eax
jmp 0x1400e1d0d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140110561]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.1400e8dd0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400e9380
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400e9300
int3
Function at 0x1400e7ac0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400e7b21
mov rdi, rax
lea rdx, [0x140108e96]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400e7b21
mov rsi, rax
lea rdx, [0x140108ea4]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400e7b21
mov rdi, rax
xor ebx, ebx
jmp 0x1400e7ba7
lea rcx, [0x140108e30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400e7c1b
mov rsi, rax
lea rdx, [0x140108e3a]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400e7c1b
mov rdi, rax
lea rdx, [0x140108e4d]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400e7c1b
mov rbx, rax
lea rdx, [0x140108e61]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400e7c1b
mov rsi, rax
lea rcx, [rbp - 0x18]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rdi
test eax, eax
jne 0x1400e7c1b
mov rdi, qword [rbp - 0x18]
movzx eax, byte [0x14013a181]
mov ecx, 0x18
mov edx, 8
call fcn.140015de0
test rax, rax
je 0x1400e7c20
mov rcx, rax
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rdi
xor eax, eax
lock cmpxchg qword [0x14013a1d0], rcx
je 0x1400e7c0f
mov rsi, rax
cmp qword [rcx], 0
mov qword [rbp - 8], rcx
je 0x1400e7bf8
mov rax, qword [rbp - 8]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x18
mov r8d, 8
mov rcx, qword [rbp - 8]
call fcn.140015df0
mov rcx, rsi
mov rax, rcx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop rbp
ret
call fcn.1400e7a90
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rbx
mov ecx, 8
mov edx, 0x18
call fcn.1400e8b30
ud2
Function at 0x140003e2c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov cl, 0x41
mov dword [rbp - 0x10], 0x202e0d41
mov dword [rbp - 0xc], 0x23280d25
xor eax, eax
mov dword [rbp - 8], 0x38332033
mov word [rbp - 4], socket
xor byte [rbp + rax - 0xf], cl
inc rax
cmp rax, 0xc
jae 0x140003e6a
mov cl, byte [rbp - 0x10]
jmp 0x140003e58
mov byte [rbp - 3], 0
mov cl, 0x67
mov dword [rbp - 0x20], 0x15020c67
xor eax, eax
mov dword [rbp - 0x1c], 0x540b0209
mov dword [rbp - 0x18], 0xb034955
mov word [rbp - 0x14], ntohs
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xc
jae 0x140003e9f
mov cl, byte [rbp - 0x20]
jmp 0x140003e8d
lea rcx, [rbp - 0x1f]
mov byte [rbp - 0x13], 0
call fcn.14000ce94
lea rdx, [rbp - 0xf]
mov rcx, rax
call fcn.1400071f0
lea r8, [0x140097510]
mov rcx, rax
lea rdx, [0x1400039d0]
mov rbx, rax
call fcn.14006e490
mov rcx, rbx
call fcn.14006e720
mov cl, 0x42
mov dword [rbp - 0x20], 0x232d0e42
xor eax, eax
mov dword [rbp - 0x1c], 0x202b0e26
mov dword [rbp - 0x18], 0x3b302330
mov word [rbp - 0x14], 3
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xc
jae 0x140003f0a
mov cl, byte [rbp - 0x20]
jmp 0x140003ef8
mov byte [rbp - 0x13], 0
mov cl, listen
mov dword [rbp - 0x10], 0x7e69670c
xor eax, eax
mov dword [rbp - 0xc], 0x3f606962
mov dword [rbp - 8], 0x6068223e
mov word [rbp - 4], 0x60
xor byte [rbp + rax - 0xf], cl
inc rax
cmp rax, 0xc
jae 0x140003f3f
mov cl, byte [rbp - 0x10]
jmp 0x140003f2d
lea rcx, [rbp - 0xf]
mov byte [rbp - 3], 0
call fcn.14000ce94
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400071f0
lea r8, [0x140097518]
mov rcx, rax
lea rdx, [0x140003e20]
mov rbx, rax
call fcn.14006e490
mov rcx, rbx
call fcn.14006e720
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x1400064a8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x140096980]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov ebx, edx
mov rdx, rcx
lea rcx, [rbp - 9]
call fcn.14000403c
mov dword [rbp + 0x17], ebx
mov ecx, 0x28
call fcn.140072890
mov rbx, rax
mov qword [rbp + 0x27], rax
lea rdx, [rbp - 9]
mov rcx, rax
call fcn.14000403c
mov ecx, dword [rbp + 0x17]
mov dword [rbx + 0x20], ecx
mov qword [rbp + 0x27], rbx
lea rax, [rbp + 0x3f]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x140007168]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x37], rax
test rax, rax
je 0x1400065c2
and qword [rbp + 0x27], 0
lea rcx, [rbp + 0x27]
call fcn.1400070f8
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 0xf
jbe 0x14000657c
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006577
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006577
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072b14
cmp dword [rbp + 0x3f], 0
je 0x1400065b6
movaps xmm0, xmmword [rbp + 0x37]
movdqa xmmword [rbp + 0x27], xmm0
lea rcx, [rbp + 0x27]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400065b6
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140072870
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
and dword [rbp + 0x3f], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14000d458
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x140096980]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
mov qword [rbp + 0x17], rcx
and dword [rbp - 0x29], 0
call fcn.14006e730
mov ecx, 8
call fcn.140072890
lea rcx, [0x14000211c]
mov qword [rax], rcx
mov qword [rbp + 0x27], rax
mov dword [rbp - 0x29], 2
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14000313c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14000d5d5
mov dword [rbp - 0x29], 3
cmp dword [rdi], 0
jne 0x14000d588
movdqa xmm0, xmmword [0x14008b700]
movdqu xmmword [rbp - 0x21], xmm0
movdqa xmm1, xmmword [0x14008b650]
movdqu xmmword [rbp - 0x11], xmm1
movdqa xmm0, xmmword [0x14008b6d0]
movdqu xmmword [rbp - 1], xmm0
mov word [rbp + 0xf], 7
xor ecx, ecx
mov al, byte [rbp - 0x21]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x30
jb 0x14000d519
mov byte [rbp + 0x10], 0
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x27]
call fcn.140002880
nop
lea rcx, [rbp + 0x27]
call fcn.1400071c4
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0xf
jbe 0x14000d583
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d57e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d57e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072b14
cmp dword [rdi], 0
je 0x14000d5c9
movups xmm0, xmmword [rbx]
movdqu xmmword [rbp + 0x27], xmm0
lea rcx, [rbp + 0x27]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14000d5c9
xorps xmm0, xmm0
movdqu xmmword [rbx], xmm0
mov rax, rbx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140072870
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
and dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140019710
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400197f2
call fcn.140032720
test al, al
jne 0x1400197f2
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x140019742
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.14003c0c0
test rax, rax
je 0x140019787
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.14003c0c0
mov rsi, rax
test rax, rax
je 0x140019787
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x1400197bb
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.14002f530
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x1400197a0
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400212a0
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x140096980]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, qword [rdx + 0x10]
mov rbx, rcx
mov rax, qword [rdx + 0x18]
lea rcx, str.SSL_PROXY
cmp qword [rdx], rcx
jne 0x1400212e7
mov rdi, qword [rax + 0xd8]
mov rsi, qword [rax + 0xe0]
mov ebp, dword [rax + 0xe8]
jmp 0x1400212f5
mov rdi, qword [rax + 0x50]
mov rsi, qword [rax + 0x58]
mov ebp, dword [rax + 0x764]
mov qword [rsp + 0x80], r15
test rdi, rdi
je 0x1400214cb
mov r9, qword [rbx]
test r9, r9
je 0x14002133b
mov r8, r9
mov rax, rdi
sub r8, rdi
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140021333
inc rax
test ecx, ecx
jne 0x140021320
test edx, edx
je 0x1400214cb
mov rcx, qword [rbx + 8]
cmp rcx, r9
je 0x14002134a
call qword [str.x9_a_]
mov rcx, qword [rbx + 0x10]
call qword [str.x9_a_]
mov rcx, qword [rbx]
call qword [str.x9_a_]
xor r15d, r15d
mov rcx, rdi
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov qword [rbx], r15
mov dword [rbx + 0x18], r15d
call qword [case.0x14001ae3b.2]
mov qword [rbx], rax
mov rcx, rax
test rax, rax
jne 0x1400213be
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140021392
call qword [str.x9_a_]
mov rcx, qword [rbx + 0x10]
call qword [str.x9_a_]
mov rcx, qword [rbx]
call qword [str.x9_a_]
mov eax, 0x1b
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov qword [rbx], r15
mov dword [rbx + 0x18], r15d
jmp 0x1400214d1
test rsi, rsi
je 0x140021402
mov r8, rsi
sub r8, rdi
nop dword [rax]
movzx edx, byte [rdi]
movzx eax, byte [rdi + r8]
sub edx, eax
jne 0x1400213e3
inc rdi
test eax, eax
jne 0x1400213d0
test edx, edx
je 0x140021402
mov rcx, rsi
call qword [case.0x14001ae3b.2]
mov qword [rbx + 8], rax
test rax, rax
jne 0x140021406
cmp qword [rbx], r15
je 0x140021392
xor ecx, ecx
jmp 0x14002138c
mov qword [rbx + 8], rcx
mov rdi, qword [rbx]
mov qword [rbx + 0x10], r15
test rdi, rdi
je 0x14002145a
cmp byte [rdi], r15b
je 0x14002145a
lea r8, [rsp + 0x20]
mov rdx, rdi
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x14002143a
mov dword [rbx + 0x18], 1
jmp 0x1400214cb
lea r8, [rsp + 0x20]
mov rdx, rdi
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x14002145a
mov dword [rbx + 0x18], 2
jmp 0x1400214cb
mov rax, qword [rbx]
mov dword [rbx + 0x18], r15d
cmp byte [rax], r15b
je 0x1400214cb
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp byte [rax + rdi], r15b
jne 0x140021470
test rdi, rdi
je 0x140021488
cmp byte [rax + rdi - 1], 0x2e
jne 0x140021488
dec rdi
cmp rdi, 0xffff
jae 0x1400214cb
lea rdx, [rdi + 1]
mov ecx, 1
call qword [str._9_a_]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1400214b5
mov rcx, qword [rbx + 8]
cmp rcx, qword [rbx]
jmp 0x14002138a
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, rax
call fcn.14002f580
mov rax, qword [rbx + 0x10]
mov byte [rdi + rax], r15b
mov dword [r14 + 0x50], ebp
xor eax, eax
mov r15, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140072870
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret