joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140200ee0
Capabilities:
Hash data using ripemd320
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 0x54], 0x67452301
mov dword [rcx + 0x50], eax
mov rdi, r9
mov qword [rcx + 8], rax
mov rbx, rcx
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
mov dword [rcx + 0x64], 0xc3d2e1f0
mov dword [rcx + 0x68], 0x76543210
mov dword [rcx + 0x6c], 0xfedcba98
mov dword [rcx + 0x70], 0x89abcdef
mov dword [rcx + 0x74], 0x1234567
mov dword [rcx + 0x78], 0x3c2d1e0f
call fcn.140200df0
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140200bf0

Function at 0x140200f60
Capabilities:
Hash data with md5

Disassembly:
lea rax, vtable.s473168zz.0
mov dword [rcx + 8], 0x67452301
mov qword [rcx], rax
xor eax, eax
mov qword [rcx + 0x18], rax
mov rax, rcx
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
ret

Function at 0x140200fd0
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword [0x14040f040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r13, qword [rsp + 0xb0]
mov r14, r9
mov rbp, qword [rsp + 0xb8]
mov rsi, r8
mov r15, rdx
mov rdi, rcx
test r13, r13
je 0x140201110
mov dword [rcx + 8], 0x67452301
xor r12d, r12d
mov qword [rcx + 0x18], r12
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov ecx, 0x4e28
call fcn.14011a720
mov rbx, rax
test rax, rax
je 0x140201110
mov dword [rsp + 0x30], r12d
mov rcx, r15
mov r12b, 1
call fcn.1402273a0
test al, al
jne 0x1402010f7
nop word [rax + rax]
mov qword [rsp + 0x28], r14
lea r9, [rsp + 0x30]
mov r8d, 0x4e20
mov qword [rsp + 0x20], rsi
mov rdx, rbx
mov rcx, r15
call fcn.1402275f0
test al, al
je 0x1402010f7
mov r8d, dword [rsp + 0x30]
test r8d, r8d
je 0x1402010d6
test rbp, rbp
je 0x1402010b3
mov rdx, rbx
mov rcx, rbp
call fcn.1401472b0
mov r8d, dword [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
call fcn.140201ad0
test rsi, rsi
je 0x1402010d6
mov edx, dword [rsp + 0x30]
mov r8, r14
mov rcx, rsi
call fcn.1401d1690
test al, al
jne 0x1402010e4
mov rcx, r15
call fcn.1402273a0
test al, al
je 0x140201070
jmp 0x1402010f7
mov rax, qword [r14]
lea rdx, str.MD4_aborted_by_application
mov rcx, r14
call qword [rax + 0x28]
xor r12b, r12b
mov rcx, rbx
call fcn.140108b5c
mov rdx, r13
mov rcx, rdi
call fcn.140201130
movzx eax, r12b
jmp 0x140201112
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140109210
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140201250
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14040f040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x20]
call fcn.140146c30
nop
lea r8, [rsp + 0x20]
xor edx, edx
mov rcx, rbx
call fcn.14010d6a0
xor eax, eax
mov qword [rdi + 0x18], rax
mov dword [rdi + 8], 0x67452301
mov dword [rdi + 0xc], 0xefcdab89
mov dword [rdi + 0x10], 0x98badcfe
mov dword [rdi + 0x14], 0x10325476
lea rcx, [rsp + 0x20]
call fcn.14014b850
mov ebx, eax
lea rcx, [rsp + 0x20]
call fcn.14014b520
mov rdx, rax
mov r8d, ebx
mov rcx, rdi
call fcn.140201ad0
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140201130
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1401472b0
nop
lea rcx, [rsp + 0x20]
call fcn.140146de0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140109210
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140201e00
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256
Resolve function by parsing pe exports

Disassembly:
cmp dword [rcx + 0x10], 0x100
jle fcn.1402052f0
jmp fcn.1402076a0

Function at 0x140201e20
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov edx, dword [rcx + 0x10]
xor r8d, r8d
sub edx, 0xa0
je 0x140201fb0
sub edx, 0x40
je 0x140201ec2
sub edx, 0x20
je 0x140201f70
sub edx, 0x80
je 0x140201f00
cmp edx, 0x80
jne 0x140201fd7
mov rax, qword [0x14054a280]
mov qword [rcx + 0x40], rax
mov rax, qword [0x14054a288]
mov qword [rcx + 0x48], rax
mov rax, qword [0x14054a290]
mov qword [rcx + 0x50], rax
mov rax, qword [0x14054a298]
mov qword [rcx + 0x58], rax
mov rax, qword [0x14054a2a0]
mov qword [rcx + 0x60], rax
mov rax, qword [0x14054a2a8]
mov qword [rcx + 0x68], rax
mov rax, qword [0x14054a2b0]
mov qword [rcx + 0x70], rax
mov rax, qword [0x14054a2b8]
mov qword [rcx + 0x78], rax
mov qword [rcx + 0x80], r8
mov qword [rcx + 0x88], r8
mov dword [rcx + 0x14], 0xc1059ed8
mov dword [rcx + 0x18], 0x367cd507
mov dword [rcx + 0x1c], 0x3070dd17
mov dword [rcx + 0x20], 0xf70e5939
mov dword [rcx + 0x24], 0xffc00b31
mov dword [rcx + 0x28], 0x68581511
mov dword [rcx + 0x2c], 0x64f98fa7
mov dword [rcx + 0x30], 0xbefa4fa4
mov qword [rcx + 0x34], r8
ret
mov rax, qword [0x140549fc0]
mov qword [rcx + 0x40], rax
mov rax, qword [0x140549fc8]
mov qword [rcx + 0x48], rax
mov rax, qword [0x140549fd0]
mov qword [rcx + 0x50], rax
mov rax, qword [0x140549fd8]
mov qword [rcx + 0x58], rax
mov rax, qword [0x140549fe0]
mov qword [rcx + 0x60], rax
mov rax, qword [0x140549fe8]
mov qword [rcx + 0x68], rax
mov rax, qword [0x140549ff0]
mov qword [rcx + 0x70], rax
mov rax, qword [0x140549ff8]
mov qword [rcx + 0x78], rax
mov qword [rcx + 0x80], r8
mov qword [rcx + 0x88], r8
ret
mov dword [rcx + 0x14], 0x6a09e667
mov dword [rcx + 0x18], 0xbb67ae85
mov dword [rcx + 0x1c], 0x3c6ef372
mov dword [rcx + 0x20], 0xa54ff53a
mov dword [rcx + 0x24], 0x510e527f
mov dword [rcx + 0x28], 0x9b05688c
mov dword [rcx + 0x2c], 0x1f83d9ab
mov dword [rcx + 0x30], 0x5be0cd19
mov qword [rcx + 0x34], r8
ret
mov dword [rcx + 0x14], 0x67452301
mov dword [rcx + 0x18], 0xefcdab89
mov dword [rcx + 0x1c], 0x98badcfe
mov dword [rcx + 0x20], 0x10325476
mov dword [rcx + 0x24], 0xc3d2e1f0
mov qword [rcx + 0x34], r8
ret
Function at 0x140203dc0
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov edi, ecx
xor esi, esi
mov qword [rsp + 0x38], rsi
mov ecx, 0x110
call fcn.1401088d8
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140203fcc
mov rcx, rax
call fcn.140119e00
nop
lea rax, vtable.s500206zz.0
mov qword [rbx], rax
call fcn.14011a6d0
mov byte [0x14041ac70], al
call fcn.1402038d0
test edi, edi
jle 0x140203fc7
mov ecx, edi
sub ecx, 0xa0
je 0x140203fa0
sub ecx, 0x40
je 0x140203f60
sub ecx, 0x20
je 0x140203f20
sub ecx, 0x80
je 0x140203eb0
cmp ecx, 0x80
jne 0x140203fc7
mov rax, qword [0x14054a280]
mov qword [rbx + 0x40], rax
mov rax, qword [0x14054a288]
mov qword [rbx + 0x48], rax
mov rax, qword [0x14054a290]
mov qword [rbx + 0x50], rax
mov rax, qword [0x14054a298]
mov qword [rbx + 0x58], rax
mov rax, qword [0x14054a2a0]
mov qword [rbx + 0x60], rax
mov rax, qword [0x14054a2a8]
mov qword [rbx + 0x68], rax
mov rax, qword [0x14054a2b0]
mov qword [rbx + 0x70], rax
mov rax, qword [0x14054a2b8]
jmp 0x140203f04
mov rax, qword [0x140549fc0]
mov qword [rbx + 0x40], rax
mov rax, qword [0x140549fc8]
mov qword [rbx + 0x48], rax
mov rax, qword [0x140549fd0]
mov qword [rbx + 0x50], rax
mov rax, qword [0x140549fd8]
mov qword [rbx + 0x58], rax
mov rax, qword [0x140549fe0]
mov qword [rbx + 0x60], rax
mov rax, qword [0x140549fe8]
mov qword [rbx + 0x68], rax
mov rax, qword [0x140549ff0]
mov qword [rbx + 0x70], rax
mov rax, qword [0x140549ff8]
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x80], rsi
mov qword [rbx + 0x88], rsi
jmp 0x140203fc7
mov dword [rbx + 0x14], 0x6a09e667
mov dword [rbx + 0x18], 0xbb67ae85
mov dword [rbx + 0x1c], 0x3c6ef372
mov dword [rbx + 0x20], 0xa54ff53a
mov dword [rbx + 0x24], 0x510e527f
mov dword [rbx + 0x28], 0x9b05688c
mov dword [rbx + 0x2c], 0x1f83d9ab
mov dword [rbx + 0x30], 0x5be0cd19
jmp 0x140203fc3
mov dword [rbx + 0x14], 0xc1059ed8
mov dword [rbx + 0x18], 0x367cd507
mov dword [rbx + 0x1c], 0x3070dd17
mov dword [rbx + 0x20], 0xf70e5939
mov dword [rbx + 0x24], 0xffc00b31
mov dword [rbx + 0x28], 0x68581511
mov dword [rbx + 0x2c], 0x64f98fa7
mov dword [rbx + 0x30], 0xbefa4fa4
jmp 0x140203fc3
mov dword [rbx + 0x14], 0x67452301
mov dword [rbx + 0x18], 0xefcdab89
mov dword [rbx + 0x1c], 0x98badcfe
mov dword [rbx + 0x20], 0x10325476
mov dword [rbx + 0x24], 0xc3d2e1f0
mov qword [rbx + 0x34], rsi
mov dword [rbx + 0x10], edi
jmp 0x140203fcf
mov rbx, rsi
mov qword [rsp + 0x38], rbx
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140204280
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, 0x100
jmp fcn.140203dc0
Function at 0x14020b040
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x14040f040]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x14020b078
xor al, al
jmp 0x14020b150
lea rcx, [rsp + 0x20]
call fcn.14020a380
test edi, edi
je 0x14020b09e
test rbx, rbx
je 0x14020b09e
mov r9b, reloc.WS2_32.dll_select
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.14020b930
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x187], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x187], 0x80
inc dl
cmp dl, 0x8f
jae 0x14020b0ed
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x8f
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, reloc.WS2_32.dll_select
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x14020b100
lea rcx, [rsp + 0x30]
call fcn.14020a480
mov eax, dword [rsp + 0x48]
lea rcx, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x30]
movsd xmm1, qword [rsp + 0x40]
movups xmmword [rsi], xmm0
movsd qword [rsi + 0x10], xmm1
mov dword [rsi + 0x18], eax
lea rax, vtable.s846590zz.0
mov qword [rsp + 0x20], rax
call fcn.140119f10
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140109210
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14020b1c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x14040f040]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x14020b1f8
xor al, al
jmp 0x14020b2c7
lea rcx, [rsp + 0x20]
call fcn.14020a380
test edi, edi
je 0x14020b21e
test rbx, rbx
je 0x14020b21e
mov r9b, select
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.14020b930
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x17f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x17f], 0x80
inc dl
cmp dl, 0x87
jae 0x14020b26d
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x87
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, select
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x14020b280
lea rcx, [rsp + 0x30]
call fcn.14020a480
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable.s846590zz.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movups xmmword [rsi + 0x10], xmm1
call fcn.140119f10
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140109210
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14020b330
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x14040f040]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x14020b368
xor al, al
jmp 0x14020b440
lea rcx, [rsp + 0x20]
call fcn.14020a380
test edi, edi
je 0x14020b38e
test rbx, rbx
je 0x14020b38e
mov r9b, ntohs
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.14020b930
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x15f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x15f], 0x80
inc dl
cmp dl, 0x67
jae 0x14020b3dd
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x67
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, ntohs
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x14020b3f0
lea rcx, [rsp + 0x30]
call fcn.14020a480
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable.s846590zz.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi + 0x20], xmm0
call fcn.140119f10
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140109210
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14020b4b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x14040f040]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x14020b4e8
xor al, al
jmp 0x14020b5c9
lea rcx, [rsp + 0x20]
call fcn.14020a380
test edi, edi
je 0x14020b50e
test rbx, rbx
je 0x14020b50e
mov r9b, 9
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.14020b930
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x13f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x13f], 0x80
inc dl
cmp dl, 0x47
jae 0x14020b55d
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x47
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, 9
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x14020b570
lea rcx, [rsp + 0x30]
call fcn.14020a480
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable.s846590zz.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm1
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
call fcn.140119f10
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140109210
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14020b860
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, r8b
lea rdi, [rcx + 0x10]
mov rbx, rdx
movzx esi, r9b
mov rdx, rcx
lea eax, [rax*8]
mov byte [rax + rcx + 0xd7], 0
lea r11d, [rax - 1]
mov r10d, eax
movzx eax, byte [rcx + 0x1a0]
mov byte [rax + rcx + 0xd8], 6
or byte [r10 + rcx + 0xd7], 0x80
movzx ecx, byte [rcx + 0x1a0]
inc cl
movzx eax, cl
cmp eax, r11d
jge 0x14020b8d5
movzx eax, cl
inc cl
mov byte [rax + rdx + 0xd8], 0
movzx eax, cl
cmp eax, r11d
jl 0x14020b8c0
test r8b, r8b
je 0x14020b8f5
mov rax, rdi
movzx edx, r8b
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x14020b8e1
mov rcx, rdi
call fcn.14020a480
test sil, sil
je 0x14020b920
sub rdi, rbx
mov rcx, rsi
nop dword [rax + rax]
movzx eax, byte [rbx + rdi]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub rcx, 1
jne 0x14020b910
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14020b930
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
lea r14, [rcx + 0x1a0]
mov qword [rsp + 0x40], rbp
mov rbx, rdx
mov qword [rsp + 0x50], r15
movzx edx, byte [r14]
mov edi, r8d
movzx r15d, r9b
mov rsi, rcx
test dl, dl
je 0x14020ba07
movzx eax, r15b
movzx r8d, dil
shl al, 3
lea r9, [rsi + rdx]
sub al, dl
mov r10, r14
movzx ecx, al
cmp ecx, edi
cmovbe r8d, ecx
xor dl, dl
test r8b, r8b
je 0x14020b9ad
nop dword [rax + rax]
movzx ecx, dl
inc dl
movzx eax, byte [rcx + rbx]
mov byte [r9 + rcx + 0xd8], al
cmp dl, r8b
jb 0x14020b990
lea r10, [rsi + 0x1a0]
add byte [r14], dl
movzx ecx, byte [r14]
mov r14, r10
movzx eax, dl
add rbx, rax
movzx eax, dl
sub edi, eax
mov eax, r15d
shl eax, 3
cmp ecx, eax
jne 0x14020ba07
lea r8, [rsi + 0x10]
test r15b, r15b
je 0x14020b9fb
mov rcx, r8
mov rdx, r15
nop dword [rax + rax]
mov rax, qword [rcx + 0xc8]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x14020b9e0
lea r14, [rsi + 0x1a0]
mov rcx, r8
call fcn.14020a480
mov byte [r14], 0
mov ebp, r15d
shl ebp, 3
cmp edi, ebp
jb 0x14020ba70
mov qword [rsp + 0x48], r12
mov r12d, ebp
nop dword [rax]
test r15b, r15b
je 0x14020ba52
mov r8, rbx
lea rax, [rsi + 0x10]
sub r8, rsi
mov rdx, r15
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rax + r8 - 0x10]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x14020ba40
lea rcx, [rsi + 0x10]
call fcn.14020a480
sub edi, ebp
add rbx, r12
cmp edi, ebp
jae 0x14020ba20
mov r12, qword [rsp + 0x48]
lea r14, [rsi + 0x1a0]
mov r15, qword [rsp + 0x50]
xor dl, dl
mov rbp, qword [rsp + 0x40]
test edi, edi
je 0x14020baab
movzx ecx, dl
inc dl
movzx eax, byte [rcx + rbx]
mov byte [rsi + rcx + 0xd8], al
movzx eax, dl
cmp eax, edi
jb 0x14020ba80
add byte [rsi + 0x1a0], dl
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
add byte [r14], dl
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14020c740
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, r8
mov rcx, rdx
mov rsi, rdx
call fcn.14013bd70
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14020c792
add rcx, 0xc8
mov r9b, 1
mov qword [rsp + 0x20], rbx
mov r8, rsi
xor edx, edx
call fcn.1401a9380
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x14020c7b2
mov rdx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.14027ed50
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x14020c7eb
add rcx, 0x550
mov qword [rsp + 0x20], rbx
mov r9b, 1
mov r8, rsi
xor edx, edx
call fcn.1401a9380
mov dl, 0x2c
mov rcx, rsi
call fcn.1401398a0
mov rcx, qword [rdi + 0x20]
add rcx, 0x570
jmp 0x14020c770
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x14020c82e
add rcx, 0xa0
call fcn.14014b850
mov rcx, qword [rdi + 0x28]
mov ebx, eax
add rcx, 0xa0
call fcn.14014b520
mov rcx, rax
mov r8, rsi
mov edx, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.1401585b0
mov rbx, qword [rsp + 0x40]
xor al, al
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140239600
Capabilities:
Encrypt data using salsa20 or chacha
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rdx
test r8, r8
je 0x140239807
lea rcx, [rdx + 0x18]
call fcn.14014b850
cmp eax, 0x20
jne 0x140239807
lea rbp, [rbx + 0x50]
mov rcx, rbp
call fcn.14014b850
cmp eax, 0xc
jb 0x140239807
lea rcx, [rbx + 0x18]
call fcn.14014b520
mov rcx, rbp
mov rbx, rax
call fcn.14014b520
mov dword [rdi], 0x61707865
mov r8, rax
mov dword [rdi + 4], 0x3320646e
mov dword [rdi + 8], 0x79622d32
mov dword [rdi + 0xc], 0x6b206574
movzx ecx, byte [rbx + 2]
movzx eax, byte [rbx]
movzx edx, byte [rbx + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [rbx + 1]
shl edx, 8
or edx, ecx
shl edx, 8
or edx, eax
mov dword [rdi + 0x10], edx
movzx eax, byte [rbx + 6]
movzx ecx, byte [rbx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 4]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x14], ecx
movzx eax, byte [rbx + 0xa]
movzx ecx, byte [rbx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 8]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x18], ecx
movzx eax, byte [rbx + 0xe]
movzx ecx, byte [rbx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x1c], ecx
movzx eax, byte [rbx + 0x12]
movzx ecx, byte [rbx + 0x13]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x20], ecx
movzx eax, byte [rbx + 0x16]
movzx ecx, byte [rbx + 0x17]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x24], ecx
movzx ecx, byte [rbx + 0x1b]
movzx eax, byte [rbx + 0x1a]
shl ecx, 8
or ecx, eax
shl ecx, 8
movzx eax, byte [rbx + 0x19]
or ecx, eax
movzx eax, byte [rbx + 0x18]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x28], ecx
movzx eax, byte [rbx + 0x1e]
movzx ecx, byte [rbx + 0x1f]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x1c]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x30], 0
mov dword [rdi + 0x2c], ecx
movzx eax, byte [r8 + 2]
movzx ecx, byte [r8 + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x34], ecx
movzx eax, byte [r8 + 6]
movzx ecx, byte [r8 + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 4]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x38], ecx
movzx eax, byte [r8 + 0xa]
movzx ecx, byte [r8 + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 8]
shl ecx, 8
or ecx, eax
mov al, 1
mov dword [rdi + 0x3c], ecx
jmp 0x140239809
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14023d5b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x1b0
mov rax, qword [0x14040f040]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rbx, rcx
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [rbx + 0x18]
cmp eax, ecx
jb 0x14023d631
cmp eax, dword [rbx + 0x28]
jb 0x14023d631
sub eax, ecx
mov ecx, eax
je 0x14023d6b3
mov r8, qword [rbx + 8]
mov eax, 1
add r8, rcx
cmove r8, rax
mov r9, qword [rbx + 0x20]
add r9, qword [rbx + 0x10]
imul rax, r9, 0x3e8
cqo
idiv r8
mov ecx, 0xffffffff
cmp rax, rcx
jg 0x14023d6b3
mov qword [rbx + 0x30], r9
mov qword [rbx + 0x38], rax
jmp 0x14023d6b3
xor edx, edx
mov r8d, 0x178
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
call fcn.14015bee0
nop
cmp byte [0x140548efe], 0
je 0x14023d688
mov eax, dword [rbx + 0x44]
cmp eax, 1
jne 0x14023d668
lea rdx, str.resetSendPerfMon
jmp 0x14023d67b
cmp eax, 2
lea rdx, str.resetReceivePerfMon
je 0x14023d67b
lea rdx, str.resetPerformanceMon
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x20]
call qword [rax + 0x30]
xor esi, esi
mov dword [rbx + 0x28], esi
mov qword [rbx + 0x20], rsi
call sub.KERNEL32.dll_GetTickCount
mov dword [rbx + 0x18], eax
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x38], rsi
lea rcx, [rsp + 0x20]
call fcn.14015bfd0
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140109210
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140240290
Capabilities:
Set socket configuration

Disassembly:
mov rcx, qword [rcx + 0x60]
test rcx, rcx
jne 0x14024029c
mov al, 1
ret
jmp fcn.1401d96e0

Function at 0x140241cb0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
cmp dword [rcx + 0x298], 2
je fcn.140243050
jmp fcn.140243160