joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140061880
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x140101db4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
xor edx, edx
mov word [rcx + rax], dx
add rsp, 0x38
ret

Function at 0x1400618c0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x140101db4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x40]
shl eax, 1
cdqe
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x140061c10
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov r8d, 0x18
xor edx, edx
mov rcx, qword [0x14010be60]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x20], rax
mov r8d, reloc.WS2_32.dll_recv
xor edx, edx
mov rcx, qword [0x14010be60]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], reloc.WS2_32.dll_recv
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x10], 0
mov rdx, qword [rsp + 0x20]
mov ecx, dword [0x140101db4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret
Function at 0x140067060
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push r12
sub rsp, 0x48
xor ebx, ebx
mov r12d, edx
mov ebp, 1
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov edx, 0x80000000
mov r8d, ebp
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140067239
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x70], rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0xffffffff
je 0x1400670ec
test eax, eax
jle 0x1400670ec
mov rdx, qword [0x14010c700]
lea r9, [rsp + 0x80]
mov r8d, eax
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400670ec
cmp dword [rsp + 0x80], edi
cmove ebx, ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140067234
mov rdx, qword [0x14010c700]
mov rax, rdx
cmp dword [rdx], 0x50555245
jne 0x140067234
mov esi, dword [rdx + 8]
add rax, 0xc
lea ecx, [rsi - 0x52455331]
cmp ecx, 8
ja 0x140067234
lea ecx, [rdi - 8]
mov qword [rsp + 0x40], r15
movsxd r15, ecx
lea rcx, [r15 + rdx]
cmp rax, rcx
jae 0x14006722f
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x88], r14
lea r13, [0x140067350]
nop word [rax + rax]
cmp dword [rax], 0x434e5354
movsxd rdi, dword [rax + 4]
lea r14, [rax + 8]
jne 0x14006720b
test edi, edi
jle 0x14006720b
mov rcx, qword [0x1401058d4]
lea r8, [rdi + 0x28]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x14006720b
lea rcx, [rax + 0x28]
mov r8, rdi
mov rdx, r14
mov dword [rax + 0x10], edi
mov dword [rax + 0x14], r12d
mov qword [rax + 8], rcx
call sub.msvcrt.dll_memcpy
cmp esi, 0x52455331
je 0x1400671e4
jle 0x1400671fa
cmp esi, 0x52455333
jle 0x1400671d0
mov qword [rbx + 0x18], r13
lea rax, [0x140069de0]
jmp 0x1400671f6
lea rax, [0x140067260]
mov qword [rbx + 0x18], rax
lea rax, [0x140069db0]
jmp 0x1400671f6
lea rax, [0x140067250]
mov qword [rbx + 0x18], rax
lea rax, [0x140069da0]
mov qword [rbx + 0x20], rax
mov rax, qword [0x140107200]
mov qword [0x140107200], rbx
mov qword [rbx], rax
mov rdx, qword [0x14010c700]
lea rax, [r14 + rdi]
add rdx, r15
cmp rax, rdx
jb 0x140067160
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x78]
mov r15, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x70]
add rsp, 0x48
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x14006a0d0
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x20
mov rcx, qword [0x14010be80]
call fcn.14005ef84
cmp dword [reloc.WS2_32.dll_accept], 0
mov rdi, qword [rax]
je 0x14006a147
cmp qword [0x14010bea0], rdi
jne 0x14006a147
cmp dword [0x140107404], 0
je 0x14006a147
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x140107408]
mov qword [rsp + 0x38], rsi
xor esi, esi
test rbx, rbx
je 0x14006a137
cmp rbx, rdi
je 0x14006a12c
cmp dword [rbx + 0x38], esi
jne 0x14006a12c
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [rbx + 0x38], esi
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14006a118
mov rbx, qword [rsp + 0x30]
mov dword [0x140107404], esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14006a150
Capabilities:
Check for time delay via gettickcount
Suspend thread

Disassembly:
push rsi
sub rsp, 0x20
mov rcx, qword [0x14010be80]
call fcn.14005ef84
cmp dword [reloc.WS2_32.dll_accept], 0
mov rsi, qword [rax]
je 0x14006a290
cmp dword [0x140107404], 0
jne 0x14006a290
lea rcx, [0x140107410]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x140106bc4], 0
je 0x14006a1c6
lea rcx, [0x14010c760]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x14011cbc0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x14010bee0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x14011cba0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [0x14010bea0], rsi
mov dword [0x140107404], 1
call qword [sym.imp.USER32.dll_PostThreadMessageA]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rbx, qword [0x140107408]
lea edi, [rax + 0xc8]
test rbx, rbx
je 0x14006a243
cmp rbx, rsi
je 0x14006a23b
cmp dword [rbx + 0x38], 0
jne 0x14006a23b
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jae 0x14006a22b
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rbx + 0x38], 0
je 0x14006a210
cmp dword [rbx + 0x38], 0
jne 0x14006a23b
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14006a203
cmp dword [0x140106bc4], 0
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
je 0x14006a27d
lea rcx, [0x14010bee0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x14011cbc0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x14010c760]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x140107410]
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add rsp, 0x20
pop rsi
ret
Function at 0x14006ee10
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x40
call fcn.14006ec20
call fcn.14006a150
xor ecx, ecx
call fcn.14006f0d0
test eax, eax
jne 0x14006ee20
mov rbx, qword [0x140106be0]
test rbx, rbx
je 0x14006ef00
cmp dword [0x140106be8], eax
je 0x14006ef00
cmp dword [0x140107440], 0
mov eax, dword [0x140106bd4]
mov dword [rsp + 0x20], 0x23
lea eax, [rax*4]
mov dword [rsp + 0x24], eax
je 0x14006eecb
mov rcx, qword [0x14010c700]
movsxd r8, eax
mov rdx, rbx
call sub.msvcrt.dll_memcpy
xor r9d, r9d
cmp dword [0x140106bd4], r9d
jle 0x14006eec4
xor r8d, r8d
nop word [rax + rax]
mov rdx, qword [0x14010c700]
inc r9d
add rdx, r8
add r8, 4
movzx ecx, byte [rdx]
movzx eax, byte [rdx + 3]
mov byte [rdx], al
movzx eax, byte [rdx + 2]
mov byte [rdx + 3], cl
movzx ecx, byte [rdx + 1]
mov byte [rdx + 1], al
mov byte [rdx + 2], cl
cmp r9d, dword [0x140106bd4]
jl 0x14006ee90
mov rbx, qword [0x14010c700]
call fcn.1400801b0
lea rcx, [0x14011cbc0]
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x140107468]
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [rax + 0x18]
lea rcx, [0x14011cbc0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rsp + 0x20], 1
call fcn.1400801b0
lea rcx, [0x14011cbc0]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x24], 0
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x140107468]
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [rax + 0x18]
lea rcx, [0x14011cbc0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [0x140107468]
call qword [rax + 0x28]
lea rcx, [0x14010bee0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x14011cbc0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x14010c760]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x140107458]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x140107458]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140107460]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x140107460]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14010bee0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x14011cbc0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x14010c760]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x14010bee0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x14011cbc0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [0x14010c760]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
add rsp, 0x40
pop rbx
ret
Function at 0x140071ab0
Capabilities:
Hash data with crc32

Disassembly:
xor ecx, ecx
lea rdx, [0x140107470]
nop dword [rax]
mov eax, ecx
shr eax, 1
test cl, 1
je 0x140071ace
xor eax, 0xedb88320
test al, 1
je 0x140071adb
shr eax, 1
xor eax, 0xedb88320
jmp 0x140071add
shr eax, 1
test al, 1
je 0x140071aea
shr eax, 1
xor eax, 0xedb88320
jmp 0x140071aec
shr eax, 1
test al, 1
je 0x140071af9
shr eax, 1
xor eax, 0xedb88320
jmp 0x140071afb
shr eax, 1
test al, 1
je 0x140071b08
shr eax, 1
xor eax, 0xedb88320
jmp 0x140071b0a
shr eax, 1
test al, 1
je 0x140071b17
shr eax, 1
xor eax, 0xedb88320
jmp 0x140071b19
shr eax, 1
test al, 1
je 0x140071b26
shr eax, 1
xor eax, 0xedb88320
jmp 0x140071b28
shr eax, 1
test al, 1
je 0x140071b35
shr eax, 1
xor eax, 0xedb88320
jmp 0x140071b37
shr eax, 1
inc ecx
mov dword [rdx], eax
add rdx, 4
cmp ecx, 0x100
jl 0x140071ac0
ret

Function at 0x1400733a0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x110
mov rsi, rdx
lea rdx, [rsp + 0x40]
mov rbp, r8
mov rdi, rcx
xor ebx, ebx
call fcn.140073bd0
test eax, eax
je 0x140073499
lea rdx, [rsp + 0x40]
mov rcx, rsi
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x140073499
lea rdx, [rsp + 0xa4]
mov rcx, rbp
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x140073499
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rdi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140073499
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140073490
test eax, eax
jle 0x140073490
lea ecx, [rdi + 1]
movsxd rcx, ecx
call sub.msvcrt.dll_malloc
mov rsi, rax
test rax, rax
je 0x140073490
lea r9, [rsp + 0x138]
mov r8d, edi
mov rdx, rax
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140073490
cmp dword [rsp + 0x138], edi
jne 0x140073490
mov rcx, rsi
mov byte [rdi + rsi], bl
call fcn.1400738b0
mov ebx, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x110]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140073ef0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x270
lea r9, [rsp + 0x20]
xor edi, edi
mov rbp, r8
sub r9, rcx
nop dword [rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [r9 + rcx - 1], al
test al, al
jne 0x140073f20
lea rcx, [rsp + 0x20]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], dil
lea rcx, [rcx + 1]
jne 0x140073f40
movzx eax, word [0x1400d28b4]
mov word [rcx], ax
lea rcx, [rsp + 0x20]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], dil
jne 0x140073f60
lea rbx, [rsp + 0x20]
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
add rbx, rax
mov eax, 0x2a
mov word [rbx], ax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140074072
lea rax, [rsp + 0x15c]
sub rbx, rax
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x15c]
nop dword [rax + rax]
movzx ecx, byte [rax]
lea rax, [rax + 1]
mov byte [rbx + rax - 1], cl
test cl, cl
jne 0x140073fc0
test byte [rsp + 0x130], 0x10
je 0x140074030
movzx edx, byte [rsp + 0x15c]
movzx ecx, byte [rsp + 0x15d]
cmp dl, byte [0x1400d28b8]
jne 0x140074009
cmp cl, byte [0x1400d28b9]
jne 0x140074009
movzx eax, byte [rsp + 0x15e]
cmp al, byte [0x1400d28ba]
je 0x140074049
cmp dl, byte [0x1400d24b4]
jne 0x140074019
cmp cl, byte [0x1400d24b5]
je 0x140074049
mov rdx, qword [rsp + 0x288]
lea rcx, [rsp + 0x20]
mov r8, rbp
call fcn.140073ef0
jmp 0x140074045
mov rdx, qword [rsp + 0x288]
lea rcx, [rsp + 0x20]
mov r8, rbp
call fcn.1400733a0
test eax, eax
jne 0x140074064
lea rdx, [rsp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140073fb0
jmp 0x140074069
mov edi, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r11, [rsp + 0x270]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14007a110
Capabilities:
Set console window title

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_AllocConsole]
lea rcx, str.PureBasic_Console_Debugger__press_CtrlC_to_stop_program_
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov eax, 0x1f4
mov ecx, 0xfffffff5
mov word [rsp + 0x22], ax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, dword [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0x4000
mov rcx, rax
call sub.msvcrt.dll__open_osfhandle
lea rdx, [0x1400d2880]
mov ecx, eax
call sub.msvcrt.dll__fdopen
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 4]
mov rcx, rax
mov qword [0x1401078b0], rax
call sub.msvcrt.dll_setvbuf
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0x4000
mov rcx, rax
call sub.msvcrt.dll__open_osfhandle
lea rdx, [0x1400d5350]
mov ecx, eax
call sub.msvcrt.dll__fdopen
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 4]
mov rcx, rax
mov qword [0x1401078b8], rax
call sub.msvcrt.dll_setvbuf
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0x4000
mov rcx, rax
call sub.msvcrt.dll__open_osfhandle
lea rdx, [0x1400d5350]
mov ecx, eax
call sub.msvcrt.dll__fdopen
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 4]
mov rcx, rax
mov qword [0x1401078c0], rax
call sub.msvcrt.dll_setvbuf
mov rax, qword [0x1401078b8]
mov qword [0x14011c1c0], rax
call fcn.1400762a0
add rsp, 0x48
ret
Function at 0x140082220
Capabilities:
Encode data using xor
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xc0
mov edi, 1
lea rcx, [rsp + 0xd0]
xor r8d, r8d
xor edx, edx
mov r9d, edi
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
xor ebx, ebx
test eax, eax
je 0x140082285
mov rcx, qword [rsp + 0xd0]
lea r8, [rsp + 0x30]
lea edx, [rdi + 0x1f]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0xd0]
test eax, eax
cmovne edi, ebx
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test edi, edi
je 0x1400822f1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x30], eax
call fcn.1400801b0
mov rcx, rbx
movups xmm0, xmmword [0x140102fc0]
mov dword [rsp + 0x34], eax
mov eax, dword [0x14010add8]
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], eax
movzx eax, byte [rsp + rcx + 0x30]
add rcx, 6
xor byte [rsp + rcx + 0x2b], al
movzx eax, byte [rsp + rcx + 0x2b]
xor byte [rsp + rcx + 0x2c], al
movzx eax, byte [rsp + rcx + 0x2c]
xor byte [rsp + rcx + 0x2d], al
movzx eax, byte [rsp + rcx + 0x2d]
xor byte [rsp + rcx + 0x2e], al
movzx eax, byte [rsp + rcx + 0x2e]
xor byte [rsp + rcx + 0x2f], al
movzx eax, byte [rsp + rcx + 0x2f]
xor byte [rsp + rcx + 0x30], al
cmp rcx, 0x1e
jl 0x1400822b1
lea rcx, [rsp + 0x60]
call fcn.1400c0f58
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
mov r8d, 0x20
call fcn.1400c17e8
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.1400c0e7c
lea rdx, [0x140000000]
nop word [rax + rax]
movzx ecx, byte [rsp + rbx + 0x50]
inc rbx
mov eax, ecx
and ecx, 0xf
shr rax, 4
movzx eax, byte [rax + rdx + 0xd83d8]
mov byte [rdx + rbx*2 + 0x10b016], al
movzx eax, byte [rcx + rdx + 0xd83d8]
mov byte [rdx + rbx*2 + 0x10b017], al
cmp rbx, 0x10
jl 0x140082330
lea r8, [0x14010b0a8]
lea rdx, [rsp + 0x30]
lea rcx, [0x14010ae30]
mov r9d, 0x20
call fcn.1400c3240
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rdi
ret
Function at 0x140082ee0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov edi, edx
mov rbp, rcx
test edx, edx
jle 0x140082f3b
nop
mov rcx, qword [0x14010adf8]
mov r8d, edi
movsxd rdx, ebx
sub r8d, ebx
add rdx, rbp
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov esi, eax
cmp eax, 0xffffffff
jne 0x140082f35
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd8bb
test eax, 0xfffffffa
je 0x140082f55
add ebx, esi
cmp ebx, edi
jl 0x140082f00
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor eax, eax
jmp 0x140082f40
Function at 0x14008d840
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
test rcx, rcx
je 0x14008d94d
mov rdx, rcx
lea r8, [rsp + 0x50]
mov ecx, 2
call fcn.1400a9f80
test eax, eax
jne 0x14008d94d
lea r8, [rsp + 0x20]
lea ecx, [rax + 0x17]
mov rdx, rbx
call fcn.1400a9f80
test eax, eax
jne 0x14008d94d
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r14
xor r14d, r14d
or rdi, 0xffffffffffffffff
mov esi, r14d
inc rdi
cmp byte [rbx + rdi], sil
jne 0x14008d8a2
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.1400a9eb0
test rax, rax
je 0x14008d8e7
sub rax, rbx
mov edx, 0x2e
mov rcx, rbx
mov r8, rax
call fcn.1400a9eb0
mov rsi, rax
test rax, rax
je 0x14008d8e7
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rax, [rdi + rbx]
mov edi, 0x1505
mov rbp, rax
sub rbp, rbx
cmp rbx, rax
cmova rbp, r14
mov r14, qword [rsp + 0x30]
test rbp, rbp
je 0x14008d934
mov rsi, rbx
neg rsi
movzx ecx, byte [rbx]
call fcn.14009bac0
lea rbx, [rbx + 1]
imul rdi, rdi, 0x21
movsx rcx, al
lea rax, [rsi + rbx]
xor rdi, rcx
cmp rax, rbp
jb 0x14008d914
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
movzx eax, dil
mov rdi, qword [rsp + 0x38]
add rsp, 0x40
pop rbx
ret
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x140090900
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.kernel32
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x14009092a
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.LoadLibraryExA
mov rcx, rax
mov qword [rsp + 0x48], r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1400d9808]
mov rcx, rbx
mov r14, rax
call qword [sym.imp.msvcrt.dll_strpbrk]
test rax, rax
je 0x14009098e
mov rcx, rbx
test r14, r14
je 0x140090978
xor edx, edx
lea r8d, [rdx + 8]
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test r14, r14
je 0x1400909c6
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400909c6
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x50], r15
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x140090a89
mov qword [rsp + 0x40], rsi
or rsi, 0xffffffffffffffff
mov rdx, rsi
nop dword [rax]
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x1400909f0
lea ecx, [rax + 1]
add rcx, rdx
call qword [sub.msvcrt.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140090a7b
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x140090a7b
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x140090a20
mov ecx, 0x5c
mov word [rax + rdi], cx
cmp byte [rdi + rsi + 1], bpl
lea rsi, [rsi + 1]
jne 0x140090a34
lea rcx, [rsi + rdi]
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
lea rbx, [rbx + 1]
mov byte [rcx + rbx - 1], al
test al, al
jne 0x140090a50
mov rcx, rdi
test r14, r14
je 0x140090a72
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x140090a78
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [sub.msvcrt.dll_free]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x48]
mov rax, rbp
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x140090c50
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x268
test cl, 2
je 0x140090c9a
lea rdx, [rsp + 0xc0]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140090c8d
movzx eax, word [rsp + 0xc0]
cmp al, 2
jne 0x140090c87
shr ax, 8
cmp al, 2
je 0x140090c9a
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
add rsp, 0x268
ret
call fcn.1400adc10
test eax, eax
jne 0x140090da1
lea rcx, [0x1400d97c8]
call fcn.140090900
mov qword [0x14010b5c8], rax
test rax, rax
je 0x140090ce4
lea rdx, str.if_nametoindex
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14010b5c0]
test rax, rax
cmovne rcx, rax
mov qword [0x14010b5c0], rcx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x9c
call sub.msvcrt.dll_memset
mov r8b, 3
mov edx, 2
xor ecx, ecx
mov dword [rsp + 0x20], 0x9c
mov qword [rsp + 0x24], 6
mov dword [rsp + 0x30], 2
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
mov rcx, rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 1
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea rcx, [rsp + 0x20]
mov edx, gethostbyname
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
je 0x140090d98
lea rcx, [0x140123360]
mov byte [0x140123380], 1
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
add rsp, 0x268
ret
mov byte [0x140123380], 0
xor eax, eax
add rsp, 0x268
ret

Function at 0x1400910c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x14009111e
mov dl, 1
call fcn.1400927e0
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov edx, ebx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.1400927e0
mov eax, ebx
jmp 0x140091162
cmp ebx, 2
ja 0x140091160
mov r9, qword [rdi + 0x668]
lea rdx, [0x1400d98a8]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.msvcrt.dll_fwrite]
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_fwrite]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret