joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800e6ca0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x120
movaps xmmword [r11 - 0x18], xmm6
mov rax, qword [0x180149040]
xor rax, rsp
mov qword [rsp + 0x100], rax
movups xmm0, xmmword [str.erWZ_]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [0x18012e750]
movups xmmword [rsp + 0x80], xmm1
movups xmm0, xmmword [0x18012e760]
movups xmmword [rsp + 0x90], xmm0
movups xmm1, xmmword [str._a_nYPc]
movups xmmword [rsp + 0xa0], xmm1
movzx eax, word [0x18012e780]
mov word [r11 - 0x78], ax
movzx eax, byte [0x18012e782]
mov byte [r11 - 0x76], al
xor ecx, ecx
cmp dword [0x180149018], 2
jl 0x1800e6e53
movdqa xmm5, xmmword [0x18012ef60]
movdqa xmm4, xmmword [0x18012f110]
movdqa xmm6, xmmword [0x18012ef80]
movdqa xmm0, xmmword [0x18012f060]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x74]
mov r8d, dword [rsp + 0x40]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x18012f040]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x18012f040]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x40
jl 0x1800e6d51
cmp ecx, 0x43
jge 0x1800e6e8c
movsxd rax, ecx
lea r8, [rsp + 0x70]
add r8, rax
nop
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, cl
sub al, dl
add al, 0x34
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x43
jl 0x1800e6e60
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800e6eb0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.180016150
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0xe0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xf0], xmm1
xor r8d, r8d
lea rdx, [0x18011f470]
lea rcx, [rsp + 0xe0]
call fcn.180016150
nop
cmp byte [0x18014ade8], 0
jne 0x1800e6f1e
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xc0]
call fcn.18002d2b0
mov rcx, rax
call fcn.180038990
jmp 0x1800e6f28
lea rcx, [rsp + 0x50]
call fcn.180036c30
mov rbx, rax
lea rcx, [rsp + 0xe0]
call fcn.18002d3d0
nop
lea rcx, [rsp + 0x50]
call fcn.18002d3d0
mov rax, rbx
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1800ed2f0
movaps xmm6, xmmword [rsp + 0x110]
add rsp, 0x120
pop rbx
ret
Function at 0x1800e7cb0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
je 0x1800e7d14
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x1800e7d02
mov r8, qword [rbx]
xor edx, edx
mov r8d, dword [r8 + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800e7cfb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x1800e7ccf
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [0x18014af40]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1800e7d24
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, ecx
mov esi, edx
imul rbx, rax, 0x38
add rbx, qword [0x18014c9d0]
mov rdx, qword [rbx]
mov cl, byte [rbx + 0x20]
mov rbp, rdx
lea rdi, [rdx - 5]
and cl, 1
je 0x1800e7d5a
mov rbp, rdi
movzx eax, cl
lea r9, [rsp + 0x40]
test cl, cl
mov r8d, 0x40
cmove rdi, rdx
lea r14, [rax*2 + 5]
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800e7d90
mov eax, 0xa
jmp 0x1800e7e1f
test esi, esi
je 0x1800e7db2
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, ebp
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x1800e7dd3
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x1800e7dd3
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x1800e7dcd
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
mov al, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x1800e7dd3
mov al, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, r14
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, sil
shl sil, 2
add al, al
xor al, byte [rbx + 0x20]
and al, 2
xor al, byte [rbx + 0x20]
xor sil, al
and sil, 4
xor sil, al
mov byte [rbx + 0x20], sil
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x1800e82b0
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x1800e82c7
cmp r8b, 0x90
je 0x1800e82c7
cmp r8b, 0xcc
jne 0x1800e82e9
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x1800e82e5
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x1800e82e9
add edx, r10d
cmp edx, r9d
jb 0x1800e82d5
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x1800e8650
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rbp - 0x58]
cmp rdi, 0x40000000
jbe 0x1800e869a
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rbx, qword [0x18014c9c8]
lea r12, [rdi + 0x40000000]
cmp qword [rbp - 0x50], r12
cmovbe r12, qword [rbp - 0x50]
sub r12, 0xfff
xor esi, esi
jmp 0x1800e86d3
cmp rbx, r14
jb 0x1800e86d0
cmp rbx, r12
jae 0x1800e86d0
cmp qword [rbx + 8], rsi
jne 0x1800e8835
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1800e86bc
mov r15, rdi
cmp rdi, r14
jb 0x1800e87ef
mov r13d, dword [rbp - 0x38]
xor edx, edx
mov rax, r15
div r13
sub r15, rdx
jmp 0x1800e871f
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800e8759
cmp dword [rbp - 0x10], 0x10000
je 0x1800e8729
mov r15, qword [rbp - 0x28]
cmp r15, r13
jb 0x1800e8759
sub r15, r13
cmp r15, r14
jae 0x1800e86f5
jmp 0x1800e8759
test r15, r15
je 0x1800e8759
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1800e87fa
cmp r15, r14
jae 0x1800e86e4
test rbx, rbx
jmp 0x1800e87ed
mov r15d, dword [rbp - 0x38]
xor edx, edx
mov rax, rdi
mov r14d, r15d
div r15
mov eax, r15d
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r12
ja 0x1800e8835
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800e8835
cmp dword [rbp - 0x10], 0x10000
je 0x1800e87c8
xor edx, edx
lea edi, [r15 - 1]
add rdi, qword [rbp - 0x18]
add rdi, qword [rbp - 0x30]
mov rax, rdi
div r14
sub rdi, rdx
cmp rdi, r12
jbe 0x1800e8785
jmp 0x1800e8835
test rdi, rdi
je 0x1800e8835
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1800e87fa
cmp rdi, r12
jbe 0x1800e8761
jmp 0x1800e8835
lea rcx, [rbx + 0x40]
mov dword [rbx + 0x10], esi
mov edx, 0x40
mov qword [rcx], rsi
mov rax, rcx
mov qword [rbx + 8], rcx
add rdx, 0x40
add rcx, 0x40
mov rsi, rax
cmp rdx, 0xfc0
jbe 0x1800e8806
mov rax, qword [0x18014c9c8]
mov qword [rbx], rax
mov qword [0x18014c9c8], rbx
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1800e90e0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.1800e9300
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x1800e91e7
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1800e9144
mov rax, qword [0x180149008]
cmp qword [rsp + 0x20], rax
ja 0x1800e9144
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1800e9106
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1800e9173
jmp 0x1800e91e7
cmp dword [rsp + 0x50], 0x10000
jne 0x1800e91ca
cmp qword [rsp + 0x48], 0x10000
jb 0x1800e91ca
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800e91b8
mov rax, qword [rsp + 0x28]
jmp 0x1800e91e9
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800e91e2
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.1800e9300
mov qword [rsp + 0x20], rax
jmp 0x1800e9106
xor eax, eax
add rsp, 0x68
ret

Function at 0x1800e91f0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.1800e9340
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x1800e92f3
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1800e924b
mov rax, qword [0x180149008]
cmp qword [rsp + 0x20], rax
ja 0x1800e924b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1800e920d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1800e927a
jmp 0x1800e92f3
cmp dword [rsp + 0x50], 0x10000
jne 0x1800e92d1
cmp qword [rsp + 0x48], 0x10000
jb 0x1800e92d1
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800e92bf
mov rax, qword [rsp + 0x28]
jmp 0x1800e92f5
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800e92ee
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.1800e9340
mov qword [rsp + 0x20], rax
jmp 0x1800e920d
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800e9390
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1800e9920
mov qword [rsp + 0x28], 0
cmp qword [0x18014a6e8], 0
jne 0x1800e93d8
cmp qword [0x18014a6e0], 0
je 0x1800e93d8
mov rax, qword [0x18014a6e0]
mov qword [0x18014a6e8], rax
cmp qword [0x18014a6e8], 0
je 0x1800e947e
mov rax, qword [0x18014a6e8]
cmp qword [rax + 0x10], 0
je 0x1800e947e
mov rax, qword [0x18014a6e8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800e947e
mov rax, qword [0x18014a6e8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800e947e
mov rax, qword [0x18014a6e8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x1800e9444
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x1800e944b
xor eax, eax
jmp 0x1800e95f9
mov rax, qword [0x18014a6e8]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x1800e95f9
mov rax, qword [0x18014a6e0]
mov qword [0x18014a6e8], rax
jmp 0x1800e94a0
mov rax, qword [0x18014a6e8]
mov rax, qword [rax + 8]
mov qword [0x18014a6e8], rax
cmp qword [0x18014a6e8], 0
je 0x1800e94ed
cmp qword [0x18014a6e8], 0
je 0x1800e94eb
mov rax, qword [0x18014a6e8]
cmp qword [rax + 0x10], 0
je 0x1800e94eb
mov rax, qword [0x18014a6e8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800e94eb
mov rax, qword [0x18014a6e8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800e94eb
jmp 0x1800e941c
jmp 0x1800e948e
mov rcx, qword [rsp + 0x60]
call fcn.1800eb550
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1800e9600
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1800e95f7
mov rax, qword [rsp + 0x48]
mov qword [0x18014a6e8], rax
mov rax, qword [0x18014a6e8]
mov dword [rax], 0x52727464
mov rax, qword [0x18014a6e8]
mov qword [rax + 0x10], 0
mov rax, qword [0x18014a6e8]
mov rcx, qword [0x18014a6e0]
mov qword [rax + 8], rcx
mov rax, qword [0x18014a6e8]
mov qword [0x18014a6e0], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x18014a6e8]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x1800e95a8
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x1800e95e2
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x1800e959e
mov rax, qword [0x18014a6e8]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x1800e941c
xor eax, eax
add rsp, 0x58
ret
Function at 0x1800ecfe0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1800ed01a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1800ed01f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800ed068
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1800f7ef0]
cmp byte [rcx + rax], 0
je 0x1800ed068
dec r8
sub rdx, 1
jne 0x1800ed04e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1400627d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
cmp byte [rdx + 0x4a], 0
je 0x1400627f3
xor eax, eax
nop dword [rax]
lea ecx, [rax + 0x6e]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0x49
jb 0x1400627e0
mov byte [rdx + 0x4a], 0
lea rcx, [0x140328b30]
call fcn.14006ab10
lea rax, [0x140328b30]
add rsp, 0x28
ret
Function at 0x140064fa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140320680]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x38], rdx
xor r14d, r14d
call fcn.1400960b0
mov rsi, rax
xorps xmm0, xmm0
test rax, rax
jne 0x14006507c
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
mov r8d, 4
lea rdx, str.null
mov rcx, rdi
call fcn.14006b9e0
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140065046
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140065041
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140065184
mov rcx, r8
call fcn.140214300
mov rax, rdi
mov byte [rbx], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbx + 0x10], r14
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1402142e0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
movups xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x1402f7190]
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0x30], 0
mov word [rbp - 0x45], Ordinal_50
movdqa xmm0, xmmword [0x1402f7250]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0x2f6e6977
mov dword [rbp - 0x4c], 0x2f697061
mov word [rbp - 0x48], 0x2e31
mov byte [rbp - 0x46], Ordinal_50
mov byte [rbp - 0x43], 0
lea r8, [rbp - 0x60]
mov edx, 0x2712
mov rcx, rsi
call fcn.14009a140
xor r8d, r8d
mov edx, 0x40
mov rcx, rsi
call fcn.14009a140
xor r8d, r8d
mov edx, 0x51
mov rcx, rsi
call fcn.14009a140
mov r8, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400650fe
mov r8, qword [rbx]
mov edx, 0x271f
mov rcx, rsi
call fcn.14009a140
lea r8, [0x140064f70]
mov edx, 0x4e2b
mov rcx, rsi
call fcn.14009a140
lea r8, [rbp - 0x30]
mov edx, 0x2711
mov rcx, rsi
call fcn.14009a140
mov rcx, rsi
call fcn.140096180
test eax, eax
je 0x140065157
mov ecx, eax
call fcn.1400971e0
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rsi
call fcn.140096090
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rdi + 0x10], xmm1
movdqa xmm0, xmmword [0x1402f7190]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
jmp 0x14006500c
call fcn.1402285c0
int3
Function at 0x1400a0090
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x140320680]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r13, qword [rcx]
mov ebp, r8d
mov rsi, rcx
lea r8, [rsp + 0x20]
mov ebx, 2
xor r14d, r14d
mov ecx, ebx
mov r15, r9
mov r12, qword [r13 + 0x11b0]
mov rdi, rdx
mov dword [r9], r14d
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400a00fc
mov r9d, ebp
lea rdx, [rsp + 0x20]
mov r8, rdi
mov ecx, ebx
call fcn.1400bed70
jmp 0x1400a01da
mov ebx, reloc.WS2_32.dll_socket
lea r8, [rsp + 0x58]
mov ecx, ebx
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400a012c
mov r9d, ebp
lea rdx, [rsp + 0x58]
mov r8, rdi
mov ecx, ebx
call fcn.1400bed70
jmp 0x1400a01da
mov ecx, dword [rsi + 0x440]
sub ecx, 1
je 0x1400a0150
cmp ecx, 1
je 0x1400a013f
mov ebx, r14d
call fcn.1400a0bc0
test al, al
mov eax, 2
cmove ebx, eax
jmp 0x1400a0155
mov ebx, 2
cmp dword [rsi + 0xbc], 3
lea r8, [0x14025d904]
xorps xmm0, xmm0
lea rcx, [rsp + 0x68]
movups xmmword [rsp + 0x28], xmm0
setne r14b
mov dword [rsp + 0x2c], ebx
inc r14d
mov r9d, ebp
mov edx, ntohl
mov dword [rsp + 0x30], r14d
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.1400b0080
lea rcx, [rsp + 0x58]
call fcn.14009ff20
lea r9, [rsp + 0x28]
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
movups xmm0, xmmword [rax]
movups xmmword [r12], xmm0
call fcn.1400a0820
test al, al
je 0x1400a01c9
mov dword [r15], 1
jmp 0x1400a01d8
lea rdx, str.getaddrinfo___thread_failed_to_start_n
mov rcx, r13
call fcn.1400ac140
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1402142e0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x1400a0090
Function at 0x1400af950
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [0x140325340], 0
mov esi, r8d
mov rdi, qword [rsp + 0x68]
je 0x1400af9ff
test rdi, rdi
je 0x1400af9ff
mov eax, dword [0x140325344]
test eax, eax
jne 0x1400af9f7
mov r8d, dword [rsp + 0x60]
lea rsi, str.recv
mov r9, rsi
lea rcx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rdx, rdi
call fcn.1400af6a0
mov ecx, 2
call fcn.140230d74
mov r9d, dword [rsp + 0x60]
lea rdx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r8, rdi
call fcn.1400b0050
mov rcx, qword [0x140325338]
call fcn.1402368ac
call fcn.1402288b4
mov dword [rax], ntohl
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
dec eax
mov dword [0x140325344], eax
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test rdi, rdi
je 0x1400afa27
mov r8d, dword [rsp + 0x60]
lea rcx, str.RECV__s:_d_recv__lu____ld_n
mov r9d, esi
mov dword [rsp + 0x20], eax
mov rdx, rdi
call fcn.1400af6a0
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400afaa0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [0x140325340], 0
mov esi, r8d
mov rdi, qword [rsp + 0x68]
je 0x1400afb4f
test rdi, rdi
je 0x1400afb4f
mov eax, dword [0x140325344]
test eax, eax
jne 0x1400afb47
mov r8d, dword [rsp + 0x60]
lea rsi, str.send
mov r9, rsi
lea rcx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rdx, rdi
call fcn.1400af6a0
mov ecx, 2
call fcn.140230d74
mov r9d, dword [rsp + 0x60]
lea rdx, str.LIMIT__s:_d__s_reached_memlimit_n
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r8, rdi
call fcn.1400b0050
mov rcx, qword [0x140325338]
call fcn.1402368ac
call fcn.1402288b4
mov dword [rax], ntohl
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
dec eax
mov dword [0x140325344], eax
call qword [sym.imp.WS2_32.dll_send]
mov ebx, eax
test rdi, rdi
je 0x1400afb77
mov r8d, dword [rsp + 0x60]
lea rcx, str.SEND__s:_d_send__lu____ld_n
mov r9d, esi
mov dword [rsp + 0x20], eax
mov rdx, rdi
call fcn.1400af6a0
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400bf0f0
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x140320680]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r13, qword [rcx]
mov ebp, r8d
mov rsi, rcx
lea r8, [rsp + 0x20]
mov ebx, 2
xor r14d, r14d
mov ecx, ebx
mov r15, r9
mov r12, qword [r13 + 0x11b0]
mov rdi, rdx
mov dword [r9], r14d
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400a00fc
mov r9d, ebp
lea rdx, [rsp + 0x20]
mov r8, rdi
mov ecx, ebx
call fcn.1400bed70
jmp 0x1400a01da
mov ebx, reloc.WS2_32.dll_socket
lea r8, [rsp + 0x58]
mov ecx, ebx
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400a012c
mov r9d, ebp
lea rdx, [rsp + 0x58]
mov r8, rdi
mov ecx, ebx
call fcn.1400bed70
jmp 0x1400a01da
mov ecx, dword [rsi + 0x440]
sub ecx, 1
je 0x1400a0150
cmp ecx, 1
je 0x1400a013f
mov ebx, r14d
call fcn.1400a0bc0
test al, al
mov eax, 2
cmove ebx, eax
jmp 0x1400a0155
mov ebx, 2
cmp dword [rsi + 0xbc], 3
lea r8, [0x14025d904]
xorps xmm0, xmm0
lea rcx, [rsp + 0x68]
movups xmmword [rsp + 0x28], xmm0
setne r14b
mov dword [rsp + 0x2c], ebx
inc r14d
mov r9d, ebp
mov edx, ntohl
mov dword [rsp + 0x30], r14d
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.1400b0080
lea rcx, [rsp + 0x58]
call fcn.14009ff20
lea r9, [rsp + 0x28]
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
movups xmm0, xmmword [rax]
movups xmmword [r12], xmm0
call fcn.1400a0820
test al, al
je 0x1400a01c9
mov dword [r15], 1
jmp 0x1400a01d8
lea rdx, str.getaddrinfo___thread_failed_to_start_n
mov rcx, r13
call fcn.1400ac140
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1402142e0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x1400a0090