joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400efd20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx + 0x190]
mov r10, rcx
mov dword [rcx + 0x7c], edx
movsxd rax, edx
imul rbx, rax, 0x68
add rbx, qword [rcx + 0x18]
test dword [rbx], 0x10000
movss xmm0, dword [rbx + 0x34]
je 0x1400efd5c
addss xmm0, dword [rcx + 0x94]
lea rsi, [r9 + 0xe0]
movss dword [rsi], xmm0
movss xmm1, dword [rcx + 0xc8]
addss xmm1, dword [rcx + 0x84]
movss dword [r9 + 0xf8], xmm0
subss xmm0, dword [r9 + 0x10]
movss dword [r9 + 0xe4], xmm1
subss xmm0, dword [r9 + 0x120]
movss dword [r9 + 0x124], xmm0
mov eax, dword [rcx + 0x90]
mov dword [r9 + 0x118], eax
movsx eax, byte [rbx + 0x62]
mov dword [r9 + 0x134], eax
movss dword [r9 + 0x1fc], xmm1
mov eax, dword [rbx + 0x34]
mov dword [r9 + 0x1f8], eax
mov eax, dword [rbx + 0x38]
mov dword [r9 + 0x200], eax
mov eax, dword [rbx + 0x3c]
mov dword [r9 + 0x19c], eax
cmp byte [rbx + 0x5a], 0
jne 0x1400efdf7
maxss xmm1, dword [rcx + 0x88]
movss dword [r9 + 0xe4], xmm1
movzx eax, byte [rbx + 0x60]
mov byte [r9 + 0x9b], al
cmp byte [rbx + 0x60], 0
je 0x1400efe1d
mov rax, qword [0x1402e3670]
xor ecx, ecx
mov dword [rax + 0x3ef8], ecx
mov dword [rax + 0x3f00], ecx
test dword [r10 + 4], 0x100000
je 0x1400efe2f
mov r8d, 2
jmp 0x1400efea5
movups xmm0, xmmword [rbx + 0x20]
mov rax, qword [r9 + 0x278]
movss xmm1, dword [rbx + 0x20]
movss xmm2, dword [rbx + 0x24]
movss xmm3, dword [rbx + 0x28]
movss xmm4, dword [rbx + 0x2c]
movups xmmword [r9 + 0x218], xmm0
movss dword [rax + 0x88], xmm1
movss dword [rax + 0x8c], xmm2
movss dword [rax + 0x90], xmm3
movss dword [rax + 0x94], xmm4
mov rax, qword [r9 + 0x278]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movss dword [rcx + rdx*8 - 0x10], xmm1
movss dword [rcx + rdx*8 - 0xc], xmm2
movss dword [rcx + rdx*8 - 8], xmm3
movss dword [rcx + rdx*8 - 4], xmm4
movzx r8d, byte [rbx + 0x57]
mov rdx, qword [r9 + 0x278]
mov rcx, qword [r10 + 0x1a8]
call fcn.1400c37e0
mov rdi, qword [0x1402e3670]
cmp byte [rdi + 0x5b5c], 0
je 0x1400efeea
cmp byte [rbx + 0x60], 0
jne 0x1400efeea
xor r8d, r8d
lea rdx, [0x1402acdd0]
mov rcx, rsi
call fcn.1400debf0
mov dword [rdi + 0x5b90], 0x7f7fffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400f1360
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [0x1402e3670]
mov rdx, qword [rax + 0x4290]
cmp ecx, 0xffffffff
jne 0x1400f137a
cmp dword [rdx + 0x7c], ecx
cmovne ecx, dword [rdx + 0x7c]
cmp ecx, dword [rdx + 0x74]
mov eax, 0xffffffff
cmove ecx, eax
test byte [rdx + 4], 7
je 0x1400f13f7
mov r10d, dword [rdx]
lea r8, [0x1402acdc1]
movzx eax, word [rdx + 0x80]
lea r11, [0x14026ed80]
not r10d
mov byte [rdx + 0x1f0], cl
mov ecx, r10d
mov byte [rdx + 0x1fe], 1
mov word [rdx + 0x82], ax
mov r9b, 0x23
cmp r9b, 0x23
jne 0x1400f13d3
cmp byte [r8], r9b
jne 0x1400f13d3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400f13c0
not ecx
jmp fcn.1400da100
ret
Function at 0x1400f8b00
Capabilities:
Initialize winsock library

Disassembly:
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1402e1040]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov eax, dword [0x1402e37a4]
mov edi, ecx
mov r8d, eax
inc eax
mov dword [0x1402e37a4], eax
test r8d, r8d
je 0x1400f8b3a
xor eax, eax
jmp 0x1400f8bec
test dl, dl
je 0x1400f8b92
mov rax, qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc], rax
mov rax, qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x1402e1138], rax
mov rax, qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov qword [case.0x140161b02.2], rax
mov rax, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov qword [case.0x140115757.0], rax
mov rax, qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [case.0x140161b02.3], rax
mov rax, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup]
mov qword [case.0x140115757.1], rax
cmp byte [0x1402e37a9], 0
jne 0x1400f8bb0
mov rax, qword [0x1402e1208]
mov byte [0x1402e37a9], 1
call qword [rax + 0x20]
test eax, eax
je 0x1400f8be1
test dil, 2
je 0x1400f8c05
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400f8be1
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x1400f8bdb
shr ax, 8
cmp al, 2
je 0x1400f8c05
call qword [sym.imp.WS2_32.dll_WSACleanup]
dec dword [0x1402e37a4]
mov eax, 2
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140171bd0
add rsp, 0x1e0
pop rdi
ret
call fcn.14012cc80
test eax, eax
jne 0x1400f8be1
lea rcx, str.iphlpapi.dll
mov qword [rsp + 0x1f0], rbx
call fcn.140104280
mov qword [0x1402e37b0], rax
test rax, rax
je 0x1400f8c3e
lea rdx, str.if_nametoindex
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ws2_32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x1400f8c98
lea rdx, str.FreeAddrInfoExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetAddrInfoExCancel
mov rcx, rbx
mov qword [0x1402e3680], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetAddrInfoExW
mov rcx, rbx
mov qword [0x1402e3690], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402e3688], rax
xor r8d, r8d
mov dword [rsp + 0x20], 3
xor edx, edx
mov ecx, 6
call fcn.14012ce90
test al, al
mov dword [rsp + 0x20], 3
mov edx, 2
mov ecx, 6
setne byte [0x1402e3f79]
xor r8d, r8d
call fcn.14012ce90
test al, al
lea rcx, [0x1402e3f70]
setne byte [0x1402e3f78]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rbx, qword [rsp + 0x1f0]
xor eax, eax
mov dword [0x1402e37a0], edi
jmp 0x1400f8bec
Function at 0x140101ae0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x1402e1040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rdx
mov edx, Ordinal_46
mov rsi, r8
mov rbp, rcx
test r8, r8
je 0x140101bcb
xor r14d, r14d
nop dword [rax + rax]
mov rax, qword [0x1402e1208]
lea rdx, [rsp + 0x20]
mov edi, 4
mov r8d, 4
cmp rsi, rdi
mov rcx, rbp
cmovb rdi, rsi
call qword [rax + 0x50]
mov edx, eax
cmp eax, 4
jne 0x140101b76
cmp byte [0x1402e37a8], r14b
jne 0x140101b80
mov r9d, 2
mov dword [rsp + 0x20], r14d
mov r8d, eax
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
neg eax
sbb edx, edx
and edx, 2
test edx, edx
jne 0x140101bcb
mov eax, dword [rsp + 0x20]
jmp 0x140101b9f
imul eax, dword [0x1402e37ac], 0x41c64e6d
mov edx, r14d
add eax, 0x3039
mov dword [0x1402e37ac], eax
ror eax, 0x10
mov dword [rsp + 0x20], eax
test rdi, rdi
je 0x140101bc2
sub rsi, rdi
nop word [rax + rax]
mov byte [rbx], al
inc rbx
shr eax, 8
sub rdi, 1
jne 0x140101bb0
mov dword [rsp + 0x20], eax
test rsi, rsi
jne 0x140101b20
mov eax, edx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140171bd0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x140101bf0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x1402e1040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
sub rsi, 1
je 0x140101cce
xor ebp, ebp
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
nop dword [rax]
mov rax, qword [0x1402e1208]
lea rdx, [rsp + 0x20]
mov r8d, 4
mov rcx, rbx
call qword [rax + 0x50]
cmp eax, 4
jne 0x140101c77
cmp byte [0x1402e37a8], bpl
jne 0x140101c81
mov r9d, 2
mov dword [rsp + 0x20], ebp
mov r8d, eax
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
neg eax
sbb eax, eax
and eax, 2
test eax, eax
jne 0x140101cd3
mov ecx, dword [rsp + 0x20]
jmp 0x140101c9e
imul ecx, dword [0x1402e37ac], 0x41c64e6d
add ecx, 0x3039
mov dword [0x1402e37ac], ecx
ror ecx, 0x10
mov dword [rsp + 0x20], ecx
cmp ecx, 0xfffffffc
jae 0x140101c30
mov eax, 0x8421085
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
imul eax, eax, 0x3e
sub ecx, eax
movzx eax, byte [rcx + r14]
mov byte [rdi], al
inc rdi
sub rsi, 1
jne 0x140101c30
mov byte [rdi], 0
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140171bd0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140101d00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x30
cmp byte [rcx + 0xa56], 0
mov rsi, r9
mov rbp, r8
mov rbx, rcx
je 0x140101d86
cmp qword [rcx + 0x270], 0
je 0x140101d96
mov rcx, qword [rcx + 0xd8]
mov qword [rsp + 0x48], rdi
test rcx, rcx
je 0x140101d4a
cmp byte [rcx + 0x22b], 0
je 0x140101d4a
mov dil, 1
jmp 0x140101d52
xor dil, dil
test rcx, rcx
je 0x140101d59
mov byte [rcx + 0x22b], 1
mov rax, qword [rbx + 0x1e8]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [rbx + 0x270]
mov rax, qword [rbx + 0xd8]
test rax, rax
je 0x140101d81
mov byte [rax + 0x22b], dil
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov ecx, edx
test edx, edx
je 0x140101da6
sub ecx, 1
je 0x140101da6
cmp ecx, 1
jne 0x140101d86
mov r9, qword [rbx + 0x1e0]
mov r8d, 1
movsxd rax, edx
mov edx, 2
lea rcx, [rax + rax*2]
lea rax, [0x14026f8a0]
add rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rbx + 0x1e0]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
jmp qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
Function at 0x140104280
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x1401042aa
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.LoadLibraryExW
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1402afbe0]
mov rcx, rbx
mov r14, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
test rax, rax
je 0x14010430c
mov rcx, rbx
test r14, r14
je 0x1401042f9
xor edx, edx
mov r8d, 8
mov rax, r14
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp rax
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test r14, r14
je 0x140104343
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140104343
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
mov rax, r14
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp rax
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r15d, eax
test eax, eax
je 0x14010440c
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x40], rsi
mov rdx, rdi
nop dword [rax]
inc rdx
cmp word [rbx + rdx*2], bp
jne 0x140104370
lea ecx, [rax + 1]
add rcx, rdx
add rcx, rcx
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1401043fe
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1401043fe
mov rax, rdi
cmp word [rsi + rax*2 + 2], bp
lea rax, [rax + 1]
jne 0x1401043a3
mov dword [rsi + rax*2], 0x5c
inc rdi
cmp word [rsi + rdi*2], bp
jne 0x1401043b5
add rdi, rdi
sub rdi, rbx
add rdi, rsi
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rbx + rdi], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x1401043d0
mov rcx, rsi
test r14, r14
je 0x1401043f5
xor edx, edx
mov r8d, 8
call r14
jmp 0x1401043fb
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbp, rax
mov rcx, rsi
call qword [0x1402e1138]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x1401103c0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1402e1040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
test rcx, rcx
je 0x1401104d2
lea rdx, [rsp + 0x20]
call fcn.140131010
test eax, eax
jg 0x1401104d2
xor r8d, r8d
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp byte [rbx + rdx], r8b
jne 0x140110400
test rdx, rdx
je 0x140110464
lea rcx, [rbx - 1]
add rcx, rdx
cmp rcx, rbx
jb 0x140110464
nop word [rax + rax]
cmp byte [rcx], 0x2e
je 0x14011042f
dec rcx
cmp rcx, rbx
jae 0x140110420
jmp 0x140110464
test rcx, rcx
je 0x140110464
cmp rcx, rbx
je 0x140110464
dec rcx
cmp rcx, rbx
jb 0x140110464
cmp byte [rcx], 0x2e
je 0x140110450
dec rcx
cmp rcx, rbx
jae 0x140110441
jmp 0x140110464
mov r8, rcx
test rcx, rcx
je 0x140110464
inc r8
mov rax, rbx
sub rax, r8
add rdx, rax
test r8, r8
cmovne rbx, r8
mov r8d, 0x1505
lea r9, [rbx + rdx]
cmp rbx, r9
jae 0x140110498
lea rdx, [0x14026f9e0]
movzx eax, byte [rbx]
inc rbx
imul r8, r8, 0x21
movsx rcx, byte [rax + rdx]
xor r8, rcx
cmp rbx, r9
jb 0x140110481
mov rcx, r8
movabs rax, 0x410410410410411
mul r8
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub r8, rcx
mov rax, r8
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140171bd0
add rsp, 0x30
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140171bd0
add rsp, 0x30
pop rbx
ret

Function at 0x1401159a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx eax, byte [rdx + 0x24]
cmp byte [rcx + 0x24], al
jne 0x140115a24
mov eax, dword [rdx + 0x20]
cmp dword [rcx + 0x20], eax
jne 0x140115a24
mov r8, qword [rdx + 0x10]
mov rdx, qword [rcx + 0x10]
test rdx, rdx
je 0x140115a1c
test r8, r8
je 0x140115a24
cmp byte [rdx], 0
je 0x1401159f1
lea r9, [0x14026f9e0]
nop
movzx eax, byte [r8]
test al, al
je 0x1401159f1
movzx ecx, byte [rdx]
movzx eax, byte [rax + r9]
cmp byte [rcx + r9], al
jne 0x140115a12
inc rdx
inc r8
cmp byte [rdx], 0
jne 0x1401159d0
xor r9d, r9d
mov ecx, r9d
mov eax, r9d
cmp byte [rdx], cl
sete cl
cmp byte [r8], al
mov r9d, ecx
setne al
xor r9d, eax
test r9d, r9d
setne al
ret
xor r9d, r9d
test r9d, r9d
setne al
ret
test r8, r8
jne 0x140115a24
mov al, 1
ret
xor al, al
ret
Function at 0x14011d780
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rdi
push r12
push r14
sub rsp, 0x50
mov rax, qword [0x1402e1040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, qword [rsp + 0xa0]
xor ebp, ebp
mov rbx, rcx
mov rdi, r9
mov r12, rdx
mov qword [r14], rbp
mov rcx, qword [rcx + 0x328]
test rcx, rcx
je 0x14011d7cc
mov rax, r8
sub rax, r9
cmp rax, rcx
jle 0x14011d7cc
lea r8, [rcx + r9]
mov r10, qword [rbx + 0x20]
test r10, r10
je 0x14011d9d9
mov rax, qword [r10 + 0x3f0]
mov qword [rsp + 0x48], rsi
cmp rax, 0xffffffffffffffff
je 0x14011d7f9
mov edx, 1
cmp rax, qword [r10 + 0x228]
je 0x14011d7fb
mov edx, ebp
lea rcx, [rsp + 0x34]
mov eax, edx
mov qword [rsp + 0x20], rcx
mov r9, r8
mov rcx, rbx
mov dword [rsp + 0x34], ebp
mov r8, r12
call qword [r10 + rax*8 + 0x240]
mov esi, dword [rsp + 0x34]
test rax, rax
cmovs rax, rbp
mov qword [r14], rax
cmp esi, 0x51
jne 0x14011d836
mov esi, ebp
mov qword [r14], rbp
jmp 0x14011d84a
test esi, esi
jne 0x14011d9b9
test rax, rax
je 0x14011d84a
add qword [rbx + 0x12d0], rax
test esi, esi
jne 0x14011d9b9
mov rbp, qword [r14]
test rbp, rbp
je 0x14011d9b9
mov qword [rsp + 0x40], r15
test rdi, rdi
je 0x14011d920
cmp rdi, rbp
cmovb rbp, rdi
cmp byte [rbx + 0xa56], sil
je 0x14011d920
cmp qword [rbx + 0x270], 0
je 0x14011d8e8
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
je 0x14011d8a4
cmp byte [rcx + 0x22b], sil
je 0x14011d8a4
mov r15b, 1
jmp 0x14011d8ac
xor r15b, r15b
test rcx, rcx
je 0x14011d8b3
mov byte [rcx + 0x22b], 1
mov rax, qword [rbx + 0x1e8]
mov r9, rbp
mov r8, r12
mov qword [rsp + 0x20], rax
mov edx, 2
mov rcx, rbx
call qword [rbx + 0x270]
mov rax, qword [rbx + 0xd8]
test rax, rax
je 0x14011d920
mov byte [rax + 0x22b], r15b
jmp 0x14011d920
mov r9, qword [rbx + 0x1e0]
lea rcx, [0x14026f8a6]
mov edx, 2
mov r8d, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rbx + 0x1e0]
mov r8d, 1
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [r14]
mov r15, qword [rsp + 0x40]
cmp rbp, rdi
jbe 0x14011d9b9
sub rbp, rdi
lea r8, [rdi + r12]
cmp byte [rbx + 0xa56], 0
je 0x14011d9a4
cmp qword [rbx + 0x270], 0
je 0x14011d9a4
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
je 0x14011d965
cmp byte [rcx + 0x22b], 0
je 0x14011d965
mov dil, 1
jmp 0x14011d96d
xor dil, dil
test rcx, rcx
je 0x14011d974
mov byte [rcx + 0x22b], 1
mov rax, qword [rbx + 0x1e8]
mov r9, rbp
mov edx, 4
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [rbx + 0x270]
mov rax, qword [rbx + 0xd8]
test rax, rax
je 0x14011d9a4
mov byte [rax + 0x22b], dil
add qword [rbx + 0x108], rbp
mov rcx, qword [rbx + 0x108]
mov qword [rbx + 0xab0], rcx
mov eax, esi
mov rsi, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140171bd0
add rsp, 0x50
pop r14
pop r12
pop rdi
pop rbp
pop rbx
ret
mov eax, 2
jmp 0x14011d9c0
Function at 0x14011fdb0
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
push rbx
push rdi
push r14
push r15
sub rsp, 0xf8
mov rax, qword [0x1402e1040]
xor rax, rsp
mov qword [rsp + 0xe0], rax
cmp byte [0x1402e3f79], 0
mov rbx, rcx
mov rdi, qword [rcx + 0x80]
je 0x14011fe1d
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r8, qword [0x1402e3f70]
mov rax, qword [rsp + 0x38]
cqo
idiv r8
mov r14, rax
mov rax, qword [rsp + 0x38]
cqo
idiv r8
imul rax, rdx, 0xf4240
cqo
idiv r8
mov r15, rax
jmp 0x14011fe44
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0x10624dd3
mul r8d
shr edx, 6
imul ecx, edx, 0x3e8
mov r14d, edx
sub r8d, ecx
imul r15d, r8d, 0x3e8
test rdi, rdi
je 0x140120030
mov rcx, rbx
call fcn.14011e800
mov rdi, rax
test rax, rax
je 0x14011fe8b
nop dword [rax]
mov rdx, rdi
mov rcx, rbx
call fcn.14011e500
xor r9d, r9d
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.14011eed0
mov rcx, rbx
call fcn.14011e800
mov rdi, rax
test rax, rax
jne 0x14011fe60
cmp qword [rbx + 0x58], 0
je 0x140120028
mov qword [rsp + 0x130], rsi
movabs rdi, 0xffdf3b645a1cac09
mov qword [rsp + 0x138], r12
movabs rsi, 0x20c49ba5e353f7
mov qword [rsp + 0xf0], r13
xor r12d, r12d
movabs r13, 0x8000000000000000
mov qword [rsp + 0x128], rbp
mov rcx, rbx
call fcn.14011f640
cmp qword [rbx + 0x58], r12
je 0x140120008
cmp byte [0x1402e3f79], r12b
je 0x14011ff23
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x38]
cqo
idiv qword [0x1402e3f70]
mov r9, rax
imul rax, rdx, 0xf4240
cqo
idiv qword [0x1402e3f70]
mov rcx, rax
jmp 0x14011ff4a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0x10624dd3
mul r8d
shr edx, 6
imul ecx, edx, 0x3e8
mov r9d, edx
sub r8d, ecx
imul ecx, r8d, 0x3e8
sub r9, r14
cmp r9, rsi
jge 0x140120008
cmp r9, rdi
jg 0x14011ff60
mov rdi, r13
jmp 0x14011ff87
sub ecx, r15d
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul rax, r9, 0x3e8
movsxd rdi, edx
add rdi, rax
jns 0x140120008
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], r12d
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov qword [rsp + 0x30], r12
neg edi
mov dword [rsp + 0x2c], 0xa
call fcn.14011f500
mov rsi, qword [rsp + 0x20]
mov ebp, eax
test eax, eax
jne 0x14011ffd6
mov edx, dword [rsp + 0x28]
mov ecx, 0x3e8
cmp edi, ecx
cmovl ecx, edi
movsxd r8, ecx
mov rcx, rsi
call fcn.140135350
cmp byte [rsp + 0x30], r12b
je 0x14011ffe6
mov rcx, rsi
call qword [0x1402e1138]
test ebp, ebp
jne 0x140120008
movabs rdi, 0xffdf3b645a1cac09
movabs rsi, 0x20c49ba5e353f7
cmp qword [rbx + 0x58], r12
jne 0x14011fed7
mov rbp, qword [rsp + 0x128]
mov rsi, qword [rsp + 0x130]
mov r12, qword [rsp + 0x138]
mov r13, qword [rsp + 0xf0]
mov rcx, rbx
call fcn.14011ebf0
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140171bd0
add rsp, 0xf8
pop r15
pop r14
pop rdi
pop rbx
ret
Function at 0x140120f90
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1402e1040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, dword [0x1402e37c8]
mov rbx, rcx
mov dword [rsp + 0x34], 0x4020
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 4
test eax, eax
jne 0x14012100e
xor r8d, r8d
mov dword [rsp + 0x20], 3
xor edx, edx
mov ecx, 6
call fcn.14012ce90
test al, al
je 0x140121002
mov dword [0x1402e37c8], 2
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140171bd0
add rsp, 0x50
pop rbx
ret
mov dword [0x1402e37c8], 1
jmp 0x140121013
cmp eax, 2
je 0x140121065
lea rax, [rsp + 0x38]
mov edx, 0xffff
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x140121044
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x30], eax
jg 0x140121065
lea r9, [rsp + 0x34]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140171bd0
add rsp, 0x50
pop rbx
ret
Function at 0x140121da0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x1402e1040]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbx, qword [rcx + 0x10]
mov rsi, rdx
mov r9, qword [rbx + 0x98]
cmp r9, 0xffffffffffffffff
je 0x140121f58
mov rax, qword [rdx + 0x20]
mov rcx, qword [rax + 0x3c8]
test dword [rcx + 0x8c], 0x800
jne 0x140121f58
xorps xmm0, xmm0
mov dword [rsp + 0x20], Ordinal_133
lea r8, [rsp + 0x20]
mov rcx, r9
lea rdx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x140121e80
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
lea rdx, [rsp + 0xb0]
mov ebx, eax
call fcn.1400fae60
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.140101e00
mov eax, 2
jmp 0x140121f5a
movzx ecx, word [rsp + 0x30]
sub ecx, 1
je 0x140121f21
cmp ecx, 1
jne 0x140121ec8
mov r8d, reloc.WLDAP32.dll_Ordinal_46
lea rdx, [rbx + 0xce]
lea rcx, [rsp + 0x34]
call fcn.14013f4b0
test rax, rax
je 0x140121ec8
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rbx + 0x100], eax
jmp 0x140121f58
mov byte [rbx + 0xce], 0
mov dword [rbx + 0x100], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x273f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.1400fae60
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.140101e00
mov eax, 2
jmp 0x140121f5a
cmp dword [rsp + 0x20], 2
jle 0x140121f47
lea r9, [rsp + 0x32]
mov edx, reloc.WLDAP32.dll_Ordinal_46
lea r8, [0x1402acbcc]
lea rcx, [rbx + 0xce]
call sym.CheraxLoader.exe_curl_msnprintf
jmp 0x140121f4e
mov byte [rbx + 0xce], 0
mov dword [rbx + 0x100], 0
xor eax, eax
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.140171bd0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret