joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140072cc0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
cmp byte [rcx + 0x1ad], 0
movzx esi, r9b
movzx ebp, r8b
movzx ebx, dl
mov rdi, rcx
je 0x140072d10
test dl, dl
je 0x140072d10
mov byte [rcx + 0x1ae], 1
xor r8d, r8d
mov rcx, qword [rcx + 0x88]
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x140072ebc
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x50], rax
mov r9d, 0x80000023
mov rax, qword [rcx + 0x130]
mov byte [rsp + 0x50], bl
mov byte [rsp + 0x52], sil
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x40], rax
test bpl, bpl
je 0x140072d4a
test bl, bl
mov eax, 0x80000033
cmove r9d, eax
mov rcx, qword [rcx + 0x128]
lea r8, [rsp + 0x40]
lea rdx, [0x140073ce0]
mov rax, qword [rcx]
call qword [rax + 0x340]
test rax, rax
jne 0x140072ea3
test bpl, bpl
jne 0x140072e59
mov rcx, qword [rdi + 0x88]
call qword [sym.imp.USER32.dll_GetParent]
mov rbp, rax
test rax, rax
je 0x140072e59
cmp qword [rdi + 0x130], 0
je 0x140072e59
xor ebx, ebx
mov qword [rsp + 0x70], reloc.WS2_32.dll_sendto
xorps xmm0, xmm0
mov qword [rsp + 0x80], rbx
movdqu xmmword [rsp + 0x8c], xmm0
mov qword [rsp + 0x9c], rbx
mov dword [rsp + 0xa4], ebx
mov qword [rsp + 0x78], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rdi + 0x130]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x88], eax
mov rax, qword [rcx]
call qword [rax + 0x360]
mov rdx, qword [rdi + 0x130]
lea r8, str.killfocus
mov byte [rsp + 0x30], 1
xor r9d, r9d
mov byte [rsp + 0x28], bl
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call fcn.1400724e0
lea ecx, [rbx + 0x10]
mov qword [rdi + 0x130], rbx
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 1
mov edx, 0x8002
test ax, ax
cmovns ebx, ecx
mov rcx, rbp
mov r8d, ebx
or r8, 2
test sil, sil
cmove r8, rbx
xor r9d, r9d
call qword [sym.imp.USER32.dll_PostMessageW]
xor al, al
jmp 0x140072ebe
test bl, bl
je 0x140072e99
mov rcx, qword [rdi + 0x128]
lea r8, [rsp + 0x58]
xor eax, eax
lea rdx, [0x140073ce0]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x68], bl
mov r9d, 0x80000023
mov byte [rsp + 0x6a], sil
mov rax, qword [rcx]
call qword [rax + 0x340]
jmp 0x140072e9e
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x140072eb5
movzx r9d, sil
mov r8b, 1
mov rdx, rax
mov rcx, rdi
call fcn.140072880
mov byte [rdi + 0x1ae], 0
mov al, 1
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140076bb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, rdx
mov r15, r9
shr rax, 0x10
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
test ax, ax
je 0x140076c18
cmp word [rdx], 0x3c
jne 0x140076c0e
call fcn.140074ed0
test al, al
jne 0x140076ca4
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
xor r8d, r8d
call fcn.140075000
jmp 0x140076beb
call fcn.14006d890
mov rcx, rax
mov r8, rbp
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x140076bf3
call fcn.14006d890
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
jne 0x140076c58
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x140076bf3
mov qword [rdi + 0x148], r15
call fcn.14006d890
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
call fcn.140075370
test al, al
je 0x140076bf3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov qword [rdi + 0x150], rbp
mov r9, qword [rsp + 0x68]
mov rdx, r15
mov r8, qword [rsp + 0x60]
mov rcx, rdi
call fcn.1400762b0
jmp 0x140076bf5

Function at 0x14007ec20
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, qword [rcx + 0xe0]
test rax, rax
je 0x14007ec3d
mov rdx, rcx
xor r9d, r9d
mov rcx, rax
xor r8d, r8d
jmp fcn.140072880
ret
Function at 0x14008c9d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0x830], 0
mov rbp, r9
mov rdi, r8
mov esi, edx
mov rbx, rcx
je 0x14008caa4
cmp edx, 0x100
jne 0x14008ca2d
cmp di, 0xd
jne 0x14008ca2d
cmp byte [rcx + 0x839], 0
jne 0x14008ca56
cmp byte [rcx + 0x83b], 0
je 0x14008ca6f
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14008ca6f
mov rax, qword [rbx + 0x830]
mov r9, rbp
mov r8, rdi
mov edx, esi
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx]
mov r10, qword [rax + 0x18]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
call r10
jmp 0x14008caa9
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14008ca2d
cmp byte [rbx + 0x83b], 0
jne 0x14008ca2d
mov rcx, qword [rbx + 0xe0]
test rcx, rcx
je 0x14008caa0
mov byte [rsp + 0x30], 1
lea r8, str.return
mov byte [rsp + 0x28], 0
xor r9d, r9d
mov rdx, rbx
mov qword [rsp + 0x20], 0
call fcn.1400724e0
xor eax, eax
jmp 0x14008caa9
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14008dda0
Capabilities:
Create directory

Disassembly:
test rdx, rdx
je 0x14008dec9
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x14036a3c8]
xor rax, rsp
mov qword [rsp + 0x440], rax
movzx eax, word [rdx]
mov rdi, rdx
mov rbx, rcx
test ax, ax
je 0x14008dea9
mov qword [rsp + 0x470], rsi
mov rcx, rdx
mov rsi, rdx
cmp ax, 0x2f
je 0x14008ddf4
cmp ax, 0x5c
jne 0x14008ddf7
mov rsi, rcx
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14008dde8
cmp rsi, rdi
je 0x14008de40
sub rsi, rdi
lea rcx, [rsp + 0x20]
sar rsi, 1
mov r8, rsi
call fcn.1402592ac
add rsi, rsi
cmp rsi, 0x208
jae 0x14008deca
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov word [rsp + rsi + 0x20], ax
call fcn.14008dda0
lea rcx, [rsp + 0x230]
sub rcx, rbx
nop dword [rax + rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x14008de50
lea rcx, [rsp + 0x230]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x14008de70
xor edx, edx
nop dword [rax]
movzx eax, word [rdi + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x14008de80
xor edx, edx
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rsi, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140240e30
mov rbx, qword [rsp + 0x478]
add rsp, 0x450
pop rdi
ret
call fcn.140241130
int3
Function at 0x14008e580
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x40
mov r15, rcx
mov ebp, r8d
mov ecx, 0x348
mov r12d, edx
call fcn.1402407f4
xor esi, esi
mov qword [rsp + 0x88], rax
mov rdi, rax
test rax, rax
je 0x14008e5c7
mov qword [rax], rsi
mov dword [rax + 8], 0xffffffff
mov dword [rax + 0x138], 0xffffffff
jmp 0x14008e5ca
mov rdi, rsi
cmp qword [rdi], 0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], r14
jne 0x14008e792
cmp dword [rdi + 8], 0xffffffff
jne 0x14008e792
lea rbx, [rdi + 0x13c]
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
sub rbx, 2
cmp word [rbx + 2], 0
lea rbx, [rbx + 2]
jne 0x14008e601
mov eax, dword [0x140285d80]
mov dword [rbx], eax
cmp ebp, 1
jne 0x14008e635
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, ebp
je 0x14008e647
mov dword [0x14036ef94], 0x2000000
jmp 0x14008e79c
lea eax, [rbp - 2]
cmp eax, 1
jbe 0x14008e647
mov eax, 0x10000
jmp 0x14008e774
xor r14b, r14b
mov qword [rsp + 0x88], rsi
cmp ebp, 1
je 0x14008e6a2
cmp ebp, 2
jne 0x14008e6fe
mov qword [rsp + 0x30], rsi
lea r8d, [rbp - 1]
mov dword [rsp + 0x28], Ordinal_133
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x88], rax
cmp rax, 0xffffffffffffffff
jne 0x14008e6ee
mov eax, 0x200
jmp 0x14008e774
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x88]
mov rcx, rax
mov dword [rsp + 0x28], esi
mov r8, rbx
mov dword [rsp + 0x20], esi
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x14008e6e6
mov eax, 0x100
jmp 0x14008e774
mov rax, qword [rsp + 0x88]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
sete r14b
mov ecx, Ordinal_41
call fcn.1402407f4
lea ecx, [rbp - 1]
mov rbx, rax
cmp ecx, 1
jbe 0x14008e728
mov word [rax], 0x100
mov qword [rax + 0x18], r15
mov dword [rax + 0x20], r12d
mov dword [rax + 0x24], esi
mov dword [rax + 0x14], esi
jmp 0x14008e763
mov byte [rax], 1
mov byte [rax + 1], r14b
mov rax, qword [rsp + 0x88]
mov qword [rbx + 8], rax
mov byte [rbx + 0x10], 0
mov dword [rbx + 0x14], esi
test r14b, r14b
je 0x14008e763
mov rcx, qword [rsp + 0x88]
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbx + 0x14], eax
mov rcx, rbx
call fcn.140091a40
mov qword [rdi], rax
mov eax, dword [0x14036ef98]
mov dword [0x14036ef94], eax
test eax, eax
jne 0x14008e79c
lea ecx, [rax + 0x10]
call fcn.1402407f4
mov dword [rax], 1
mov qword [rax + 8], rdi
jmp 0x14008e7a6
mov dword [0x14036ef94], 0x1000000
mov rcx, rdi
call fcn.1400bfa70
xor eax, eax
mov r14, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400912b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov r10, r8
mov rdi, r9
imul r10d, edx
mov rsi, rdx
cmp byte [r9], 0
mov r11, rcx
je 0x14009130a
mov rdx, rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x48]
mov r8d, r10d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400912f6
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
xor edx, edx
div rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov edx, dword [r9 + 0x24]
mov ecx, dword [r9 + 0x20]
sub ecx, edx
mov qword [rsp + 0x40], rbx
lea eax, [rdx + r10]
cmp eax, dword [r9 + 0x20]
cmovbe ecx, r10d
add rdx, qword [r9 + 0x18]
mov ebx, ecx
mov r8d, ecx
mov rcx, r11
call fcn.1402430d0
add dword [rdi + 0x24], ebx
mov eax, ebx
mov rbx, qword [rsp + 0x40]
xor edx, edx
div rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400913e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x1400913eb
xor eax, eax
ret
lea r11, [0x140291320]
not ecx
cmp r8d, 8
jb 0x1400914c1
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x140091410
test r8d, r8d
je 0x1400914ed
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x1400914d0
not ecx
mov eax, ecx
ret
Function at 0x1400929a0
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
sub rsp, 0x38
cmp byte [rcx], 0
mov r14, rdx
mov qword [rsp + 0x58], rbp
mov rbx, rcx
mov qword [rsp + 0x30], rdi
mov edi, 1
je 0x1400929f0
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x60]
mov r8d, edi
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400929ea
mov byte [rbx + 0x10], dil
mov ebp, dword [rsp + 0x60]
jmp 0x140092a27
mov qword [rsp + 0x68], rsi
mov esi, dword [rcx + 0x24]
mov ecx, dword [rcx + 0x20]
lea eax, [rsi + 1]
cmp eax, ecx
jbe 0x140092a06
mov edi, ecx
sub edi, esi
mov rdx, rsi
mov r8d, edi
add rdx, qword [rbx + 0x18]
lea rcx, [rsp + 0x50]
mov ebp, edi
call fcn.1402430d0
lea eax, [rsi + rdi]
mov rsi, qword [rsp + 0x68]
mov dword [rbx + 0x24], eax
mov rdi, qword [rsp + 0x30]
cmp ebp, 1
mov rbp, qword [rsp + 0x58]
jne 0x140092a48
movzx eax, byte [rsp + 0x50]
mov dword [r14], eax
xor eax, eax
add rsp, 0x38
pop r14
pop rbx
ret
cmp byte [rbx], 0
je 0x140092a3e
cmp byte [rbx + 0x10], 0
je 0x140092a3e
mov eax, 0xffffffff
add rsp, 0x38
pop r14
pop rbx
ret
Function at 0x1400a8de0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rcx
mov rcx, qword [rcx + 0x7f8]
test rcx, rcx
je 0x1400a8df9
mov rax, qword [rcx]
jmp qword [rax + 0x2e0]
mov rcx, rax
jmp method.DuiLib::CCheckBoxUI.virtual_736
Function at 0x1400ad2a0
Capabilities:
Get graphical window text

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rdi
mov rax, qword [0x14036a3c8]
xor rax, rbp
mov qword [rbp], rax
cmp byte [rcx + 0x38], 0
mov rbx, rcx
je 0x1400ad391
cmp qword [rcx + 0x28], 0
je 0x1400ad391
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea r8d, [rax + 1]
movsxd rax, r8d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400ad300
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140240e90
sub rsp, rcx
lea rdi, [rsp + 0x40]
test rdi, rdi
je 0x1400ad391
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
add rcx, 0x280
call fcn.1400686d0
mov rcx, qword [rbx + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x100]
mov rdx, qword [rbx + 0x28]
lea r8, str.textchanged
mov byte [rsp + 0x30], 1
mov rcx, rax
mov byte [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], 0
call fcn.1400724e0
mov rcx, qword [rbx + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x100]
mov rcx, rax
call fcn.14006dde0
test al, al
je 0x1400ad391
mov rcx, qword [rbx + 0x28]
call fcn.14007bbe0
xor eax, eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.140240e30
mov rbx, qword [rbp + 0x20]
mov rdi, qword [rbp + 0x28]
lea rsp, [rbp + 0x10]
pop rbp
ret

Function at 0x1400add70
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.14007ed20
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x290]
test al, al
jne 0x1400addb1
cmp qword [rbx + 0x888], 0
je 0x1400addb1
mov rcx, qword [rbx + 0xe0]
xor r9d, r9d
mov r8b, 1
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.140072880
add rsp, 0x20
pop rbx
ret

Function at 0x1400adf30
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.14007f700
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x290]
test al, al
jne 0x1400adf71
cmp qword [rbx + 0x888], 0
je 0x1400adf71
mov rcx, qword [rbx + 0xe0]
xor r9d, r9d
mov r8b, 1
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.140072880
add rsp, 0x20
pop rbx
ret
Function at 0x1400bbf90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x10]
mov rbx, rcx
mov r10d, edx
mov ecx, edx
and r10d, 7
je 0x1400bbff6
mov r8d, dword [rbx + 0x14]
cmp edx, r10d
jge 0x1400bbfe4
mov r9, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r9
jb 0x1400bbfc0
xor cl, cl
jmp 0x1400bbfc9
movzx ecx, byte [rax]
inc rax
mov qword [rbx], rax
movzx eax, cl
mov ecx, edx
shl eax, cl
add edx, 8
or eax, r8d
mov dword [rbx + 0x10], edx
mov dword [rbx + 0x14], eax
mov r8d, eax
cmp edx, 0x18
jle 0x1400bbfb4
mov ecx, r10d
shr r8d, cl
sub edx, r10d
mov dword [rbx + 0x14], r8d
mov dword [rbx + 0x10], edx
mov ecx, edx
xor r9d, r9d
test edx, edx
jle 0x1400bc02e
mov edx, dword [rbx + 0x14]
lea r8, [rsp + 0x30]
nop word [rax + rax]
movzx eax, byte [rbx + 0x14]
inc r9d
shr edx, 8
sub ecx, 8
mov byte [r8], al
lea r8, [r8 + 1]
mov dword [rbx + 0x14], edx
test ecx, ecx
jg 0x1400bc010
mov dword [rbx + 0x10], ecx
movsxd rcx, r9d
cmp rcx, 4
jge 0x1400bc062
mov r8, qword [rbx + 8]
nop dword [rax + rax]
mov rax, qword [rbx]
cmp rax, r8
jb 0x1400bc04c
xor dl, dl
jmp 0x1400bc055
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x1400bc040
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
je 0x1400bc0a5
lea rax, str.zlib_corrupt
mov qword [0x14036efc0], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x1400bc0d4
lea rax, str.read_past_buffer
mov qword [0x14036efc0], rax
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x1400bc0ee
mov rcx, rbx
call fcn.1400bf8c0
test eax, eax
je 0x1400bc0c7
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call fcn.1402430d0
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1400c6d00
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rsi, [rcx + rdx]
mov rbx, rcx
mov edi, 0x1505
cmp rcx, rsi
jae 0x1400c6a3b
movzx ecx, byte [rbx]
call fcn.1400d3780
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x1400c6a20
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
movzx eax, dil
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400c6d36
call fcn.1400c7080
test al, al
jne 0x1400c6d36
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400c6fd0
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x1400c6a00
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400d0a50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x728], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x1400d0aae
mov dl, 1
call fcn.1400c31d0
mov rax, qword [rdi + 0x680]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x728]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.1400c31d0
mov eax, ebx
jmp 0x1400d0afb
mov edx, ebx
test ebx, ebx
je 0x1400d0abe
sub edx, 1
je 0x1400d0abe
cmp edx, 1
jne 0x1400d0af9
mov r9, qword [rdi + 0x678]
lea rax, [0x14029d900]
mov edx, 2
lea rcx, [rbx + rbx*2]
add rcx, rax
lea r8d, [rdx - 1]
call fcn.140256278
mov r9, qword [rdi + 0x678]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call fcn.140256278
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400d0dc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x1400d0dfb
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov edx, 0x51
cmp eax, 0x2733
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400d0f30
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x14036a3c8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r14, qword [rsp + 0x100]
mov rsi, r9
movsxd rax, edx
mov rdi, r8
mov r15, rcx
mov rbx, qword [rcx + rax*8 + 0x250]
call fcn.1400d1540
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
movsxd rdi, eax
mov dword [r14], 0
cmp rdi, 0xffffffffffffffff
jne 0x1400d0fe2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x1400d0fae
mov dword [r14], 0x51
xor eax, eax
jmp 0x1400d0fe5
mov r8d, Ordinal_133
lea rdx, [rsp + 0x20]
mov ecx, ebx
call fcn.1400fb880
mov rcx, qword [r15]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.1400d0b10
mov rcx, qword [r15]
mov dword [rcx + 0x10f0], ebx
mov dword [r14], gethostname
mov rax, rdi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140240e30
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400d1540
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
movsxd rcx, edx
mov rax, rcx
shl rax, 5
lea rbx, [rsi + 0x298]
add rbx, rax
mov rax, qword [rsi + 0x3f8]
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x7c], 3
je 0x1400d163a
lea rax, [0x1400d0e50]
cmp qword [rsi + rcx*8 + 0x278], rax
jne 0x1400d163a
cmp qword [rbx], 0
je 0x1400d15a3
test rdi, rdi
je 0x1400d163a
mov rdx, 0xffffffffffffffff
mov qword [rsp + 0x30], rbp
mov rbp, qword [rsi + rcx*8 + 0x250]
xor r9d, r9d
mov rcx, rbp
mov r8, rdx
call fcn.1400d0670
cmp eax, 0xffffffff
je 0x1400d1635
test al, 1
je 0x1400d1635
mov rax, qword [rbx]
test rax, rax
jne 0x1400d160a
mov rax, qword [rsi]
mov ecx, dword [rax + 0xb68]
add ecx, ecx
movsxd rcx, ecx
mov qword [rbx + 8], rcx
call qword [str._h__]
mov rdi, qword [rbx + 8]
mov qword [rbx], rax
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
test rax, rax
je 0x1400d162d
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rax
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x1400d1635
add qword [rbx + 0x10], rcx
jmp 0x1400d1635
mov qword [rbx + 8], 0
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400d1750
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
test byte [rcx + 0x2e8], 1
je 0x1400d176d
call fcn.1400ca8c0
test eax, eax
jne 0x1400d1793
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x250]
cmp rcx, 0xffffffffffffffff
je 0x1400d1766
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x1400d1766
mov al, 1
add rsp, 0x28
ret