joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140066c6c
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x34], 0x4020
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 4
cmp dword [0x140147d30], 0
jne 0x140066cd0
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov ecx, 6
call fcn.1400981a8
movzx eax, al
test eax, eax
je 0x140066cc6
mov dword [0x140147d30], 2
jmp 0x140066cd0
mov dword [0x140147d30], 1
cmp dword [0x140147d30], 2
jne 0x140066cdb
jmp 0x140066d33
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x140066d10
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x30], eax
jle 0x140066d10
jmp 0x140066d33
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x48
ret

Function at 0x140066f48
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x1c0
mov rax, qword [0x140146de8]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov dword [rsp + 0x24], 0x80
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x80
rep stosb byte [rdi], al
lea r8, [rsp + 0x24]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x140066fea
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x20], eax
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, dword [rsp + 0x20]
call fcn.1400941cc
mov r9, rax
mov r8d, dword [rsp + 0x20]
lea rdx, str.getsockname___failed_with_errno__d:__s
mov rcx, qword [rsp + 0x1d0]
call fcn.140064834
jmp 0x140067052
mov r9, qword [rsp + 0x1e8]
mov r8, qword [rsp + 0x1e0]
mov edx, dword [rsp + 0x24]
lea rcx, [rsp + 0x30]
call fcn.140066a30
movzx eax, al
test eax, eax
jne 0x140067052
call fcn.1400bb440
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, dword [rax]
call fcn.1400941cc
mov qword [rsp + 0x28], rax
call fcn.1400bb440
mov rcx, qword [rsp + 0x28]
mov r9, rcx
mov r8d, dword [rax]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov rcx, qword [rsp + 0x1d0]
call fcn.140064834
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400ab3a0
add rsp, 0x1c0
pop rdi
ret
Function at 0x140067700
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [0x140146de8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x90]
movzx eax, byte [rax + 0xa83]
test eax, eax
je 0x14006773d
mov dword [rsp + 0x54], 1
jmp 0x140067745
mov dword [rsp + 0x54], 0
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x50]
mov r8d, 8
mov edx, 0xffff
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x140067782
xor eax, eax
test eax, eax
jne 0x140067777
jmp 0x140067835
mov dword [rsp + 0x60], 1
mov rax, qword [rsp + 0x90]
mov ecx, dword [rax + 0xa04]
call fcn.140068b1c
mov dword [rsp + 0x50], eax
imul eax, dword [rsp + 0x50], 0x3e8
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x64], eax
mov rax, qword [rsp + 0x90]
mov ecx, dword [rax + 0xa08]
call fcn.140068b1c
mov dword [rsp + 0x50], eax
imul eax, dword [rsp + 0x50], 0x3e8
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, listen
lea r8, [rsp + 0x60]
mov edx, 0x98000004
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x140067835
xor eax, eax
test eax, eax
jne 0x14006782f
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400ab3a0
add rsp, 0x88
ret
Function at 0x1400689b4
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], 6
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
mov r8d, 1
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x1400689fe
xor eax, eax
test eax, eax
jne 0x1400689f8
add rsp, 0x48
ret

Function at 0x1400690f4
Capabilities:
Initialize winsock library

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x208
mov rax, qword [0x140146de8]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov eax, dword [rsp + 0x210]
and eax, 2
test eax, eax
je 0x1400691ac
mov eax, 0x202
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x50]
movzx ecx, word [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x140069152
mov eax, 2
jmp 0x140069252
movzx eax, word [rsp + 0x50]
and rax, 0xff
movzx eax, al
movzx ecx, word [rsp + 0x30]
and rcx, 0xff
movzx ecx, cl
cmp eax, ecx
jne 0x14006919c
movzx eax, word [rsp + 0x50]
shr rax, 8
and rax, 0xff
movzx eax, al
movzx ecx, word [rsp + 0x30]
shr rcx, 8
and rcx, 0xff
movzx ecx, cl
cmp eax, ecx
je 0x1400691ac
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
jmp 0x140069252
call fcn.140099ad0
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x1400691c5
mov eax, dword [rsp + 0x34]
jmp 0x140069252
lea rcx, str.iphlpapi.dll
call fcn.1400692c8
mov qword [0x140147d40], rax
cmp qword [0x140147d40], 0
je 0x14006920f
lea rdx, str.if_nametoindex
mov rcx, qword [0x140147d40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x14006920f
mov rax, qword [rsp + 0x40]
mov qword [0x140147d38], rax
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov ecx, 6
call fcn.1400981a8
movzx eax, al
test eax, eax
je 0x14006923c
mov byte [0x140149c98], 1
jmp 0x140069243
mov byte [0x140149c98], 0
lea rcx, [0x140149ca0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1400ab3a0
add rsp, 0x208
ret
Function at 0x140071ecc
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4004747b
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x140071f47
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x54]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x68
ret
Function at 0x140077c40
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
add rax, 0xe8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx + 0x70]
mov dword [rax + 0x12a0], ecx
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x71b]
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x12a8], eax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x10f9]
test eax, eax
je 0x140077cb4
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x10f9]
mov rcx, qword [rsp + 0x58]
movzx ecx, byte [rcx + 0x71b]
cmp eax, ecx
jle 0x140077cca
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov cl, byte [rcx + 0x71b]
mov byte [rax + 0x10f9], cl
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x1108], 0
je 0x140077d03
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x1170]
test eax, eax
jne 0x140077d03
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x70], 0x1a0
jne 0x140077d03
mov rax, qword [rsp + 0x30]
mov byte [rax + 0xdc], 1
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x71b]
cmp eax, 0xa
jne 0x140077d2b
xor eax, eax
test eax, eax
jne 0x140077d14
mov edx, 1
mov rcx, qword [rsp + 0x58]
call fcn.1400674e4
jmp 0x140077d96
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x71b]
cmp eax, 0x14
je 0x140077d55
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x8c], 2
jne 0x140077d6f
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x70], 0x65
jne 0x140077d6f
xor eax, eax
test eax, eax
jne 0x140077d55
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x6d8]
mov dword [rax], 2
jmp 0x140077d96
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x71b]
cmp eax, 0xb
jl 0x140077d96
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0x3aa]
test eax, eax
jne 0x140077d96
xor eax, eax
test eax, eax
jne 0x140077d90
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x70], 0x64
jl 0x140077db9
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x70], 0xc8
jge 0x140077db9
mov dword [rsp + 0x20], 1
jmp 0x140077dc1
mov dword [rsp + 0x20], 0
cmp dword [rsp + 0x20], 0
jne 0x140077dd2
mov dword [rsp + 0x24], 0
jmp 0x140077dda
mov dword [rsp + 0x24], 1
mov rax, qword [rsp + 0x30]
mov cl, byte [rsp + 0x24]
mov byte [rax + 0xdd], cl
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x70]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xcc
je 0x140077e27
cmp dword [rsp + 0x28], 0x130
je 0x140077e0b
jmp 0x140077e4c
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x558]
test eax, eax
je 0x140077e27
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x1384], 1
mov rax, qword [rsp + 0x30]
mov qword [rax], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x30]
mov byte [rax + 0xdd], 1
xor eax, eax
add rsp, 0x48
ret
Function at 0x1400804dc
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x78], 0
je 0x140080506
mov rax, qword [rsp + 0x78]
cmp dword [rax], 0
jne 0x140080548
cmp qword [rsp + 0x80], 0
je 0x14008051e
mov rax, qword [rsp + 0x80]
cmp dword [rax], 0
jne 0x140080548
cmp qword [rsp + 0x88], 0
je 0x140080536
mov rax, qword [rsp + 0x88]
cmp dword [rax], 0
jne 0x140080548
mov rcx, qword [rsp + 0x90]
call fcn.140080464
jmp 0x14008060d
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x50]
call fcn.1400a28b4
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x88], 0
je 0x140080586
mov rax, qword [rsp + 0x88]
cmp dword [rax], 0
je 0x140080586
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x30], rax
jmp 0x14008058f
mov qword [rsp + 0x30], 0
cmp qword [rsp + 0x80], 0
je 0x1400805b6
mov rax, qword [rsp + 0x80]
cmp dword [rax], 0
je 0x1400805b6
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
jmp 0x1400805bf
mov qword [rsp + 0x38], 0
cmp qword [rsp + 0x78], 0
je 0x1400805dd
mov rax, qword [rsp + 0x78]
cmp dword [rax], 0
je 0x1400805dd
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
jmp 0x1400805e6
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x70]
inc eax
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_select]
add rsp, 0x68
ret
Function at 0x140086758
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
xor edx, edx
xor ecx, ecx
call fcn.1400e0bfc
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400867af
mov rax, 0xffffffffffffffff
cmp qword [rsp + 0x30], rax
jne 0x1400867b3
xor eax, eax
jmp 0x1400867b8
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x140086f50
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov rcx, qword [rsp + 0x38]
rep stosb byte [rdi], al
mov r9d, 2
mov r8d, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
je 0x140086f8f
mov eax, 2
jmp 0x140086f91
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14008d9f8
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 4
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x38], eax
mov rdi, qword [rsp + 0x70]
xor eax, eax
mov rcx, qword [rsp + 0x78]
rep stosb byte [rdi], al
mov dword [rsp + 0x20], 0xf0000040
mov r9d, dword [rsp + 0x80]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14008da72
jmp 0x14008db4a
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x14008da9d
jmp 0x14008db22
xor r9d, r9d
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x14008dabb
jmp 0x14008db22
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
mov edx, 4
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x14008dae3
jmp 0x14008db22
mov eax, dword [rsp + 0x30]
cmp qword [rsp + 0x78], rax
jae 0x14008daf0
jmp 0x14008db22
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
mov r8, qword [rsp + 0x70]
mov edx, 2
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x14008db18
jmp 0x14008db22
xor eax, eax
test eax, eax
jne 0x14008da72
cmp qword [rsp + 0x40], 0
je 0x14008db35
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp qword [rsp + 0x48], 0
je 0x14008db4a
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
add rsp, 0x50
pop rdi
ret

Function at 0x14008dbf8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x28], 0x8000
mov eax, dword [rsp + 0x20]
mov edx, eax
mov rcx, qword [rsp + 0x30]
call qword [fcn.1400bb550]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14008dc47
mov rcx, qword [rsp + 0x30]
call qword [fcn.1400bb560]
xor eax, eax
jmp 0x14008dcb2
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14008dc8d
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x20], eax
je 0x14008dc8d
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x20], eax
jbe 0x14008dc9c
mov rcx, qword [rsp + 0x30]
call qword [fcn.1400bb560]
xor eax, eax
jmp 0x14008dcb2
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x20], eax
jae 0x14008dcad
mov rax, qword [rsp + 0x30]
jmp 0x14008dcb2
jmp 0x14008dc1a
add rsp, 0x48
ret
Function at 0x140094930
Capabilities:
Parse pe header

Disassembly:
mov byte [rsp + 8], cl
sub rsp, 0x18
movzx eax, byte [rsp + 0x20]
mov dword [rsp], eax
cmp dword [rsp], 0x56
jg 0x140094ac8
cmp dword [rsp], 0x56
je 0x140094bd9
cmp dword [rsp], 0x45
jg 0x140094a18
cmp dword [rsp], 0x45
je 0x140094bd9
cmp dword [rsp], 0x36
jg 0x1400949cd
cmp dword [rsp], 0x36
je 0x140094bd9
cmp dword [rsp], 0x2d
je 0x140094bd9
cmp dword [rsp], 0x2e
je 0x140094bd9
cmp dword [rsp], 0x30
je 0x140094bd9
cmp dword [rsp], 0x31
je 0x140094bd9
cmp dword [rsp], 0x32
je 0x140094bd9
cmp dword [rsp], 0x33
je 0x140094bd9
cmp dword [rsp], 0x34
je 0x140094bd9
cmp dword [rsp], 0x35
je 0x140094bd9
jmp 0x140094bdd
cmp dword [rsp], 0x37
je 0x140094bd9
cmp dword [rsp], 0x38
je 0x140094bd9
cmp dword [rsp], 0x39
je 0x140094bd9
cmp dword [rsp], 0x41
je 0x140094bd9
cmp dword [rsp], 0x42
je 0x140094bd9
cmp dword [rsp], 0x43
je 0x140094bd9
cmp dword [rsp], 0x44
je 0x140094bd9
jmp 0x140094bdd
cmp dword [rsp], 0x4e
jg 0x140094a7d
cmp dword [rsp], 0x4e
je 0x140094bd9
cmp dword [rsp], 0x46
je 0x140094bd9
cmp dword [rsp], 0x47
je 0x140094bd9
cmp dword [rsp], 0x48
je 0x140094bd9
cmp dword [rsp], 0x49
je 0x140094bd9
cmp dword [rsp], 0x4a
je 0x140094bd9
cmp dword [rsp], 0x4b
je 0x140094bd9
cmp dword [rsp], 0x4c
je 0x140094bd9
cmp dword [rsp], 0x4d
je 0x140094bd9
jmp 0x140094bdd
cmp dword [rsp], 0x4f
je 0x140094bd9
cmp dword [rsp], 0x50
je 0x140094bd9
cmp dword [rsp], 0x51
je 0x140094bd9
cmp dword [rsp], 0x52
je 0x140094bd9
cmp dword [rsp], 0x53
je 0x140094bd9
cmp dword [rsp], 0x54
je 0x140094bd9
cmp dword [rsp], 0x55
je 0x140094bd9
jmp 0x140094bdd
cmp dword [rsp], 0x6c
jg 0x140094b75
cmp dword [rsp], 0x6c
je 0x140094bd9
cmp dword [rsp], 0x64
jg 0x140094b41
cmp dword [rsp], 0x64
je 0x140094bd9
cmp dword [rsp], 0x57
je 0x140094bd9
cmp dword [rsp], 0x58
je 0x140094bd9
cmp dword [rsp], 0x59
je 0x140094bd9
cmp dword [rsp], 0x5a
je 0x140094bd9
cmp dword [rsp], 0x5f
je 0x140094bd9
cmp dword [rsp], 0x61
je 0x140094bd9
cmp dword [rsp], 0x62
je 0x140094bd9
cmp dword [rsp], 0x63
je 0x140094bd9
jmp 0x140094bdd
cmp dword [rsp], 0x65
je 0x140094bd9
cmp dword [rsp], 0x66
je 0x140094bd9
cmp dword [rsp], 0x67
je 0x140094bd9
cmp dword [rsp], 0x68
je 0x140094bd9
cmp dword [rsp], 0x69
je 0x140094bd9
cmp dword [rsp], 0x6a
je 0x140094bd9
cmp dword [rsp], 0x6b
je 0x140094bd9
jmp 0x140094bdd
cmp dword [rsp], 0x74
jg 0x140094bad
cmp dword [rsp], 0x74
je 0x140094bd9
cmp dword [rsp], 0x6d
je 0x140094bd9
cmp dword [rsp], 0x6e
je 0x140094bd9
cmp dword [rsp], 0x6f
je 0x140094bd9
cmp dword [rsp], 0x70
je 0x140094bd9
cmp dword [rsp], 0x71
je 0x140094bd9
cmp dword [rsp], 0x72
je 0x140094bd9
cmp dword [rsp], 0x73
je 0x140094bd9
jmp 0x140094bdd
cmp dword [rsp], 0x75
je 0x140094bd9
cmp dword [rsp], 0x76
je 0x140094bd9
cmp dword [rsp], 0x77
je 0x140094bd9
cmp dword [rsp], 0x78
je 0x140094bd9
cmp dword [rsp], 0x79
je 0x140094bd9
cmp dword [rsp], 0x7a
je 0x140094bd9
cmp dword [rsp], 0x7e
je 0x140094bd9
jmp 0x140094bdd
mov al, 1
jmp 0x140094bdf
xor al, al
add rsp, 0x18
ret
Function at 0x140097594
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
cmp dword [rsp + 0x48], 0
je 0x1400975b2
mov dword [rsp + 0x20], 1
jmp 0x1400975ba
mov dword [rsp + 0x20], 0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x38
ret

Function at 0x14009adec
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x140146de8]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x30], 0x3e8
lea rcx, [rsp + 0x60]
call fcn.1400727c4
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x80], xmm0
mov rcx, qword [rsp + 0xb0]
call fcn.1400e84e0
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0xb8]
call fcn.1400e84e0
mov qword [rsp + 0x28], rax
mov r8d, 1
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x14009aeb2
cmp qword [rsp + 0x20], 0
je 0x14009ae86
mov rcx, qword [rsp + 0x20]
call fcn.1400bb560
mov qword [rsp + 0x20], 0
xor eax, eax
test eax, eax
jne 0x14009ae6b
cmp qword [rsp + 0x28], 0
je 0x14009aea7
mov rcx, qword [rsp + 0x28]
call fcn.1400bb560
mov qword [rsp + 0x28], 0
xor eax, eax
test eax, eax
jne 0x14009ae8c
jmp 0x14009af54
movups xmm0, xmmword [rsp + 0x80]
movdqu xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x70]
call fcn.1400727c4
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140072890
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jl 0x14009aefb
movsxd rax, dword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jle 0x14009af44
cmp qword [rsp + 0x20], 0
je 0x14009af16
mov rcx, qword [rsp + 0x20]
call fcn.1400bb560
mov qword [rsp + 0x20], 0
xor eax, eax
test eax, eax
jne 0x14009aefb
cmp qword [rsp + 0x28], 0
je 0x14009af37
mov rcx, qword [rsp + 0x28]
call fcn.1400bb560
mov qword [rsp + 0x28], 0
xor eax, eax
test eax, eax
jne 0x14009af1c
mov eax, 1
jmp 0x14009af56
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14009ae51
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400ab3a0
add rsp, 0xa8
ret
Function at 0x1400a935c
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1400a93b1
mov rax, qword [rsp + 0x40]
add rax, 8
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
xor eax, eax
add rsp, 0x38
ret

Function at 0x1400a93c0
Capabilities:
Hash data via wincrypt

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
add rsp, 0x28
ret

Function at 0x1400bb2e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rcx
test rax, 7
je 0x1400bb2fd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1400bb358
test al, 7
jne 0x1400bb2f0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1400bb311
mov rdx, qword [rax - 8]
test dl, dl
je 0x1400bb382
test dh, dh
je 0x1400bb37c
shr rdx, 0x10
test dl, dl
je 0x1400bb376
test dh, dh
je 0x1400bb370
shr rdx, 0x10
test dl, dl
je 0x1400bb36a
test dh, dh
je 0x1400bb364
shr edx, 0x10
test dl, dl
je 0x1400bb35e
test dh, dh
jne 0x1400bb311
lea rax, [rcx + rax - 1]
ret
lea rax, [rcx + rax - 2]
ret
lea rax, [rcx + rax - 3]
ret
lea rax, [rcx + rax - 4]
ret
lea rax, [rcx + rax - 5]
ret
lea rax, [rcx + rax - 6]
ret
lea rax, [rcx + rax - 7]
ret
lea rax, [rcx + rax - 8]
ret

Function at 0x1400ca73c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400ca41c