joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d9df0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov edi, r8d
mov rsi, rcx
mov r9, qword [rcx]
lea ecx, [rdi - 0xd]
mov eax, 0x9b0
cmp ecx, 2
ja 0x1400d9e19
mov eax, ecx
lea rcx, [0x1402976b8]
mov rax, qword [rcx + rax*8]
mov r8, qword [r9 + 0x1e0]
lea rcx, [rsi + 0xa00]
mov rax, qword [r9 + rax]
test dl, dl
jne 0x1400d9e5f
mov edx, dword [rsi + 0xaac]
lea r10d, [rdx + 1]
mov dword [rsi + 0xaac], r10d
test rax, rax
je 0x1400d9eb9
test edx, edx
js 0x1400d9e6e
xor r10d, r10d
mov rax, qword [rax + 8]
cmp r10d, edx
jge 0x1400d9e69
inc r10d
test rax, rax
jne 0x1400d9e4c
jmp 0x1400d9e69
mov dword [rsi + 0xaac], 0
test rax, rax
je 0x1400d9eb9
mov rax, qword [rax]
xor edx, edx
cmp byte [rax], 0x2a
sete dl
lea r8, [rdx + rax]
mov dword [rsi + 0xab0], edx
lea rdx, [0x140275393]
call fcn.1400f6a20
test eax, eax
jne 0x1400d9e9b
mov dword [rsi + 0xab8], edi
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
cmp dword [r8 + 0x10], 0
je 0x1400d9fd6
mov dword [rsi + 0xab8], 0
jmp 0x1400d9e99
xor eax, eax
cmp edi, 0xd
je 0x1400d9ea2
cmp edi, 0xe
je 0x1400d9fb8
cmp edi, 0xf
je 0x1400d9e9b
cmp byte [rsi + 0xa92], 1
jne 0x1400d9f1e
cmp byte [r9 + 0xf09], 0
jne 0x1400d9eef
cmp dword [r9 + 0x9f8], 0
je 0x1400d9fc8
mov r8, qword [rsi + 0xa88]
test r8, r8
je 0x1400d9fc8
lea rdx, str.MDTM__s
call fcn.1400f6a20
test eax, eax
jne 0x1400d9e9b
mov dword [rsi + 0xab8], 0x12
jmp 0x1400d9e99
mov dword [rsi + 0xab0], 0
xor eax, eax
cmp dword [r9 + 0xbac], 2
sete al
mov dword [rsi + 0xab4], eax
cmp byte [rsi + 0x655], 1
jne 0x1400d9f74
mov r8, qword [rsi + 0xa70]
test r8, r8
je 0x1400d9f74
cmp dword [rsi + 0xa80], 0
je 0x1400d9f68
mov rax, qword [rsi + 0xa78]
mov rax, qword [rax]
cmp byte [rax], 0x2f
je 0x1400d9f74
mov dword [rsi + 0xa94], 0
jmp 0x1400d9f95
cmp dword [rsi + 0xa80], 0
je 0x1400d9ed7
mov dword [rsi + 0xa94], 1
mov rax, qword [rsi + 0xa78]
mov r8, qword [rax]
lea rdx, str.CWD__s
call fcn.1400f6a20
test eax, eax
jne 0x1400d9e9b
mov dword [rsi + 0xab8], 0x10
jmp 0x1400d9e99
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400da510
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400da760
mov rax, qword [rsi + 0xad0]
cmp rax, 0xffffffffffffffff
je 0x1400da025
mov ecx, dword [r9 + 0xfa4]
and ecx, 0xffffffbf
xor edx, edx
test rax, rax
cmovg rdx, rax
shr rax, 0x39
and eax, 0xffffffc0
or eax, ecx
xor eax, 0x40
mov qword [r9 + 0xf78], rdx
mov dword [r9 + 0xfa4], eax
mov rdx, qword [rsi + 0xad0]
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400da380
mov r8, qword [rsi + 0xa88]
cmp byte [r9 + 0xf24], 1
je 0x1400da059
lea rdx, str.SIZE__s
call fcn.1400f6a20
test eax, eax
jne 0x1400d9e9b
mov dword [rsi + 0xab8], 0x18
jmp 0x1400d9e99
lea rdx, str.RETR__s
call fcn.1400f6a20
test eax, eax
jne 0x1400d9e9b
mov dword [rsi + 0xab8], 0x20
jmp 0x1400d9e99
Function at 0x1400da760
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rax, qword [rcx]
mov rcx, qword [rax + 0x1e0]
cmp byte [rax + 0xf1c], 1
jne 0x1400da7df
cmp qword [rsi + 0xa88], 0
je 0x1400da7df
movzx edx, byte [rax + 0xf0b]
movsx r8d, byte [rsi + 0xaa8]
xor edx, 1
lea edx, [rdx*8 + 0x41]
cmp edx, r8d
je 0x1400da7df
mov dword [rcx + 0x10], 1
mov bl, byte [rax + 0xf0b]
xor bl, 1
shl bl, 3
or bl, 0x41
cmp byte [rsi + 0xaa8], bl
jne 0x1400da858
mov dword [rsi + 0xab8], 0x13
mov rax, qword [rsi]
mov rax, qword [rax + 0x1e0]
mov eax, dword [rax + 0x10]
jmp 0x1400da7e2
mov eax, dword [rcx + 0x10]
test eax, eax
je 0x1400da81a
lea rcx, [rsi + 0xa00]
cmp eax, 1
jne 0x1400da828
mov r8, qword [rsi + 0xa88]
test r8, r8
je 0x1400da81a
lea rdx, str.SIZE__s
call fcn.1400f6a20
test eax, eax
jne 0x1400da851
mov dword [rsi + 0xab8], 0x17
jmp 0x1400da84f
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.1400da890
cmp qword [rsi + 0xa88], 0
je 0x1400da81a
lea rdx, str.REST__d
xor r8d, r8d
call fcn.1400f6a20
test eax, eax
jne 0x1400da851
mov dword [rsi + 0xab8], 0x1a
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
movzx r8d, bl
lea rcx, [rsi + 0xa00]
lea rdx, str.TYPE__c
call fcn.1400f6a20
test eax, eax
jne 0x1400da851
mov dword [rsi + 0xab8], 0x13
mov byte [rsi + 0xaa8], bl
jmp 0x1400da84f

Function at 0x1400da890
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rax, qword [rcx]
mov rcx, qword [rax + 0x1e0]
cmp dword [rcx + 0x10], 0
je 0x1400da8c9
mov dword [rsi + 0xab8], 0xd
mov rcx, rsi
mov dl, 1
mov r8d, Ordinal_14
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400d9df0
cmp byte [rax + 0xf0e], 1
jne 0x1400da8e2
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400da9d0
lea rcx, [rsi + 0xa00]
cmp byte [rax + 0xf11], 1
jne 0x1400da913
mov r8, qword [rsi + 0xa88]
test r8, r8
je 0x1400da97c
cmp byte [rax + 0xf1d], 1
jne 0x1400da973
lea rdx, str.PRET_STOR__s
jmp 0x1400da9a8
mov al, byte [rsi + 0x666]
test al, al
jne 0x1400da92f
cmp byte [rsi + 0x65f], 1
jne 0x1400da92f
mov byte [rsi + 0x666], 1
mov al, 1
xor al, 1
movzx edi, al
lea rax, [rdi + rdi*4]
lea r8, str.EPSV
add r8, rax
lea rdx, [0x140275393]
call fcn.1400f6a20
test eax, eax
jne 0x1400da9bd
mov dword [rsi + 0xaac], edi
mov dword [rsi + 0xab8], 0x1e
mov rcx, qword [rsi]
lea rdx, str.Connect_data_stream_passively_n
call fcn.1400b11f0
jmp 0x1400da9bb
lea rdx, str.PRET_RETR__s
jmp 0x1400da9a8
mov r8, qword [rax + 0xc08]
test r8, r8
jne 0x1400da9a1
lea rdx, str.NLST
lea r8, str.LIST
cmp byte [rax + 0xf0d], 0
cmovne r8, rdx
lea rdx, str.PRET__s
call fcn.1400f6a20
test eax, eax
jne 0x1400da9bd
mov dword [rsi + 0xab8], 0x1d
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400db730
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov rsi, rcx
mov rax, qword [0x1402b4040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, qword [rcx]
mov rbx, qword [rcx + 0x4c8]
movaps xmm0, xmmword [0x140270080]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx + 0x70], xmm0
movaps xmmword [rdx + 0x60], xmm0
movaps xmmword [rdx + 0x50], xmm0
movaps xmmword [rdx + 0x40], xmm0
movaps xmmword [rdx + 0x30], xmm0
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
lea r8, [rsp + 0x28]
mov dword [r8], Ordinal_133
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1400db7dd
mov rcx, rsi
mov rdx, rbx
call fcn.1400b7490
lea rdx, str.Error_accept__ing_server_connect
mov rcx, rdi
call fcn.1400b14f0
mov ebx, 0x1e
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140192360
mov eax, ebx
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
ret
lea r8, [rsp + 0x28]
mov dword [r8], Ordinal_133
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_accept]
mov r14, rax
mov rcx, rsi
mov rdx, rbx
call fcn.1400b7490
cmp r14, 0xffffffffffffffff
je 0x1400db7aa
lea rdx, str.Connection_accepted_from_server_n
mov rcx, rdi
call fcn.1400b11f0
mov byte [rsi + 0x660], 0
mov qword [rsi + 0x4c8], r14
lea r8, [rsp + 0x2c]
mov dword [r8], 1
mov rcx, r14
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov byte [rsi + 0xb2c], 1
mov rax, qword [rdi + 0x728]
xor ebx, ebx
test rax, rax
je 0x1400db7be
test rdi, rdi
je 0x1400db8e4
mov rcx, qword [rdi + 0xd8]
test rcx, rcx
je 0x1400db90b
mov byte [rcx + 0x18a], 1
mov rax, qword [rdi + 0x728]
mov rcx, qword [rdi + 0x730]
mov rdx, r14
mov r8d, 1
call qword [0x1402a4f40]
mov rcx, qword [rdi + 0xd8]
test rcx, rcx
je 0x1400db8fd
mov byte [rcx + 0x18a], 0
test eax, eax
je 0x1400db7be
mov rdx, qword [rsi + 0x4c8]
cmp rdx, 0xffffffffffffffff
je 0x1400db8d3
mov rcx, rsi
call fcn.1400b7490
mov qword [rsi + 0x4c8], 0xffffffffffffffff
mov byte [rsi + 0x653], 0
mov ebx, Ordinal_46
jmp 0x1400db7be
mov rcx, qword [0x730]
mov rdx, r14
mov r8d, 1
call qword [0x1402a4f40]
jmp 0x1400db8ab
mov rcx, qword [rdi + 0xd0]
test rcx, rcx
jne 0x1400db8a4
jmp 0x1400db8ab
mov rcx, qword [rdi + 0xd0]
test rcx, rcx
jne 0x1400db874
jmp 0x1400db882
Function at 0x1400de140
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
cmp edx, 0x1f
jne 0x1400de2df
mov rdi, rcx
mov rsi, qword [rcx]
mov rbx, qword [rsi + 0x1e0]
lea r12, [rbx + 0x1eb8]
mov word [rbx + 0x1cb8], 0xfaff
lea r14, [rbx + 0x1cbb]
mov qword [rbx + 0x1eb8], r14
mov byte [rbx + 0x1cba], 0x1f
movzx ecx, word [rbx + 0x1ca8]
mov r15, qword [sym.imp.WS2_32.dll_htons]
call r15
mov ebp, eax
movzx ecx, word [rbx + 0x1caa]
call r15
mov r9, qword [rbx + 0x1eb8]
cmp r9, r12
jae 0x1400de1c1
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], bpl
mov r9, qword [r12]
cmp r9, r12
jae 0x1400de1d8
shr ebp, 8
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], bpl
mov r9, qword [r12]
cmp r9, r12
jae 0x1400de1ec
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], al
mov r9, qword [r12]
cmp r9, r12
jae 0x1400de203
shr eax, 8
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], al
mov r9, qword [r12]
cmp r9, r12
jae 0x1400de218
lea rax, [r9 + 1]
mov qword [r12], rax
mov byte [r9], 0xff
mov r9, qword [r12]
lea r15, [rbx + 0x1cb8]
lea r8, [rbx + 0x1cba]
cmp r9, r12
jae 0x1400de23b
lea rax, [r9 + 1]
mov qword [r12], rax
mov byte [r9], 0xf0
mov r9, qword [r12]
mov qword [rbx + 0x1ec0], r9
mov qword [rbx + 0x1eb8], r15
sub r9, r15
add r9, 0xfffffffffffffffe
mov rcx, rsi
mov edx, 0x3e
call fcn.1400de2f0
mov rcx, qword [rdi + 0x4c0]
mov rdx, r15
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1400de292
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.1400b14f0
mov r8d, 4
mov rcx, rdi
mov rdx, r14
call fcn.1400ddc40
add rbx, 0x1cbf
mov rcx, qword [rdi + 0x4c0]
mov rdx, rbx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1400de2df
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.1400b14f0
nop
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400eb100
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration
Start tcp server

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, r9
mov rax, qword [0x1402b4040]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x2c], 0x10
mov dword [rsp + 0x28], 1
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x40], rax
movdqa xmm0, xmmword [0x140270080]
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 2
mov edx, 1
mov r8d, 6
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
je 0x1400eb2e0
mov rdi, rax
mov qword [rsp + 0x50], 0
mov word [rsp + 0x48], 2
mov ecx, 0x7f000001
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x4c], eax
mov word [rsp + 0x4a], 0
pcmpeqd xmm0, xmm0
movdqu xmmword [rsi], xmm0
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x28]
mov rcx, rdi
mov edx, 0xffff
mov r8d, 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1400eb2a2
lea rdx, [rsp + 0x48]
mov rcx, rdi
mov r8d, 0x10
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x1400eb2a2
lea rdx, [rsp + 0x48]
lea r8, [rsp + 0x2c]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1400eb2a2
mov rcx, rdi
mov edx, 1
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x1400eb2a2
mov ecx, 2
mov edx, 1
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
je 0x1400eb2a2
lea rdx, [rsp + 0x48]
mov rcx, rax
mov r8d, 0x10
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1400eb2a2
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rsi + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1400eb2a2
lea r8, [0x140276a48]
lea rbx, [rsp + 0x30]
mov edx, Ordinal_14
mov rcx, rbx
mov r9, rsi
call fcn.1400bc740
mov rcx, rbx
call fcn.1401b3ac0
mov r14, rax
mov rcx, qword [rsi]
mov rdx, rbx
mov r8d, r14d
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cdqe
cmp r14, rax
je 0x1400eb2e7
mov rbx, qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, rdi
call rbx
mov rcx, qword [rsi]
call rbx
mov rdi, qword [rsi + 8]
mov ebx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140192360
mov eax, ebx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ebx, 0xffffffff
jmp 0x1400eb2c5
lea r15, [rsp + 0x3c]
mov rcx, qword [rsi + 8]
xor ebx, ebx
mov rdx, r15
mov r8d, Ordinal_14
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
cdqe
cmp r14, rax
jne 0x1400eb2a2
lea rcx, [rsp + 0x30]
mov rdx, r15
mov r8, r14
call fcn.1401cdb00
test eax, eax
jne 0x1400eb2a2
jmp 0x1400eb2bc
Function at 0x1400ede00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rsp + 0x90]
mov qword [rax], 0
mov rcx, qword [rcx]
xor edx, edx
mov r8b, 1
call fcn.1400b6410
test rax, rax
js 0x1400eded6
xor r12d, r12d
movabs r13, 0x7fffffffffffffff
mov r15, qword [sym.imp.WS2_32.dll_recv]
mov ebp, 0xffffffff
jmp 0x1400ede8a
movsxd rdx, eax
mov rcx, r14
sub rcx, rdx
je 0x1400edeee
test eax, eax
je 0x1400ededb
add rsi, rdx
add r12, rdx
mov r14, rcx
mov rcx, qword [rbx]
xor edx, edx
mov r8b, 1
call fcn.1400b6410
test rax, rax
js 0x1400eded6
test rax, rax
cmove rax, r13
mov rcx, rdi
mov rdx, 0xffffffffffffffff
mov r8, 0xffffffffffffffff
mov r9, rax
call fcn.1400cf1c0
test eax, eax
jle 0x1400ededb
mov rcx, rdi
mov rdx, rsi
mov r8d, r14d
xor r9d, r9d
call r15
cmp eax, 0xffffffff
jne 0x1400ede5c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x1400ede78
mov ebp, 0x38
jmp 0x1400ededb
mov ebp, 0x1c
mov eax, ebp
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add r12, r14
mov rax, qword [rsp + 0x90]
mov qword [rax], r12
xor ebp, ebp
jmp 0x1400ededb
Function at 0x1400f61e0
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov ebx, edx
mov rdi, rcx
mov rax, qword [0x1402b4040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, qword [rcx + 0x58]
mov r12, qword [r14]
mov ebp, dword [r12 + 0x798]
test ebp, ebp
jne 0x1400f621a
mov ebp, dword [rdi + 0x50]
cmp byte [0x1402c9840], 1
je 0x1400f6246
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
imul rcx, rcx, 0x10624dd3
shr rcx, 0x26
imul edx, ecx, 0x3e8
sub eax, edx
imul eax, eax, 0x3e8
jmp 0x1400f627f
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsi]
mov r8, qword [0x1402c9848]
cqo
idiv r8
mov rcx, rax
imul rax, rdx, 0xf4240
cqo
idiv r8
movsxd rsi, ebp
movabs r15, 0x7fffffffffffffff
movabs r13, 0x20c49ba5e353f6
sub rcx, qword [rdi + 0x40]
mov rdx, r15
cmp rcx, r13
jg 0x1400f62dd
movabs rdx, 0xffdf3b645a1cac0a
cmp rcx, rdx
jl 0x1400f62d9
imul rcx, rcx, 0x3e8
sub eax, dword [rdi + 0x48]
cdqe
imul rax, rax, 0x10624dd3
mov rdx, rax
shr rdx, 0x3f
sar rax, 0x26
add eax, edx
movsxd rdx, eax
add rdx, rcx
jmp 0x1400f62dd
lea rdx, [r15 + 1]
sub rsi, rdx
movsxd r12, dword [r12 + 0x788]
test r12, r12
sete al
or al, bl
jne 0x1400f6383
cmp byte [0x1402c9840], 1
je 0x1400f6322
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
imul rcx, rcx, 0x10624dd3
shr rcx, 0x26
imul edx, ecx, 0x3e8
sub eax, edx
imul eax, eax, 0x3e8
jmp 0x1400f635b
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x28]
mov qword [rdi], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rdi]
mov r8, qword [0x1402c9848]
cqo
idiv r8
mov rcx, rax
imul rax, rdx, 0xf4240
cqo
idiv r8
sub rcx, qword [r14 + 0x490]
cmp rcx, r13
jg 0x1400f6379
movabs rdx, 0xffdf3b645a1cac0a
cmp rcx, rdx
jge 0x1400f63a4
inc r15
sub r12, r15
cmp rsi, r12
cmovge rsi, r12
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140192360
mov rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
imul rcx, rcx, 0x3e8
sub eax, dword [r14 + 0x498]
cdqe
imul rax, rax, 0x10624dd3
mov rdx, rax
shr rdx, 0x3f
sar rax, 0x26
add eax, edx
movsxd r15, eax
add r15, rcx
jmp 0x1400f6379
Function at 0x1400f6790
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rax, qword [0x1402b4040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [rcx + 0x58]
test rbx, rbx
je 0x1400f6979
mov rdi, r8
mov rsi, rcx
lea rcx, str._s_r_n
call fcn.1400bc7d0
mov ebp, reloc.WLDAP32.dll_Ordinal_27
test rax, rax
je 0x1400f697e
mov r14, rax
mov rcx, rax
mov rdx, rdi
call fcn.1400bc8a0
mov rdi, rax
mov rax, qword [fcn.14018e130]
mov rcx, r14
call qword [0x1402a4f40]
test rdi, rdi
je 0x1400f697e
mov rcx, rdi
call fcn.1401b3ac0
mov r14, rax
mov r15, rax
mov rax, qword [rsi + 0x58]
mov qword [rsi + 0x10], 0
mov rax, qword [rax]
mov rax, qword [rax + 0x1128]
mov qword [rsi + 0x18], rax
mov byte [rsi + 0x20], 1
cmp byte [0x1402c9840], 1
je 0x1400f685e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
imul rcx, rcx, 0x10624dd3
shr rcx, 0x26
imul edx, ecx, 0x3e8
sub eax, edx
imul eax, eax, 0x3e8
jmp 0x1400f6899
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r12, [rsp + 0x28]
mov qword [r12], rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [r12]
mov r8, qword [0x1402c9848]
cqo
idiv r8
mov rcx, rax
imul rax, rdx, 0xf4240
cqo
idiv r8
movabs r13, 0xaaaaaaaa00000000
mov eax, eax
or rax, r13
mov qword [rsi + 0x40], rcx
mov qword [rsi + 0x48], rax
mov rax, qword [rbx + 0x4c0]
lea rcx, [rsp + 0x28]
mov dword [rcx], 0
xor edx, edx
cmp qword [rbx + 0x4c8], rax
sete dl
mov rax, qword [rbx + rdx*8 + 0x4f8]
mov qword [rsp + 0x20], rcx
mov rcx, rbx
mov r8, rdi
mov r9, r15
call qword [0x1402a4f40]
mov r12, rax
test rax, rax
js 0x1400f699e
mov rcx, qword [rbx]
cmp byte [rcx + 0xf1e], 1
jne 0x1400f6912
mov edx, 2
mov r8, rdi
mov r9, r12
call fcn.1400b13f0
sub r14, r12
jne 0x1400f6969
mov rax, qword [fcn.14018e130]
mov rcx, rdi
call qword [0x1402a4f40]
xorps xmm0, xmm0
movups xmmword [rsi + 0x28], xmm0
mov qword [rsi + 0x38], 0
cmp byte [0x1402c9840], 1
je 0x1400f69ca
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
imul rcx, rcx, 0x10624dd3
shr rcx, 0x26
imul edx, ecx, 0x3e8
sub eax, edx
imul eax, eax, 0x3e8
jmp 0x1400f6a03
mov qword [rsi + 0x28], rdi
mov qword [rsi + 0x38], r15
mov qword [rsi + 0x30], r14
xor ebp, ebp
jmp 0x1400f697e
mov ebp, 0x37
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140192360
mov eax, ebp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ebp, dword [rsp + 0x28]
test ebp, ebp
je 0x1400f69b3
cmp ebp, 0x51
jne 0x1400f69b8
xor r12d, r12d
jmp 0x1400f68f6
mov ebp, 0x37
mov rax, qword [fcn.14018e130]
mov rcx, rdi
call qword [0x1402a4f40]
jmp 0x1400f697e
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x28]
mov qword [rdi], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rdi]
mov r8, qword [0x1402c9848]
cqo
idiv r8
mov rcx, rax
imul rax, rdx, 0xf4240
cqo
idiv r8
mov eax, eax
or rax, r13
mov qword [rsi + 0x40], rcx
mov qword [rsi + 0x48], rax
jmp 0x1400f6975
Function at 0x1400fcb60
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1402b4040]
xor rax, rsp
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
mov dword [rsp + 0x20], 0xf0000040
xor r14d, r14d
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400fcbcb
lea rax, [rsp + 0x38]
mov rcx, qword [rax - 8]
mov qword [rsp + 0x20], rax
mov edx, 0x8002
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov rcx, qword [rsp + 0x38]
mov rdx, rbx
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
lea rdi, [rsp + 0x4c]
mov dword [rdi], r14d
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], r14d
mov edx, 2
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rdi], 0x10
jne 0x1400fcc27
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
mov edx, 2
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400fcc37
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400fcc49
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140192360
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400fcca0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov ebp, r8d
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1402b4040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, dword [rcx + 0x18]
mov ecx, dword [rcx + 0x20]
add eax, eax
add rcx, rax
add rcx, 0x18
mov rax, qword [fcn.1401371c0]
call qword [0x1402a4f40]
mov rdi, rax
test rax, rax
je 0x1400fce09
mov qword [rdi], rsi
lea rcx, [rdi + 0x18]
mov qword [rdi + 8], rcx
mov eax, dword [rsi + 0x18]
add rax, rdi
add rax, 0x18
mov qword [rdi + 0x10], rax
cmp dword [rsi + 0x1c], ebp
jae 0x1400fcd48
mov rax, qword [rsi]
call qword [0x1402a4f40]
mov rax, qword [rsi + 8]
mov rcx, qword [rdi + 8]
mov rdx, rbx
mov r8d, ebp
call qword [0x1402a4f40]
mov ebx, dword [rsi + 0x18]
add rbx, qword [rdi + 0x10]
mov rax, qword [rsi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, rbx
call qword [0x1402a4f40]
mov ebp, dword [rsi + 0x20]
mov rcx, qword [rdi + 8]
mov byte [rsp + 0x27], 0xaa
mov rax, qword [rsi]
call qword [0x1402a4f40]
mov rax, qword [rsi]
mov rcx, qword [rdi + 0x10]
call qword [0x1402a4f40]
mov r15d, ebp
test ebp, ebp
je 0x1400fcdbc
xor r12d, r12d
lea r14, [rsp + 0x27]
mov al, byte [rbx + r12]
xor al, 0x36
mov byte [rsp + 0x27], al
mov rax, qword [rsi + 8]
mov rcx, qword [rdi + 8]
mov rdx, r14
mov r8d, 1
call qword [0x1402a4f40]
mov al, byte [rbx + r12]
xor al, 0x5c
mov byte [rsp + 0x27], al
mov rax, qword [rsi + 8]
mov rcx, qword [rdi + 0x10]
mov rdx, r14
mov r8d, 1
call qword [0x1402a4f40]
inc r12
cmp r15, r12
jne 0x1400fcd72
cmp r15d, dword [rsi + 0x1c]
jae 0x1400fce09
lea rbx, str.6kernel32.dll
lea r14, [0x1402a12a4]
mov rax, qword [rsi + 8]
mov rcx, qword [rdi + 8]
mov rdx, rbx
mov r8d, 1
call qword [0x1402a4f40]
mov rax, qword [rsi + 8]
mov rcx, qword [rdi + 0x10]
mov rdx, r14
mov r8d, 1
call qword [0x1402a4f40]
inc r15
mov eax, dword [rsi + 0x1c]
cmp r15, rax
jb 0x1400fcdd0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140192360
mov rax, rdi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret