joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003d3a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x138
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14003d412
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
nop dword [rax]
nop word [rax + rax]
mov edx, dword [r8 - 8]
xor edx, dword [r8]
lea r8, [r8 + 8]
btr edx, 0x1f
xor rdx, qword [r8 - 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x14003d3d0
mov ecx, dword [r10]
jmp 0x14003d513
cmp ecx, 0x270
jb 0x14003d513
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
mov rdx, qword [rbx + 8]
lea r8, [rbx + 8]
xor rdx, rax
btr edx, 0x1f
xor rdx, rax
movzx eax, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx + 0x4e0]
xor rcx, rdx
mov qword [rbx - 0x9c0], rcx
lea rbx, [r8]
sub rdi, 1
jne 0x14003d440
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov rax, qword [rbx]
nop
mov rdx, rax
lea r8, [rbx + 8]
xor rdx, qword [r8]
btr edx, 0x1f
xor rdx, rax
movzx eax, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx - 0xea0]
xor rcx, rdx
mov qword [rbx - 0x9c0], rcx
lea rbx, [r8]
sub rdi, 1
jne 0x14003d490
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 8]
mov rdi, qword [rsp]
btr edx, 0x1f
xor rdx, qword [r10 + 0x1380]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret
Function at 0x14003da20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, qword [0x14130a6d8]
mov rbx, r8
lea rsi, [rdi + 0x164]
lea rcx, [rdi + 0x16c]
mov dword [rsi], 1
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + 0x168], ebx
add rbx, 8
je 0x14003dafb
mov rax, qword [rdi]
test rax, rax
je 0x14003daab
mov rcx, qword [rax + 8]
cmp rcx, 0xffffffffffffffff
je 0x14003daab
test rsi, rsi
je 0x14003daab
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
mov r8d, ebx
mov qword [rsp + 0x20], 0
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x14003daab
cmp dword [rsp + 0x40], ebx
je 0x14003dafb
mov r8, qword [rdi + 0x18]
test r8, r8
je 0x14003daca
mov eax, dword [rdi + 8]
dec eax
test eax, 0xfffffffd
jne 0x14003daca
mov ecx, dword [rdi + 0x60]
lea rdx, [rdi + 0x64]
call r8
mov rbx, qword [rdi]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
xor al, al
mov byte [rbx], 0
mov dword [rdi + 8], 0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
mov al, 1
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400444a0
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov rax, qword [0x140cec080]
xor rax, rsp
mov qword [rbp + 8], rax
mov r12d, r9d
mov r15d, r8d
mov r14d, edx
mov esi, ecx
mov dword [0x1412d3a3c], ecx
mov dword [0x1412d3a38], edx
mov dword [0x1412d3a4c], r8d
mov dword [0x1412d3a48], r9d
xor r13d, r13d
mov qword [rbp - 0x48], r13
movdqa xmm0, xmmword [0x140ccd010]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], r13b
lea r8d, [r13 + 0xe]
lea rdx, [0x140cc9510]
lea rcx, [rbp - 0x48]
call fcn.14002caf0
nop
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rdx, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x38]
add rdi, rdx
lea rbx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rbx, qword [rbp - 0x48]
mov qword [rbp - 0x28], r13
movdqa xmm0, xmmword [0x140ccd000]
movdqu xmmword [rbp - 0x18], xmm0
mov rdx, rdi
sub rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.1400449d0
lea rax, [rbp - 0x28]
mov qword [rbp - 0x50], rax
cmp rbx, rdi
je 0x140044584
nop dword [rax]
movsx edx, byte [rbx]
lea rcx, [rbp - 0x28]
call fcn.140044870
inc rbx
cmp rbx, rdi
jne 0x140044570
mov qword [rsp + 0x60], 0x50
lea rax, [0x140044710]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp - 0x80], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
lea rax, [0x140cc9520]
mov qword [rbp - 0x60], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp - 0x58], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x140044605
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], esi
mov r9d, 0x96080000
lea r8, [0x140cc952c]
lea rdx, [0x140cc952c]
mov ecx, 8
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x1412d3a40], rax
test rax, rax
jne 0x14004466e
lea rcx, [rbp - 0x28]
call fcn.1400348d0
nop
lea rcx, [rbp - 0x48]
call fcn.14002ca90
xor eax, eax
jmp 0x1400446e4
mov edx, 0xffffffec
mov r8d, 0xa8
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowLongW]
movdqa xmm0, xmmword [0x140ccf920]
movdqu xmmword [rbp - 8], xmm0
lea rdx, [rbp - 8]
mov rcx, qword [0x1412d3a40]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov edx, 5
mov rcx, qword [0x1412d3a40]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1412d3a40]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [0x1412d3a40]
call qword [sym.imp.USER32.dll_BringWindowToTop]
lea rcx, [rbp - 0x28]
call fcn.1400348d0
nop
lea rcx, [rbp - 0x48]
call fcn.14002ca90
mov eax, 1
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.140138a50
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400455b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1d], 0
je 0x1400455d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1c
jb 0x1400455c0
mov byte [rcx + 0x1d], 0
mov rax, rcx
ret
Function at 0x140049250
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
je 0x140049273
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1b
jb 0x140049260
mov byte [rcx + 0x1c], 0
mov rax, rcx
ret

Function at 0x140049280
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x22], 0
je 0x1400492a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x21
jb 0x140049290
mov byte [rcx + 0x22], 0
mov rax, rcx
ret

Function at 0x1400492e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x140049303
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x1400492f0
mov byte [rcx + 3], 0
mov rax, rcx
ret
Function at 0x140056370
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1e], 0
je 0x140056393
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1d
jb 0x140056380
mov byte [rcx + 0x1e], 0
ret

Function at 0x1400563a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor edx, edx
cmp byte [rcx + 0x1e], dl
je 0x1400563d4
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 - 0x2d]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x1d
jb 0x1400563c0
mov byte [rcx + 0x1e], dl
lea rax, [rcx + 0x1d]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dl
cmp rcx, rax
je 0x1400563ff
mov rdx, rcx
mov r8d, Ordinal_32
mov rcx, rbx
call fcn.14002caf0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140056410
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x140056433
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x140056420
mov byte [rcx + 3], 0
ret

Function at 0x140056440
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x28], 0
je 0x140056463
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x27
jb 0x140056450
mov byte [rcx + 0x28], 0
ret

Function at 0x140056470
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2f], 0
je 0x140056493
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2e
jb 0x140056480
mov byte [rcx + 0x2f], 0
ret

Function at 0x1400564a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x25], 0
je 0x1400564c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x24
jb 0x1400564b0
mov byte [rcx + 0x25], 0
ret

Function at 0x1400564d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2a], 0
je 0x1400564f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x29
jb 0x1400564e0
mov byte [rcx + 0x2a], 0
ret

Function at 0x140056500
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x22], 0
je 0x140056523
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x21
jb 0x140056510
mov byte [rcx + 0x22], 0
ret

Function at 0x140056530
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x24], 0
je 0x140056553
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x23
jb 0x140056540
mov byte [rcx + 0x24], 0
ret
Function at 0x140056560
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor edx, edx
cmp byte [rcx + 0x1a], dl
je 0x140056594
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x1f]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x19
jb 0x140056580
mov byte [rcx + 0x1a], dl
lea rax, [rcx + 0x19]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dl
cmp rcx, rax
je 0x1400565bf
mov rdx, rcx
mov r8d, Ordinal_27
mov rcx, rbx
call fcn.14002caf0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1400565d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor edx, edx
cmp byte [rcx + 0xa], dl
je 0x140056604
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x1f]
xor byte [r8 + rcx], al
inc r8
cmp r8, 9
jb 0x1400565f0
mov byte [rcx + 0xa], dl
lea rax, [rcx + 9]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dl
cmp rcx, rax
je 0x14005662f
mov rdx, rcx
mov r8d, 9
mov rcx, rbx
call fcn.14002caf0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140056640
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
je 0x140056663
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1b
jb 0x140056650
mov byte [rcx + 0x1c], 0
ret

Function at 0x140056670
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor edx, edx
cmp byte [rcx + 0x1c], dl
je 0x1400566a4
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 - 0x2d]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x1b
jb 0x140056690
mov byte [rcx + 0x1c], dl
lea rax, [rcx + 0x1b]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dl
cmp rcx, rax
je 0x1400566cf
mov rdx, rcx
mov r8d, reloc.WLDAP32.dll_Ordinal_27
mov rcx, rbx
call fcn.14002caf0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1400566e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor edx, edx
cmp byte [rcx + 9], dl
je 0x140056714
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x1f]
xor byte [r8 + rcx], al
inc r8
cmp r8, 8
jb 0x140056700
mov byte [rcx + 9], dl
lea rax, [rcx + 8]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dl
cmp rcx, rax
je 0x14005673f
mov rdx, rcx
mov r8d, 8
mov rcx, rbx
call fcn.14002caf0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140056750
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x26], 0
je 0x140056773
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x25
jb 0x140056760
mov byte [rcx + 0x26], 0
ret
Function at 0x140056780
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor edx, edx
cmp byte [rcx + 0x1f], dl
je 0x1400567b4
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x1f]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x1e
jb 0x1400567a0
mov byte [rcx + 0x1f], dl
lea rax, [rcx + 0x1e]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dl
cmp rcx, rax
je 0x1400567df
mov rdx, rcx
mov r8d, reloc.WLDAP32.dll_Ordinal_30
mov rcx, rbx
call fcn.14002caf0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1400567f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor edx, edx
cmp byte [rcx + 0x18], dl
je 0x140056824
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x1f]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x17
jb 0x140056810
mov byte [rcx + 0x18], dl
lea rax, [rcx + 0x17]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dl
cmp rcx, rax
je 0x14005684f
mov rdx, rcx
mov r8d, reloc.WS2_32.dll_socket
mov rcx, rbx
call fcn.14002caf0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140056860
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor edx, edx
cmp byte [rcx + 7], dl
je 0x140056894
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x1f]
xor byte [r8 + rcx], al
inc r8
cmp r8, 6
jb 0x140056880
mov byte [rcx + 7], dl
lea rax, [rcx + 6]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dl
cmp rcx, rax
je 0x1400568bf
mov rdx, rcx
mov r8d, 6
mov rcx, rbx
call fcn.14002caf0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1400568d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor edx, edx
cmp byte [rcx + 0xb], dl
je 0x140056904
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x1f]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0xa
jb 0x1400568f0
mov byte [rcx + 0xb], dl
lea rax, [rcx + 0xa]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dl
cmp rcx, rax
je 0x14005692f
mov rdx, rcx
mov r8d, 0xa
mov rcx, rbx
call fcn.14002caf0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140056940
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1d], 0
je 0x140056963
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1c
jb 0x140056950
mov byte [rcx + 0x1d], 0
ret
Function at 0x140056970
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor edx, edx
cmp byte [rcx + 0x1d], dl
je 0x1400569a4
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 - 0x2d]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x1c
jb 0x140056990
mov byte [rcx + 0x1d], dl
lea rax, [rcx + 0x1c]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dl
cmp rcx, rax
je 0x1400569cf
mov rdx, rcx
mov r8d, Ordinal_32
mov rcx, rbx
call fcn.14002caf0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1400569e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor edx, edx
cmp byte [rcx + 0x16], dl
je 0x140056a14
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x1f]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x15
jb 0x140056a00
mov byte [rcx + 0x16], dl
lea rax, [rcx + 0x15]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dl
cmp rcx, rax
je 0x140056a3f
mov rdx, rcx
mov r8d, reloc.WS2_32.dll_setsockopt
mov rcx, rbx
call fcn.14002caf0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140056a50
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor edx, edx
cmp byte [rcx + 0x19], dl
je 0x140056a84
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x1f]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x18
jb 0x140056a70
mov byte [rcx + 0x19], dl
lea rax, [rcx + 0x18]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dl
cmp rcx, rax
je 0x140056aaf
mov rdx, rcx
mov r8d, Ordinal_27
mov rcx, rbx
call fcn.14002caf0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140056ac0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor edx, edx
cmp byte [rcx + 0x13], dl
je 0x140056af4
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x1f]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x12
jb 0x140056ae0
mov byte [rcx + 0x13], dl
lea rax, [rcx + 0x12]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dl
cmp rcx, rax
je 0x140056b1f
mov rdx, rcx
mov r8d, reloc.WS2_32.dll_select
mov rcx, rbx
call fcn.14002caf0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140056b30
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor edx, edx
cmp byte [rcx + 0x15], dl
je 0x140056b64
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x1f]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x14
jb 0x140056b50
mov byte [rcx + 0x15], dl
lea rax, [rcx + 0x14]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dl
cmp rcx, rax
je 0x140056b8f
mov rdx, rcx
mov r8d, reloc.WS2_32.dll_sendto
mov rcx, rbx
call fcn.14002caf0
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140056ba0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor edx, edx
cmp byte [rcx + 0xe], dl
je 0x140056bd4
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x1f]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0xd
jb 0x140056bc0
mov byte [rcx + 0xe], dl
lea rax, [rcx + 0xd]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dl
cmp rcx, rax
je 0x140056bff
mov rdx, rcx
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
call fcn.14002caf0
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400709b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x140070b44
mov r15, qword [rsp + 0x60]
lea r9d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x140070b44
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r9w, dx
jae 0x140070a4b
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x140070b6b
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x140070a62
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x140070a62
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140070a75
movzx r8d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x140070ac2
mov r8d, eax
cmp eax, 0x800
jae 0x140070a8f
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x140070ac2
cmp eax, 0x10000
jae 0x140070aa9
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x140070ac2
shr r8d, 0x12
mov r10d, 3
movzx r11d, sil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r9d
cmp rdx, rcx
jl 0x140070b44
add qword [r14], 2
test sil, sil
jne 0x140070ae3
cmp r10d, 3
jae 0x140070aef
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
test r9d, r9d
je 0x140070b21
lea r8d, [r10 + r10*2]
add r8d, r8d
nop dword [rax + rax]
sub r8d, 6
mov edx, eax
mov ecx, r8d
dec r9d
shr edx, cl
mov rcx, qword [rbx]
and dl, 0x3f
or dl, 0x80
mov byte [rcx], dl
inc qword [rbx]
test r9d, r9d
jg 0x140070b00
shr eax, 0xa
mov r9d, 1
test sil, sil
mov ecx, r9d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x1400709ff
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x140070b52

Function at 0x140076650
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400766ad
lea rbx, [0x1401e86c0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140076694
cmp r10, 2
jb 0x140076694
cmp byte [r9], r8b
jne 0x140076694
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140076670
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400766ef
lea rbx, [0x1401e86c0]
cmp r8b, 0x23
jne 0x1400766d3
cmp byte [r9], r8b
jne 0x1400766d3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400766c0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x140076830
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14007684a
mov qword [r8], 0
lea rdx, [0x140cc9720]
call fcn.140076700
mov rbx, rax
test rax, rax
jne 0x14007686a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140076955
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140076955
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140076955
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140076955
cmp rdi, 0xffffffffffffffff
je 0x140076955
mov rax, qword [0x1412d40b8]
test rax, rax
je 0x1400768e6
inc dword [rax + 0x3b4]
mov rdx, qword [0x1412d40c0]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rsi, rax
test rax, rax
je 0x140076955
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140076942
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1412d40b8]
test rax, rax
je 0x140076931
dec dword [rax + 0x3b4]
mov rdx, qword [0x1412d40c0]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x14007695e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140076950
mov qword [r14], rdi
mov rax, rsi
jmp 0x140076960
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret