joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b5550
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rbp, rdx
mov r15, rcx
mov r12, qword [rdx + 8]
sub r12, qword [rdx]
call fcn.1400b0730
mov rsi, rax
lea rcx, [rax + 0x28]
call fcn.14025d0d0
test eax, eax
jne 0x1400b56df
mov rdi, qword [rsi + 8]
test rdi, rdi
je 0x1400b55aa
mov rax, qword [rdi]
mov qword [rsi + 8], rax
lea rcx, [rsi + 0x28]
call fcn.14025d0f4
jmp 0x1400b55c3
mov rcx, rsi
call fcn.1400ad590
mov rdi, rax
lea rcx, [rsi + 0x28]
call fcn.14025d0f4
test rdi, rdi
je 0x1400b55d6
mov r8, r14
mov rdx, rbp
mov rcx, rdi
call fcn.1400aa390
mov rsi, rax
jmp 0x1400b55d8
xor esi, esi
mov qword [rsp + 0x58], rsi
lea rdi, [r15 + 0x100d8]
lea rbx, [rdi + 0x28]
mov qword [rsp + 0x68], rbx
mov rcx, rbx
call fcn.14025d0d0
test eax, eax
jne 0x1400b56d7
mov rcx, qword [rdi + 0x20]
mov rdx, qword [rdi + 0x18]
mov r8, rcx
lea eax, [rcx + rdx]
test al, 1
jne 0x1400b5631
lea rax, [rcx + 2]
shr rax, 1
cmp qword [rdi + 0x10], rax
ja 0x1400b5631
mov edx, 1
mov rcx, rdi
call fcn.1400a1ca0
mov rdx, qword [rdi + 0x18]
mov r8, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x10]
lea rax, [rcx*2 - 1]
and rax, rdx
mov qword [rdi + 0x18], rax
lea rbp, [rax + r8]
dec rcx
mov rax, rbp
shr rax, 1
and rcx, rax
lea r14, [rcx*8]
mov rcx, qword [rdi + 8]
cmp qword [rcx + r14], 0
jne 0x1400b5680
mov ecx, reloc.WS2_32.dll_recv
call fcn.14025e2ec
mov rcx, rax
mov rax, qword [rdi + 8]
mov qword [r14 + rax], rcx
mov rcx, qword [rdi + 8]
and ebp, 1
mov rcx, qword [r14 + rcx]
mov qword [rcx + rbp*8], rsi
inc qword [rdi + 0x20]
mov rcx, rbx
call fcn.14025d0f4
nop
mov rcx, qword [r15 + 0x10050]
mov rcx, qword [rcx + 0x30]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x1402f466c]
mov rcx, qword [rcx + 0x178]
call sub.WS2_32.dll_send
mov eax, r12d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ecx, eax
call fcn.14025d438
nop
mov ecx, eax
call fcn.14025d438
int3

Function at 0x1400b56f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbp, rcx
lea rbx, [rcx + 0x101b8]
mov qword [rsp + 0x30], rbx
mov rcx, rbx
call fcn.14025d0d0
test eax, eax
jne 0x1400b5786
mov rdx, qword [rsi]
mov rsi, qword [rsi + 8]
sub rsi, rdx
mov r8d, esi
mov rcx, qword [rbp + 0x101b0]
call fcn.1400b8010
mov edi, eax
mov rcx, qword [rbp + 0x10050]
mov rcx, qword [rcx + 0x30]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x1402f466c]
mov rcx, qword [rcx + 0x178]
call sub.WS2_32.dll_send
test edi, edi
cmove edi, esi
mov rcx, rbx
call fcn.14025d0f4
mov eax, edi
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov ecx, eax
call fcn.14025d438
int3
Function at 0x1400b5790
Capabilities:
Send data
Send data on socket

Disassembly:
cmp byte [rcx + 0x10190], 0
mov r9, r8
jne fcn.1400b5550
lea r8, [rcx + 0x10170]
cmp word [r8], 0
jne 0x1400b57c5
movups xmm0, xmmword [rcx + 0x10150]
movups xmmword [r8], xmm0
movups xmm1, xmmword [rcx + 0x10160]
movups xmmword [r8 + 0x10], xmm1
mov rax, qword [rcx]
jmp qword [rax + Ordinal_26]

Function at 0x1400b57d0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140398b38]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea r8, str._yasio__warning__io_transport_doesnt_support_write_to_operation__n
mov edx, reloc.WLDAP32.dll_Ordinal_127
lea rcx, [rsp + 0x20]
call fcn.140089000
cmp qword [rax + 0x18], 0x10
jb 0x1400b5803
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400b5845
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b5840
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b5859
call fcn.14025e328
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14025e930
add rsp, 0x58
ret
call fcn.14026d254
int3
Function at 0x1400b5860
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r9
mov r14, r8
mov rbp, rdx
mov r15, rcx
mov r13, qword [rdx + 8]
sub r13, qword [rdx]
call fcn.1400b0870
mov rsi, rax
lea rcx, [rax + 0x28]
call fcn.14025d0d0
test eax, eax
jne 0x1400b5a1d
mov rdi, qword [rsi + 8]
test rdi, rdi
je 0x1400b58c3
mov rax, qword [rdi]
mov qword [rsi + 8], rax
lea rcx, [rsi + 0x28]
call fcn.14025d0f4
jmp 0x1400b58dc
mov rcx, rsi
call fcn.1400ad590
mov rdi, rax
lea rcx, [rsi + 0x28]
call fcn.14025d0f4
test rdi, rdi
je 0x1400b5910
mov r8, r12
mov rdx, rbp
mov rcx, rdi
call fcn.1400aa390
lea rax, vtable.yasio::inet::io_sendto_op.0
mov qword [rdi], rax
xorps xmm0, xmm0
movups xmmword [rdi + 0x68], xmm0
movups xmmword [rdi + 0x78], xmm0
movups xmm0, xmmword [r14]
movups xmmword [rdi + 0x68], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rdi + 0x78], xmm1
mov qword [rsp + 0x68], rdi
lea rsi, [r15 + 0x100d8]
lea rbx, [rsi + 0x28]
mov qword [rsp + 0x20], rbx
mov rcx, rbx
call fcn.14025d0d0
test eax, eax
jne 0x1400b5a15
mov rcx, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x18]
mov r8, rcx
lea eax, [rcx + rdx]
test al, 1
jne 0x1400b5969
lea rax, [rcx + 2]
shr rax, 1
cmp qword [rsi + 0x10], rax
ja 0x1400b5969
mov edx, 1
mov rcx, rsi
call fcn.1400a1ca0
mov rdx, qword [rsi + 0x18]
mov r8, qword [rsi + 0x20]
mov rcx, qword [rsi + 0x10]
lea rax, [rcx*2 - 1]
and rax, rdx
mov qword [rsi + 0x18], rax
lea rbp, [rax + r8]
dec rcx
mov rax, rbp
shr rax, 1
and rcx, rax
lea r14, [rcx*8]
mov rcx, qword [rsi + 8]
cmp qword [rcx + r14], 0
jne 0x1400b59b8
mov ecx, reloc.WS2_32.dll_recv
call fcn.14025e2ec
mov rcx, rax
mov rax, qword [rsi + 8]
mov qword [r14 + rax], rcx
mov rcx, qword [rsi + 8]
and ebp, 1
mov rcx, qword [r14 + rcx]
mov qword [rcx + rbp*8], rdi
inc qword [rsi + 0x20]
mov rcx, rbx
call fcn.14025d0f4
nop
mov rcx, qword [r15 + 0x10050]
mov rcx, qword [rcx + 0x30]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x1402f466c]
mov rcx, qword [rcx + 0x178]
call sub.WS2_32.dll_send
mov eax, r13d
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, eax
call fcn.14025d438
nop
mov ecx, eax
call fcn.14025d438
int3

Function at 0x1400b5ba0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov rcx, qword [rdi]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
jne 0x1400b5bdd
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 4
je 0x1400b5bb0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], 1
mov edx, 0x8004667e
mov rcx, rax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1400b5c90
Capabilities:
Connect socket

Disassembly:
movzx r8d, byte [rdx + 0x1c]
mov rcx, qword [rcx]
jmp qword [sym.imp.WS2_32.dll_connect]
Function at 0x1400b5ca0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx]
lea r8, [rsp + 0x30]
mov rdi, rdx
mov dword [rsp + 0x30], 1
mov rcx, rbx
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
movzx r8d, byte [rdi + 0x1c]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_connect]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400b5cf0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov dword [rsp + 0x38], 1
mov edx, 0x8004667e
lea r8, [rsp + 0x38]
mov rdi, rcx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
movzx r8d, byte [rbx + 0x1c]
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.WS2_32.dll_connect]

Function at 0x1400b5d40
Capabilities:
Connect socket

Disassembly:
sub rsp, 0xb8
mov rax, qword [0x140398b38]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rcx, qword [rcx]
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
mov r8d, Ordinal_133
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
call qword [sym.imp.WS2_32.dll_connect]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14025e930
add rsp, 0xb8
ret

Function at 0x1400b5dc0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
lea r9, [rsp + 0x48]
movzx eax, dl
mov r8d, 0xfffffffb
mov edx, 0xffff
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret
Function at 0x1400b5e70
Capabilities:
Get hostname
Print debug messages
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x140398b38]
xor rax, rsp
mov qword [rbp + 0xd0], rax
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_01b05ae6d6dfe9e227a2332d7ac0cede___bool__struct_yasio::inet::ip::endpoint_const____ptr64_.0
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x70], rax
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.1402612c0
mov edx, 0x100
lea rcx, [rbp - 0x30]
call qword [sym.imp.WS2_32.dll_gethostname]
mov qword [rsp + 0x28], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x78]
xor edx, edx
lea rcx, [rbp - 0x30]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x1400b5fb6
nop dword [rax]
mov rbx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x20]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
mov r8, rbx
lea rcx, [rbp - 0x58]
call fcn.140260c10
mov byte [rbp - 0x3c], bl
movzx eax, word [rbp - 0x58]
test ax, ax
je 0x1400b5fa1
cmp eax, 2
je 0x1400b5f77
cmp eax, 0x17
jne 0x1400b5fa1
movzx eax, byte [rbp - 0x50]
and eax, 0xf0
je 0x1400b5fa1
cmp eax, 0xf0
jmp 0x1400b5f83
cmp byte [rbp - 0x54], 0x7f
je 0x1400b5fa1
cmp word [rbp - 0x54], 0xfea9
je 0x1400b5fa1
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400b605d
mov rax, qword [rcx]
lea rdx, [rbp - 0x58]
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
jne 0x1400b5faa
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x1400b5f30
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400b5fd1
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov r9d, dword [rsp + 0x20]
lea r8, str._yasio_xxsocket::getipsv:_flags_d_n
mov edx, reloc.WLDAP32.dll_Ordinal_127
lea rcx, [rbp - 0x58]
call fcn.140089000
cmp qword [rax + 0x18], 0x10
jb 0x1400b5ff5
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400b6035
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b6030
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b6063
call fcn.14025e328
mov eax, dword [rsp + 0x20]
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.14025e930
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.14025b99c
nop
call fcn.14026d254
int3
Function at 0x1400b6090
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [rcx]
lea r8, [rsp + 0x30]
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0x20
movups xmmword [rdx], xmm0
mov rbx, rdx
movups xmmword [rdx + 0x10], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
movzx eax, byte [rsp + 0x30]
mov byte [rbx + 0x1c], al
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1400b61d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
lea rax, [rsp + 0x40]
mov rbx, r9
mov qword [rsp + 0x28], rax
mov r9d, dword [rsp + 0x60]
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x40], 0x20
call qword [sym.imp.WS2_32.dll_recvfrom]
movzx ecx, byte [rsp + 0x40]
mov byte [rbx + 0x1c], cl
add rsp, 0x30
pop rbx
ret
Function at 0x1400b64c0
Capabilities:
Resolve dns

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x90
mov rax, qword [0x140398b38]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
mov dword [rsp + 0x4c], reloc.WS2_32.dll_socket
mov rbx, rdx
mov dword [rsp + 0x50], r9d
xor edx, edx
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x74], edx
xorps xmm0, xmm0
mov dword [rsp + 0x48], edx
xorps xmm1, xmm1
mov qword [rsp + 0x20], rdx
mov rsi, rcx
mov word [rsp + 0x7c], ax
movdqu xmmword [rsp + 0x54], xmm0
movdqu xmmword [rsp + 0x64], xmm1
test r8w, r8w
je 0x1400b653c
movzx r8d, r8w
lea rdx, [0x1402f5180]
lea rcx, [rsp + 0x78]
call fcn.140084b10
lea rdx, [rsp + 0x78]
lea r9, [rsp + 0x20]
mov rcx, rbx
lea r8, [rsp + 0x48]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov rbx, qword [rsp + 0x20]
mov ebp, eax
test rbx, rbx
je 0x1400b65e8
mov qword [rsp + 0xb0], rdi
mov ecx, dword [rbx + 4]
cmp ecx, 0x17
je 0x1400b6574
cmp ecx, 2
jne 0x1400b65ca
mov rdi, qword [rbx + 0x10]
lea rcx, [rsp + 0x28]
mov rdx, qword [rbx + 0x20]
xorps xmm0, xmm0
mov r8, rdi
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
call fcn.140260c10
mov rdx, qword [rsi + 8]
mov byte [rsp + 0x44], dil
cmp rdx, qword [rsi + 0x10]
je 0x1400b65bd
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
add qword [rsi + 8], 0x20
jmp 0x1400b65ca
lea r8, [rsp + 0x28]
mov rcx, rsi
call fcn.1400a9800
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x1400b6567
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rdi, qword [rsp + 0xb0]
mov eax, ebp
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14025e930
add rsp, 0x90
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400b6610
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
lea r9, [rsp + 0x48]
movzx eax, dl
mov r8d, 4
mov edx, 0xffff
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x1400b6670
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x38
movzx eax, byte [r9 + 0x1c]
mov rcx, qword [rcx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r9
mov r9d, dword [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_sendto]
add rsp, 0x38
ret

Function at 0x1400b6730
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
lea r8, [rsp + 0x38]
movzx eax, dl
mov edx, 0x8004667e
mov dword [rsp + 0x38], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret
Function at 0x1400b8290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [rcx + 0x70], 0
mov r8, rcx
mov dword [rcx + 0x4c], edx
jne 0x1400b82aa
mov dword [rcx + 0x70], 1
mov dword [rcx + 0x54], edx
mov ecx, edx
jmp 0x1400b82ad
mov ecx, dword [rcx + 0x54]
mov eax, edx
sub eax, ecx
cmp eax, 0x2710
jge 0x1400b82c5
cmp eax, 0xffffd8f0
jl 0x1400b82c5
test eax, eax
js 0x1400b82e6
jmp 0x1400b82c7
mov ecx, edx
mov r9d, dword [r8 + 0x50]
add ecx, r9d
cmp edx, ecx
mov dword [r8 + 0x54], ecx
js 0x1400b82de
lea eax, [r9 + rdx]
mov dword [r8 + 0x54], eax
mov rcx, r8
jmp fcn.1400b69d0
ret

Function at 0x1400b9270
Capabilities:
Get geographical location

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140398b38]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.14009f240
nop
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.14009f140
mov rbx, rax
lea rdx, str.app_version
lea rcx, [rsp + 0x28]
call fcn.14009f920
mov rcx, rax
mov rdx, rbx
call fcn.14009f5a0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.14009f140
mov rbx, rax
lea rdx, str.country
lea rcx, [rsp + 0x28]
call fcn.14009f920
mov rcx, rax
mov rdx, rbx
call fcn.14009f5a0
xor edi, edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x50], dil
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.1400badd0
movzx ebx, al
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400b9374
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b936f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b93ac
call fcn.14025e328
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.14009f4f0
movzx eax, bl
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14025e930
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
call fcn.14026d254
nop
int3
Function at 0x1400c6110
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov r9d, 0xffffffff
mov dword [rsp + 0x28], 0x104
mov rbp, rcx
lea rax, [rsp + 0x30]
mov r8, rcx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
lea edx, [r9 + 9]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor esi, esi
test eax, eax
je 0x1400c6161
lea rbx, [rsp + 0x30]
jmp 0x1400c61d5
mov r9d, 0xffffffff
mov dword [rsp + 0x28], esi
mov r8, rbp
mov qword [rsp + 0x20], rsi
mov ecx, 0xfde9
lea edx, [r9 + 9]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
test eax, eax
je 0x1400c61c9
mov rcx, rdi
add rcx, rcx
call fcn.14027b1c8
mov rbx, rax
test rax, rax
je 0x1400c61c9
mov r9d, 0xffffffff
mov dword [rsp + 0x28], edi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
lea edx, [r9 + 9]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1400c61cc
mov rcx, rbx
call fcn.140273908
mov rbx, rsi
test rbx, rbx
je 0x1400c62d1
lea rdx, [0x1402f5ec8]
mov rcx, rbx
call fcn.14027b1b0
mov rbp, rax
lea rax, [rsp + 0x30]
cmp rbx, rax
je 0x1400c61f9
mov rcx, rbx
call fcn.140273908
test rbp, rbp
je 0x1400c62d1
xor edx, edx
mov qword [rsp + 0x250], r14
mov rcx, rbp
lea r8d, [rdx + 2]
call fcn.14027f2f8
mov rcx, rbp
mov ebx, eax
call fcn.14027f9b0
xor r8d, r8d
xor edx, edx
mov rcx, rbp
mov rdi, rax
call fcn.14027f2f8
test eax, eax
mov ecx, esi
mov r14d, 1
sets cl
test rdi, rdi
setle sil
or ecx, esi
test ebx, ebx
cmovs ecx, r14d
test ecx, ecx
jne 0x1400c62c7
lea rcx, [rdi + 2]
call fcn.1400c1e30
mov rsi, rax
test rax, rax
je 0x1400c62c7
mov r9, rbp
mov r8, rdi
mov edx, r14d
mov rcx, rax
call fcn.14027efc0
mov rcx, rbp
mov rbx, rax
call fcn.14027af90
cmp rbx, rdi
je 0x1400c62b0
mov rcx, qword [rsi - 8]
call fcn.140273908
xor eax, eax
mov r14, qword [rsp + 0x250]
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
cmp byte [rsi + rdi - 1], 0xa
je 0x1400c62be
mov byte [rsi + rdi], 0xa
inc rdi
mov byte [rsi + rdi], 0
mov rax, rsi
jmp 0x1400c628f
mov rcx, rbp
call fcn.14027af90
jmp 0x1400c628d
xor eax, eax
jmp 0x1400c6297
Function at 0x14011cbf0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov ebx, dword [rcx + 0x9668]
mov r11, rdx
mov edx, dword [rcx + 0x9660]
xor r9d, r9d
mov r10d, edx
sub r10d, ebx
cmp dword [rcx + 0x6420], 2
jne 0x14011cc31
movsxd r8, dword [rcx + 0x5fb8]
mov rax, qword [rcx + 0x6130]
cmp word [rax + r8*2], r9w
jne 0x14011cc31
cmp edx, ebx
cmovg r10d, r9d
mov edx, 1
cmp dword [rcx + 0x966c], r9d
je 0x14011cc65
movsxd r8, dword [rcx + 0x60d0]
mov rax, qword [rcx + 0x6118]
cmp byte [r8 + rax], 2
je 0x14011cc62
mov rax, qword [rcx + 0x6130]
test byte [rax + r8*2], 0x3f
je 0x14011cc65
mov r9d, edx
lea rbx, [0x140000000]
test r10d, r10d
je 0x14011ccd5
lea r8d, [r10 + r10]
sub edx, r8d
cmovns r8d, edx
dec r8d
cmp r8d, 0x33
jl 0x14011cc96
cmp r8d, 0x34
je 0x14011cc96
mov eax, 0x67
sub eax, r8d
mov r8d, eax
movsxd rcx, r9d
sar r9d, 1
add r9d, 2
movzx edx, byte [rcx + r11 + 0x80]
movzx eax, byte [rbx + rdx*2 + 0x2fee31]
xor rdx, 1
mov byte [rcx + r11 + 0x80], al
movzx edx, word [rbx + rdx*2 + 0x2fef70]
add edx, dword [r11 + 0x40]
mov dword [r11 + 0x40], edx
sub r8d, 1
jne 0x14011cc96
jmp 0x14011ccd9
mov edx, dword [r11 + 0x40]
movsxd rax, r9d
movzx ecx, byte [rax + r11 + 0x80]
movzx eax, word [rbx + rcx*2 + 0x2fef70]
mov rbx, qword [rsp + 8]
add eax, edx
mov dword [r11 + 0x40], eax
ret

Function at 0x14011cd00
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
movsxd rax, r9d
lea rbx, [0x140000000]
mov r10, rdx
mov rdx, rcx
movzx ecx, byte [rax + rbx + 0x31abd8]
movsxd rax, r8d
lea r8, [rax + rax*4]
xor eax, eax
lea r9, [r8*8]
lea r8, [r9 + rcx]
cmp byte [r8 + rdx + 0x939f], al
jle 0x14011cd4d
cmp byte [rcx + rdx + 0x95cf], al
mov r11d, 1
cmove eax, r11d
cmp byte [r8 + rdx + 0x9398], 0
jle 0x14011cd65
cmp byte [rcx + rdx + 0x95c8], 0
jne 0x14011cd65
add eax, 2
add rcx, r9
movsx r9d, byte [rcx + rdx + 0x93a0]
test r9d, r9d
jle 0x14011cdb6
nop word [rax + rax]
movsxd rdx, eax
dec r9d
sar eax, 2
add eax, 4
movzx r8d, byte [rdx + r10 + 0x7a]
movzx ecx, byte [rbx + r8*2 + 0x2fee31]
xor r8, 1
mov byte [rdx + r10 + 0x7a], cl
movzx ecx, word [rbx + r8*2 + 0x2fef70]
add dword [r10 + 0x40], ecx
test r9d, r9d
jg 0x14011cd80
movsxd rcx, eax
movzx edx, byte [rcx + r10 + 0x7a]
movzx eax, byte [rbx + rdx*2 + 0x2fee30]
mov byte [rcx + r10 + 0x7a], al
movzx eax, word [rbx + rdx*2 + 0x2fef70]
add dword [r10 + 0x40], eax
mov rbx, qword [rsp + 8]
ret
Function at 0x14011cde0
Capabilities:
Encode data using xor

Disassembly:
movsxd rax, r8d
lea r11, [0x140000000]
mov r9, rdx
movzx r8d, byte [rax + r11 + 0x31abd8]
add r8, rcx
xor ecx, ecx
cmp byte [r8 + 0x939f], cl
movsx r10d, byte [r8 + 0x93a0]
setg cl
cmp byte [r8 + 0x9398], 0
lea eax, [rcx + 2]
cmovle eax, ecx
test r10d, r10d
jle 0x14011ce56
movsxd rdx, eax
dec r10d
sar eax, 2
add eax, 4
movzx r8d, byte [rdx + r9 + 0x7a]
movzx ecx, byte [r11 + r8*2 + 0x2fee31]
xor r8, 1
mov byte [rdx + r9 + 0x7a], cl
movzx ecx, word [r11 + r8*2 + 0x2fef70]
add dword [r9 + 0x40], ecx
test r10d, r10d
jg 0x14011ce20
movsxd rcx, eax
movzx edx, byte [rcx + r9 + 0x7a]
movzx eax, byte [r11 + rdx*2 + 0x2fee30]
mov byte [rcx + r9 + 0x7a], al
movzx eax, word [r11 + rdx*2 + 0x2fef70]
add dword [r9 + 0x40], eax
ret