joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180006ee0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x18001fabc], 0
je 0x180006efd
mov eax, dword [0x18001fabc]
jmp 0x180006fc3
call sub.KERNEL32.dll_GetCurrentThread
cmp qword [rsp + 0x50], rax
jne 0x180006f10
xor eax, eax
jmp 0x180006fc3
mov ecx, 0x10
call fcn.18000840c
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x180006f7e
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x180006f63
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x38]
call fcn.180008404
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x18001fabc], eax
mov qword [0x18001fac0], 0
mov eax, dword [rsp + 0x20]
jmp 0x180006fc3
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x180006f98
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x180006f39
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x18001fac8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x18001fac8], rax
xor eax, eax
add rsp, 0x48
ret

Function at 0x180008fa0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x180000000], ax
jne 0x18000902b
movsxd rcx, dword [0x18000003c]
lea rdx, [0x180000000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x18000902b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18000902b
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x180009027
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x180009021
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jae 0x180009021
test rdx, rdx
je 0x180009027
cmp dword [rdx + 0x24], 0
jge 0x18000901d
xor al, al
jmp 0x180009031
mov al, 1
jmp 0x180009031
add rdx, 0x28
jmp 0x180008ff3
xor al, al
jmp 0x180009031
xor al, al
jmp 0x180009031
add rsp, 0x18
ret

Function at 0x140001680
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x2748
call fcn.1400026f0
sub rsp, rax
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rsp + 0x2730], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r9d, 0x10
mov byte [rsp + 0x20], 0
lea r8, [0x140004238]
xor ecx, ecx
lea rdx, [0x140004248]
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rsp + 0x20]
call fcn.140001240
xor eax, eax
mov rcx, qword [rsp + 0x2730]
xor rcx, rsp
call fcn.140001890
add rsp, 0x2748
ret

Function at 0x140002224
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000226e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000226e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000226e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000226e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000226e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002270
xor al, al
add rsp, 0x28
ret
Function at 0x458a40
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x458a4d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x458a5d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x458a45
lea eax, [rcx + 1]
jmp 0x458a6b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x458a7e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x458a64
sub eax, 3
jb 0x458a9e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x458aed
sar eax, 1
movsxd rbp, eax
jb 0x458ad4
jmp 0x458aac
add ebx, ebx
jne 0x458aaa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x458ad4
inc ecx
add ebx, ebx
jne 0x458aba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x458ad4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x458acd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x458abc
add ecx, 2
jmp 0x458ad9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00458a02
jmp 0x458a4d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2200
mov dl, 2
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x458b3d
cmp rsi, rcx
jae 0x458b45
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x458b24
cmp al, 0x8f
ja 0x458b24
cmp byte [rsi - 2], 0xf
je 0x458b2a
sub al, 0xe8
cmp al, 1
ja 0x458b0e
cmp rsi, rcx
jae 0x458b45
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x458b14
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x458b45
lodsb al, byte [rsi]
jmp 0x458b24
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x56000]
mov eax, dword [rdi]
or eax, eax
je 0x458ba2
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x58000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x458b52
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x458b9c
mov qword [rbx], rax
add rbx, 8
jmp 0x458b72
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.00458c25], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.00458c25
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x458c15
sub rsp, 0xffffffffffffff80
jmp 0x4014c0
Function at 0x1400021f0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x20], rsi
push r12
sub rsp, 0x40
lea rax, vtable.vkrREjkNPlvCrRXBScFk.0
mov rsi, rcx
mov qword [rsp + 0x50], rbx
mov qword [rcx], rax
mov rcx, qword [rcx + 0x70]
mov qword [rsp + 0x60], rdi
test rcx, rcx
je 0x14000222d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsi + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsi + 0x68]
test rcx, rcx
je 0x140002248
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsi + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsi + 0x18]
cmp qword [rsi + 0x10], rax
je 0x140002280
mov rbx, qword [rsi + 0x10]
mov rdx, rax
cmp rbx, rax
je 0x140002280
sub rax, rax
mov rcx, rbx
sar rax, 3
lea rdi, [rax*8]
mov r8, rdi
call fcn.1400187d0
lea r11, [rdi + rbx]
mov qword [rsi + 0x18], r11
xor r12d, r12d
mov edi, r12d
cmp qword [rsi + 0x58], r12
jbe 0x140002346
mov qword [rsp + 0x58], rbp
nop word [rax + rax]
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x38]
call fcn.14000ae00
mov r11, rax
mov rax, qword [rax]
test rax, rax
jne 0x1400022be
mov rax, r12
jmp 0x1400022c1
mov rax, qword [rax]
mov rbx, qword [r11 + 0x10]
mov rdx, qword [rax + 0x10]
mov rcx, rbx
and ebx, 1
shr rcx, 1
cmp rdx, rcx
ja 0x1400022da
sub rcx, rdx
mov rax, qword [rax + 8]
mov rdx, qword [rsi + 0x58]
mov rcx, qword [rax + rcx*8]
mov rbx, qword [rcx + rbx*8]
test rdx, rdx
je 0x14000231a
inc qword [rsi + 0x50]
mov rcx, qword [rsi + 0x50]
mov rax, qword [rsi + 0x48]
add rax, rax
cmp rax, rcx
lea rax, [rdx - 1]
cmovbe rcx, r12
mov qword [rsi + 0x58], rax
mov qword [rsi + 0x50], rcx
test rax, rax
jne 0x14000231a
mov qword [rsi + 0x50], r12
test rbx, rbx
je 0x140002334
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000232c
call fcn.140018b3c
mov rcx, rbx
call fcn.1400187b4
inc rdi
cmp rdi, qword [rsi + 0x58]
jb 0x1400022a0
mov rbp, qword [rsp + 0x58]
mov rax, qword [rsi + 0x58]
mov rdi, qword [rsp + 0x60]
test rax, rax
je 0x14000236c
test rax, rax
je 0x140002366
dec rax
mov qword [rsi + 0x58], rax
jne 0x140002366
mov qword [rsi + 0x50], r12
cmp qword [rsi + 0x58], r12
jne 0x140002354
mov rbx, qword [rsi + 0x48]
test rbx, rbx
je 0x14000239b
nop word [rax + rax]
mov rcx, qword [rsi + 0x40]
dec rbx
cmp qword [rcx + rbx*8], r12
je 0x140002396
mov rcx, qword [rcx + rbx*8]
call fcn.1400187b4
test rbx, rbx
jne 0x140002380
mov rcx, qword [rsi + 0x40]
mov rbx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400023ae
call fcn.1400187b4
mov rcx, qword [rsi + 0x38]
mov qword [rsi + 0x48], r12
mov qword [rsi + 0x40], r12
call fcn.1400187b4
mov qword [rsi + 0x38], r12
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x1400023d1
call fcn.1400187b4
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
mov qword [rsi + 0x20], r12
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x140002e90
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x18]
mov rbx, rcx
sub rax, qword [rcx + 0x10]
test rax, 0xfffffffffffffff8
je 0x140002f12
mov rdx, qword [rcx + 0x10]
mov rdx, qword [rdx]
call fcn.140002920
test al, al
je 0x140002f12
lea rax, [rsp + 0x40]
lea r8, [0x140001080]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x70], rax
test rax, rax
je 0x140002f12
lea rax, [rsp + 0x48]
lea r8, [0x140001060]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x68], rax
add rsp, 0x30
pop rbx
ret

Function at 0x140004480
Capabilities:
Create thread
Terminate thread

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov r12, rcx
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x30
call fcn.140018b7c
mov qword [rsp + 0x88], rax
xor r15d, r15d
test rax, rax
je 0x1400044f1
mov qword [rsp + 0x20], 0xb
lea r9, [0x140037428]
lea r8d, [r15 + 0x4a]
lea rdx, [0x140037300]
mov rcx, rax
call fcn.14000ff40
mov rbx, rax
jmp 0x1400044f4
mov rbx, r15
mov rcx, rbx
call fcn.140010470
mov rdi, rax
mov rcx, qword [r12 + 0x40]
mov r8, qword [rcx]
mov rdx, rax
call qword [r8 + 8]
test al, al
je 0x140004643
test rbx, rbx
je 0x14000452b
mov rcx, rbx
call fcn.14000ff70
mov rcx, rbx
call fcn.1400187b4
mov rcx, rdi
call fcn.140018b3c
mov rcx, r12
call fcn.140004300
mov rcx, qword [r12 + 0x18]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r13, qword [r12 + 0x50]
sub r13, qword [r12 + 0x48]
sar r13, 3
mov ebp, r13d
mov eax, 8
mul rbp
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.1400185b0
mov rsi, rax
mov eax, 4
mul rbp
cmovo rax, rbx
mov rcx, rax
call fcn.1400185b0
mov r14, rax
mov dword [rsp + 0x80], r15d
test r13d, r13d
je 0x1400045d5
mov rbx, r15
mov rdi, rax
nop
mov r9, qword [r12 + 0x48]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r15d
mov r9, qword [rbx + r9]
lea r8, [0x140003120]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + rsi], rax
add rdi, 4
add rbx, 8
dec rbp
jne 0x1400045a0
or edx, 0xffffffff
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r13d, 1
jbe 0x140004633
lea rbx, [rsi + 8]
lea edi, [r13 - 1]
nop dword [rax + rax]
lea rdx, [rsp + 0x80]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edx, dword [rsp + 0x80]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 8
dec rdi
jne 0x140004600
mov rcx, rsi
call fcn.1400194f0
mov rcx, r14
call fcn.1400194f0
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140008550
Capabilities:
Query environment variable

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x260
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x280], rbx
mov rax, qword [0x14003ae50]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, r8
mov rsi, rdx
mov qword [rsp + 0x30], rbx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
cmp qword [r8 + 0x10], rbp
jne 0x1400085bc
mov qword [rdx + 0x18], 7
mov qword [rdx + 0x10], rbp
mov word [rdx], bp
xor r8d, r8d
lea rdx, [0x14002bb08]
mov rcx, rsi
call fcn.1400039a0
nop
jmp 0x14000863e
mov word [rsp + 0x40], bp
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x42]
call fcn.140018cd0
cmp qword [rbx + 0x18], 8
jb 0x1400085df
mov rcx, qword [rbx]
jmp 0x1400085e2
mov rcx, rbx
mov r8d, 0x104
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbp
mov word [rsi], bp
test eax, eax
jne 0x14000861b
xor r8d, r8d
lea rdx, [0x14002bb08]
mov rcx, rsi
call fcn.1400039a0
nop
jmp 0x14000863e
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400039a0
nop
cmp qword [rbx + 0x18], 8
jb 0x14000864d
mov rcx, qword [rbx]
call fcn.1400187b4
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rbp
mov word [rbx], bp
mov rax, rsi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400194d0
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400088a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov qword [rbp - 0x21], 0xfffffffffffffffe
mov qword [rsp + 0xc0], rbx
mov rax, qword [0x14003ae50]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rbp - 1], rdx
mov rcx, qword [rcx + 0x78]
test rcx, rcx
je 0x1400088ea
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, [rdi + 0x18]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
call fcn.1400083e0
xor esi, esi
mov qword [rbx + 0x10], rsi
cmp qword [rbx + 0x18], 8
jb 0x14000890f
mov rax, qword [rbx]
jmp 0x140008912
mov rax, rbx
mov word [rax], si
mov dword [rbp + 0x17], 0x65006b
mov eax, WSAStartup
mov word [rbp + 0x1b], ax
mov dword [rbp + 0x1d], 0x65006e
mov dword [rbp + 0x21], 0x33006c
mov eax, 0x32
mov word [rbp + 0x25], ax
mov eax, 0x2e
mov word [rbp + 0x27], ax
mov dword [rbp + 0x29], 0x6c0064
mov dword [rbp + 0x2d], 0x6c
mov dword [rbp + 7], 0x656c6552
mov dword [rbp + 0xb], 0x4d657361
mov dword [rbp + 0xf], 0x78657475
mov byte [rbp + 0x13], sil
lea rcx, [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400089c1
mov rcx, qword [rdi + 0x78]
call rax
test eax, eax
jne 0x1400089c1
lea rax, [0x14002bed0]
mov qword [rbp - 0x29], rax
mov r8d, 2
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x19]
call fcn.1400185b8
lea rdx, [0x1400360a0]
lea rcx, [rbp - 0x19]
call fcn.140018c20
nop
cmp qword [rbx + 0x18], 8
jb 0x1400089d0
mov rcx, qword [rbx]
call fcn.1400187b4
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
mov word [rbx], si
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400194d0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000baf0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
mov rcx, qword [rcx + 0x28]
mov dword [rsp + 0x30], edi
test rcx, rcx
je 0x14000bb25
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp qword [rbx + 0x18], 8
jb 0x14000bb34
mov rcx, qword [rbx]
call fcn.1400187b4
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
mov word [rbx], di
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000d330
Capabilities:
Encode data using xor

Disassembly:
push r12
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov r12, r9
mov ebx, r8d
mov rbp, rdx
xor esi, esi
mov qword [rsp + 0x20], rsi
lea ecx, [rsi + 0x30]
call fcn.140018b7c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000d382
mov rcx, rax
call fcn.14000ff30
mov rdi, rax
jmp 0x14000d385
mov rdi, rsi
mov r8, rbx
lea r9, [rsp + 0x20]
mov rdx, rbp
mov rcx, rdi
call fcn.140010480
mov rbx, rax
test rdi, rdi
je 0x14000d3b0
mov rcx, rdi
call fcn.14000ff70
mov rcx, rdi
call fcn.1400187b4
test rbx, rbx
je 0x14000d45e
cmp qword [rsp + 0x20], 4
jb 0x14000d45e
lea rcx, [rbx + 4]
mov r9, 0xfffffffffffffffc
sub r9, rbx
mov r8d, 0xb
nop dword [rax]
lea rax, [r9 + rcx]
and eax, 3
movzx eax, byte [rax + rbx]
xor byte [rcx], al
inc rcx
dec r8
jne 0x14000d3e0
lea rax, [0x14003846c]
mov ecx, dword [rax]
cmp ecx, dword [rbx + 4]
jne 0x14000d416
movzx ecx, word [rax + 4]
cmp cx, word [rbx + 8]
jne 0x14000d416
movzx ecx, byte [rax + 6]
cmp cl, byte [rbx + 0xa]
je 0x14000d41d
sbb eax, eax
sbb eax, 0xffffffff
mov esi, eax
test esi, esi
jne 0x14000d45e
mov eax, dword [rsp + 0x20]
add eax, 0xfffffff5
mov dword [r12], eax
mov edi, eax
lea edx, [rsi + 1]
mov ecx, eax
call fcn.1400194f8
mov rsi, rax
test rax, rax
je 0x14000d45e
lea r8, [rbx + 0xb]
mov r9d, edi
mov edx, edi
mov rcx, rax
call fcn.14001953c
mov rcx, rbx
call fcn.140018b3c
mov rax, rsi
jmp 0x14000d460
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret

Function at 0x14000d480
Capabilities:
Initialize winsock library

Disassembly:
push rdi
sub rsp, 0x1e0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x1f8], rbx
mov rax, qword [0x14003ae50]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rdi, rcx
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call sub.WS2_32.dll_WSAStartup
mov ecx, 0x30
call fcn.140018b7c
mov qword [rsp + 0x20], rax
test rax, rax
je 0x14000d4df
mov rcx, rax
call fcn.14000ff30
mov rbx, rax
jmp 0x14000d4e1
xor ebx, ebx
mov dl, 1
mov rcx, rbx
call fcn.140010090
lea rcx, [rdi + 0x71]
mov r9d, 0x40
mov r8, qword [rbx + 0x28]
mov edx, r9d
call fcn.14001953c
mov rcx, rbx
call fcn.14000ff70
mov rcx, rbx
call fcn.1400187b4
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400194d0
mov rbx, qword [rsp + 0x1f8]
add rsp, 0x1e0
pop rdi
ret
Function at 0x14000e9e0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
sub rsp, 0x90
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x14003ae50]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
mov qword [r11 - 0x78], rdx
xor r12d, r12d
mov dword [rsp + 0x24], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call fcn.14001997c
lea ecx, [rax + rbx]
call fcn.140019964
lea rcx, [rsp + 0x20]
call fcn.140019860
xor edx, edx
mov ecx, dword [rsp + 0x20]
mov eax, ecx
or r8d, 0xffffffff
div r8d
add ecx, eax
mov rax, qword [rbp + 0x30]
mov dword [rax], ecx
mov rcx, qword [rbp + 0x30]
add rcx, 4
mov r9d, 7
lea r8, [0x1400383d8]
mov edx, r9d
call fcn.14001953c
mov r11, qword [rbp + 0x30]
mov dword [r11 + 0xb], edi
xor r8b, r8b
cmp dword [rbp + 0x38], 4
je 0x14000eac5
mov edx, r12d
nop word [rax + rax]
mov rax, qword [rbp + 0x30]
lea rcx, [rax + rdx + 4]
and edx, 3
movzx eax, byte [rdx + rax]
xor byte [rcx], al
inc r8b
movzx edx, r8b
mov eax, dword [rbp + 0x38]
sub rax, 4
cmp rdx, rax
jb 0x14000eaa0
mov r9d, dword [rbp + 0x38]
mov r8, qword [rbp + 0x30]
mov rdx, rsi
mov rcx, rbp
call fcn.14000dfd0
mov dword [rsp + 0x24], 1
mov r8d, dword [0x140038318]
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.14000e0d0
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000d9e0
mov rbx, rax
cmp rsi, rax
je 0x14000eb67
cmp qword [rsi + 0x18], 0x10
jb 0x14000eb1c
mov rcx, qword [rsi]
call fcn.1400187b4
mov qword [rsi + 0x18], 0xf
mov qword [rsi + 0x10], r12
mov byte [rsi], 0
cmp qword [rbx + 0x18], 0x10
jae 0x14000eb46
mov r8, qword [rbx + 0x10]
inc r8
mov rdx, rbx
mov rcx, rsi
call fcn.1400187d0
jmp 0x14000eb4f
mov rax, qword [rbx]
mov qword [rsi], rax
mov qword [rbx], r12
mov rax, qword [rbx + 0x10]
mov qword [rsi + 0x10], rax
mov rax, qword [rbx + 0x18]
mov qword [rsi + 0x18], rax
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
cmp qword [rsp + 0x50], 0x10
jb 0x14000eb79
mov rcx, qword [rsp + 0x38]
call fcn.1400187b4
mov qword [rsp + 0x50], 0xf
mov qword [rsp + 0x48], r12
mov byte [rsp + 0x38], 0
cmp qword [rsp + 0x78], 0x10
jb 0x14000eb9e
mov rcx, qword [rsp + 0x60]
call fcn.1400187b4
mov rax, rsi
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400194d0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x14000ebd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov ebp, r8d
mov r14, rdx
mov r13, rcx
lea esi, [rbp + 0xb]
mov edx, 1
mov r12, r9
mov ecx, esi
call fcn.1400194f8
mov rdi, rax
test rax, rax
jne 0x14000ec16
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x60], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call fcn.14001997c
lea ecx, [rax + rbx]
call fcn.140019964
lea rcx, [rsp + 0x60]
call fcn.140019860
mov ecx, dword [rsp + 0x60]
xor edx, edx
or r8d, 0xffffffff
mov eax, ecx
mov r9d, 7
div r8d
lea rbx, [rdi + 4]
lea r8, [0x14003846c]
add eax, ecx
mov rcx, rbx
mov edx, r9d
mov dword [rdi], eax
call fcn.14001953c
lea rcx, [rdi + 0xb]
mov rdx, rbp
mov r9, rbp
mov r8, r14
call fcn.14001953c
mov rdx, 0xfffffffffffffffc
mov ecx, 0xb
sub rdx, rdi
lea rax, [rdx + rbx]
inc rbx
and eax, 3
movzx eax, byte [rax + rdi]
xor byte [rbx - 1], al
dec rcx
jne 0x14000ec92
mov r9, r12
mov r8d, esi
mov rdx, rdi
mov rcx, r13
call fcn.14000e8a0
mov rcx, rdi
mov rbx, rax
call fcn.140018b3c
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140010130
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12d, dword [0x1400387a0]
lea rsi, [r8 + r8 + 0x8000]
xor ebp, ebp
mov r15, rdx
and rsi, 0xffffffffffff8000
lea edx, [rbp + 1]
add rsi, 0x8000
mov rbx, r9
mov r14, r8
lea rcx, [r12 + rsi]
mov r13d, ebp
call fcn.1400194f8
mov qword [rbx], rbp
mov rdi, rax
test rax, rax
je 0x14001029d
mov rdx, qword [rsp + 0x70]
add rsi, rax
mov r8, r12
mov rcx, rsi
call fcn.1400187d0
mov r11d, 4
cmp r14, 3
jb 0x140010228
movabs rax, 0xaaaaaaaaaaaaaaab
mul r14
mov r10, rdx
shr r10, 1
mov rax, r10
imul rax, rax, 0xfffffffffffffffd
add r14, rax
nop
movzx eax, byte [r13 + r15]
movzx ecx, byte [r13 + r15 + 1]
movzx edx, byte [r13 + r15 + 2]
shl rax, 8
mov r8, rbp
mov r9, r11
xor rcx, rax
shl rcx, 8
xor rdx, rcx
add r13, 3
nop word [rax + rax]
mov rcx, qword [rbx]
mov rax, rdx
shr rdx, 6
sub rcx, r8
and eax, 0x3f
inc r8
dec r9
movzx eax, byte [rax + rsi]
mov byte [rcx + rdi + 3], al
jne 0x140010200
add qword [rbx], r11
dec r10
jne 0x1400101d0
test r14, r14
je 0x14001029a
cmp r14, 1
jbe 0x14001024c
movzx eax, byte [r13 + r15]
movzx edx, byte [r13 + r15 + 1]
shl rax, 8
add rdx, rax
shl rdx, 8
jmp 0x140010260
movzx edx, byte [r13 + r15]
shl rdx, 0x10
nop word [rax + rax]
mov rcx, qword [rbx]
mov rax, rdx
shr rdx, 6
sub rcx, rbp
and eax, 0x3f
inc rbp
dec r11
movzx eax, byte [rax + rsi]
mov byte [rcx + rdi + 3], al
jne 0x140010260
mov rax, qword [rbx]
mov byte [rax + rdi + 3], 0x3d
cmp r14, 1
jne 0x140010296
mov rax, qword [rbx]
mov byte [rax + rdi + 2], 0x3d
add qword [rbx], 4
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret