joyce8/EMBER2024-capa huggingface dataset:
Function at 0x39804fc70
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov eax, 0x10020
mov rbp, rsp
push r13
push r12
push rsi
push rbx
and rsp, 0xfffffffffffffff0
call fcn.39803b440
sub rsp, rax
mov rax, qword [rdx]
mov r12, rdx
mov rsi, rcx
mov rcx, rdx
call qword [rax + 0x20]
mov rcx, r12
mov r13, rax
mov rax, qword [r12]
lea r12, [rsp + 0x20]
call qword [rax + 0x18]
lea rcx, [rsp + 0x30]
mov r8d, 0xffef
xor edx, edx
mov qword [rsp + 0x20], 0
mov rbx, rax
mov qword [rsp + 0x28], 0
call sub.msvcrt.dll_memset
mov r8, rbx
mov rdx, r13
mov rcx, r12
call sub.msvcrt.dll_memcpy
mov r8d, ebx
mov rdx, r12
xor ecx, ecx
call fcn.39804d8f0
mov rcx, qword [rsi + 0x18]
lea r8d, [rbx + 4]
mov rdx, r12
mov dword [rsp + rbx + 0x20], eax
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
lea rsp, [rbp - 0x20]
pop rbx
pop rsi
pop r12
pop r13
pop rbp
ret
Function at 0x3980bb3c0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x3980bb3e7
call rbp
cmp dword [rax], 4
jne 0x3980bb404
mov rcx, rdi
call fcn.3980bb1f0
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call sub.msvcrt.dll__read_1
movsxd r12, eax
cmp eax, 0xffffffff
je 0x3980bb3e0
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x3980cf410
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x3980cf438
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sub.msvcrt.dll__read_1
test eax, eax
jle 0x3980cf480
cdqe
add rsi, rax
sub rbx, rax
jne 0x3980cf450
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x3980cf48c
call rbp
cmp dword [rax], 4
je 0x3980cf450
lea rcx, str.random_device_could_not_be_read
call fcn.39812ae20
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x3980fe690
Capabilities:
Encode data using xor

Disassembly:
mov r11, rdx
mov rax, rcx
mov r10, rdx
and r11, 0xfffffffffffffff8
add r11, rcx
movabs rcx, 0xc6a4a7935bd1e995
imul r10, rcx
xor r10, r8
cmp rax, r11
je 0x3980fe6e8
nop word cs:[rax + rax]
mov r9, qword [rax]
add rax, 8
imul r9, rcx
mov r8, r9
shr r8, 0x2f
xor r8, r9
imul r8, rcx
xor r8, r10
mov r10, r8
imul r10, rcx
cmp r11, rax
jne 0x3980fe6c0
and edx, 7
je 0x3980fe71d
sub edx, 1
movsxd rax, edx
xor edx, edx
nop dword [rax]
movzx ecx, byte [r11 + rax]
shl rdx, 8
sub rax, 1
add rdx, rcx
test eax, eax
jns 0x3980fe6f8
xor rdx, r10
movabs r10, 0xc6a4a7935bd1e995
imul r10, rdx
movabs rax, 0xc6a4a7935bd1e995
mov rdx, r10
shr rdx, 0x2f
xor rdx, r10
imul rdx, rax
mov rax, rdx
shr rax, 0x2f
xor rax, rdx
ret
Function at 0x398109230
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
mov rbp, rsp
push r12
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x50
mov ecx, dword [0x39812fa20]
test ecx, ecx
jne 0x398109351
movdqa xmm0, xmmword [0x3981309e0]
xor edx, edx
movups xmmword [0x39812f902], xmm0
movdqa xmm0, xmmword [0x3981309f0]
movups xmmword [0x39812f912], xmm0
movdqa xmm0, xmmword [str._________._0123456789:_____ABCDEFGHIJKLMNOPQRSTUVWXYZ____abcdefghijklmnopqrstuvwxyz]
movups xmmword [0x39812f922], xmm0
movdqa xmm0, xmmword [0x398130a10]
movups xmmword [0x39812f932], xmm0
movdqa xmm0, xmmword [0x398130a20]
movups xmmword [0x39812f942], xmm0
movdqa xmm0, xmmword [0x398130a30]
movups xmmword [0x39812f952], xmm0
movdqa xmm0, xmmword [0x398130a40]
movups xmmword [0x39812f962], xmm0
movdqa xmm0, xmmword [0x398130a50]
movups xmmword [0x39812f972], xmm0
movdqa xmm0, xmmword [0x398130a60]
movups xmmword [0x39812f982], xmm0
movdqa xmm0, xmmword [0x398130a70]
movups xmmword [0x39812f992], xmm0
movdqa xmm0, xmmword [0x398130a80]
movups xmmword [0x39812f9a2], xmm0
movdqa xmm0, xmmword [0x398130a90]
movups xmmword [0x39812f9b2], xmm0
movdqa xmm0, xmmword [0x398130aa0]
movups xmmword [0x39812f9c2], xmm0
movdqa xmm0, xmmword [0x398130ab0]
movups xmmword [0x39812f9d2], xmm0
movdqa xmm0, xmmword [0x398130ac0]
movups xmmword [0x39812f9e2], xmm0
movdqa xmm0, xmmword [0x398130ad0]
movups xmmword [0x39812f9f2], xmm0
mov word [0x39812f900], dx
mov dword [0x39812fa20], 1
mov eax, dword [0x39812f8f0]
test eax, eax
jne 0x39810938d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
lea rcx, [0x39812f8e0]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x3981094a0
mov dword [0x39812f8f0], 1
lea r12, [rsp + 0x30]
mov rcx, qword [0x39812f8e0]
mov edx, 0x20
mov r8, r12
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x3981094b1
movzx r8d, byte [0x39812f900]
xor edx, edx
movzx r10d, byte [0x39812f901]
lea rbx, [0x39812f900]
lea esi, [r8 - 1]
mov byte [0x39812f900], sil
nop dword [rax + rax]
lea eax, [r8 + rdx]
mov ecx, edx
add edx, 1
movzx eax, al
and ecx, 0x1f
movzx r9d, byte [rbx + rax + 2]
movzx r11d, byte [rsp + rcx + 0x30]
add r11d, r9d
mov ecx, r11d
add r10d, ecx
movzx ecx, r10b
movzx r11d, byte [rbx + rcx + 2]
mov byte [rbx + rax + 2], r11b
mov byte [rbx + rcx + 2], r9b
cmp edx, 0x100
jne 0x3981093d8
mov byte [rbx + rax + 2], r11b
mov edx, 0x20
mov byte [rbx + rcx + 2], r9b
mov rcx, r12
mov byte [0x39812f901], sil
call fcn.398123ee0
movzx eax, byte [rbx]
mov edx, 0xc00
movzx ecx, byte [0x39812f901]
lea r11d, [rax + 1]
nop dword [rax]
mov eax, r11d
sub eax, edx
movzx eax, al
movzx r9d, byte [rbx + rax + 2]
add ecx, r9d
movzx r8d, cl
movzx r10d, byte [rbx + r8 + 2]
mov byte [rbx + rax + 2], r10b
mov byte [rbx + r8 + 2], r9b
sub edx, 1
jne 0x398109450
mov byte [rbx + rax + 2], r10b
xor eax, eax
mov byte [0x39812f901], cl
mov byte [rbx + r8 + 2], r9b
mov dword [0x39812f5e0], 0x186a00
lea rsp, [rbp - 0x18]
pop rbx
pop rsi
pop r12
pop rbp
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x80090016
je 0x398109383
mov eax, 0xffffffff
jmp 0x398109496
Function at 0x398112360
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov eax, dword [rcx + 0x14]
xor r8d, r8d
cmp eax, 0x19
je 0x39811249d
push r13
mov r9d, edx
push r12
push rbp
push rdi
mov rdi, rcx
push rsi
push rbx
sub rsp, 0x28
cmp dword [rcx + 0x10], edx
ja 0x39811248d
add eax, 1
movsd xmm1, qword [0x3981309c0]
lea r10, [0x398142340]
cdqe
nop
mov edx, dword [r10 + rax*4]
pxor xmm0, xmm0
cmp eax, 0x19
mov r12d, eax
setle r8b
cvtsi2sd xmm0, rdx
mov rbx, rdx
mulsd xmm0, xmm1
cvttsd2si rcx, xmm0
cmp r9d, ecx
mov ebp, ecx
setae cl
add rax, 1
test r8b, cl
jne 0x3981123a0
lea r13, [rdx*8]
mov rcx, r13
call fcn.39811f120
mov rsi, rax
test rax, rax
je 0x3981124a1
mov r8, r13
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov eax, dword [rdi + 8]
mov r8, qword [rdi]
test eax, eax
je 0x398112470
xor r9d, r9d
nop word [rax + rax]
mov edx, r9d
mov rcx, qword [r8 + rdx*8]
test rcx, rcx
je 0x398112467
nop dword [rax]
mov r8, rcx
mov rcx, qword [rcx]
mov eax, dword [r8 + 8]
mov edx, eax
shr edx, 0x10
xor eax, edx
imul eax, eax, 0x85ebca6b
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae35
mov edx, eax
shr edx, 0x10
xor eax, edx
xor edx, edx
div ebx
lea rax, [rsi + rdx*8]
mov rdx, qword [rax]
mov qword [r8], rdx
mov qword [rax], r8
test rcx, rcx
jne 0x398112420
mov eax, dword [rdi + 8]
mov r8, qword [rdi]
add r9d, 1
cmp r9d, eax
jb 0x398112410
test r8, r8
je 0x39811247d
mov rcx, r8
call fcn.39811f100
mov qword [rdi], rsi
xor r8d, r8d
mov dword [rdi + 8], ebx
mov dword [rdi + 0x14], r12d
mov dword [rdi + 0x10], ebp
add rsp, 0x28
mov eax, r8d
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov eax, r8d
ret
mov rcx, qword [rdi]
mov rdx, r13
call fcn.39811f150
mov rsi, rax
test rax, rax
je 0x39811256d
mov eax, dword [rdi + 8]
mov r8d, ebx
xor edx, edx
sub r8d, eax
lea rcx, [rsi + rax*8]
shl r8, 3
call sub.msvcrt.dll_memset
mov eax, dword [rdi + 8]
xor r9d, r9d
test eax, eax
je 0x39811247d
nop word [rax + rax]
mov edx, r9d
lea r8, [rsi + rdx*8]
mov rcx, qword [r8]
test rcx, rcx
je 0x39811253d
nop
mov eax, dword [rcx + 8]
mov edx, eax
shr edx, 0x10
xor eax, edx
imul eax, eax, 0x85ebca6b
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae35
mov edx, eax
shr edx, 0x10
xor eax, edx
xor edx, edx
div ebx
cmp edx, r9d
je 0x398112560
mov rax, qword [rcx]
mov edx, edx
mov qword [r8], rax
lea rax, [rsi + rdx*8]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov qword [rax], rcx
mov rcx, qword [r8]
test rcx, rcx
jne 0x3981124f0
mov eax, dword [rdi + 8]
add r9d, 1
cmp r9d, eax
jb 0x3981124e0
mov qword [rdi], rsi
xor r8d, r8d
mov dword [rdi + 8], ebx
mov dword [rdi + 0x14], r12d
mov dword [rdi + 0x10], ebp
jmp 0x39811248d
mov r8, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x3981124f0
jmp 0x39811253a
mov r8d, 0xffffffff
jmp 0x39811248d
Function at 0x398116ee0
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
test rcx, rcx
je 0x398117140
movzx eax, byte [rcx + 0x38]
mov rsi, rdx
mov rdx, qword [rcx + 0x30]
xor r12d, r12d
mov rbp, rcx
mov r13, r8
test al, 0x10
cmovne r12, rcx
test rdx, rdx
je 0x398117088
xor ecx, ecx
call fcn.3981220a0
test byte [rbp + 0x38], 2
jne 0x398117110
test byte [r12 + 0x90], 2
jne 0x398117110
mov rax, qword [rbp + 0x18]
xor r14d, r14d
test rax, rax
je 0x398117116
test rsi, rsi
js 0x398116f56
cmp rax, rsi
jae 0x398116f59
mov rsi, rax
mov rcx, rbp
mov edx, 1
lea r14, [r12 + 0xa8]
call fcn.398116850
lea rdi, [r12 + 0xb0]
mov rcx, r14
xor eax, eax
mov qword [r12 + 0x98], 0
and rdi, 0xfffffffffffffff8
mov dword [r12 + 0xa0], 0
sub rcx, rdi
add ecx, 0x100
mov qword [r12 + 0xa8], 0
mov qword [r12 + 0x1a0], 0
shr ecx, 3
rep stosq qword [rdi], rax
mov rbx, qword [rbp]
mov qword [r12 + 0x98], rbx
test rbx, rbx
je 0x398117148
mov r15, r14
xor edi, edi
jmp 0x398116ff8
mov dword [r15], eax
add r15, 0x10
sub rsi, qword [rbx + 0x18]
mov rbx, qword [rbx]
cmp edi, 0xf
jg 0x39811702c
test rbx, rbx
je 0x39811702c
mov rax, qword [rbx + 0x10]
add rax, qword [rbx + 0x28]
mov edx, 0x20
mov rcx, rbx
mov qword [r15 + 8], rax
call fcn.398113c30
mov rax, qword [rbx + 0x18]
movsxd rdx, edi
add edi, 1
cmp rax, rsi
jb 0x398116fe0
shl rdx, 4
mov dword [rdx + r12 + 0xa8], esi
mov ebx, edi
mov dword [r12 + 0xa0], edi
mov rcx, rbp
call fcn.398116990
lea r9, [rsp + 0x4c]
mov r8d, ebx
mov rdx, r14
mov rcx, qword [r12 + 0x88]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
jne 0x3981170b0
or byte [r12 + 0x90], 2
xor r14d, r14d
jmp 0x398117116
mov r14d, 0xffffffff
test al, 2
jne 0x398117126
test byte [r12 + 0x90], 2
je 0x398116f3c
jmp 0x398117110
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x398117071
mov eax, dword [r12 + 0xa0]
mov rsi, qword [r12 + 0x98]
xor ebx, ebx
test eax, eax
jle 0x3981170f5
nop dword [rax + rax]
mov rcx, rsi
mov edx, 0x20
mov rsi, qword [rsi]
add ebx, 1
call fcn.398113c40
cmp ebx, dword [r12 + 0xa0]
jl 0x3981170d8
mov rcx, rbp
mov edx, 1
call fcn.398117df0
mov rcx, rbp
call fcn.3981161c0
nop word [rax + rax]
mov r14d, 0xffffffff
mov rdx, qword [rbp + 0x30]
test rdx, rdx
je 0x398117126
xor ecx, ecx
call fcn.3981220c0
add rsp, 0x58
mov eax, r14d
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r14d, 0xffffffff
jmp 0x398117126
xor ebx, ebx
xor edi, edi
jmp 0x39811702e
Function at 0x39811a7e0
Capabilities:
Send data
Send data on socket

Disassembly:
push r12
push rsi
push rbx
mov rbx, rcx
sub rsp, 0x30
mov rax, qword [rcx + 0xc8]
cmp qword [rax + 0x118], 0
je 0x39811a801
call fcn.398122050
mov rsi, qword [rbx + 0x28]
or byte [rbx + 0xbc], 2
test rsi, rsi
je 0x39811a81a
cmp byte [rsi + 0x1a1], 0
je 0x39811a828
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
mov rax, qword [rbx + 0xc8]
cmp qword [rax + 0x118], 0
je 0x39811a83e
call fcn.398122050
cmp dword [rsi + 0x1b0], 1
jne 0x39811a85c
mov rax, qword [rbx + 0xc8]
mov eax, dword [rax + 0x120]
test eax, eax
jne 0x39811a980
mov eax, dword [rsi + 0x88]
xor r9d, r9d
mov dword [rsp + 0x28], eax
lea rax, [rsi + 8]
mov qword [rsp + 0x20], rax
mov r8d, dword [rbx + 0xc]
mov rdx, qword [rbx]
mov rcx, qword [rsi]
call qword [sym.imp.WS2_32.dll_sendto]
test eax, eax
js 0x39811a920
cmp eax, dword [rbx + 0xc]
je 0x39811a94e
mov rax, qword [rbx + 0x28]
mov byte [rax + 0x1a1], 1
mov rbx, qword [rbx + 0x28]
mov rax, qword [rbx + 0x1a8]
cmp qword [rax + 0x118], 0
je 0x39811a8b8
call fcn.398122050
cmp byte [rbx + 0x1a2], 1
je 0x39811a81a
mov byte [rbx + 0x1a2], 1
lea r12, [rbx + 0x98]
mov rcx, r12
call fcn.39811dde0
mov rax, qword [rbx + 0x1a8]
mov rcx, r12
mov r9d, 0x16
mov rdx, qword [rax + 0x20]
lea rax, [0x398127d40]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
mov r8, qword [rbx]
call fcn.39811b800
add rsp, 0x30
mov rcx, r12
xor edx, edx
pop rbx
pop rsi
pop r12
jmp fcn.39811afa0
mov rcx, qword [rsi]
call fcn.398124ce0
cmp eax, 0x2733
je 0x39811a893
cmp eax, 0x2714
je 0x39811a893
mov ecx, eax
call fcn.398124a30
mov rcx, qword [rbx + 0x28]
call fcn.398126e50
mov rax, qword [rbx + 0xc8]
lea rcx, [rbx + 0x40]
lea rdx, [rax + 0x38]
call fcn.39811afa0
add dword [rbx + 0x14], 1
and byte [rbx + 0xbc], 0xfd
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
xor edx, edx
lea rcx, [rsi + 0x98]
call fcn.39811afa0
test eax, eax
jns 0x39811a85c
jmp 0x39811a893
Function at 0x398123e20
Capabilities:
Set socket configuration

Disassembly:
push rbp
mov r9, rcx
xor r8d, r8d
mov edx, 1
mov rbp, rsp
push r12
push rdi
push rsi
push rbx
mov rbx, rcx
mov ecx, 2
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
call fcn.3981226c0
test eax, eax
jne 0x398123ea0
lea rdi, [rsp + 0x2c]
mov rcx, qword [rbx]
mov r12d, eax
mov edx, 0x8004667e
mov dword [rsp + 0x2c], 1
mov rsi, qword [sym.imp.WS2_32.dll_ioctlsocket]
mov r8, rdi
call rsi
cmp eax, 0xffffffff
je 0x398123eb0
mov dword [rsp + 0x2c], 1
mov rcx, qword [rbx + 8]
mov r8, rdi
mov edx, 0x8004667e
call rsi
cmp eax, 0xffffffff
je 0x398123eb0
lea rsp, [rbp - 0x20]
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
pop rbp
ret
pcmpeqd xmm0, xmm0
mov r12d, 0xffffffff
movups xmmword [rbx], xmm0
jmp 0x398123e91
mov rcx, qword [rbx]
mov rsi, qword [sym.imp.WS2_32.dll_closesocket]
mov r12d, 0xffffffff
call rsi
mov rcx, qword [rbx + 8]
call rsi
pcmpeqd xmm0, xmm0
movups xmmword [rbx], xmm0
jmp 0x398123e91
Function at 0x398124a30
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rbx
mov ebx, ecx
sub rsp, 0x58
mov rdx, qword [0x39812fee0]
mov qword [rsp + 0x48], 0
test rdx, rdx
je 0x398124a54
xor ecx, ecx
call fcn.3981220a0
mov rcx, qword [0x39812fec0]
test rcx, rcx
je 0x398124ad0
mov eax, ebx
shr eax, 0x10
xor eax, ebx
imul eax, eax, 0x85ebca6b
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae35
mov edx, eax
shr edx, 0x10
xor eax, edx
xor edx, edx
div dword [0x39812fec8]
mov rax, qword [rcx + rdx*8]
test rax, rax
jne 0x398124aa0
jmp 0x398124ad0
mov rax, qword [rax]
test rax, rax
je 0x398124ad0
cmp ebx, dword [rax + 8]
jne 0x398124a98
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x48], rax
mov rdx, qword [0x39812fee0]
test rdx, rdx
je 0x398124ac1
xor ecx, ecx
call fcn.3981220c0
mov rax, qword [rsp + 0x48]
add rsp, 0x58
pop rbx
pop rsi
ret
lea rax, [rsp + 0x48]
xor r9d, r9d
xor edx, edx
mov r8d, ebx
mov qword [rsp + 0x30], 0
mov ecx, 0x1300
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_FormatMessageA]
test eax, eax
je 0x398124bd0
mov rsi, qword [rsp + 0x48]
test rsi, rsi
je 0x398124b30
mov rcx, rsi
call sub.msvcrt.dll_strlen
test rax, rax
je 0x398124b30
lea rdx, [rax - 1]
lea rcx, [rsi + rdx]
cmp byte [rcx], 0xa
je 0x398124c30
nop
mov ecx, 0x18
call fcn.39811f120
mov rsi, rax
test rax, rax
je 0x398124c14
mov dword [rax + 8], ebx
mov rcx, qword [0x39812fec0]
mov rax, qword [rsp + 0x48]
mov edx, dword [0x39812fecc]
mov qword [rsi + 0x10], rax
test rcx, rcx
je 0x398124b6c
cmp edx, dword [0x39812fed0]
jb 0x398124b88
add edx, 1
lea rcx, [0x39812fec0]
call fcn.398112360
mov edx, dword [0x39812fecc]
mov rcx, qword [0x39812fec0]
add edx, 1
mov dword [0x39812fecc], edx
mov eax, dword [rsi + 8]
mov edx, eax
shr edx, 0x10
xor eax, edx
imul eax, eax, 0x85ebca6b
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae35
mov edx, eax
shr edx, 0x10
xor eax, edx
xor edx, edx
div dword [0x39812fec8]
lea rax, [rcx + rdx*8]
mov rdx, qword [rax]
mov qword [rsi], rdx
mov qword [rax], rsi
jmp 0x398124aae
xor ecx, ecx
mov edx, 0x32
call qword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov qword [rsp + 0x48], rax
mov rcx, rax
test rax, rax
je 0x398124c03
mov r9d, ebx
lea r8, str.winsock_error_0x_08x
mov edx, 0x32
call fcn.398124700
jmp 0x398124b30
lea rax, str.LocalAlloc_failed_during_Winsock_error
mov qword [rsp + 0x48], rax
jmp 0x398124aae
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.DLL_LocalFree]
lea rax, str.malloc_failed_during_Winsock_error
mov qword [rsp + 0x48], rax
jmp 0x398124aae
mov byte [rcx], 0
test rdx, rdx
je 0x398124b30
lea rax, [rsi + rax - 2]
cmp byte [rax], 0xd
jne 0x398124b30
mov byte [rax], 0
jmp 0x398124b30
Function at 0x14000e510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14000e5a0
cmp r11, r10
ja 0x14000e616
cmp r10, rdx
ja 0x14000e628
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14000e5a2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14000e580
jmp 0x14000e604
ja 0x14000e5aa
mov r11, r10
cmp rax, r8
jne 0x14000e544
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14000e5e0
mov rdi, r8
sub ecx, edx
jns 0x14000e5fb
jmp 0x14000e606
cmp r8, rsi
je 0x14000e637
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14000e606
xor al, 1
cmp rdi, rsi
jne 0x14000e5c0
jmp 0x14000e606
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400a1500
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400a11f0
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.1400a1670
int3

Function at 0x140010be5
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor ecx, ecx
test rbx, rbx
setne cl
call fcn.14002529e
test rbx, rbx
je 0x140010c1e
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140010c38
mov cl, byte [rdi + 8]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140010c30

Function at 0x140010c38
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x140010c5e
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x140010c48
mov qword [rcx], rax
ret
Function at 0x14004f995
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x6f8
invalid
add byte [rax], al
mov r13, r8
mov r12, rdx
mov qword [rsp + 0x148], rcx
mov rdx, qword [rdx + 0x400]
add rdx, 0x10
adc byte [rax - 0x73], cl
mov ah, 0x24
mov al, 1
add byte [rax], al
Function at 0x14005f883
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x78]
mov rcx, qword [rdx + 0x68]
mov rdx, qword [rdx + 0x70]
lea r9, [0x1400d48c8]
call fcn.14005f626
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0xf0]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x14005f9d2
test eax, eax
je 0x14005f95f
cmp eax, 0x90317
je 0x14005f9cc
cmp eax, 0x90321
jne 0x14005f9f0
mov dword [rdi + 0xd0], 0x10000
xor ebx, ebx
mov byte [rdi + 0xd4], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x78]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.14005f82d
and qword [rdi + 0x110], 0
mov byte [rsi + 1], bl
jmp 0x14005f9fe
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x68]
mov rdx, qword [rdi + 0x70]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x40]
and qword [rdi + 0x50], 0
call fcn.14005fa12
lea r8, [rdx + rax]
mov rcx, rbx
mov rdx, rax
call fcn.14008109d
and qword [rdi + 0x58], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x78]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14005f82d
xor eax, eax
cmp qword [rdi + 0x78], rbx
sete al
mov qword [rdi + 0x110], rax
mov byte [rsi + 1], 0
jmp 0x14005f9fe
mov byte [rsi + 1], 1
jmp 0x14005f9ec
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x110], rax
mov byte [rsi + 1], 0
xor ebx, ebx
jmp 0x14005f9fe
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
Function at 0x14005fcaa
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x178]
mov rcx, qword [rdx + 0x168]
mov rdx, qword [rdx + 0x170]
lea r9, [0x1400d48c8]
call fcn.14005f626
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0x1f0]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x14005fe1a
test eax, eax
je 0x14005fd92
cmp eax, 0x90317
je 0x14005fe14
cmp eax, 0x90321
jne 0x14005fe38
mov dword [rdi + 0x1d0], 0x10000
xor ebx, ebx
mov byte [rdi + 0x1d4], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x178]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.14005fc4b
and qword [rdi + 0x210], 0
mov byte [rsi + 1], bl
jmp 0x14005fe46
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x168]
mov rdx, qword [rdi + 0x170]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x140]
and qword [rdi + 0x150], 0
call fcn.14005fa12
lea r8, [rdx + rax]
mov rcx, rbx
mov rdx, rax
call fcn.14008109d
and qword [rdi + 0x158], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x178]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14005fc4b
xor eax, eax
cmp qword [rdi + 0x178], rbx
sete al
mov qword [rdi + 0x210], rax
mov byte [rsi + 1], 0
jmp 0x14005fe46
mov byte [rsi + 1], 1
jmp 0x14005fe34
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x210], rax
mov byte [rsi + 1], 0
xor ebx, ebx
jmp 0x14005fe46
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret