joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d3470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xc8]
mov rbx, rcx
mov r8, rdx
test rax, rax
je 0x1400d34b8
mov rdx, qword [rcx]
mov r9, qword [rax]
lea rcx, [rcx + 0xc0]
call qword [rax + 8]
test eax, eax
je 0x1400d34a8
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.MQTTPersistence_restorePackets
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400d3d80
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov r8, rcx
mov r9, rdx
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]

Function at 0x1400d41d0
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
or byte [rdx + 0x20], 8
mov rbx, rdx
mov rdx, qword [rdx + 0x100]
mov rsi, rcx
mov edi, r8d
mov ebp, r9d
test rdx, rdx
je 0x1400d4390
lea rax, str.http:__
lea r9, [rbx + 0x58]
mov rcx, rbx
mov qword [rsp + 0x20], rax
lea r8, [rbx + 0x50]
call sym.MQTTProtocol_setHTTPProxy
test eax, eax
je 0x1400d4228
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9, qword [rbx + 0x50]
mov edx, 0xffffffff
mov ecx, 4
lea r8, str.Setting_http_proxy_to__s
call sym.Log
mov r9, qword [rbx + 0x58]
test r9, r9
je 0x1400d4261
lea r8, str.Setting_http_proxy_auth_to__s
mov edx, 0xffffffff
mov ecx, 4
call sym.Log
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x1400d42f0
lea rdx, [rsp + 0x3c]
mov r9d, 0x1f90
lea r12, [rbx + 0x30]
xor r8d, r8d
call sym.MQTTProtocol_addressPort
mov rcx, qword [rbx + 0x50]
mov r8d, dword [rsp + 0x3c]
mov r9, r12
mov rdx, rax
call sym.Socket_new
lea edx, [rax - 0x2733]
cmp edx, 1
jbe 0x1400d4334
test eax, eax
jne 0x1400d421a
cmp qword [rbx + 0x50], 0
je 0x1400d4350
movzx eax, word [rbx + 0x20]
xor edx, edx
mov r8, rsi
mov rcx, r12
and ax, 0xfc3f
or ax, 0x140
mov word [rbx + 0x20], ax
call sym.Proxy_connect
test edi, edi
jne 0x1400d43b0
test eax, eax
je 0x1400d4354
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp edi, 1
lea rdx, [rsp + 0x3c]
lea r12, [rbx + 0x30]
mov rcx, rsi
sbb eax, eax
xor r8d, r8d
and eax, 0x70b
lea r9d, [rax + 0x50]
call sym.MQTTProtocol_addressPort
mov r8d, dword [rsp + 0x3c]
mov r9, r12
mov rcx, rsi
mov rdx, rax
call sym.Socket_new
lea edx, [rax - 0x2733]
cmp edx, 1
ja 0x1400d42a8
movzx edx, word [rbx + 0x20]
and dx, 0xfc3f
or edx, 0x40
mov word [rbx + 0x20], dx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test edi, edi
jne 0x1400d43b0
mov r9, qword [rsp + 0x98]
mov r8, qword [rsp + 0x90]
mov edx, ebp
mov rcx, rbx
call sym.MQTTPacket_send_connect
test eax, eax
jne 0x1400d43e0
movzx edx, word [rbx + 0x20]
and dx, 0xfc3f
or dh, 1
mov word [rbx + 0x20], dx
jmp 0x1400d421a
lea rcx, str.http_proxy
call sym.getenv
mov rdx, rax
test rax, rax
je 0x1400d4261
jmp 0x1400d41fa
xor edx, edx
mov r8, rsi
mov rcx, r12
call sym.WebSocket_connect
cmp eax, 0xffffffea
jne 0x1400d42e0
movzx edx, word [rbx + 0x20]
and dx, 0xfc3f
or dl, 0xc0
mov word [rbx + 0x20], dx
jmp 0x1400d421a
and word [rbx + 0x20], 0xfc3f
jmp 0x1400d421a
Function at 0x1400d4600
Capabilities:
Create directory

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r13, rcx
mov rcx, r8
mov rbp, rdx
mov rbx, r8
mov rdi, r9
call sym.strlen
lea r12, [rax + 1]
mov rcx, r12
call sym.malloc
mov rsi, rax
test rax, rax
je 0x1400d482d
mov r8, r12
mov rdx, rbx
mov rcx, rax
call sym.memcpy
jmp 0x1400d4653
mov byte [rax], 0x2d
mov edx, 0x3a
mov rcx, rsi
call sym.strchr
test rax, rax
jne 0x1400d4650
mov rcx, rdi
call sym.strlen
mov rcx, rbp
mov r12, rax
call sym.strlen
mov rcx, rsi
mov rbx, rax
call sym.strlen
lea rbx, [r12 + rbx + 3]
add rbx, rax
mov rcx, rbx
call sym.malloc
mov r12, rax
test rax, rax
je 0x1400d4834
mov rcx, rax
mov qword [rsp + 0x28], rsi
mov r9, rdi
mov rdx, rbx
mov qword [rsp + 0x20], rbp
lea r8, str._s__s__s
call qword [sym.imp.msvcrt.dll__snprintf]
mov rcx, r12
cdqe
cmp rax, rbx
jae 0x1400d4801
call sym.strlen
lea rdi, [rax + 1]
mov rcx, rdi
call sym.malloc
mov rbx, rax
test rax, rax
je 0x1400d481d
mov rcx, rdi
call sym.malloc
mov r14, rax
test rax, rax
je 0x1400d4815
mov r8, rdi
mov rdx, r12
mov rcx, rax
call sym.memcpy
movzx eax, byte [r14]
cmp al, 0x2f
je 0x1400d47a0
cmp al, 0x5c
je 0x1400d47a0
lea rdi, [0x140124269]
mov rcx, r14
mov rdx, rdi
call sym.strtok
mov rcx, rbx
mov rdx, rax
call sym.strcpy
mov rbp, qword [sym.imp.msvcrt.dll__mkdir]
mov rcx, rbx
call rbp
test eax, eax
jne 0x1400d4784
nop dword [rax]
mov rdx, rdi
xor ecx, ecx
call sym.strtok
mov r15, rax
test rax, rax
je 0x1400d47d0
mov rcx, rbx
call sym.strlen
mov rdx, r15
mov byte [rbx + rax], 0x2f
lea rcx, [rbx + rax + 1]
call sym.strcpy
mov rcx, rbx
call rbp
test eax, eax
je 0x1400d4750
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0x11
je 0x1400d4750
mov rdx, rdi
xor ecx, ecx
mov edi, 0xfffffffe
call sym.strtok
jmp 0x1400d47d2
mov byte [rbx], al
lea rdi, [0x140124269]
lea rcx, [r14 + 1]
mov rdx, rdi
call sym.strtok
lea rcx, [rbx + 1]
mov rdx, rax
call sym.strcpy
jmp 0x1400d473d
xor edi, edi
mov qword [r13], r12
mov rcx, r14
call sym.free
mov rcx, rbx
call sym.free
mov rcx, rsi
call sym.free
mov eax, edi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call sym.free
mov rcx, rsi
mov edi, 0xfffffffe
call sym.free
jmp 0x1400d47ee
mov rcx, rbx
call sym.free
mov rcx, r12
call sym.free
mov rcx, rsi
call sym.free
mov edi, 0xffffff9d
jmp 0x1400d47ee
mov rcx, rsi
call sym.free
jmp 0x1400d482d

Function at 0x1400d4840
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.msvcrt.dll__mkdir]
test eax, eax
jne 0x1400d4858
xor eax, eax
add rsp, 0x28
ret
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0x11
je 0x1400d484e
mov eax, 0xfffffffe
jmp 0x1400d4850
Function at 0x1400d4870
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov r12, rdx
mov rbp, r8
mov rdi, r9
test rcx, rcx
je 0x1400d4988
call sym.strlen
mov rcx, r12
mov rsi, rax
call sym.strlen
lea r13, [rsi + rax + 6]
mov rcx, r13
call sym.malloc
mov rsi, rax
test rax, rax
je 0x1400d498f
lea rax, str..msg
mov r9, rbx
mov rdx, r13
mov rcx, rsi
mov qword [rsp + 0x28], rax
lea r8, str._s__s_s
mov qword [rsp + 0x20], r12
call qword [sym.imp.msvcrt.dll__snprintf]
cdqe
cmp rax, r13
jae 0x1400d4980
mov rcx, rsi
lea rdx, [0x140124279]
call sym.fopen
mov rcx, rsi
mov rbx, rax
call sym.free
test rbx, rbx
je 0x1400d4988
mov r8d, 2
xor edx, edx
mov rcx, rbx
call sym.fseek
mov rcx, rbx
call sym.ftell
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov r13d, eax
call sym.fseek
mov rcx, r13
call sym.malloc
mov rsi, rax
test rax, rax
je 0x1400d498f
mov rcx, rax
mov r9, rbx
mov r8, r13
mov edx, 1
call sym.fread
mov qword [rbp], rsi
xor esi, esi
mov rcx, rbx
mov dword [rdi], eax
cmp r13d, eax
sete sil
lea esi, [rsi + rsi - 2]
call sym.fclose
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rsi
call sym.free
mov esi, 0xfffffffe
jmp 0x1400d4971
mov esi, 0xffffff9d
jmp 0x1400d4971

Function at 0x1400d4a60
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov qword [rsp + 0x88], rdx
mov rdi, rcx
movsxd rbp, r8d
mov rbx, r9
test rcx, rcx
je 0x1400d4b9f
call sym.strlen
mov rcx, qword [rsp + 0x88]
mov rsi, rax
call sym.strlen
lea r12, [rsi + rax + 6]
mov rcx, r12
call sym.malloc
mov rsi, rax
test rax, rax
je 0x1400d4ba9
lea rax, str..msg
mov r9, rdi
mov rdx, r12
mov rcx, rsi
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
lea r8, str._s__s_s
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll__snprintf]
cdqe
cmp rax, r12
jb 0x1400d4b10
mov ebx, 0xfffffffe
mov rcx, rsi
call sym.free
mov eax, ebx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [0x14012427c]
mov rcx, rsi
call sym.fopen
mov r14, rax
test rax, rax
je 0x1400d4aee
test ebp, ebp
jle 0x1400d4b90
mov r13, qword [rsp + 0xa0]
xor r12d, r12d
lea r15, [r13 + rbp*4]
xor ebp, ebp
nop dword [rax]
movsxd r8, dword [r13]
mov rcx, qword [rbx]
mov r9, r14
mov edx, 1
add r13, 4
add rbx, 8
add r12, r8
call sym.fwrite
add rbp, rax
cmp r13, r15
jne 0x1400d4b40
mov rcx, r14
call sym.fclose
cmp r12, rbp
je 0x1400d4b98
mov rdx, qword [rsp + 0x88]
mov rcx, rdi
call sym.pstremove
jmp 0x1400d4aee
mov rcx, rax
call sym.fclose
xor ebx, ebx
jmp 0x1400d4af3
mov ebx, 0xfffffffe
jmp 0x1400d4afb
mov ebx, 0xffffff9d
jmp 0x1400d4afb
Function at 0x1400d4bc0
Capabilities:
Delete directory

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
test rcx, rcx
je 0x1400d4c0c
call qword [sym.imp.msvcrt.dll__rmdir]
test eax, eax
jne 0x1400d4bf0
xor esi, esi
mov rcx, rbx
call sym.free
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, qword [sym.imp.msvcrt.dll__errno]
call rsi
cmp dword [rax], 2
je 0x1400d4bd8
call rsi
cmp dword [rax], 0x29
je 0x1400d4bd8
mov esi, 0xfffffffe
jmp 0x1400d4bda
mov esi, 0xfffffffe
jmp 0x1400d4be2

Function at 0x1400d4c20
Capabilities:
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x278
lea r8, str._s_
lea rbx, [rsp + 0x20]
mov r9, rcx
mov r14, rdx
mov edx, 0x105
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__snprintf]
cmp eax, 0x104
jg 0x1400d4de2
lea r12, [rsp + 0x130]
mov rcx, rbx
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1400d4de2
mov r13, qword [sym.imp.KERNEL32.dll_FindNextFileA]
nop word cs:[rax + rax]
test byte [rsp + 0x130], 0x20
je 0x1400d4d60
lea rsi, [rsp + 0x15c]
mov rcx, rsi
call sym.strlen
lea rbx, [rax + 1]
mov rcx, rbx
call sym.malloc
mov r15, rax
test rax, rax
je 0x1400d4dec
cmp ebx, 8
jae 0x1400d4d90
test bl, 4
jne 0x1400d4db0
test ebx, ebx
je 0x1400d4cf0
movzx eax, byte [rsp + 0x15c]
mov byte [r15], al
test bl, 2
jne 0x1400d4dd0
lea rdx, str..msg
mov rcx, r15
call sym.strstr
test rax, rax
je 0x1400d4d07
mov byte [rax], 0
mov rdx, r14
mov rcx, r15
call sym.strcmp
mov ebx, eax
test eax, eax
jne 0x1400d4d58
mov rcx, r15
call sym.free
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400d4d36
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
add rsp, 0x278
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r15
call sym.free
mov rdx, r12
mov rcx, rbp
call r13
test eax, eax
jne 0x1400d4c90
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1400d4c90
mov ebx, 0xfffffffe
jmp 0x1400d4d36
mov eax, ebx
sub ebx, 1
mov rdi, r15
mov rdx, qword [rsi + rax - 8]
shr ebx, 3
mov ecx, ebx
mov qword [r15 + rax - 8], rdx
rep movsq qword [rdi], qword [rsi]
jmp 0x1400d4cf0
mov eax, dword [rsp + 0x15c]
mov ebx, ebx
mov dword [r15], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r15 + rbx - 4], eax
jmp 0x1400d4cf0
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r15 + rbx - 2], ax
jmp 0x1400d4cf0
mov ebx, 0xfffffffe
jmp 0x1400d4d3f
mov ebx, 0xffffff9d
jmp 0x1400d4d3f

Function at 0x1400d4e00
Capabilities:
Enumerate files on windows

Disassembly:
test rcx, rcx
je 0x1400d4e0a
jmp sym.containskeyWin32
mov eax, 0xfffffffe
ret
Function at 0x1400d4e10
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x298
mov rax, qword [sym.imp.msvcrt.dll__snprintf]
lea r8, str._s_
mov edx, 0x105
lea rbx, [rsp + 0x40]
mov rdi, rcx
mov r9, rcx
mov qword [rsp + 0x38], rax
mov rcx, rbx
call rax
cmp eax, 0x104
jg 0x1400d4f45
lea r12, [rsp + 0x150]
mov rcx, rbx
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1400d4f45
mov r13, qword [sym.imp.KERNEL32.dll_FindNextFileA]
nop
lea rsi, [rsp + 0x17c]
lea r14, str._s__s
test byte [rsp + 0x150], 0x20
je 0x1400d4efa
mov rcx, rdi
call sym.strlen
mov rcx, rsi
mov rbx, rax
call sym.strlen
lea rbx, [rbx + rax + 2]
mov rcx, rbx
call sym.malloc
mov r15, rax
test rax, rax
je 0x1400d4f57
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x38]
mov r9, rdi
mov r8, r14
mov rdx, rbx
call rax
mov rcx, r15
cdqe
cmp rax, rbx
jae 0x1400d4f40
call sym.remove
mov rcx, r15
mov ebx, eax
call sym.free
test ebx, ebx
jne 0x1400d4f50
mov rdx, r12
mov rcx, rbp
call r13
mov ebx, eax
test eax, eax
jne 0x1400d4e8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1400d4e80
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
add rsp, 0x298
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call sym.free
mov ebx, 0xfffffffe
jmp 0x1400d4f21
mov ebx, 0xfffffffe
jmp 0x1400d4f18
mov ebx, 0xffffff9d
jmp 0x1400d4f21

Function at 0x1400d4f60
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
test rcx, rcx
je 0x1400d4f6a
jmp sym.clearWin32
mov eax, 0xfffffffe
ret
Function at 0x1400d4f70
Capabilities:
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x288
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x2d8], rdx
mov r9, rcx
mov edx, 0x105
mov qword [rsp + 0x2e0], r8
mov rcx, rbp
lea r8, str._s_
call qword [sym.imp.msvcrt.dll__snprintf]
cmp eax, 0x104
jg 0x1400d51b2
lea r12, [rsp + 0x140]
mov r14, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, rbp
mov rdx, r12
call r14
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400d51b2
mov r13, qword [sym.imp.KERNEL32.dll_FindNextFileA]
xor r15d, r15d
nop word [rax + rax]
mov eax, dword [rsp + 0x140]
mov rdx, r12
mov rcx, rsi
and eax, 0x20
cmp eax, 1
sbb r15d, 0xffffffff
call r13
mov ebx, eax
test eax, eax
jne 0x1400d4ff0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1400d4ff0
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rsi
mov qword [rsp + 0x28], rax
call rax
test r15d, r15d
jne 0x1400d5135
mov qword [rsp + 0x20], 0
mov rdx, r12
mov rcx, rbp
call r14
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400d51b2
lea rbp, [rsp + 0x16c]
nop dword [rax]
test byte [rsp + 0x140], 0x20
je 0x1400d50d8
mov rcx, rbp
call sym.strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sym.malloc
mov rdi, qword [rsp + 0x20]
mov r8, rax
movsxd rax, ebx
mov qword [rdi + rax*8], r8
test r8, r8
je 0x1400d514f
cmp esi, 8
jae 0x1400d5160
test sil, 4
jne 0x1400d5180
test esi, esi
je 0x1400d50be
movzx eax, byte [rbp]
mov byte [r8], al
test sil, 2
jne 0x1400d51a0
lea rdx, str..msg
mov rcx, r8
call sym.strstr
test rax, rax
je 0x1400d50d5
mov byte [rax], 0
add ebx, 1
mov rdx, r12
mov rcx, r14
call r13
mov esi, eax
test eax, eax
jne 0x1400d5060
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1400d5060
mov rax, qword [rsp + 0x28]
mov rcx, r14
call rax
mov rax, qword [rsp + 0x2e0]
mov rdi, qword [rsp + 0x20]
mov dword [rax], r15d
mov rax, qword [rsp + 0x2d8]
mov qword [rax], rdi
mov eax, esi
add rsp, 0x288
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movsxd rcx, r15d
shl rcx, 3
call sym.malloc
mov qword [rsp + 0x20], rax
test rax, rax
jne 0x1400d503e
mov esi, 0xffffff9d
jmp 0x1400d511f
mov eax, esi
lea ecx, [rsi - 1]
mov rdi, r8
mov rsi, rbp
mov rdx, qword [rbp + rax - 8]
shr ecx, 3
mov qword [r8 + rax - 8], rdx
rep movsq qword [rdi], qword [rsi]
jmp 0x1400d50be
mov eax, dword [rbp]
mov esi, esi
mov dword [r8], eax
mov eax, dword [rbp + rsi - 4]
mov dword [r8 + rsi - 4], eax
jmp 0x1400d50be
mov esi, esi
movzx eax, word [rbp + rsi - 2]
mov word [r8 + rsi - 2], ax
jmp 0x1400d50be
mov esi, 0xfffffffe
jmp 0x1400d511f

Function at 0x1400d51c0
Capabilities:
Enumerate files on windows

Disassembly:
test rcx, rcx
je 0x1400d51ca
jmp sym.keysWin32
mov eax, 0xfffffffe
ret
Function at 0x1400d6fd0
Capabilities:
Decode data using base64 via winapi

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x30], 0
mov rax, rcx
mov r10d, edx
mov rcx, r8
lea r8, [rsp + 0x4c]
mov edx, r9d
mov dword [rsp + 0x4c], r10d
mov r9, rax
mov qword [rsp + 0x20], r8
mov r8d, 1
mov qword [rsp + 0x28], 0
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov edx, eax
xor eax, eax
test edx, edx
je 0x1400d701c
mov eax, dword [rsp + 0x4c]
add rsp, 0x58
ret

Function at 0x1400d7030
Capabilities:
Encode data using base64 via winapi

Disassembly:
sub rsp, 0x48
mov rax, rcx
mov r10d, edx
mov rcx, r8
mov edx, r9d
lea r8, [rsp + 0x3c]
mov dword [rsp + 0x3c], r10d
mov r9, rax
mov qword [rsp + 0x20], r8
mov r8d, 0x40000001
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov edx, eax
xor eax, eax
test edx, edx
je 0x1400d706a
mov eax, dword [rsp + 0x3c]
add rsp, 0x48
ret
Function at 0x1400d8220
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [rcx + 0x30]
mov rsi, rdx
test eax, eax
je 0x1400d82b0
mov rbx, qword [0x1401477c8]
test rbx, rbx
je 0x1400d8280
mov rbx, qword [rbx]
test rbx, rbx
je 0x1400d8280
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x1400d8280
mov r8, qword [rbx]
mov rdx, qword [rbx + 8]
mov eax, 0xffffffff
cmp r8, rdx
je 0x1400d8280
cmp rdx, r8
jae 0x1400d8278
lea rax, [rdx + 1]
mov qword [rbx + 8], rax
movzx eax, byte [rbx + rdx + 0x10]
mov byte [rsi], al
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
ret
lea rdx, [rsp + 0x28]
call sym.WebSocket_receiveFrame
test eax, eax
jne 0x1400d8278
mov rdx, qword [0x1401477c8]
mov rdx, qword [rdx]
test rdx, rdx
je 0x1400d82a1
mov rbx, qword [rdx + 0x10]
test rbx, rbx
je 0x1400d8276
mov r8, qword [rbx]
mov rdx, qword [rbx + 8]
jmp 0x1400d8262
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
jmp sym.Socket_getch

Function at 0x1400d8490
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov eax, dword [rcx + 0x30]
mov rdi, rcx
mov rbp, r8
mov rbx, r9
test eax, eax
je 0x1400d8518
mov qword [rsp + 0x28], r9
lea rcx, [rsp + 0x70]
mov r9, rdx
mov rdx, rdi
mov qword [rsp + 0x20], r8
mov r8d, 2
call sym.WebSocket_buildFrame.constprop.0
movdqu xmm0, xmmword [rbx]
mov rsi, qword [rsp + 0x70]
lea r9, [rsp + 0x40]
mov rcx, qword [rdi]
mov r8, qword [rsp + 0x78]
movaps xmmword [rsp + 0x40], xmm0
movdqu xmm1, xmmword [rbx + 0x10]
mov rdx, rsi
movaps xmmword [rsp + 0x50], xmm1
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x60], rax
call sym.Socket_putdatas
cmp eax, 0xffffffea
jne 0x1400d8558
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
ret
movdqu xmm2, xmmword [r9]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
mov r8, qword [r8]
movaps xmmword [rsp + 0x40], xmm2
movdqu xmm3, xmmword [r9 + 0x10]
movaps xmmword [rsp + 0x50], xmm3
mov rax, qword [r9 + 0x20]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x60], rax
call sym.Socket_putdatas
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r10d, dword [rbx]
mov rcx, qword [rbp]
test r10d, r10d
jle 0x1400d85c1
mov r8, qword [rbx + 0x10]
xor r11d, r11d
nop dword [rax + rax]
xor edx, edx
cmp qword [r8 + r11*8], 0
lea r9, [r11*8]
je 0x1400d85b8
nop dword [rax]
mov r8, qword [rbx + 8]
mov r10, rcx
add rcx, 1
and r10d, 3
mov rdi, qword [r8 + r9]
movzx r10d, byte [rbx + r10 + 0x20]
add rdi, rdx
add rdx, 1
xor byte [rdi], r10b
mov r8, qword [rbx + 0x10]
cmp rdx, qword [r8 + r9]
jb 0x1400d8588
mov r10d, dword [rbx]
add r11, 1
cmp r10d, r11d
jg 0x1400d8570
mov dword [rbx + 0x20], 0
mov rcx, rsi
mov dword [rsp + 0x3c], eax
call sym.free
mov eax, dword [rsp + 0x3c]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x1400d8e40
Capabilities:
Hash data using sha1
Initialize hashing via wincrypt

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
xor edx, edx
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400d8e70
xor eax, eax
jmp 0x1400d8e98
lea rax, [rbx + 8]
mov rcx, qword [rbx]
mov edx, 0x8004
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov edx, eax
mov eax, 1
test edx, edx
je 0x1400d8ea0
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x1400d8e98

Function at 0x1400d8eb0
Capabilities:
Hash data via wincrypt

Disassembly:
sub rsp, 0x28
xor r9d, r9d
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
setne al
movzx eax, al
add rsp, 0x28
ret
Function at 0x1400df880
Capabilities:
Hash data with crc32

Disassembly:
push rdi
push rsi
push rbx
mov r11d, 0x80000000
mov r10d, ecx
mov eax, edx
test r8d, r8d
je 0x1400df8fc
mov esi, 3
lea rdi, [0x140126040]
jmp 0x1400df8b0
add esi, 1
sar r8d, 1
je 0x1400df8fc
test r8b, 1
je 0x1400df8a8
mov edx, esi
mov ecx, r11d
mov r9d, 0x80000000
xor r11d, r11d
and edx, 0x1f
mov ebx, dword [rdi + rdx*4]
jmp 0x1400df8e4
mov edx, ecx
shr ecx, 1
and edx, 1
shr r9d, 1
neg edx
and edx, 0xedb88320
xor ecx, edx
test ebx, r9d
je 0x1400df8d0
lea edx, [r9 - 1]
xor r11d, ecx
test edx, ebx
jne 0x1400df8d0
add esi, 1
sar r8d, 1
jne 0x1400df8b0
xor r8d, r8d
mov ecx, 0x80000000
jmp 0x1400df926
mov edx, r10d
shr r10d, 1
and edx, 1
shr ecx, 1
neg edx
and edx, 0xedb88320
xor r10d, edx
test ecx, r11d
je 0x1400df910
lea edx, [rcx - 1]
xor r8d, r10d
test edx, r11d
jne 0x1400df910
xor eax, r8d
pop rbx
pop rsi
pop rdi
ret

Function at 0x1400df940
Capabilities:
Hash data with crc32

Disassembly:
push rdi
push rsi
push rbx
mov r11d, 0x80000000
mov r10d, ecx
mov eax, edx
test r8d, r8d
je 0x1400df9bc
mov esi, 3
lea rdi, [0x140126040]
jmp 0x1400df970
add esi, 1
sar r8d, 1
je 0x1400df9bc
test r8b, 1
je 0x1400df968
mov edx, esi
mov ecx, r11d
mov r9d, 0x80000000
xor r11d, r11d
and edx, 0x1f
mov ebx, dword [rdi + rdx*4]
jmp 0x1400df9a4
mov edx, ecx
shr ecx, 1
and edx, 1
shr r9d, 1
neg edx
and edx, 0xedb88320
xor ecx, edx
test ebx, r9d
je 0x1400df990
lea edx, [r9 - 1]
xor r11d, ecx
test edx, ebx
jne 0x1400df990
add esi, 1
sar r8d, 1
jne 0x1400df970
xor r8d, r8d
mov ecx, 0x80000000
jmp 0x1400df9e6
mov edx, r10d
shr r10d, 1
and edx, 1
shr ecx, 1
neg edx
and edx, 0xedb88320
xor r10d, edx
test ecx, r11d
je 0x1400df9d0
lea edx, [rcx - 1]
xor r8d, r10d
test edx, r11d
jne 0x1400df9d0
xor eax, r8d
pop rbx
pop rsi
pop rdi
ret

Function at 0x1400dfa00
Capabilities:
Hash data with crc32

Disassembly:
push rbx
mov r10d, 0x80000000
test ecx, ecx
je 0x1400dfa74
mov r11d, 3
lea rbx, [0x140126040]
jmp 0x1400dfa28
add r11d, 1
sar ecx, 1
je 0x1400dfa74
test cl, 1
je 0x1400dfa20
mov eax, r11d
mov edx, r10d
mov r8d, 0x80000000
xor r10d, r10d
and eax, 0x1f
mov r9d, dword [rbx + rax*4]
jmp 0x1400dfa5b
mov eax, edx
shr edx, 1
and eax, 1
shr r8d, 1
neg eax
and eax, 0xedb88320
xor edx, eax
test r9d, r8d
je 0x1400dfa48
lea eax, [r8 - 1]
xor r10d, edx
test eax, r9d
jne 0x1400dfa48
add r11d, 1
sar ecx, 1
jne 0x1400dfa28
mov eax, r10d
pop rbx
ret

Function at 0x1400dfa80
Capabilities:
Hash data with crc32

Disassembly:
push rbx
mov r10d, 0x80000000
test ecx, ecx
je 0x1400dfaf4
mov r11d, 3
lea rbx, [0x140126040]
jmp 0x1400dfaa8
add r11d, 1
sar ecx, 1
je 0x1400dfaf4
test cl, 1
je 0x1400dfaa0
mov eax, r11d
mov edx, r10d
mov r8d, 0x80000000
xor r10d, r10d
and eax, 0x1f
mov r9d, dword [rbx + rax*4]
jmp 0x1400dfadb
mov eax, edx
shr edx, 1
and eax, 1
shr r8d, 1
neg eax
and eax, 0xedb88320
xor edx, eax
test r9d, r8d
je 0x1400dfac8
lea eax, [r8 - 1]
xor r10d, edx
test eax, r9d
jne 0x1400dfac8
add r11d, 1
sar ecx, 1
jne 0x1400dfaa8
mov eax, r10d
pop rbx
ret