joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003740
Capabilities:
Delete file

Disassembly:
sub rsp, 0x148
lea rdx, str.chm_client_old.exe
lea rcx, [rsp + 0x30]
call fcn.140003a30
nop
mov rcx, qword [rsp + 0x30]
movsxd rax, dword [rcx + 4]
test byte [rsp + rax + 0x40], 6
jne 0x1400037a8
lea rcx, [rsp + 0x40]
call fcn.140006360
test rax, rax
jne 0x140003796
mov rax, qword [rsp + 0x30]
movsxd rdx, dword [rax + 4]
lea rcx, [rsp + 0x30]
add rcx, rdx
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, str.chm_client_old.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, qword [rsp + 0x30]
movsxd rax, dword [rcx + 4]
lea rcx, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rax + 0x30], rcx
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x2c], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0xc0], 0
je 0x14000381b
mov rax, qword [rsp + 0x58]
lea rcx, [rsp + 0xb0]
cmp qword [rax], rcx
jne 0x14000381b
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xc8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x78]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rsp + 0x90]
mov dword [rax], edx
cmp byte [rsp + 0xbc], 0
je 0x14000382f
lea rcx, [rsp + 0x40]
call fcn.140006360
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
add rsp, 0x148
ret

Function at 0x140003960
Capabilities:
Create thread
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
lea r8, [0x140003930]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x1400018a0]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x1400035a0]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x14000d040]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x14000d990]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp byte [0x14008d1ce], bl
jne 0x140003a19
call fcn.140013b00
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x14008d1ce], bl
je 0x140003a01
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1400058a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400058d1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x1400058ef
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140005910
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140005912
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140005944
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
mov rbx, rdi
je 0x1400059e1
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140005982
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rdi, 0xfff
jbe 0x1400059c1
nop dword [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
add r14, rax
mov rbx, rdi
cmp rax, 0xfff
jne 0x140005a02
cmp rdi, rax
ja 0x140005990
test rbx, rbx
je 0x1400059e1
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
sub rbp, rdi
jmp 0x1400059e4
Function at 0x140005a10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140005a47
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140005a68
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140005a6a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140005ac3
test ecx, ecx
jle 0x140005aa3
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140005ac3
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140005ac3
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400060d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14008c070]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400060fd
xor eax, eax
jmp 0x140006252
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140006128
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140006128
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140006252
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140006245
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14000616b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140006196
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000624a
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140006205
sub eax, 1
je 0x140006205
cmp eax, 2
jne 0x140006245
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000624a
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140006233
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140006245
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov eax, edi
jne 0x14000624a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14006cd00
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140006270
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14008c070]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140006343
cmp byte [rcx + 0x71], 0
je 0x140006343
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14000633f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140006304
sub eax, 1
je 0x140006308
cmp eax, 2
jne 0x14000633f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006cd00
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140006336
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000633f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400062ec
xor al, al
jmp 0x1400062ec
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006cd00
add rsp, 0x60
pop rbx
ret

Function at 0x140009770
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x14008c070]
xor rax, rsp
mov qword [rsp + 0xc0], rax
movzx edi, cl
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rdx, [0x14008c1b8]
lea rcx, [rsp + 0x60]
call fcn.1400065f0
mov rbx, rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
mov r8d, 0xa
lea rdx, str.PUR_nXT__G
lea rcx, [rsp + 0x38]
call fcn.1400067c0
nop
mov r9, rbx
mov r8d, 0xa
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x80]
call fcn.140010cb0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.140014ae0
nop
mov byte [0x14008d1cc], 0
xor r8d, r8d
lea rdx, [0x140080558]
lea rcx, [0x14008c0f8]
call fcn.1400067c0
xor r8d, r8d
lea rdx, [0x140080558]
lea rcx, [0x14008c1f8]
call fcn.1400067c0
xor r8d, r8d
lea rdx, [0x140080558]
lea rcx, [0x14008c178]
call fcn.1400067c0
xor r8d, r8d
lea rdx, [0x140080558]
lea rcx, [0x14008c158]
call fcn.1400067c0
mov ecx, 0xffffffff
call fcn.140001990
call fcn.140001aa0
mov rcx, qword [0x14008d1c0]
test rcx, rcx
je 0x1400098a7
test dil, dil
je 0x1400098a7
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov qword [0x14008d1c0], 0
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x1400098ed
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400098e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400098e8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cd20
mov eax, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14006cd00
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rdi
ret
Function at 0x140013b00
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x520
mov rax, qword [0x14008c070]
xor rax, rsp
mov qword [rsp + 0x510], rax
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtQueryInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, str.OLLYDBG
mov qword [0x14008d208], rax
call qword [sym.imp.USER32.dll_FindWindowA]
xor edx, edx
lea rcx, str.WinDbgFrameClass
mov r12, rax
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.Scylla_x86_v0.9.7c
xor ecx, ecx
mov r15, rax
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.Scylla_x64_v0.9.7c
xor ecx, ecx
mov r14, rax
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.x32_dbg
xor ecx, ecx
mov rbp, rax
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.x64_dbg
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, [0x140080d50]
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.USER32.dll_FindWindowA]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140013c1b
xor r8d, r8d
lea rcx, str.kernel32.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rbx, rax
test rax, rax
je 0x140013c2d
lea rdx, [0x140080cb0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140013c24
call rax
test rax, rax
je 0x140013c24
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r12, r12
jne 0x140013d3b
test r15, r15
jne 0x140013d3b
test r14, r14
jne 0x140013d3b
test rbp, rbp
jne 0x140013d3b
test rsi, rsi
jne 0x140013d3b
test rdi, rdi
jne 0x140013d3b
xor ebx, ebx
mov dword [rsp + 0x30], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9d, [r12 + 4]
mov qword [rsp + 0x20], rbx
mov rcx, rax
lea r8, [rsp + 0x30]
lea edx, [rbp + 0x1f]
call qword [0x14008d208]
test eax, eax
jne 0x140013c94
cmp dword [rsp + 0x30], ebx
je 0x140013c1b
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x70], 0x100010
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140013c1b
cmp qword [rsp + 0x88], rbx
mov eax, 1
cmovne ebx, eax
cmp qword [rsp + 0x90], 0
je 0x140013ce7
inc ebx
cmp qword [rsp + 0x98], 0
je 0x140013cf4
inc ebx
cmp qword [rsp + 0xa0], 0
je 0x140013d01
inc ebx
test ebx, ebx
jne 0x140013c1b
mov rcx, qword [rsp + 0x510]
xor rcx, rsp
call fcn.14006cd00
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140014130
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x30
mov rbp, r8
mov r15, rdx
mov rdi, rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
test r8, r8
je 0x140014177
test bpl, 3
jne 0x14001416f
cmp byte [rdx + r8 - 1], 0x3d
jne 0x140014177
mov r14d, 1
jmp 0x14001417a
mov r14d, ebx
mov eax, r14d
lea rsi, [r8 + 3]
shr rsi, 2
sub rsi, rax
shl rsi, 2
mov qword [rcx], rbx
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], bl
mov rdx, rsi
shr rdx, 2
lea rax, [rax + rdx*2]
add rdx, rax
call fcn.140013990
mov dword [rsp + 0x20], 1
lea r10, [0x1400805c0]
test rsi, rsi
je 0x140014256
lea r8, [r15 + 2]
lea r9, [rsi - 1]
shr r9, 2
inc r9
nop word [rax + rax]
movzx eax, byte [r8 - 2]
mov ecx, dword [r10 + rax*4]
shl ecx, 6
movzx eax, byte [r8 - 1]
or ecx, dword [r10 + rax*4]
shl ecx, 6
movzx eax, byte [r8]
or ecx, dword [r10 + rax*4]
shl ecx, 6
movzx eax, byte [r8 + 1]
or ecx, dword [r10 + rax*4]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140014219
mov rdx, qword [rdi]
mov eax, ecx
sar eax, 0x10
mov byte [rdx + rbx], al
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14001422e
mov rdx, qword [rdi]
mov eax, ecx
sar eax, 8
mov byte [rdx + rbx + 1], al
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140014244
mov rax, qword [rdi]
mov byte [rax + rbx + 2], cl
add rbx, 3
add r8, 4
sub r9, 1
jne 0x1400141e0
test r14d, r14d
je 0x1400142ec
movzx ecx, byte [rsi + r15 + 1]
movzx eax, byte [rsi + r15]
mov edx, dword [r10 + rax*4]
shl edx, 6
or edx, dword [r10 + rcx*4]
shl edx, 0xc
mov r8, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140014285
mov r8, qword [rdi]
mov ecx, edx
sar ecx, 0x10
mov rax, qword [rdi + 0x10]
mov byte [rax + r8 - 1], cl
lea rax, [rsi + 2]
cmp rbp, rax
jbe 0x1400142ec
movzx eax, byte [rsi + r15 + 2]
cmp al, 0x3d
je 0x1400142ec
mov ecx, dword [r10 + rax*4]
shl ecx, 6
sar ecx, 8
sar edx, 8
or cl, dl
mov rdx, qword [rdi + 0x10]
mov r8, qword [rdi + 0x18]
cmp rdx, r8
jae 0x1400142e0
lea rax, [rdx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp r8, 0x10
jb 0x1400142d6
mov rax, qword [rdi]
mov byte [rax + rdx], cl
mov byte [rax + rdx + 1], 0
jmp 0x1400142ec
movzx r9d, cl
mov rcx, rdi
call fcn.140005470
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140014310
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdi, rcx
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [r8 + rbx], 0
jne 0x140014330
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor r10d, r10d
mov r9, rax
sub rdi, rax
lea r8, [rax + 1]
nop dword [rax]
nop word [rax + rax]
xor edx, edx
movsxd rcx, r10d
mov rax, rcx
div rbx
movzx eax, byte [rdx + rsi]
xor edx, edx
xor al, byte [r8 + rdi - 1]
mov byte [r8 - 1], al
lea rax, [rcx + 1]
div rbx
movzx eax, byte [rdx + rsi]
xor edx, edx
xor al, byte [rdi + r8]
mov byte [r8], al
lea rax, [rcx + 2]
div rbx
movzx eax, byte [rdx + rsi]
xor edx, edx
xor al, byte [rdi + r8 + 1]
mov byte [r8 + 1], al
lea rax, [rcx + 3]
div rbx
movzx eax, byte [rdx + rsi]
xor edx, edx
xor al, byte [rdi + r8 + 2]
mov byte [r8 + 2], al
lea rax, [rcx + 4]
div rbx
movzx eax, byte [rdx + rsi]
xor edx, edx
xor al, byte [rdi + r8 + 3]
mov byte [r8 + 3], al
lea rax, [rcx + 5]
div rbx
movzx eax, byte [rdx + rsi]
xor edx, edx
xor al, byte [rdi + r8 + 4]
mov byte [r8 + 4], al
lea rax, [rcx + 6]
div rbx
movzx eax, byte [rdx + rsi]
xor edx, edx
xor al, byte [rdi + r8 + 5]
mov byte [r8 + 5], al
lea rax, [rcx + 7]
div rbx
movzx eax, byte [rdx + rsi]
xor edx, edx
xor al, byte [rdi + r8 + 6]
mov byte [r8 + 6], al
lea rax, [rcx + 8]
div rbx
movzx eax, byte [rdx + rsi]
xor edx, edx
xor al, byte [rdi + r8 + 7]
mov byte [r8 + 7], al
lea rax, [rcx + 9]
div rbx
movzx eax, byte [rdx + rsi]
xor edx, edx
xor al, byte [rdi + r8 + 8]
mov byte [r8 + 8], al
lea rax, [rcx + 0xa]
div rbx
movzx eax, byte [rdx + rsi]
xor edx, edx
xor al, byte [rdi + r8 + 9]
mov byte [r8 + 9], al
lea rax, [rcx + 0xb]
div rbx
movzx eax, byte [rdx + rsi]
xor edx, edx
xor al, byte [rdi + r8 + 0xa]
mov byte [r8 + 0xa], al
lea rax, [rcx + 0xc]
div rbx
movzx eax, byte [rdx + rsi]
xor al, byte [rdi + r8 + 0xb]
mov byte [r8 + 0xb], al
xor edx, edx
lea rax, [rcx + 0xd]
div rbx
add r10d, 0xf
lea r8, [r8 + 0xf]
movzx eax, byte [rdx + rsi]
xor edx, edx
xor al, byte [rdi + r8 - 3]
mov byte [r8 - 3], al
lea rax, [rcx + 0xe]
div rbx
movzx eax, byte [rdx + rsi]
xor al, byte [rdi + r8 - 2]
mov byte [r8 - 2], al
cmp r10d, 0xf
jb 0x140014360
mov rbx, qword [rsp + 0x30]
mov rax, r9
mov rsi, qword [rsp + 0x38]
mov byte [r9 + 0xf], 0
add rsp, 0x20
pop rdi
ret
Function at 0x14002be80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0xad6], 0
mov rsi, r9
mov rbp, r8
movsxd rdi, edx
mov rbx, rcx
je 0x14002bf34
cmp qword [rcx + 0x270], 0
je 0x14002bee7
mov dl, 1
call fcn.14001b670
mov rax, qword [rbx + 0x1d8]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, edi
mov rcx, rbx
call qword [rbx + 0x270]
xor edx, edx
mov rcx, rbx
call fcn.14001b670
jmp 0x14002bf34
mov ecx, edi
test edx, edx
je 0x14002bef7
sub ecx, 1
je 0x14002bef7
cmp ecx, 1
jne 0x14002bf34
mov r9, qword [rbx + 0x1d0]
lea rax, [0x140073558]
mov edx, 2
lea rcx, [rdi + rdi*2]
add rcx, rax
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rbx + 0x1d0]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14002bf50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x160
mov rax, qword [0x14008c070]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xad6], 0
mov rbx, rcx
jne 0x14002bf93
cmp qword [rcx + 0x1e0], 0
je 0x14002c065
mov r8, rdx
mov qword [rsp + 0x158], rdi
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.14003f050
mov r8, qword [rbx + 0x1e0]
movsxd r9, eax
test r8, r8
je 0x14002bff9
cmp byte [rbx + 0x1303], 0
jne 0x14002bff9
lea rdx, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
mov byte [r8], cl
lea r8, [r8 + 1]
test cl, cl
jne 0x14002bfe0
mov byte [rbx + 0x1303], 1
mov byte [rsp + r9 + 0x30], 0xa
inc r9d
movsxd rdi, r9d
cmp rdi, 0x102
jae 0x14002c0b8
cmp byte [rbx + 0xad6], 0
mov byte [rsp + rdi + 0x30], 0
je 0x14002c05d
cmp qword [rbx + 0x270], 0
je 0x14002c07e
mov dl, 1
mov rcx, rbx
call fcn.14001b670
mov rax, qword [rbx + 0x1d8]
lea r8, [rsp + 0x30]
mov r9, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rbx
call qword [rbx + 0x270]
xor edx, edx
mov rcx, rbx
call fcn.14001b670
mov rdi, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14006cd00
add rsp, 0x160
pop rbx
ret
mov r9, qword [rbx + 0x1d0]
lea rcx, [0x140073558]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rbx + 0x1d0]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x14002c05d
call fcn.14006d380
int3

Function at 0x14002c1e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x14002c222
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret