joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400aa510
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov edi, 1
xor r14d, r14d
mov r15, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop dword [rax]
mov edx, edi
mov rcx, r14
call qword [str.___r_]
test rax, rax
je 0x1400aa56e
mov rbx, rax
mov rcx, rsi
mov rdx, rax
mov r8d, edi
call r15
test eax, eax
je 0x1400aa569
cmp eax, edi
je 0x1400aa569
cmp eax, 0x8001
jae 0x1400aa569
mov r14, rbx
cmp eax, edi
mov edi, eax
jae 0x1400aa530
jmp 0x1400aa579
mov rcx, rbx
jmp 0x1400aa571
mov rcx, r14
call qword [0x140136438]
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400ae0a0
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x30
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor esi, esi
xor ecx, ecx
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
cmp rax, 0xffffffffffffffff
mov rcx, rax
cmove rcx, rsi
test rax, rax
cmovne rax, rcx
add rsp, 0x30
pop rsi
ret

Function at 0x1400ae160
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rsi, r9
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov qword [r9], 0
lea r9, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
test eax, eax
jne 0x1400ae2e7
mov r13, qword [rsp + 0x20]
test r13, r13
je 0x1400ae2d2
xor ebp, ebp
xorps xmm6, xmm6
xor edi, edi
jmp 0x1400ae1d3
mov r14, rbp
mov r13, qword [r13 + 0x28]
mov rbp, r14
test r13, r13
je 0x1400ae2bb
mov rcx, qword [r13 + 0x18]
test rcx, rcx
je 0x1400ae1f0
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rbx, rax
inc rbx
jmp 0x1400ae1f2
xor ebx, ebx
mov eax, dword [r13 + 4]
cmp eax, 2
je 0x1400ae210
cmp eax, 0x17
jne 0x1400ae1c0
mov r15d, 0x1c
cmp qword [r13 + 0x20], 0
jne 0x1400ae21d
jmp 0x1400ae1c0
mov r15d, reloc.WS2_32.dll_recv
cmp qword [r13 + 0x20], 0
je 0x1400ae1c0
cmp qword [r13 + 0x10], r15
jb 0x1400ae1c0
lea rcx, [rbx + r15]
add rcx, 0x30
call qword [str.0__r_]
test rax, rax
je 0x1400ae30c
mov r14, rax
mov eax, dword [r13]
mov dword [r14], eax
mov eax, dword [r13 + 4]
mov dword [r14 + 4], eax
mov eax, dword [r13 + 8]
mov dword [r14 + 8], eax
mov eax, dword [r13 + 0xc]
mov dword [r14 + 0xc], eax
mov dword [r14 + 0x10], r15d
lea r12, [r14 + 0x30]
movups xmmword [r14 + 0x18], xmm6
mov qword [r14 + 0x28], 0
mov qword [r14 + 0x20], r12
mov rdx, qword [r13 + 0x20]
mov rcx, r12
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
test rbx, rbx
je 0x1400ae2a2
lea rax, [r14 + 0x18]
add r12, r15
mov qword [rax], r12
mov rdx, qword [r13 + 0x18]
mov rcx, r12
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
test rdi, rdi
cmove rdi, r14
test rbp, rbp
je 0x1400ae1c3
mov qword [rbp + 0x28], r14
jmp 0x1400ae1c3
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400ae2cb
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
xor ebx, ebx
test rdi, rdi
jne 0x1400ae2e4
mov ebx, 0x2af9
mov ecx, 0x2af9
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor edi, edi
mov qword [rsi], rdi
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400d2000
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400ae31c
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ebx, 8
test rdi, rdi
je 0x1400ae2e2
nop word cs:[rax + rax]
mov r14, qword [rdi + 0x28]
mov rcx, rdi
call qword [0x140136438]
mov rdi, r14
test r14, r14
jne 0x1400ae330
jmp 0x1400ae2e2
Function at 0x1400ae570
Capabilities:
Convert ip address from string

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov esi, edx
mov rdi, rcx
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x20]
mov ecx, 2
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400ae5ed
mov ecx, 0x40
call qword [str.0__r_]
test rax, rax
je 0x1400ae676
mov rbx, rax
mov rcx, rdi
call qword [case.0x14008c265.1]
test rax, rax
je 0x1400ae67a
mov rdi, rax
lea rax, [rbx + 0x20]
mov ecx, dword [rsp + 0x20]
mov dword [rbx + 0x20], ecx
mov qword [rbx], rdi
mov qword [rbx + 8], 0
mov dword [rbx + 0x10], 0x40002
jmp 0x1400ae647
lea r8, [rsp + 0x28]
mov ecx, reloc.WS2_32.dll_socket
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1400ae676
mov ecx, 0x40
call qword [str.0__r_]
test rax, rax
je 0x1400ae676
mov rbx, rax
mov rcx, rdi
call qword [case.0x14008c265.1]
test rax, rax
je 0x1400ae67a
mov rdi, rax
lea rax, [rbx + 0x20]
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx], rdi
mov qword [rbx + 8], 0
mov dword [rbx + 0x10], 0x100017
mov rcx, rbx
add rcx, 0x30
mov qword [rbx + 0x18], rcx
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], 0
mov rcx, rbx
mov edx, esi
call fcn.1400ae350
mov rsi, rax
mov rcx, rdi
call qword [0x140136438]
jmp 0x1400ae67c
xor esi, esi
jmp 0x1400ae685
xor esi, esi
mov rcx, rbx
call qword [0x140136438]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400d2000
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400aefd0
Capabilities:
Convert ip address from string

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x28]
mov ecx, 2
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_inet_pton]
mov bl, 1
test eax, eax
jg 0x1400af019
lea r8, [rsp + 0x30]
mov ecx, reloc.WS2_32.dll_socket
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
setg bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400d2000
mov eax, ebx
add rsp, 0x48
pop rbx
pop rsi
ret
Function at 0x1400b2b90
Capabilities:
Convert ip address from string

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov ebx, socket
cmp r8, 4
jb 0x1400b2cab
mov r15, r8
mov rsi, rdx
mov rdi, rcx
inc rsi
add r15, 0xfffffffffffffffe
lea rdx, str.0123456789abcdefABCDEF:.
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strspn]
cmp r15, rax
jne 0x1400b2c53
mov byte [rsi + r15], 0
lea r8, [rsp + 0x50]
mov ecx, reloc.WS2_32.dll_socket
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_inet_pton]
mov ebx, socket
cmp eax, 1
jne 0x1400b2cab
lea rdx, [rsp + 0x50]
lea r8, [rsp + 0x20]
mov r9d, 0x2e
mov ecx, reloc.WS2_32.dll_socket
call sub.WS2_32.dll_inet_ntop
test rax, rax
je 0x1400b2c4a
lea rcx, [rsp + 0x20]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp rax, r15
jae 0x1400b2c4a
mov rdi, rax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov byte [rdi + rsi + 1], 0
mov r15, rdi
mov byte [rsi + r15], 0x5d
xor ebx, ebx
jmp 0x1400b2cab
mov r14, rax
cmp byte [rsi + rax], 0x25
jne 0x1400b2cab
lea r15, [r14 + rsi]
inc r15
lea rdx, [0x1401200e8]
mov r8d, 2
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x1400b2cc6
movzx eax, byte [r15]
mov ebx, socket
test al, al
je 0x1400b2cab
xor ecx, ecx
nop dword [rax]
cmp al, 0x5d
je 0x1400b2cda
cmp rcx, 0xe
ja 0x1400b2cda
mov byte [rsp + rcx + 0x20], al
movzx eax, byte [r15 + rcx + 1]
inc rcx
test al, al
jne 0x1400b2c90
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400d2000
mov eax, ebx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
movzx eax, byte [r15 + 2]
cmp eax, 0x5d
je 0x1400b2c7d
test eax, eax
je 0x1400b2c7d
add r15, 2
jmp 0x1400b2c81
test rcx, rcx
je 0x1400b2cab
cmp al, 0x5d
jne 0x1400b2cab
mov byte [rsp + rcx + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [case.0x14008c265.1]
mov qword [rdi + 0x28], rax
test rax, rax
je 0x1400b2d0b
mov word [rsi + r14], 0x5d
mov r15, r14
jmp 0x1400b2bde
mov ebx, 7
jmp 0x1400b2cab
Function at 0x1400bdf50
Capabilities:
Move file

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x40]
call fcn.1400902e0
mov rbx, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rcx, rdi
call rbx
mov rdi, rax
mov rcx, rsi
call rbx
mov rsi, rax
mov rcx, rdi
mov rdx, rax
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x1400be010
lea rbx, [rsp + 0x30]
lea r14, [rsp + 0x20]
mov r15, qword [sym.imp.KERNEL32.dll_Sleep]
mov r12, qword [sym.imp.KERNEL32.dll_MoveFileExA]
nop word cs:[rax + rax]
mov rcx, rbx
call fcn.1400902e0
movups xmm0, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x20], xmm0
mov rcx, rbx
mov rdx, r14
call fcn.1400903a0
cmp rax, 0x3e9
jae 0x1400be04b
mov ecx, 1
call r15
mov rcx, rdi
mov rdx, rsi
mov r8d, 1
call r12
test eax, eax
je 0x1400bdfd0
test rdi, rdi
je 0x1400be01e
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor edi, edi
test rsi, rsi
je 0x1400be02e
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400d2000
mov eax, edi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
test rdi, rdi
je 0x1400be059
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edi, 1
test rsi, rsi
jne 0x1400be025
jmp 0x1400be02e

Function at 0x1400c19e0
Capabilities:
Set socket configuration

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x34], 0x4020
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x2c], 4
mov eax, dword [0x14013ca14]
cmp eax, 2
je 0x1400c1aab
mov rsi, rcx
test eax, eax
jne 0x1400c1a59
mov dword [rsp + 0x20], 3
mov ecx, 6
xor edx, edx
xor r8d, r8d
mov r9d, 2
call fcn.1400adea0
test al, al
je 0x1400c1a4f
mov dword [0x14013ca14], 2
jmp 0x1400c1aab
mov dword [0x14013ca14], 1
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov rcx, rsi
mov edx, 0xffff
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1400c1a8a
cmp dword [rsp + 0x30], 0x4020
jg 0x1400c1aab
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov rcx, rsi
mov edx, 0xffff
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400d2000
nop
add rsp, 0x40
pop rsi
ret
Function at 0x1400c2c00
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1c0
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
mov rax, qword [rdx + 0x20]
mov rax, qword [rax + 0x2e8]
test byte [rax + 0x85], 8
jne 0x1400c2d1c
mov rsi, rdx
mov rdi, qword [rcx + 0x10]
mov dword [rsp + 0x2c], 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm0
mov rcx, qword [rdi + 0x98]
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x2c]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1400c2cc1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
lea rdx, [rsp + 0xb0]
mov r8d, 0x100
mov ecx, eax
call fcn.1400ba2b0
lea rdx, str.getsockname___failed_with_errno__d:__s
mov rcx, rsi
mov r8d, edi
mov r9, rax
jmp 0x1400c2d17
lea r9, [rdi + 0x144]
add rdi, 0x114
mov edx, dword [rsp + 0x2c]
lea rcx, [rsp + 0x30]
mov r8, rdi
call fcn.14008e730
test al, al
jne 0x1400c2d1c
mov rbx, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call rbx
mov ecx, dword [rax]
lea rdx, [rsp + 0xb0]
mov r8d, 0x100
call fcn.1400ba2b0
mov rdi, rax
call rbx
mov r8d, dword [rax]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov rcx, rsi
mov r9, rdi
call fcn.140079120
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.1400d2000
nop
add rsp, 0x1c0
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400c3f50
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
test rdx, rdx
je 0x1400c4007
mov ebp, r8d
mov rbx, rdx
mov rsi, rcx
mov r9, rdx
shr r9, 0x20
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], 0
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test rax, rax
je 0x1400c400f
mov rdi, rax
mov eax, ebp
and eax, 4
lea edx, [rax*8 + 4]
mov qword [rsp + 0x20], rbx
mov rcx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14d, 1
test rax, rax
je 0x1400c4020
mov r15, rax
xor eax, eax
test bpl, 2
sete al
lea edx, [rax + rax]
add edx, 2
mov qword [rsp + 0x20], rbx
mov rcx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x1400c4017
mov qword [rsi], r15
mov qword [rsi + 8], rax
xor r14d, r14d
jmp 0x1400c4020
mov r14d, 2
jmp 0x1400c4029
mov r14d, 1
jmp 0x1400c4029
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r14d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400c4090
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
cmp dword [0x14013ca18], 0
jne 0x1400c40ef
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x2c]
mov ecx, dword [rsp + 0x50]
dec eax
mov edx, eax
shr edx, 1
or edx, eax
mov eax, edx
shr eax, 2
or eax, edx
mov edx, eax
shr edx, 4
or edx, eax
mov eax, edx
shr eax, 8
or eax, edx
mov edx, eax
shr edx, 0x10
or edx, eax
inc edx
shl rcx, 0x20
or rdx, rcx
mov qword [0x14013ca20], rdx
mov eax, 1
xchg dword [0x14013ca18], eax
mov rax, qword [0x14013ca20]
add rsp, 0x58
ret
Function at 0x1400cc680
Capabilities:
Set socket configuration

Disassembly:
push rsi
sub rsp, 0x30
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor eax, eax
test edx, edx
setne al
mov dword [rsp + 0x24], eax
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400d2000
mov eax, esi
add rsp, 0x30
pop rsi
ret

Function at 0x1400d1a10
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0xf0000040
lea rcx, [rsp + 0x30]
xor edx, edx
xor r8d, r8d
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1400d1a71
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, 0x800c
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov rcx, rbx
call fcn.140088550
mov rcx, qword [rsp + 0x38]
mov rdx, rdi
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov dword [rsp + 0x44], 0
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov edx, 2
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x44], 0x20
jne 0x1400d1adc
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov edx, 2
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400d1aec
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400d1afe
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d2000
xor eax, eax
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400d1c20
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov ebp, r8d
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, dword [rcx + 0x18]
mov ecx, dword [rcx + 0x20]
add eax, eax
add rcx, rax
add rcx, 0x18
call qword [str.0__r_]
mov rdi, rax
test rax, rax
je 0x1400d1d5b
mov qword [rdi], rsi
lea rcx, [rdi + 0x18]
mov qword [rdi + 8], rcx
mov eax, dword [rsi + 0x18]
add rax, rdi
add rax, 0x18
mov qword [rdi + 0x10], rax
cmp dword [rsi + 0x1c], ebp
jae 0x1400d1cac
call qword [rsi]
mov rcx, qword [rdi + 8]
mov rdx, rbx
mov r8d, ebp
call qword [rsi + reloc.WS2_32.dll_htonl]
mov ebx, dword [rsi + 0x18]
add rbx, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, rbx
call qword [rsi + reloc.WS2_32.dll_recv]
mov ebp, dword [rsi + 0x20]
mov rcx, qword [rdi + 8]
call qword [rsi]
mov rcx, qword [rdi + 0x10]
call qword [rsi]
mov r15d, ebp
test ebp, ebp
je 0x1400d1d0e
xor r12d, r12d
lea r14, [rsp + 0x27]
nop word cs:[rax + rax]
movzx eax, byte [rbx + r12]
xor al, 0x36
mov byte [rsp + 0x27], al
mov rcx, qword [rdi + 8]
mov rdx, r14
mov r8d, 1
call qword [rsi + reloc.WS2_32.dll_htonl]
movzx eax, byte [rbx + r12]
xor al, 0x5c
mov byte [rsp + 0x27], al
mov rcx, qword [rdi + 0x10]
mov rdx, r14
mov r8d, 1
call qword [rsi + reloc.WS2_32.dll_htonl]
inc r12
cmp r15, r12
jne 0x1400d1cd0
cmp r15d, dword [rsi + 0x1c]
jae 0x1400d1d5b
lea rbx, [0x1401155e8]
lea r14, [0x1401155e9]
nop word cs:[rax + rax]
mov rcx, qword [rdi + 8]
mov rdx, rbx
mov r8d, 1
call qword [rsi + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
mov rdx, r14
mov r8d, 1
call qword [rsi + reloc.WS2_32.dll_htonl]
inc r15
mov eax, dword [rsi + 0x1c]
cmp r15, rax
jb 0x1400d1d30
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400d2000
mov rax, rdi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400d2968
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.1400d2a84
mov ebx, eax
test eax, eax
jne 0x1400d2998
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x1400d29fb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400d29f2
test al, 0x10
je 0x1400d29f2
bt eax, 0xa
jae 0x1400d29eb
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.1400d2388
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x1400d29e7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400d29e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
test edi, edi
jne 0x1400d29f2
and dword [rsp + 0x3c], 0
jmp 0x1400d29f7
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d2af0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400d2b2a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400d2b2f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400d2b78
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1400d2b78
dec r8
sub rdx, 1
jne 0x1400d2b5e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400d2f68
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400d2fb2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400d2fb2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400d2fb2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400d2fb2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400d2fb2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400d2fb4
xor al, al
add rsp, 0x28
ret
Function at 0x180017e50
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x23
syscall
ret
Function at 0x140001130
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov dword [rsp + 0x38], 0
mov rcx, qword [rcx]
xor r8d, r8d
xor edx, edx
call fcn.14000ad80
mov r9, qword [rbx]
lea rcx, [rsp + 0x30]
mov edx, 1
lea r8d, [rdx + 1]
call fcn.14000aa44
cmp byte [rsp + 0x30], 0x4d
jne 0x140001220
cmp byte [rsp + 0x31], 0x5a
jne 0x140001220
mov rcx, qword [rbx]
xor r8d, r8d
lea edx, [r8 + 0x3c]
call fcn.14000ad80
mov r9, qword [rbx]
lea rcx, [rsp + 0x38]
mov edx, 4
lea r8d, [rdx - 3]
call fcn.14000aa44
mov edx, dword [rsp + 0x38]
xor r8d, r8d
mov rcx, qword [rbx]
add edx, 0x18
call fcn.14000ad80
mov r9, qword [rbx]
lea rcx, [rsp + 0x30]
mov edx, 2
lea r8d, [rdx - 1]
call fcn.14000aa44
cmp byte [rsp + 0x30], 0xb
jne 0x140001220
movzx eax, byte [rsp + 0x31]
cmp al, 1
jne 0x1400011de
mov ecx, 0x98
jmp 0x1400011e7
cmp al, 2
jne 0x140001220
mov ecx, 0xa8
mov edx, dword [rsp + 0x38]
xor r8d, r8d
add edx, ecx
mov rcx, qword [rbx]
call fcn.14000ad80
mov r9, qword [rbx]
lea rcx, [rsp + 0x38]
mov edx, 4
lea r8d, [rdx - 3]
call fcn.14000aa44
mov eax, dword [rsp + 0x38]
or ecx, 0xffffffff
test eax, eax
cmove eax, ecx
add rsp, 0x20
pop rbx
ret
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret

Function at 0x140001230
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbp, rdx
mov rdi, rcx
jne 0x140001277
add rcx, 0x78
lea rdx, [0x1400233e0]
call fcn.1400028d0
mov qword [rdi], rax
test rax, rax
jne 0x140001277
lea rcx, str.Cannot_open_archive_file_n
call fcn.140001a00
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [rbp + 4]
mov qword [rsp + 0x38], rsi
call sub.WS2_32.dll_ntohl
add eax, dword [rdi + 8]
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, eax
call fcn.14000ad80
mov ecx, dword [rbp + 8]
call sub.WS2_32.dll_ntohl
mov ecx, eax
call fcn.14000a674
mov rsi, rax
test rax, rax
jne 0x1400012c9
lea rcx, str.Could_not_allocate_read_buffer_n
call fcn.140001a00
mov rsi, qword [rsp + 0x38]
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [rbp + 8]
call sub.WS2_32.dll_ntohl
mov r9, qword [rdi]
mov r8d, 1
mov edx, eax
mov rcx, rsi
call fcn.14000aa44
cmp rax, 1
jae 0x140001310
lea rcx, str.Could_not_read_from_file_n
call fcn.140001a00
mov rcx, rsi
call fcn.14000a66c
mov rsi, qword [rsp + 0x38]
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
cmp byte [rbp + 0x10], 1
jne 0x140001360
mov rdx, rbp
mov qword [rsp + 0x30], rbx
mov rcx, rsi
call fcn.140001040
mov rcx, rsi
mov rbx, rax
call fcn.14000a66c
test rbx, rbx
mov rsi, rbx
mov rbx, qword [rsp + 0x30]
jne 0x140001360
lea rdx, [rbp + 0x12]
lea rcx, str.Error_decompressing__s_n
call fcn.140001a00
mov rsi, qword [rsp + 0x38]
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rdi]
test rcx, rcx
je 0x140001374
call fcn.14000a700
mov qword [rdi], 0
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret