joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002f610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x10]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14002f65e
cmp qword [rcx + 0x18], 0x10
jb 0x14002f637
mov rcx, qword [rcx]
lea r9, str.ygx_kservice.msg.CMD_KSVR_CONSL_SETTEMPTURE_request.client
mov r8d, 1
mov edx, eax
call fcn.1400ed210
mov rcx, qword [rdi + 0x10]
lea rdx, [rbx + 1]
mov byte [rbx], 0xa
call fcn.1400ceec0
mov rbx, rax
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x14002f68d
mov byte [rbx], reloc.WS2_32.dll_recv
inc rbx
cmp ecx, 0x80
jb 0x14002f688
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x14002f673
mov byte [rbx], cl
inc rbx
mov ecx, dword [rdi + 0x1c]
test ecx, ecx
je 0x14002f6bc
mov byte [rbx], 0x18
inc rbx
cmp ecx, 0x80
jb 0x14002f6b7
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x14002f6a2
mov byte [rbx], cl
inc rbx
mov ecx, dword [rdi + 0x20]
test ecx, ecx
je 0x14002f6eb
mov byte [rbx], 0x20
inc rbx
cmp ecx, 0x80
jb 0x14002f6e6
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x14002f6d1
mov byte [rbx], cl
inc rbx
mov ecx, dword [rdi + 0x24]
test ecx, ecx
je 0x14002f71a
mov byte [rbx], 0x28
inc rbx
cmp ecx, 0x80
jb 0x14002f715
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x14002f700
mov byte [rbx], cl
inc rbx
test byte [rdi + 8], 1
je 0x14002f743
cmp byte [0x14024a158], 0
je 0x14002f743
mov rcx, qword [rdi + 8]
mov rdx, rbx
and rcx, 0xfffffffffffffffe
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400ea080
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14004c340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x28]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14004c38e
cmp qword [rcx + 0x18], 0x10
jb 0x14004c367
mov rcx, qword [rcx]
lea r9, str.ygx_kservice.msg.CMD_KSVR_CONSL_GETSVRNORMALINFO_response.ServerNormalInfo.svrname
mov r8d, 1
mov edx, eax
call fcn.1400ed210
mov rcx, qword [rdi + 0x28]
lea rdx, [rbx + 1]
mov byte [rbx], 0xa
call fcn.1400ceec0
mov rbx, rax
mov rcx, qword [rdi + 0x30]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14004c3cc
cmp qword [rcx + 0x18], 0x10
jb 0x14004c3a5
mov rcx, qword [rcx]
lea r9, str.ygx_kservice.msg.CMD_KSVR_CONSL_GETSVRNORMALINFO_response.ServerNormalInfo.svrver
mov r8d, 1
mov edx, eax
call fcn.1400ed210
mov rcx, qword [rdi + 0x30]
lea rdx, [rbx + 1]
mov byte [rbx], reloc.WS2_32.dll_select
call fcn.1400ceec0
mov rbx, rax
mov ecx, dword [rdi + 0x38]
test ecx, ecx
je 0x14004c3fb
mov byte [rbx], 0x18
inc rbx
cmp ecx, 0x80
jb 0x14004c3f6
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x14004c3e1
mov byte [rbx], cl
inc rbx
mov ecx, dword [rdi + 0x3c]
test ecx, ecx
je 0x14004c42a
mov byte [rbx], 0x20
inc rbx
cmp ecx, 0x80
jb 0x14004c425
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x14004c410
mov byte [rbx], cl
inc rbx
mov ecx, dword [rdi + 0x40]
test ecx, ecx
je 0x14004c45a
mov byte [rbx], 0x28
inc rbx
cmp ecx, 0x80
jb 0x14004c455
nop
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x14004c440
mov byte [rbx], cl
inc rbx
cmp dword [rdi + 0x10], 0
jle 0x14004c4d2
mov byte [rbx], 0x32
inc rbx
mov ecx, dword [rdi + 0x20]
cmp ecx, 0x80
jb 0x14004c486
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x14004c471
mov byte [rbx], cl
inc rbx
mov r8, qword [rdi + 0x18]
xor edx, edx
movsxd r9, dword [rdi + 0x10]
nop word [rax + rax]
mov ecx, dword [r8 + rdx*4 + 8]
cmp ecx, 0x80
jb 0x14004c4c5
nop dword [rax]
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x14004c4b0
mov byte [rbx], cl
inc rdx
inc rbx
cmp rdx, r9
jl 0x14004c4a0
test byte [rdi + 8], 1
je 0x14004c4fb
cmp byte [0x14024a158], 0
je 0x14004c4fb
mov rcx, qword [rdi + 8]
mov rdx, rbx
and rcx, 0xfffffffffffffffe
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400ea080
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140050040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x10]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14005008e
cmp qword [rcx + 0x18], 0x10
jb 0x140050067
mov rcx, qword [rcx]
lea r9, str.ygx_kservice.msg.CMD_KSVR_CLI_REPORTSAFEEVENT_request.name
mov r8d, 1
mov edx, eax
call fcn.1400ed210
mov rcx, qword [rdi + 0x10]
lea rdx, [rbx + 1]
mov byte [rbx], 0xa
call fcn.1400ceec0
mov rbx, rax
mov ecx, dword [rdi + 0x30]
test ecx, ecx
je 0x1400500bd
mov byte [rbx], reloc.WS2_32.dll_recv
inc rbx
cmp ecx, 0x80
jb 0x1400500b8
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x1400500a3
mov byte [rbx], cl
inc rbx
mov ecx, dword [rdi + 0x34]
test ecx, ecx
je 0x1400500ec
mov byte [rbx], 0x18
inc rbx
cmp ecx, 0x80
jb 0x1400500e7
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x1400500d2
mov byte [rbx], cl
inc rbx
mov ecx, dword [rdi + 0x38]
test ecx, ecx
je 0x14005011b
mov byte [rbx], 0x20
inc rbx
cmp ecx, 0x80
jb 0x140050116
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x140050101
mov byte [rbx], cl
inc rbx
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140050159
cmp qword [rcx + 0x18], 0x10
jb 0x140050132
mov rcx, qword [rcx]
lea r9, str.ygx_kservice.msg.CMD_KSVR_CLI_REPORTSAFEEVENT_request.content
mov r8d, 1
mov edx, eax
call fcn.1400ed210
mov rcx, qword [rdi + 0x18]
lea rdx, [rbx + 1]
mov byte [rbx], 0x2a
call fcn.1400ceec0
mov rbx, rax
mov rcx, qword [rdi + 0x20]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140050197
cmp qword [rcx + 0x18], 0x10
jb 0x140050170
mov rcx, qword [rcx]
lea r9, str.ygx_kservice.msg.CMD_KSVR_CLI_REPORTSAFEEVENT_request.server
mov r8d, 1
mov edx, eax
call fcn.1400ed210
mov rcx, qword [rdi + 0x20]
lea rdx, [rbx + 1]
mov byte [rbx], 0x32
call fcn.1400ceec0
mov rbx, rax
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x1400501d5
cmp qword [rcx + 0x18], 0x10
jb 0x1400501ae
mov rcx, qword [rcx]
lea r9, str.ygx_kservice.msg.CMD_KSVR_CLI_REPORTSAFEEVENT_request.mac
mov r8d, 1
mov edx, eax
call fcn.1400ed210
mov rcx, qword [rdi + 0x28]
lea rdx, [rbx + 1]
mov byte [rbx], 0x3a
call fcn.1400ceec0
mov rbx, rax
mov ecx, dword [rdi + 0x3c]
test ecx, ecx
je 0x14005020a
mov byte [rbx], 0x40
inc rbx
cmp ecx, 0x80
jb 0x140050205
nop word [rax + rax]
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x1400501f0
mov byte [rbx], cl
inc rbx
test byte [rdi + 8], 1
je 0x140050233
cmp byte [0x14024a158], 0
je 0x140050233
mov rcx, qword [rdi + 8]
mov rdx, rbx
and rcx, 0xfffffffffffffffe
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400ea080
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140051600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edx, dword [rcx + 0x18]
mov rbx, r8
mov rdi, rcx
test edx, edx
je 0x14005164a
inc rbx
mov byte [r8], 8
cmp edx, 0x80
jb 0x140051645
nop word [rax + rax]
movzx eax, dl
shr edx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp edx, 0x80
jae 0x140051630
mov byte [rbx], dl
inc rbx
mov rcx, qword [rcx + 0x10]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140051688
cmp qword [rcx + 0x18], 0x10
jb 0x140051661
mov rcx, qword [rcx]
lea r9, str.ygx_kservice.msg.CMD_KSVR_CONSL_GETLOCALSVRIPSTATUS_response.localIpInfo.name
mov r8d, 1
mov edx, eax
call fcn.1400ed210
mov rcx, qword [rdi + 0x10]
lea rdx, [rbx + 1]
mov byte [rbx], reloc.WS2_32.dll_select
call fcn.1400ceec0
mov rbx, rax
mov ecx, dword [rdi + 0x1c]
test ecx, ecx
je 0x1400516ba
mov byte [rbx], 0x18
inc rbx
cmp ecx, 0x80
jb 0x1400516b5
nop dword [rax]
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x1400516a0
mov byte [rbx], cl
inc rbx
mov ecx, dword [rdi + 0x20]
test ecx, ecx
je 0x1400516ea
mov byte [rbx], 0x20
inc rbx
cmp ecx, 0x80
jb 0x1400516e5
nop
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x1400516d0
mov byte [rbx], cl
inc rbx
mov ecx, dword [rdi + 0x24]
test ecx, ecx
je 0x14005171a
mov byte [rbx], 0x28
inc rbx
cmp ecx, 0x80
jb 0x140051715
nop
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x140051700
mov byte [rbx], cl
inc rbx
test byte [rdi + 8], 1
je 0x140051743
cmp byte [0x14024a158], 0
je 0x140051743
mov rcx, qword [rdi + 8]
mov rdx, rbx
and rcx, 0xfffffffffffffffe
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400ea080
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400648e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [rcx + 0x20]
mov r9, rcx
test edx, edx
je 0x14006491c
mov byte [r8], 8
inc r8
cmp edx, 0x80
jb 0x140064916
nop dword [rax]
movzx eax, dl
shr edx, 7
or al, 0x80
mov byte [r8], al
inc r8
cmp edx, 0x80
jae 0x140064900
mov byte [r8], dl
inc r8
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14006495e
mov byte [r8], reloc.WS2_32.dll_recv
inc r8
cmp rcx, 0x80
jb 0x140064958
nop word [rax + rax]
movzx eax, cl
shr rcx, 7
or al, 0x80
mov byte [r8], al
inc r8
cmp rcx, 0x80
jae 0x140064940
mov byte [r8], cl
inc r8
mov rcx, qword [r9 + 0x18]
test rcx, rcx
je 0x14006499e
mov byte [r8], 0x18
inc r8
cmp rcx, 0x80
jb 0x140064998
nop word [rax + rax]
movzx eax, cl
shr rcx, 7
or al, 0x80
mov byte [r8], al
inc r8
cmp rcx, 0x80
jae 0x140064980
mov byte [r8], cl
inc r8
mov rcx, qword [r9 + 0x28]
test rcx, rcx
je 0x1400649de
mov byte [r8], 0x20
inc r8
cmp rcx, 0x80
jb 0x1400649d8
nop word [rax + rax]
movzx eax, cl
shr rcx, 7
or al, 0x80
mov byte [r8], al
inc r8
cmp rcx, 0x80
jae 0x1400649c0
mov byte [r8], cl
inc r8
mov ecx, dword [r9 + 0x24]
test ecx, ecx
je 0x140064a1c
mov byte [r8], 0x28
inc r8
cmp ecx, 0x80
jb 0x140064a16
nop word [rax + rax]
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [r8], al
inc r8
cmp ecx, 0x80
jae 0x140064a00
mov byte [r8], cl
inc r8
mov ecx, dword [r9 + 0x30]
test ecx, ecx
je 0x140064a5c
mov byte [r8], 0x30
inc r8
cmp ecx, 0x80
jb 0x140064a56
nop dword [rax]
nop word [rax + rax]
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [r8], al
inc r8
cmp ecx, 0x80
jae 0x140064a40
mov byte [r8], cl
inc r8
mov ecx, dword [r9 + 0x34]
test ecx, ecx
je 0x140064a9c
mov byte [r8], 0x38
inc r8
cmp ecx, 0x80
jb 0x140064a96
nop dword [rax]
nop word [rax + rax]
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [r8], al
inc r8
cmp ecx, 0x80
jae 0x140064a80
mov byte [r8], cl
inc r8
test byte [r9 + 8], 1
je 0x140064abc
cmp byte [0x14024a158], 0
je 0x140064abc
mov rcx, qword [r9 + 8]
mov rdx, r8
and rcx, 0xfffffffffffffffe
jmp fcn.1400ea080
mov rax, r8
ret
Function at 0x1400679c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x10]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140067a0e
cmp qword [rcx + 0x18], 0x10
jb 0x1400679e7
mov rcx, qword [rcx]
lea r9, str.ygx_kservice.msg.CMD_KSVR_CLI_GETDESKTOPCONFIG_request.clientname
mov r8d, 1
mov edx, eax
call fcn.1400ed210
mov rcx, qword [rdi + 0x10]
lea rdx, [rbx + 1]
mov byte [rbx], 0xa
call fcn.1400ceec0
mov rbx, rax
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x140067a3d
mov byte [rbx], reloc.WS2_32.dll_recv
inc rbx
cmp ecx, 0x80
jb 0x140067a38
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x140067a23
mov byte [rbx], cl
inc rbx
mov ecx, dword [rdi + 0x1c]
test ecx, ecx
je 0x140067a6c
mov byte [rbx], 0x18
inc rbx
cmp ecx, 0x80
jb 0x140067a67
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x140067a52
mov byte [rbx], cl
inc rbx
mov ecx, dword [rdi + 0x20]
test ecx, ecx
je 0x140067a9b
mov byte [rbx], 0x20
inc rbx
cmp ecx, 0x80
jb 0x140067a96
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x140067a81
mov byte [rbx], cl
inc rbx
mov ecx, dword [rdi + 0x24]
test ecx, ecx
je 0x140067aca
mov byte [rbx], 0x28
inc rbx
cmp ecx, 0x80
jb 0x140067ac5
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x140067ab0
mov byte [rbx], cl
inc rbx
test byte [rdi + 8], 1
je 0x140067af3
cmp byte [0x14024a158], 0
je 0x140067af3
mov rcx, qword [rdi + 8]
mov rdx, rbx
and rcx, 0xfffffffffffffffe
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400ea080
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400681f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x10]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14006823e
cmp qword [rcx + 0x18], 0x10
jb 0x140068217
mov rcx, qword [rcx]
lea r9, str.ygx_kservice.msg.CMD_KSVR_CLI_GETDESKTOPCONFIG_response.configname
mov r8d, 1
mov edx, eax
call fcn.1400ed210
mov rcx, qword [rdi + 0x10]
lea rdx, [rbx + 1]
mov byte [rbx], 0xa
call fcn.1400ceec0
mov rbx, rax
mov ecx, dword [rdi + 0x20]
test ecx, ecx
je 0x14006826d
mov byte [rbx], reloc.WS2_32.dll_recv
inc rbx
cmp ecx, 0x80
jb 0x140068268
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x140068253
mov byte [rbx], cl
inc rbx
mov ecx, dword [rdi + 0x24]
test ecx, ecx
je 0x14006829c
mov byte [rbx], 0x18
inc rbx
cmp ecx, 0x80
jb 0x140068297
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x140068282
mov byte [rbx], cl
inc rbx
mov rcx, qword [rdi + 0x18]
cmp qword [rcx + 0x10], 0
jbe 0x1400682b6
lea rdx, [rbx + 1]
mov byte [rbx], 0x22
call fcn.1400ceec0
mov rbx, rax
mov ecx, dword [rdi + 0x28]
test ecx, ecx
je 0x1400682ea
mov byte [rbx], 0x28
inc rbx
cmp ecx, 0x80
jb 0x1400682e5
nop dword [rax + rax]
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x1400682d0
mov byte [rbx], cl
inc rbx
mov ecx, dword [rdi + 0x2c]
test ecx, ecx
je 0x14006831a
mov byte [rbx], 0x30
inc rbx
cmp ecx, 0x80
jb 0x140068315
nop
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x140068300
mov byte [rbx], cl
inc rbx
test byte [rdi + 8], 1
je 0x140068343
cmp byte [0x14024a158], 0
je 0x140068343
mov rcx, qword [rdi + 8]
mov rdx, rbx
and rcx, 0xfffffffffffffffe
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400ea080
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14006f430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [rcx + 0x18]
mov r9, rcx
test edx, edx
je 0x14006f46c
mov byte [r8], 8
inc r8
cmp edx, 0x80
jb 0x14006f466
nop dword [rax]
movzx eax, dl
shr edx, 7
or al, 0x80
mov byte [r8], al
inc r8
cmp edx, 0x80
jae 0x14006f450
mov byte [r8], dl
inc r8
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14006f4ad
mov byte [r8], reloc.WS2_32.dll_recv
lea rdx, [r8 + 1]
cmp rcx, 0x80
jb 0x14006f4a7
nop word [rax + rax]
movzx eax, cl
shr rcx, 7
or al, 0x80
mov byte [rdx], al
inc rdx
cmp rcx, 0x80
jae 0x14006f490
mov byte [rdx], cl
lea r8, [rdx + 1]
movsxd rax, dword [r9 + 0x1c]
test eax, eax
je 0x14006f4ed
mov byte [r8], 0x18
lea rdx, [r8 + 1]
mov rcx, rax
cmp rax, 0x80
jb 0x14006f4e7
nop dword [rax + rax]
movzx eax, cl
shr rcx, 7
or al, 0x80
mov byte [rdx], al
inc rdx
cmp rcx, 0x80
jae 0x14006f4d0
mov byte [rdx], cl
lea r8, [rdx + 1]
mov ecx, dword [r9 + 0x20]
test ecx, ecx
je 0x14006f52b
mov byte [r8], 0x20
lea rdx, [r8 + 1]
cmp ecx, 0x80
jb 0x14006f525
nop word [rax + rax]
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rdx], al
inc rdx
cmp ecx, 0x80
jae 0x14006f510
mov byte [rdx], cl
lea r8, [rdx + 1]
test byte [r9 + 8], 1
je 0x14006f54b
cmp byte [0x14024a158], 0
je 0x14006f54b
mov rcx, qword [r9 + 8]
mov rdx, r8
and rcx, 0xfffffffffffffffe
jmp fcn.1400ea080
mov rax, r8
ret
Function at 0x14007c210
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x9b0]
sub rsp, 0xab0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0xaf8], rbx
mov rax, qword [0x14024a080]
xor rax, rsp
mov qword [rbp + 0x9a0], rax
mov r14, r8
mov rsi, rdx
mov ebx, ecx
xor eax, eax
mov qword [rbp - 0x80], rax
xor r15d, r15d
mov qword [rsp + 0x78], r15
mov dword [rbp - 0x80], r15d
mov qword [rbp - 0x78], r15
xor dil, dil
mov r9d, 0x20219
lea r8, str.SOFTWARE3798BE84_4E13_4b81_B8CF_5063730FF905GINFO
lea rcx, [rsp + 0x78]
call fcn.14007b880
test eax, eax
jne 0x14007c413
mov r8d, ebx
lea rdx, [0x1401f1aac]
lea rcx, [rbp - 0x70]
call fcn.14007de30
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x1a0]
call fcn.140159570
mov dword [rsp + 0x58], 0x1000
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5c]
xor r8d, r8d
lea rdx, [rbp - 0x70]
mov rbx, qword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007c400
mov eax, dword [rsp + 0x5c]
dec eax
cmp eax, 1
ja 0x14007c400
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x14007c322
test al, 1
jne 0x14007c400
shr rax, 1
cmp word [rbp + rax*2 + 0x19e], r15w
je 0x14007c32a
jmp 0x14007c400
mov word [rbp + 0x1a0], r15w
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
movdqa xmm0, xmmword [0x140201ef0]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r15w
lea rax, [rbp + 0x1a0]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14007c360
lea rdx, [rbp + 0x1a0]
lea rcx, [rsp + 0x30]
call fcn.14007dc20
nop
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.14007bbf0
nop
lea rcx, [rsp + 0x30]
call fcn.14007dbb0
mov rax, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
sub rax, r8
sar rax, 5
cmp rax, 2
jb 0x14007c3f6
cmp rsi, r8
je 0x14007c3d1
mov rdx, r8
cmp qword [r8 + 0x18], 8
jb 0x14007c3c0
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
mov rcx, rsi
call fcn.14007dc20
mov r8, qword [rsp + 0x60]
add r8, 0x20
cmp r14, r8
je 0x14007c3f3
mov rdx, r8
cmp qword [r8 + 0x18], 8
jb 0x14007c3e7
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
mov rcx, r14
call fcn.14007dc20
mov dil, 1
lea rcx, [rsp + 0x60]
call fcn.14007db20
test rbx, rbx
je 0x14007c418
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r15
jmp 0x14007c418
mov rbx, qword [rsp + 0x78]
test rbx, rbx
je 0x14007c426
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, dil
mov rcx, qword [rbp + 0x9a0]
xor rcx, rsp
call fcn.1400c7300
mov rbx, qword [rsp + 0xaf8]
add rsp, 0xab0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14007c450
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x280
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x2b0], rbx
mov rax, qword [0x14024a080]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
mov qword [rdx + 0x10], rbp
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x14007c497
mov rax, qword [rdx]
mov word [rax], bp
xor sil, sil
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x50], rbp
mov r9d, 0x20019
lea r8, str.SOFTWAREBDC31FE5_0C98_4906_8CFF_A1784066604A
lea rcx, [rsp + 0x40]
call fcn.14007b880
test eax, eax
jne 0x14007c59e
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.140159570
cmp qword [rbx + 0x18], 8
jb 0x14007c4ed
mov rbx, qword [rbx]
mov dword [rsp + 0x38], 0x208
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov rdx, rbx
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007c55f
mov eax, dword [rsp + 0x3c]
dec eax
cmp eax, 1
jbe 0x14007c538
mov eax, recv
jmp 0x14007c55d
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x14007c556
test al, 1
jne 0x14007c54f
shr rax, 1
cmp word [rsp + rax*2 + 0x5e], 0
je 0x14007c55b
mov eax, recv
jmp 0x14007c55d
mov word [rsp + 0x60], bp
mov eax, ebp
test eax, eax
sete sil
test eax, eax
jne 0x14007c58b
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14007c573
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.14007dc20
test rbx, rbx
je 0x14007c5a3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rbp
jmp 0x14007c5a3
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x14007c5b1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, sil
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400c7300
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x14007c5e0
Capabilities:
Connect socket
Get socket status
Set socket configuration

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x270
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x268], rbx
mov qword [rbp + 0x270], rsi
mov qword [rbp + 0x278], rdi
mov rax, qword [0x14024a080]
xor rax, rbp
mov qword [rbp + 0x230], rax
mov rdi, rcx
test rcx, rcx
je 0x14007c785
mov r14d, 1
mov r15d, 2
mov edx, r14d
mov ecx, r15d
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14007c785
lea r8, [rbp]
mov dword [rbp], r14d
mov edx, 0x8004667e
mov rcx, rax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x14007c77c
xor eax, eax
mov ecx, 0x32c8
mov qword [rbp + 0x10], rax
mov word [rbp + 0x10], r15w
mov qword [rbp + 0x18], rax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x12], ax
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], 0
jne 0x14007c690
inc eax
xor esi, esi
cmp eax, 0x3fffffff
jle 0x14007c6a9
mov eax, esi
jmp 0x14007c6e7
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14007c6c5
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400c7fc0
sub rsp, rcx
mov r9d, 3
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14007b7e0
mov rcx, rax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rbp + 0x14], eax
cmp eax, 0xffffffff
je 0x14007c77c
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x10]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_connect]
lea rax, [rbp + 8]
mov qword [rbp + 8], r15
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x20]
mov qword [rbp + 0x28], rbx
xor edx, edx
mov dword [rbp + 0x20], r14d
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x14007c77c
lea r8, [rbp]
mov dword [rbp], esi
mov edx, 0x8004667e
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x14007c77c
lea r9, [rbp + 4]
mov dword [rbp + 4], r14d
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, rbx
jmp 0x14007c78c
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, 0xffffffffffffffff
mov rcx, qword [rbp + 0x230]
xor rcx, rbp
call fcn.1400c7300
mov rbx, qword [rbp + 0x268]
mov rsi, qword [rbp + 0x270]
mov rdi, qword [rbp + 0x278]
lea rsp, [rbp + 0x240]
pop r15
pop r14
pop rbp
ret