joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f280
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
lea rdi, [rsp + 0x20]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x58], 0
cmp qword [rsp + 0x98], 0
je 0x14000f2d7
mov rax, qword [rsp + 0x98]
mov qword [rax], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rax, qword [rsp + 0x90]
mov rcx, qword [rax + 0x38]
call fcn.1401370a0
lea r8, [0x1404da638]
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140392bf0
cmp qword [rsp + 0x28], 0
jne 0x14000f314
jmp 0x14000f546
mov r8d, 2
mov edx, 0xfffffff0
mov rcx, qword [rsp + 0x28]
call fcn.1403b6030
mov r9, qword [rsp + 0x28]
mov r8d, reloc.WS2_32.dll_recv
mov edx, 1
lea rcx, [0x14058a640]
call fcn.1403b55a0
mov rcx, rax
call fcn.1400011d0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [0x1404d6048]
lea rcx, [0x14058a640]
call fcn.1404104c0
test eax, eax
jne 0x14000f53b
mov r8d, 1
mov edx, 0xffffffec
mov rcx, qword [rsp + 0x28]
call fcn.1403b6030
mov r9, qword [rsp + 0x28]
mov r8d, 4
mov edx, 1
lea rcx, [rsp + 0x44]
call fcn.1403b55a0
cmp rax, 4
jne 0x14000f53b
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rsp + 0x44], eax
mov eax, 0xfffffffc
sub eax, dword [rsp + 0x44]
mov r8d, 1
mov edx, eax
mov rcx, qword [rsp + 0x28]
call fcn.1403b6030
movsxd rax, dword [rsp + 0x44]
mov ecx, 0xffffffff
cmp rax, rcx
jae 0x14000f434
movsxd rax, dword [rsp + 0x44]
mov ecx, 0xffffffff
sub rcx, rax
mov rax, rcx
test rax, rax
jbe 0x14000f434
movsxd rax, dword [rsp + 0x44]
mov ecx, 0xffffffe7
cmp rax, rcx
jae 0x14000f434
xor eax, eax
cmp eax, 1
je 0x14000f434
movsxd rax, dword [rsp + 0x44]
add rax, 0x18
mov r9d, 0x1125
lea r8, [0x1404da640]
mov edx, 1
mov rcx, rax
call fcn.1403ba980
mov qword [rsp + 0x78], rax
jmp 0x14000f43d
mov qword [rsp + 0x78], 0
movsxd rax, dword [rsp + 0x44]
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.1401375b0
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x98], 0
je 0x14000f475
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x58]
mov qword [rax], rcx
movsxd rax, dword [rsp + 0x44]
mov r9, qword [rsp + 0x28]
mov r8, rax
mov edx, 1
mov rcx, qword [rsp + 0x58]
call fcn.1403b55a0
movsxd rcx, dword [rsp + 0x44]
cmp rax, rcx
jne 0x14000f53b
cmp qword [rsp + 0x98], 0
jne 0x14000f53b
mov qword [rsp + 0x68], 0
xor r8d, r8d
lea rdx, [0x1404da688]
mov rax, qword [rsp + 0x90]
mov rcx, qword [rax + 0x38]
call fcn.140002670
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, rax
call fcn.1401370a0
lea r8, [0x1404da680]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140392bf0
cmp qword [rsp + 0x68], 0
je 0x14000f530
movsxd rax, dword [rsp + 0x44]
mov r9, qword [rsp + 0x68]
mov r8, rax
mov edx, 1
mov rcx, qword [rsp + 0x58]
call fcn.1403b7ca0
mov rcx, rax
call fcn.1400011d0
mov rcx, qword [rsp + 0x68]
call fcn.1403b3fa0
nop
mov rcx, qword [rsp + 0x58]
call fcn.140137da0
nop
mov rcx, qword [rsp + 0x28]
call fcn.1403b3fa0
nop
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.14037c300
add rsp, 0x80
pop rdi
ret
Function at 0x1400165f0
Capabilities:
Log keystrokes

Disassembly:
mov dword [rsp + 0x10], edx
mov byte [rsp + 8], cl
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x20]
mov ecx, reloc.WS2_32.dll_recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
movzx ecx, byte [rsp + 0x70]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14001662b
jmp 0x1400166bf
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [rsp + 0x28], 1
movzx eax, byte [rsp + 0x70]
mov word [rsp + 0x30], ax
mov dword [rsp + 0x34], 0
cmp dword [rsp + 0x78], 1
jne 0x140016661
mov dword [rsp + 0x34], 2
jmp 0x140016681
cmp dword [rsp + 0x78], 3
jne 0x140016672
mov dword [rsp + 0x34], 3
jmp 0x140016681
cmp dword [rsp + 0x78], 4
jne 0x140016681
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x38], 0
movzx eax, byte [rsp + 0x70]
xor edx, edx
mov ecx, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov word [rsp + 0x32], ax
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov qword [rsp + 0x40], rax
mov r8d, 0x28
lea rdx, [rsp + 0x28]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
nop
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.14037c300
add rsp, 0x60
pop rdi
ret
Function at 0x140017890
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [0x1405766b0], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140017740]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1405766b8], rax
add rsp, 0x30
pop rdi
ret

Function at 0x1400179e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
cmp qword [0x140576768], 0
je 0x140017b05
cmp dword [rsp + 0x68], 2
jl 0x140017a6a
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x60]
movzx ecx, word [rcx + rax]
call sub.WS2_32.dll_ntohs
movzx eax, ax
cmp eax, 0xa
jne 0x140017a6a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140018530]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140017a6a
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r9d, 2
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x140576768]
call fcn.1401556d0
cmp qword [0x140577300], 0
je 0x140017aba
mov eax, 4
imul rax, rax, 2
mov rcx, qword [0x140577300]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0
mov rax, qword [rax + rcx]
mov qword [rsp + 0x40], rax
jmp 0x140017ac3
mov qword [rsp + 0x40], 0
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x60]
movzx ecx, word [rcx + rax]
call sub.WS2_32.dll_ntohs
movzx eax, ax
mov dword [rsp + 0x20], eax
lea r9, str.KVM__Master_:_Write_Input__Type___u_
mov r8d, 4
mov edx, 0x100
mov rcx, qword [rsp + 0x40]
call fcn.1401589b0
mov eax, dword [rsp + 0x68]
jmp 0x140017b63
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 0
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x68]
sub ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x3c]
mov rdx, qword [rsp + 0x60]
add rdx, rcx
mov rcx, rdx
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, eax
call fcn.140019560
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x140017b5f
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x3c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3c], eax
jmp 0x140017b15
mov eax, dword [rsp + 0x3c]
add rsp, 0x50
pop rdi
ret
Function at 0x140017bd0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
cmp qword [rsp + 0x58], 0
je 0x140017c55
cmp dword [0x14057674c], 1
jne 0x140017c0a
cmp dword [0x1404dc884], 0
jne 0x140017c0a
xor eax, eax
jmp 0x140017d38
mov dword [0x14057673c], 0
mov dword [reloc.WS2_32.dll_accept], 5
mov eax, dword [rsp + 0x70]
mov dword [0x1404dc874], eax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov ecx, 1
call fcn.140017f90
jmp 0x140017d38
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, reloc.WS2_32.dll_sendto
call fcn.140138010
mov qword [rsp + 0x30], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x60]
mov qword [rcx + rax], rdx
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x68]
mov qword [rcx + rax], rdx
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov ecx, 4
imul rcx, rcx, 0
mov dword [rax + rcx], 1
mov dword [0x140576750], 1
cmp dword [0x14057674c], 1
jne 0x140017ced
cmp dword [0x1404dc884], 0
jne 0x140017ced
mov edx, 1
mov rcx, qword [rsp + 0x30]
call fcn.1403ba8b0
xor eax, eax
jmp 0x140017d38
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x30]
lea r8, [fcn.14001b2b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140576730], rax
cmp qword [0x140576730], 0
je 0x140017d33
mov rcx, qword [0x140576730]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 1
add rsp, 0x40
pop rdi
ret

Function at 0x140017e50
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x30]
mov ecx, reloc.WS2_32.dll_recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov dword [rsp + 0x34], 3
mov qword [rsp + 0x58], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140017edc
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.SoftwareSASGeneration
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_bind
call fcn.14037c300
add rsp, 0x70
pop rdi
ret
Function at 0x14001a290
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x75e0
call fcn.14037c5f0
sub rsp, rax
lea rdi, [rsp + 0x40]
mov ecx, 0x1d68
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x75f0]
mov rax, qword [0x140575740]
xor rax, rsp
mov qword [rsp + 0x75d0], rax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x7594], 0
mov dword [rsp + 0x75a4], 0
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x75f0]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x75b8], rax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x75f0]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x75c0], rax
lea r9, str.KVM__SLAVE_:__mainloopinput__Starting...
mov r8d, 2
mov edx, 0x200
mov rcx, qword [0x140576760]
call fcn.1401589b0
nop
cmp dword [0x1404dc884], 0
jne 0x14001a48e
mov eax, 0x7530
sub eax, dword [rsp + 0x48]
movsxd rcx, dword [rsp + 0x48]
lea rcx, [rsp + rcx + 0x60]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x75a4]
mov r8d, eax
mov rdx, rcx
mov rcx, qword [0x1404dc898]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x7594], eax
cmp dword [rsp + 0x7594], 0
je 0x14001a3bd
cmp dword [rsp + 0x75a4], 0
je 0x14001a3bd
cmp dword [0x1404dc884], 0
je 0x14001a40a
mov eax, dword [0x1404dc884]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x75a4]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x7594]
mov dword [rsp + 0x20], eax
lea r9, str.KVM__SLAVE_:_fSuccess__d__cbBytesRead__d__g_shutdown__d
mov r8d, 2
mov edx, 0x200
mov rcx, qword [0x140576760]
call fcn.1401589b0
mov dword [0x1404dc884], 1
jmp 0x14001a48e
mov eax, dword [rsp + 0x75a4]
mov ecx, dword [rsp + 0x48]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x44], 0
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x48]
sub ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x40]
lea rcx, [rsp + rcx + 0x60]
mov r9, qword [rsp + 0x75c0]
mov r8, qword [rsp + 0x75b8]
mov edx, eax
call fcn.140019560
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x14001a46f
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
jmp 0x14001a425
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x40], eax
jne 0x14001a489
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
jmp 0x14001a355
lea r9, str.KVM__SLAVE_:__mainloopinput__Exiting...
mov r8d, 2
mov edx, 0x200
mov rcx, qword [0x140576760]
call fcn.1401589b0
mov rcx, qword [0x140576760]
call fcn.140159100
mov qword [0x140576760], 0
xor eax, eax
mov edi, eax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_bind
call fcn.14037c300
mov eax, edi
mov rcx, qword [rsp + 0x75d0]
xor rcx, rsp
call fcn.14037c650
add rsp, 0x75e0
pop rdi
ret
Function at 0x14001ddd0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov dword [rsp + 0x30], 0
mov r9d, 0x1d9
lea r8, [0x1404dd360]
mov edx, 1
mov ecx, 0x10000
call fcn.1403ba980
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
jne 0x14001de59
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x1d9
lea rdx, [0x1404dd3a0]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x1d9
lea rdx, [0x1404dd3e0]
lea rcx, [0x1404dd420]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
mov eax, 0x10000
sub eax, dword [rsp + 0x30]
cdqe
movsxd rcx, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x50]
add rcx, qword [rdx]
lea r8, str._netif_:_
mov rdx, rax
call fcn.140015f80
mov ecx, dword [rsp + 0x30]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
mov eax, 0x10000
sub eax, dword [rsp + 0x30]
movsxd rcx, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x50]
add rcx, qword [rdx]
mov edx, eax
call fcn.14001e330
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x30]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
mov eax, 0x10000
sub eax, dword [rsp + 0x30]
cdqe
movsxd rcx, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x50]
add rcx, qword [rdx]
lea r8, [0x1404dd454]
mov rdx, rax
call fcn.140015f80
mov ecx, dword [rsp + 0x30]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x14001defe
cmp dword [rsp + 0x34], 0
jne 0x14001df28
mov edx, 1
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call fcn.1403ba8b0
mov rax, qword [rsp + 0x50]
mov qword [rax], 0
xor eax, eax
jmp 0x14001dfc5
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov byte [rcx + rax], 0
mov eax, dword [rsp + 0x30]
inc eax
cdqe
mov dword [rsp + 0x20], 0x1e5
lea r9, [0x1404dd458]
mov r8d, 1
mov rdx, rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call fcn.1403bab60
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
jne 0x14001dfc1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x1e5
lea rdx, [0x1404dd498]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x1e5
lea rdx, str.C:UsersyfjvyDownloadsMeshAgent_mastermeshcoremeshinfo.c
lea rcx, [0x1404dd518]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
mov eax, dword [rsp + 0x30]
add rsp, 0x40
pop rdi
ret
Function at 0x14001ee90
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rdi, [rsp + 0x30]
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
lea r8, [rsp + 0x38]
lea rdx, [0x140417a60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14001ef12
mov rcx, qword [rsp + 0x68]
call fcn.14038cd80
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.14037c300
add rsp, 0x50
pop rdi
ret
Function at 0x140020020
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x40
lea rdi, [rsp + 0x20]
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x50]
mov qword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140418148]
lea rcx, [rsp + 0x28]
call sub.ncrypt.dll_BCryptOpenAlgorithmProvider
test eax, eax
jge 0x14002006b
jmp 0x140020085
mov r9d, 1
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
call sub.ncrypt.dll_BCryptGenRandom
cmp qword [rsp + 0x28], 0
je 0x14002009a
xor edx, edx
mov rcx, qword [rsp + 0x28]
call sub.ncrypt.dll_BCryptCloseAlgorithmProvider
nop
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.14037c300
add rsp, 0x40
pop rdi
ret
Function at 0x140021830
Capabilities:
Hash data via bcrypt

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xd0
lea rdi, [rsp + 0x40]
mov ecx, 0x24
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x84], 0
mov dword [rsp + 0xa4], 0
mov qword [rsp + 0xb8], 0
mov dword [rsp + 0xc0], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x48]
call sub.ncrypt.dll_BCryptOpenAlgorithmProvider
test eax, eax
jge 0x1400218ca
jmp 0x1400219ec
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x84]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0xa4]
lea rdx, str.ObjectLength
mov rcx, qword [rsp + 0x48]
call sub.ncrypt.dll_BCryptGetProperty
test eax, eax
jge 0x14002190c
jmp 0x1400219ec
mov eax, dword [rsp + 0xa4]
mov qword [rsp + 0xc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, qword [rsp + 0xc8]
mov r8, rcx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0
jne 0x140021954
jmp 0x1400219ec
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0xa4]
mov r8, qword [rsp + 0xb8]
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
call sub.ncrypt.dll_BCryptCreateHash
test eax, eax
jge 0x140021994
jmp 0x1400219ec
xor r9d, r9d
mov r8d, dword [rsp + 0xf0]
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x68]
call sub.ncrypt.dll_BCryptHashData
test eax, eax
jge 0x1400219b9
jmp 0x1400219ec
xor r9d, r9d
mov r8d, dword [rsp + 0x100]
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x68]
call sub.ncrypt.dll_BCryptFinishHash
test eax, eax
jge 0x1400219de
jmp 0x1400219ec
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0xc0], eax
cmp qword [rsp + 0x68], 0
je 0x1400219ff
mov rcx, qword [rsp + 0x68]
call sub.ncrypt.dll_BCryptDestroyHash
nop
cmp qword [rsp + 0xb8], 0
je 0x140021a24
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0xb8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
cmp qword [rsp + 0x48], 0
je 0x140021a39
xor edx, edx
mov rcx, qword [rsp + 0x48]
call sub.ncrypt.dll_BCryptCloseAlgorithmProvider
nop
mov eax, dword [rsp + 0xc0]
mov edi, eax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_connect
call fcn.14037c300
mov eax, edi
add rsp, 0xd0
pop rdi
ret
Function at 0x14006c120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
cmp qword [rsp + 0x58], 0x10
jae 0x14006c163
jmp 0x14006c293
mov rax, qword [rsp]
and rax, 3
test rax, rax
je 0x14006c1ad
mov rax, qword [rsp]
movzx eax, byte [rax]
mov byte [rsp + 0x30], al
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
movzx eax, byte [rsp + 0x30]
cmp eax, 0x80
jl 0x14006c1ab
movzx eax, byte [rsp + 0x30]
cmp eax, 0xbf
jg 0x14006c1ab
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
jmp 0x14006c163
mov rax, qword [rsp]
mov rcx, qword [rsp + 8]
sub rcx, rax
mov rax, rcx
and rax, 0xfffffffffffffffc
mov rcx, qword [rsp]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x10], rax
mov rax, qword [rsp]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x10]
cmp qword [rsp + 0x18], rax
je 0x14006c28a
mov rax, qword [rsp + 0x18]
mov eax, dword [rax]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x18]
add rax, 4
mov qword [rsp + 0x18], rax
mov eax, dword [rsp + 0x34]
and eax, 0x80808080
test eax, eax
jne 0x14006c210
jmp 0x14006c285
mov eax, dword [rsp + 0x34]
xor eax, 0x80808080
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
and eax, 0xc0000000
test eax, eax
jne 0x14006c237
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x34]
and eax, 0xc00000
test eax, eax
jne 0x14006c251
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x34]
and eax, 0xc000
test eax, eax
jne 0x14006c26b
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x34]
and eax, 0xc0
test eax, eax
jne 0x14006c285
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
jmp 0x14006c1d8
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
mov rax, qword [rsp + 8]
cmp qword [rsp], rax
je 0x14006c2db
mov rax, qword [rsp]
movzx eax, byte [rax]
mov byte [rsp + 0x38], al
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
movzx eax, byte [rsp + 0x38]
cmp eax, 0x80
jl 0x14006c2d9
movzx eax, byte [rsp + 0x38]
cmp eax, 0xbf
jg 0x14006c2d9
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
jmp 0x14006c293
xor eax, eax
test eax, eax
jne 0x14006c2db
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
xor eax, eax
test eax, eax
jne 0x14006c2f6
mov rax, qword [rsp + 0x28]
add rsp, 0x40
pop rdi
ret
Function at 0x140089d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x10
xor eax, eax
test eax, eax
jne 0x140089d2e
xor eax, eax
test eax, eax
jne 0x140089d34
mov eax, dword [rsp + 0x28]
xor rax, qword [rsp + 0x20]
mov qword [rsp], rax
mov rax, qword [rsp]
and rax, 0xff
mov qword [rsp], rax
xor eax, eax
test eax, eax
jne 0x140089d55
mov eax, dword [rsp]
add rsp, 0x10
pop rdi
ret