joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140025e70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140025e9a
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140025f0a
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x140025f04
test rax, rax
jle 0x140025ee4
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x140025f04
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140025f04
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14003366c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
xor r15d, r15d
lea r12, [0x140000000]
movzx eax, byte [r15 + r12 + 0x84680]
mov edi, eax
mov r8d, eax
shr edi, 5
mov r11d, eax
shr r8d, 6
mov ebp, edi
lea edx, [rax + rax]
shr r11d, 7
xor edx, eax
and ebp, 4
mov r10d, edi
mov r9d, r8d
and edi, 1
and r10d, 2
imul ecx, edi, 0x1b000000
and r8d, 1
lea ebx, [rdx + rdx]
and r9d, 2
lea edx, [rdx*4]
xor ebx, eax
xor edx, eax
shl ebx, 0x19
shl edx, 8
mov esi, eax
xor rbx, rcx
mov r14d, eax
imul ecx, r10d, 0x1b000000
xor rbx, rcx
imul ecx, r8d, 0x1b000000
xor rbx, rcx
imul ecx, r9d, 0x1b000000
xor rbx, rcx
imul ecx, ebp, 0x1b000000
xor rbx, rcx
imul ecx, r11d, 0x1b000000
xor rbx, rcx
imul ecx, edi, 0x11b00
xor rdx, rcx
imul ecx, r10d, 0x11b00
xor rdx, rcx
imul ecx, r8d, 0x11b00
xor rdx, rcx
imul ecx, r9d, 0x11b00
xor rdx, rcx
imul ecx, ebp, 0x11b00
xor rdx, rcx
imul ecx, edi, 0x11b0000
or rbx, rdx
lea edx, [rax*8]
xor edx, eax
lea eax, [rax*4]
shl edx, 0x10
xor eax, r14d
xor rdx, rcx
imul ecx, r10d, 0x11b0000
xor rdx, rcx
imul ecx, ebp, 0x11b0000
xor rdx, rcx
imul ecx, edi, 0x11b
or rbx, rdx
lea edx, [rax + rax]
xor rdx, rcx
imul ecx, r10d, 0x11b
xor rdx, rcx
imul ecx, ebp, 0x11b
xor rdx, rcx
imul ecx, r11d, 0x11b
xor rdx, rcx
xor rdx, rsi
or rdx, rbx
shl rdx, 0x20
or rdx, rbx
or rdx, rsi
mov qword [r12 + r15*8 + 0xa3830], rdx
inc r15
cmp r15, 0x100
jl 0x14003368f
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov byte [0x1400a4031], 1
pop r15
pop r14
pop r12
ret

Function at 0x1400337f8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r11d, r11d
lea rbx, [0x140000000]
movzx r9d, byte [r11 + rbx + 0x84580]
mov edx, r9d
shr edx, 7
imul r10d, edx, 0x1b000000
lea r8d, [r9 + r9]
imul ecx, edx, 0x11b
mov eax, r8d
shl eax, 0x18
xor r10, rax
mov eax, r9d
shl eax, 8
or eax, r9d
shl eax, 8
or r10, rax
mov eax, r8d
xor rcx, rax
xor rcx, r9
or rcx, r10
shl rcx, 0x20
or rcx, r10
mov qword [rbx + r11*8 + 0xa3020], rcx
inc r11
cmp r11, 0x100
jl 0x140033807
and qword [0x1400a3828], 0
and qword [0x1400a3820], 0
mov rbx, qword [rsp + 8]
mov byte [0x1400a4030], 1
ret
Function at 0x14004e4d0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rsi, [rcx + rdx]
mov rbx, rcx
mov edi, 0x1505
cmp rcx, rsi
jae 0x14004e50a
mov cl, byte [rbx]
call fcn.14004cf90
imul rdi, rdi, 0x21
movsx rdx, al
inc rbx
xor rdi, rdx
cmp rbx, rsi
jb 0x14004e4f0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
movzx eax, dil
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14004e912
call fcn.140063d44
test al, al
jne 0x14004e912
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14004eb88
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x14004e4d0
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14004e8dc
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rsi, [rcx + rdx]
mov rbx, rcx
mov edi, 0x1505
cmp rcx, rsi
jae 0x14004e50a
mov cl, byte [rbx]
call fcn.14004cf90
imul rdi, rdi, 0x21
movsx rdx, al
inc rbx
xor rdi, rdx
cmp rbx, rsi
jb 0x14004e4f0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
movzx eax, dil
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14004e912
call fcn.140063d44
test al, al
jne 0x14004e912
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14004eb88
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x14004e4d0
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14005a2ac
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor ebx, ebx
movsxd rsi, edx
mov rbp, r9
mov r14, r8
mov rdi, rcx
cmp byte [rcx + 0xb11], bl
je 0x14005a367
cmp qword [rcx + 0x278], rbx
je 0x14005a31a
mov dl, 1
call fcn.140055af4
mov rax, qword [rdi + 0x1d8]
mov r9, rbp
mov r8, r14
mov qword [rsp + 0x20], rax
mov edx, esi
mov rcx, rdi
call qword [rdi + 0x278]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.140055af4
jmp 0x14005a367
mov ecx, esi
test edx, edx
je 0x14005a32a
sub ecx, 1
je 0x14005a32a
cmp ecx, 1
jne 0x14005a367
mov r9, qword [rdi + 0x1d0]
lea rax, [0x140086e58]
mov edx, 2
lea rcx, [rsi + rsi*2]
add rcx, rax
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x1d0]
mov r8d, 1
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14005a560
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x14005a599
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
and qword [rbx], 0
mov ecx, 0x38
cmp eax, 0x2733
lea edx, [rcx + 0x19]
cmove ecx, edx
mov eax, ecx
jmp 0x14005a59e
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14005ca18
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, rcx
xor ebx, ebx
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
je 0x14005cb4f
lea rdx, str.LoadLibraryExA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x140087318]
mov rcx, rbp
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbspbrk]
test rax, rax
je 0x14005ca8f
mov rcx, rbp
test rsi, rsi
je 0x14005ca87
mov r8d, 8
jmp 0x14005cab2
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x14005cab6
test rsi, rsi
je 0x14005cabe
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005cabe
mov r8d, 0x800
mov rcx, rbp
xor edx, edx
call rsi
mov rbx, rax
jmp 0x14005cb4c
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r14d, eax
test eax, eax
je 0x14005cb4c
mov rcx, rbp
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea ecx, [r14 + 1]
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x14005cb43
mov edx, r14d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x14005cb43
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rdx, [0x140087330]
lea rcx, [rdi + rax]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdx, rbp
lea rcx, [rdi + rax]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov rcx, rdi
test rsi, rsi
je 0x14005cb3a
xor edx, edx
lea r8d, [rdx + 8]
call rsi
jmp 0x14005cb40
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov rcx, rdi
call qword [0x1400a0210]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14005cb6c
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x1400a0280]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
test cl, 2
je 0x14005cbc1
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14005cba8
mov eax, 2
jmp 0x14005cc28
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x14005cbb9
shr ax, 8
cmp al, 2
je 0x14005cbc1
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x14005cb9e
call fcn.1400737fc
test eax, eax
jne 0x14005cc28
lea rcx, str.iphlpapi.dll
call fcn.14005ca18
mov qword [0x1400a4710], rax
test rax, rax
je 0x14005cbfe
lea rdx, str.if_nametoindex
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005cbfe
mov qword [0x1400a4708], rax
xor edx, edx
lea r9d, [rdx + 3]
lea r8d, [rdx + 2]
lea ecx, [rdx + 6]
call fcn.140072c40
test al, al
lea rcx, [0x1400a4d48]
setne byte [0x1400a4d44]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14007ae30
add rsp, 0x1d8
ret
Function at 0x1400646bc
Capabilities:
Convert ip address from string

Disassembly:
and qword [r9], 0
cmp qword [rsp + 0x28], 0
jge 0x1400646ce
mov eax, 0xfffffffe
ret
mov qword [rsp + 0x28], r9
mov r9b, 1
jmp fcn.1400643e0

Function at 0x140064abc
Capabilities:
Convert ip address from string

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x40
mov rax, qword [0x1400a0280]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov edi, ecx
lea rcx, str.localhost
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov edx, 1
lea rcx, [rax + 0x41]
call qword [case.0x14007524c.1]
mov rbx, rax
test rax, rax
je 0x140064bb0
xor edx, edx
lea rcx, [rsp + 0x28]
lea r8d, [rdx + 0x10]
call sub.VCRUNTIME140.dll_memset
mov ebp, 2
movzx ecx, di
mov word [rsp + 0x28], bp
call qword [sym.imp.WS2_32.dll_htons]
lea r8, [rsp + 0x20]
mov ecx, ebp
lea rdx, str.127.0.0.1
mov word [rsp + 0x2a], ax
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jl 0x140064bb0
lea r8d, [rbp + 2]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x2c]
call sub.VCRUNTIME140.dll_memcpy
and dword [rbx], 0
lea rcx, [rbx + 0x30]
lea r8d, [rbp + 0xe]
mov qword [rbx + 0x20], rcx
lea rdx, [rsp + 0x28]
mov dword [rbx + 4], ebp
mov dword [rbx + 8], 1
mov dword [rbx + 0xc], 6
mov dword [rbx + reloc.WS2_32.dll_recv], 0x10
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0x20]
lea rdx, str.localhost
add rcx, 0x10
mov qword [rbx + 0x18], rcx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov ecx, edi
call fcn.140064bd0
mov qword [rbx + 0x28], rax
mov rax, rbx
jmp 0x140064bb2
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14007ae30
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140064bd0
Capabilities:
Convert ip address from string

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1400a0280]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov edi, ecx
lea rcx, str.localhost
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov edx, 1
lea rcx, [rax + 0x4d]
call qword [case.0x14007524c.1]
mov rbx, rax
test rax, rax
je 0x140064cba
mov r14d, reloc.WS2_32.dll_socket
movzx ecx, di
mov word [rsp + 0x20], r14w
call qword [sym.imp.WS2_32.dll_htons]
and dword [rsp + 0x24], 0
lea r8, [rsp + 0x40]
and dword [rsp + 0x38], 0
lea rdx, [0x14008a560]
mov ecx, r14d
mov word [rsp + 0x22], ax
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jl 0x140064cba
lea r8d, [r14 - 7]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call sub.VCRUNTIME140.dll_memcpy
and dword [rbx], 0
lea r8d, [r14 + 5]
and qword [rbx + 0x28], 0
lea rcx, [rbx + 0x30]
lea rdx, [rsp + 0x20]
mov dword [rbx + 0x10], r8d
mov qword [rbx + 0x20], rcx
mov dword [rbx + 4], r14d
mov dword [rbx + 8], 1
mov dword [rbx + 0xc], 6
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0x20]
lea rdx, str.localhost
add rcx, 0x1c
mov qword [rbx + 0x18], rcx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov rax, rbx
jmp 0x140064cbc
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14007ae30
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
Function at 0x14006b230
Capabilities:
Convert ip address from string

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1400a0280]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r13, rcx
mov rbx, rdx
mov rcx, rdx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp byte [rbx], 0x5b
mov rdi, rax
jne 0x14006b3a9
cmp rax, 4
jb 0x14006b3be
inc rbx
sub rdi, 2
cmp byte [rbx + rdi], 0x5d
jne 0x14006b3be
lea rdx, str.0123456789abcdefABCDEF:.
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strspn]
mov rbp, rax
cmp rdi, rax
je 0x14006b358
cmp byte [rbx + rax], 0x25
mov rdi, rax
jne 0x14006b3be
lea r15, [rbx + rax]
xor r14d, r14d
lea rdx, [0x14008bb8c]
lea rcx, [r15 + 1]
lea rsi, [r15 + 1]
lea r8d, [r14 + 2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x14006b2e7
lea rcx, [r15 + 3]
mov al, byte [rcx]
test al, al
je 0x14006b2e7
cmp al, 0x5d
cmovne rsi, rcx
mov al, byte [rsi]
test al, al
je 0x14006b3be
xor ecx, ecx
cmp al, 0x5d
je 0x14006b310
cmp rcx, 0xf
jge 0x14006b310
inc rsi
mov byte [rsp + rcx + 0x20], al
inc r14d
inc rcx
mov al, byte [rsi]
test al, al
jne 0x14006b2f3
test r14d, r14d
je 0x14006b3be
cmp byte [rsi], 0x5d
jne 0x14006b3be
movsxd rax, r14d
cmp rax, 0x10
jae 0x14006b3c5
lea rcx, [rsp + 0x20]
mov byte [rsp + rax + 0x20], 0
call qword [case.0x14007524c.0]
mov qword [r13 + 0x28], rax
test rax, rax
jne 0x14006b34f
mov eax, 7
jmp 0x14006b383
mov byte [rbx + rbp], 0x5d
mov byte [r15 + 1], 0
lea r8, [rsp + 0x30]
mov byte [rbx + rdi], 0
mov rdx, rbx
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x14006b3be
mov byte [rbx + rdi], 0x5d
mov al, byte [rbx]
neg al
sbb eax, eax
not eax
and eax, 0xe
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14007ae30
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
lea rdx, [0x140080eac]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcspn]
cmp rdi, rax
je 0x14006b378
mov eax, 3
jmp 0x14006b383
call fcn.14007b3e8
int3
Function at 0x140079c58
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rdi, rcx
mov ecx, dword [rcx + 0x20]
mov r14, rdx
add rcx, 0x18
mov r15d, r8d
lea r9d, [rax + rax]
add rcx, r9
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140079d6c
lea rcx, [rax + 0x18]
mov qword [rax], rdi
mov qword [rax + 8], rcx
lea rsi, [rdi + 8]
mov eax, dword [rdi + 0x18]
add rax, rcx
mov qword [rbx + 0x10], rax
cmp r15d, dword [rdi + 0x1c]
jbe 0x140079ce1
call qword [rdi]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, r14
call qword [rsi]
mov r14d, dword [rdi + 0x18]
add r14, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, r14
call qword [rdi + reloc.WS2_32.dll_recv]
mov r15d, dword [rdi + 0x20]
mov rcx, qword [rbx + 8]
call qword [rdi]
mov rcx, qword [rbx + 0x10]
call qword [rdi]
test r15, r15
je 0x140079d61
mov rbp, r15
mov al, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rbx + 8]
call qword [rsi]
mov al, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
mov r8d, 1
mov byte [rsp + 0x40], al
inc r14
mov rcx, qword [rbx + 0x10]
call qword [rsi]
sub r15, 1
jne 0x140079cf5
lea rsi, [rdi + 8]
jmp 0x140079d61
mov rcx, qword [rbx + 8]
lea rdx, [0x14008f079]
mov r8d, 1
call qword [rsi]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x14008f07a]
mov r8d, 1
call qword [rsi]
inc rbp
mov eax, dword [rdi + 0x1c]
cmp rbp, rax
jb 0x140079d38
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x14007a04c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14007a086
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14007a08b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14007a0d4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x14007a0d4
dec r8
sub rdx, 1
jne 0x14007a0ba
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14007b744
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007b78e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14007b78e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14007b78e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14007b78e
cmp dword [rcx + 0x84], 0xe
jbe 0x14007b78e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14007b790
xor al, al
add rsp, 0x28
ret
Function at 0x18061d564
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor dil, al
lea rax, [rsp + rax + 0x18]
movzx dx, byte [rax]
sub r8, 2
jmp 0x18063c538
mov word [r8], dx
push 0xffffffff8514e3a9
lea rsp, [rsp + 0x20]
jmp fcn.18065483c

Function at 0x18061ea5f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
not al
sal dword [rsp + 9], 0xf0
sub al, 0x83
xor dil, al
sub r8, 2
push 0x83b3d25
mov word [r8], ax
push 0xffffffffc68e03aa
lea rsp, [rsp + 0x20]
jmp fcn.18065483c

Function at 0x18062191f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor dil, dl
lea rdx, [rsp + rdx + 0x18]
mov qword [rsp], 0x53093838
mov dword [rdx], r10d
push 0x2cbb5296
lea rsp, [rsp + 0x20]
jmp fcn.18063a6e8

Function at 0x180628bbb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub word [rsp + 0x14], r9w
add r9, r9
xor di, r10w
shr r9, 0xbb
lea r10, [rsp + r10 + 0x18]
add r9d, dword [r10 + r9*4]
sub r8, 4
mov dword [r8], r9d
lea rsp, [rsp + 0x18]
jmp fcn.18065483c

Function at 0x18062c475
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor r8b, dl
rol qword [rsp + 0x10], 0x5c
jae 0x180649b1c
sbb r11, 2
push 0x89d8a18
call fcn.180636cf5

Function at 0x18062d1a5
Capabilities:
Encode data using xor

Disassembly:
mov r11w, word [r10 + r11*4 - 0x4ffe]
adc r10, 2
mov qword [rsp], 0xffffffffe9136213
not byte [rsp + 7]
add cx, r11w
mov word [r10], cx
jmp 0x18062d1a0
sub r8, 2
movzx edx, word [r8]
or ax, 0x2836
lea rax, [rax + 0x79ad0e01]
dec ax
xor dx, bx
sal ax, 0x69
dec eax
ja 0x180627a93
lea rsp, [rsp + 8]
je 0x180622553
mov edx, 0xf2380609
push rdi
movzx edi, dl
lea rdx, [rdi*2 - 0x3eeb886e]
lea rdx, [0x18063d2f8]
mov edi, 0x72047e84
inc dil
movzx edi, byte [rcx + rdi - 0x72047e85]
xor edi, r11d
push 0xffffffffba1a7b8c
and edi, 0xff
mov edi, dword [rdx + rdi*4]
shr r11d, 8
mov qword [rsp], 0xffffffffa61a36ae
push 0xffffffff87973b90
xor r11d, edi
inc rcx
xor r11d, 0x6c98fc1c
dec rax
lea rsp, [rsp + 0x10]
jne 0x180622505
pop rdi
not r11d
call fcn.18061ed28
call fcn.18062d5cf
mov eax, 0xca87f309
mov edx, eax
jmp 0x1806224ba

Function at 0x18063304b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
neg si
xor di, si
mov qword [rsp], 0x55065881
lea rsi, [rsp + rsi + 0x10]
mov qword [rsi], rdx
lea rsp, [rsp + 0x10]
jmp fcn.18063a6e8

Function at 0x180634928
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sbb r8, 4
mov dword [r8], edx
jmp 0x1806398b8
inc word [rsp + 0xd]
inc edx
push 0x1e82c703
rol edx, 1
bswap edx
mov qword [rsp + 0x10], rdi
push 0x563df697
xor dword [rsp + 0x18], edx
shl dword [rsp + 0xc], 0x1f
dec word [rsp + 3]
mov edi, dword [rsp]
mov rdi, qword [rsp + rdi - 0x553df67f]
jg 0x18063100d
push 0x20631b8
lea rsp, [rsp + 0x28]
jmp fcn.18065483c

Function at 0x1806450b3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
neg r10w
add r10w, 0x189f
neg r10w
add r10w, 0x520c
push 0x1b305130
not r10w
rol r10w, 1
neg r10w
xor di, r10w
lea r10, [rsp + r10 + 0x18]
jmp 0x18062de7a
Function at 0x180651b31
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rbx], r10d
lea rsp, [rsp + 0x18]
jmp fcn.18063a6e8
not bl
neg bl
push 0xffffffffb3823087
inc bl
xor dil, bl
lea rbx, [rsp + rbx + 0x18]
jmp 0x180639394

Function at 0x180653ccf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add r9b, cl
sbb cl, al
pop rcx
call fcn.180645e9e
jmp 0x180642368
neg sil
call fcn.18061e4c5
lea rsp, [rsp + 0x30]
jmp fcn.1806498fe
inc dl
neg dl
add dl, 0x9c
ror dl, 1
push 0x1912e418
call fcn.18061dd22
pop r10
ror al, 0x24
movzx r8d, cl
movsx ebx, dl
pop rbp
and r8b, bl
pop r12
jle 0x180631730
mov esi, 0xe62db780
neg sil
push rsi
sub rdi, 1
xchg word [rsp + 5], si
rol si, 0x42
add si, 0xbbaf
movzx esi, byte [rdi]
xor sil, bl
not sil
dec sil
ror byte [rsp + 1], 0x66
jb 0x18063fc0f
xor dl, bl
mov qword [rsp], 0xffffffffb4875e88
not dl
jmp 0x180653ca4

Function at 0x180656f4c
Capabilities:
Encode data using xor

Disassembly:
not r11
call fcn.18062e11e
add byte [rax], al
add byte [rax], al
xor eax, 0xa3aa2bc2
sub al, 0xdd
sbb dword [rbx - 0x6c70bbdb], esp
and dh, byte [rbx]
sub al, 6
lodsd eax, dword [rsi]
mov edx, 0xda4136
xchg r14d, eax
push rdi
xor al, 7
invalid

Function at 0x180657470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor di, r10w
xor edx, edx
lea r10, [rsp + r10 + 0x10]
or dx, word [r10 + rdx]
push 0xa8ef603
sub r8, 2
push 0x7f80af21
mov word [r8], dx
lea rsp, [rsp + 0x20]
jmp fcn.18065483c