joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004a470
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movsxd rbx, ecx
mov edi, r9d
lea rcx, [0x140272f60]
mov rsi, r8
mov rbp, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140272fe0]
lea rcx, [0x140272f60]
mov rbx, qword [rax + rbx*8]
call fcn.14002ec90
mov eax, dword [rbx + 0x68]
test al, 0x40
jne 0x14004a4df
lea r9, str.invalid_type:__d
mov dword [rsp + 0x20], eax
mov r8d, 0x72e
lea rdx, str.vsock_send
mov ecx, 0x580202
call fcn.140028ed0
mov eax, dword [rbx + 0x68]
mov rcx, qword [rbx + 0x40]
test eax, 0x80000004
jne 0x14004a544
test rcx, rcx
je 0x14004a4fc
cmp dword [rbx + 0xc], 2
jne 0x14004a4fc
cmp word [rbx + 0x6c], 0
jne 0x14004a544
test al, 1
je 0x14004a520
movsxd rcx, dword [rbx + 0x70]
mov r9d, edi
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_send]
movsxd rcx, eax
call fcn.140172320
jmp 0x14004a5a3
lea r9, str.invalid_type:__d
mov dword [rsp + 0x20], eax
mov r8d, 0x733
lea rdx, str.vsock_send
mov ecx, 0x580202
call fcn.140028ed0
jmp 0x14004a5a1
test rcx, rcx
je 0x14004a590
cmp dword [rbx + 0xc], 2
jne 0x14004a590
cmp word [rbx + 0x6c], 0
je 0x14004a590
bt eax, 0x18
jae 0x14004a5b8
cmp dword [rbx + 0x14], 0x11
lea rax, [rbx + 0xb0]
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov r9d, edi
mov qword [rsp + 0x20], rax
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
jne 0x14004a589
call fcn.140049fe0
jmp 0x14004a5a1
call fcn.140049ef0
jmp 0x14004a5a1
mov r9d, edi
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.140049bf0
cdqe
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea rdx, str.cannot_use_send_when_socket_not_connected
mov ecx, 0x580000
call fcn.140029170
int3
Function at 0x14004a5d0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x30
movsxd rbx, ecx
mov esi, r9d
lea rcx, [0x140272f60]
mov rbp, r8
mov r14, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140272fe0]
lea rcx, [0x140272f60]
mov rbx, qword [rax + rbx*8]
call fcn.14002ec90
mov eax, dword [rbx + 0x68]
test al, 0x40
je 0x14004a731
test eax, 0x80000004
jne 0x14004a693
cmp qword [rbx + 0x40], 0
je 0x14004a63a
cmp dword [rbx + 0xc], 2
jne 0x14004a63a
cmp word [rbx + 0x6c], 0
jne 0x14004a693
test al, 1
je 0x14004a66d
mov eax, dword [rsp + 0x68]
mov r9d, esi
movsxd rcx, dword [rbx + 0x70]
mov r8d, ebp
mov dword [rsp + 0x28], eax
mov rdx, r14
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
movsxd rcx, eax
call fcn.140172320
jmp 0x14004a6b7
lea r9, str.invalid_type:__d
mov dword [rsp + 0x20], eax
mov r8d, 0x783
lea rdx, str.vsock_sendto
mov ecx, 0x580202
call fcn.140028ed0
cdqe
jmp 0x14004a6b7
mov qword [rsp + 0x40], rdi
mov rdi, qword [rsp + 0x60]
test rdi, rdi
jne 0x14004a6cd
mov ecx, dword [rbx]
mov r9d, esi
mov r8, rbp
mov rdx, r14
call fcn.14004a470
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
cmp dword [rbx + 0xc], 2
jne 0x14004a743
cmp dword [rbx + 0x14], 0x11
jne 0x14004a70b
mov rcx, rbx
call fcn.14004a9f0
test eax, eax
je 0x14004a6eb
or rax, 0xffffffffffffffff
jmp 0x14004a6b2
mov eax, dword [rsp + 0x68]
mov r9d, esi
mov dword [rsp + 0x28], eax
mov r8, rbp
mov rdx, r14
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call fcn.140049fe0
jmp 0x14004a6b2
cmp dword [rbx + 0x10], 3
jne 0x14004a743
mov eax, dword [rsp + 0x68]
mov r9d, esi
mov dword [rsp + 0x28], eax
mov r8, rbp
mov rdx, r14
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call fcn.140049ef0
jmp 0x14004a6b2
lea rdx, str.sendto_to_non_packet_socket
mov ecx, 0x580000
call fcn.140029170
int3
lea rdx, str.invalid_socket_address
mov ecx, 0x580000
call fcn.140029170
int3
Function at 0x14004a8b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movsxd rbx, ecx
mov esi, edx
lea rcx, [0x140272f60]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140272fe0]
lea rcx, [0x140272f60]
mov rdi, qword [rax + rbx*8]
call fcn.14002ec90
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
lea rbx, [rdi + 0x150]
test dword [rdi + 0x68], 0x800000
jne 0x14004a9b0
movsxd rcx, dword [rdi + 0x70]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x14004a92e
or eax, 0xffffffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x24]
lea r8, [rsp + 0x40]
mov dword [rbx + 4], eax
lea rdx, [rsp + 0x20]
movzx eax, word [rsp + 0x22]
mov dword [rbx + 8], eax
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
movsxd rcx, dword [rdi + 0x70]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x14004a91b
cmp dword [rdi + 0x54], eax
je 0x14004a96b
movups xmm0, xmmword [rdi + 0x50]
movups xmmword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x20]
shr rax, 0x20
mov dword [rbx + 0xc], eax
mov rax, qword [rsp + 0x20]
shr rax, 0x10
movzx ecx, ax
mov dword [rbx + 0x10], ecx
test esi, esi
je 0x14004a993
mov eax, dword [rbx + 8]
mov dword [rbx + 8], ecx
mov dword [rbx + 0x10], eax
mov rcx, rbx
mov dword [rbx], 5
call fcn.1400484a0
test eax, eax
jne 0x14004a91b
or dword [rdi + 0x68], 0x800000
mov rbx, qword [rsp + 0x48]
xor eax, eax
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140055ef0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
or ebx, 0xffffffff
mov rcx, qword [rdx]
xor esi, esi
mov rdi, rdx
test rcx, rcx
je 0x140055f1f
call fcn.14017668c
mov qword [rdi], rsi
mov edx, 1
mov ecx, 0x400
call fcn.140176684
lea r9, [rsp + 0x38]
mov qword [rdi], rax
mov r8d, 0x400
mov rdx, rax
mov rcx, rbp
call sub.PSAPI.DLL_EnumProcessModules
movsxd rcx, eax
call fcn.140172320
test rax, rax
jne 0x140055f95
cmp dword [0x1402734b4], 6
jl 0x140055f6e
lea rdx, str.EnumProcessModules_failed:__m
mov ecx, 0x650006
call fcn.140028ca0
mov rcx, qword [rdi]
test rcx, rcx
je 0x140055f7e
call fcn.14017668c
mov qword [rdi], rsi
mov rbp, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov ebx, dword [rsp + 0x38]
shr ebx, 3
cmp ebx, 0x80
jb 0x140055f7e
mov rcx, qword [rdi]
lea esi, [rbx + rbx]
mov edx, esi
shl rdx, 3
call fcn.140181ac0
lea r8d, [rsi*8]
mov qword [rdi], rax
lea r9, [rsp + 0x38]
mov rdx, rax
mov rcx, rbp
call sub.PSAPI.DLL_EnumProcessModules
movsxd rcx, eax
call fcn.140172320
test rax, rax
je 0x140055fea
mov ebx, dword [rsp + 0x38]
shr ebx, 3
cmp ebx, esi
jae 0x140055ffc
jmp 0x140055f7e
lea rdx, str.EnumProcessModules_2nd_failed:__m
mov ecx, 0x650000
call fcn.140029170
int3
lea rdx, str.EnumProcessModules_no_space
mov ecx, 0x650000
call fcn.140029170
int3
Function at 0x140056150
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbp, r8
xor edx, edx
mov ebx, r9d
mov rsi, rcx
lea r8d, [rdx + 0x78]
call fcn.140175020
xor r8d, r8d
mov dword [rsi + 0x38], ebx
mov rdx, rdi
mov qword [rsi], rdi
mov rcx, rsi
mov qword [rsi + 8], rbp
call fcn.140056620
mov rcx, rsi
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x10], rax
call fcn.1400563a0
test eax, eax
jne 0x14005623c
mov rbx, qword [rsi + 0x10]
lea r9, [rsp + 0x58]
mov rcx, rbx
lea edx, [rax + 0x32]
lea r8d, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14005623c
mov edi, dword [rsp + 0x58]
test rbx, rbx
je 0x14005623c
mov r9, qword [rsi + 0x10]
mov rdx, rbx
mov r8d, dword [rsi + 0x30]
mov rcx, rsi
mov qword [rsp + 0x20], rbp
call fcn.140056790
movsd xmm0, qword [rbx]
mov r8d, edi
mov r9, qword [rsi + 8]
mov edx, 0x32
movsd qword [rsi + 0x3c], xmm0
mov rcx, rbx
mov eax, dword [rbx + 8]
mov dword [rsi + 0x44], eax
movzx eax, word [rbx + 0xc]
mov word [rsi + 0x48], ax
movsd xmm0, qword [r9]
movsd qword [rsi + 0x66], xmm0
mov eax, dword [r9 + 8]
mov dword [rsi + 0x6e], eax
movzx eax, word [r9 + 0xc]
lea r9, [rsp + 0x58]
mov word [rsi + 0x72], ax
mov dword [rsp + 0x58], edi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
jmp 0x14005625e
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14005625b
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov qword [rsi + 0x20], 0
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400563a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
sub rsp, 0xcc8
mov r9d, dword [rcx + 0x38]
lea rax, [rsp + 0xce0]
mov rdx, qword [rcx + 0x18]
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
xor ebx, ebx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x28], sendto
mov qword [rsp + 0x20], rax
lea r8d, [rbx + 0x32]
call fcn.140007ed0
cmp eax, 3
je 0x140056612
lea edx, [rbx + 0x2a]
mov qword [rsp + 0xce8], rbp
xor ecx, ecx
lea r9d, [rbx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
je 0x1400565fd
mov qword [rsp + 0xcf0], rdi
mov qword [rsp + 0xcf8], r12
mov qword [rsp + 0xcc0], r13
mov qword [rsp + 0xcb8], r14
mov qword [rsp + 0xcb0], r15
cmp qword [rsi + 0x28], rbx
jne 0x14005644a
mov qword [rsi + 0x28], rax
mov rdx, qword [rsi + 8]
mov r13d, 0x80000000
mov rcx, qword [rsi + 0x10]
mov rax, rdx
sub rax, rcx
mov rdi, rcx
sub rdi, rdx
mov r14d, 5
cmp rcx, rdx
mov r8d, r14d
mov r12d, recv
cmovbe rdi, rax
cmp rdi, r13
mov edi, dword [rsp + 0xce0]
cmovae r8d, r12d
xor edx, edx
test edi, edi
je 0x1400564ab
nop
cmp ebx, r8d
jge 0x1400564ab
mov eax, edx
inc edx
imul rcx, rax, 0xd0
add ebx, dword [rsp + rcx + 0x140]
cmp edx, edi
jb 0x140056490
mov rdx, qword [rsi + 0x18]
mov rcx, rbp
movsxd r15, ebx
mov r8, r15
call fcn.1401757c0
mov rdx, qword [rsi + 0x28]
mov rdi, qword [rsi + 0x10]
mov rcx, rdx
sub rcx, rdi
mov rax, rdi
sub rax, rdx
cmp rdx, rdi
lea r9, [r15 + rdx]
lea r8, [r15 + rdi]
mov edx, r14d
cmovbe rcx, rax
mov rax, r8
cmp rcx, r13
mov rcx, r9
cmovae edx, r12d
sub rax, r9
sub rcx, r8
cmp r9, r8
cmovbe rcx, rax
cmp rcx, r13
jae 0x14005651c
sub r8d, r9d
mov eax, r14d
sub r8d, r14d
mov byte [rsp + 0x40], 0xe9
mov dword [rsp + 0x41], r8d
lea rdi, [rsp + 0x45]
jmp 0x140056538
mov eax, r12d
lea rdi, [rsp + 0x4e]
mov word [rsp + 0x40], 0x25ff
mov dword [rsp + 0x42], 0
mov qword [rsp + 0x46], r8
mov r8d, edx
cmp eax, edx
jae 0x14005654c
mov ecx, r8d
sub rcx, rax
mov eax, 0xcc
rep stosb byte [rdi], al
lea rcx, [r15 + rbp]
lea rdx, [rsp + 0x40]
call fcn.1401757c0
mov r9, qword [rsi + 0x10]
lea rax, [rsp + 0x80]
mov r8d, ebx
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rbp
call fcn.1400566c0
mov r15, qword [rsp + 0xcb0]
test eax, eax
jne 0x1400565e7
mov r8, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x28]
mov rcx, r8
sub rcx, rdx
mov qword [rsi + 0x20], rbp
mov rdi, rdx
mov dword [rsi + 0x30], ebx
sub rdi, r8
cmp rdx, r8
cmovbe rdi, rcx
cmp rdi, r13
cmovae r14d, r12d
add r14d, ebx
mov dword [rsi + 0x34], r14d
mov r13, qword [rsp + 0xcc0]
mov r12, qword [rsp + 0xcf8]
mov rdi, qword [rsp + 0xcf0]
mov r14, qword [rsp + 0xcb8]
mov rbp, qword [rsp + 0xce8]
add rsp, 0xcc8
pop rsi
pop rbx
ret
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
or eax, 0xffffffff
jmp 0x1400565b5
or eax, 0xffffffff
mov rbp, qword [rsp + 0xce8]
add rsp, 0xcc8
pop rsi
pop rbx
ret
or eax, 0xffffffff
add rsp, 0xcc8
pop rsi
pop rbx
ret
Function at 0x140059110
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r15
mov rdi, r9
mov rsi, r8
mov r15, rdx
test rcx, rcx
je 0x140059162
cmp qword [rcx], 0
je 0x140059162
cmp dword [rcx + 8], 0x40
jb 0x140059162
xor r9d, r9d
test r8, r8
je 0x14005913d
mov qword [r8], r9
test rdi, rdi
je 0x140059145
mov qword [rdi], r9
mov r10, qword [rsp + 0x38]
test r10, r10
je 0x140059152
mov qword [r10], r9
mov rax, qword [rcx]
mov edx, dword [rcx + 8]
mov ecx, 0x5a4d
cmp word [rax], cx
je 0x14005916e
or eax, 0xffffffff
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret
movsxd r8, dword [rax + 0x3c]
lea ecx, [r8 + 0x14]
cmp ecx, edx
ja 0x140059162
add ecx, 0x18
mov qword [rsp + 0x18], rbx
lea rbx, [rax + r8]
cmp ecx, edx
ja 0x140059280
cmp dword [rbx], 0x4550
jne 0x140059280
mov qword [rsp + 0x20], rbp
mov r8d, 0xe0
movzx ebp, word [rbx + 0x14]
mov qword [rsp + 0x28], r14
movzx eax, bp
sub ax, r8w
lea r14, [rbx + 4]
mov r8d, 0xffef
test r8w, ax
jne 0x14005927b
movzx eax, bp
add ecx, eax
cmp ecx, edx
ja 0x14005927b
movzx eax, word [rbx + 0x18]
lea r8, [rbx + 0x18]
mov r11d, 0x10b
sub ax, r11w
mov r11d, 0xfeff
test r11w, ax
jne 0x14005927b
movzx r11d, word [r14 + 2]
lea eax, [r11 + r11*4]
lea ecx, [rcx + rax*8]
cmp ecx, edx
ja 0x14005927b
cmp dword [r8 + 0x3c], edx
ja 0x14005927b
movzx ebp, bp
add rbp, r8
test r11d, r11d
je 0x140059241
lea rcx, [rbp + 0x10]
nop dword [rax]
mov eax, dword [rcx + 4]
add eax, dword [rcx]
cmp eax, edx
ja 0x14005927b
mov eax, dword [rcx - 8]
add eax, dword [rcx - 4]
cmp eax, dword [r8 + 0x38]
ja 0x14005927b
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140059220
test r15, r15
je 0x140059249
mov qword [r15], rbx
test rsi, rsi
je 0x140059251
mov qword [rsi], r14
test rdi, rdi
je 0x140059259
mov qword [rdi], r8
test r10, r10
je 0x140059261
mov qword [r10], rbp
xor eax, eax
mov rbp, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret
or eax, 0xffffffff
jmp 0x140059263
mov rbx, qword [rsp + 0x18]
or eax, 0xffffffff
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret

Function at 0x14005af60
Capabilities:
List tcp connections and listeners

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x14026f610]
mov rbx, rcx
mov rcx, qword [rcx]
mov edx, eax
mov dword [rsp + 0x40], eax
call fcn.140181ac0
mov r9d, 2
mov dword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rbx], rax
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x20], 5
mov rcx, rax
call sub.IPHLPAPI.DLL_GetExtendedTcpTable
cmp eax, 0x7a
jne 0x14005b01b
mov edx, dword [rsp + 0x40]
mov rcx, qword [rbx]
mov qword [rsp + 0x48], rdi
call fcn.140181ac0
mov edx, dword [0x14026f610]
mov r9d, 2
cmp edx, dword [rsp + 0x40]
mov rcx, rax
mov dword [rsp + 0x28], 0
cmovb edx, dword [rsp + 0x40]
xor r8d, r8d
mov dword [0x14026f610], edx
lea rdx, [rsp + 0x40]
mov qword [rbx], rax
mov dword [rsp + 0x20], 5
call sub.IPHLPAPI.DLL_GetExtendedTcpTable
mov edi, eax
test eax, eax
je 0x14005b014
mov rcx, qword [rbx]
test rcx, rcx
je 0x14005b014
call fcn.14017668c
mov qword [rbx], 0
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
Function at 0x14005b030
Capabilities:
List udp connections and listeners

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x14026f614]
mov rbx, rcx
mov rcx, qword [rcx]
mov edx, eax
mov dword [rsp + 0x40], eax
call fcn.140181ac0
mov r9d, 2
mov dword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rbx], rax
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x20], 1
mov rcx, rax
call sub.IPHLPAPI.DLL_GetExtendedUdpTable
cmp eax, 0x7a
jne 0x14005b0eb
mov edx, dword [rsp + 0x40]
mov rcx, qword [rbx]
mov qword [rsp + 0x48], rdi
call fcn.140181ac0
mov edx, dword [0x14026f614]
mov r9d, 2
cmp edx, dword [rsp + 0x40]
mov rcx, rax
mov dword [rsp + 0x28], 0
cmovb edx, dword [rsp + 0x40]
xor r8d, r8d
mov dword [0x14026f614], edx
lea rdx, [rsp + 0x40]
mov qword [rbx], rax
mov dword [rsp + 0x20], 1
call sub.IPHLPAPI.DLL_GetExtendedUdpTable
mov edi, eax
test eax, eax
je 0x14005b0e4
mov rcx, qword [rbx]
test rcx, rcx
je 0x14005b0e4
call fcn.14017668c
mov qword [rbx], 0
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret

Function at 0x14005f530
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x60]
call fcn.140175020
mov eax, 1
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
add rsp, 0x20
pop rbx
ret

Function at 0x140061fd0
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x5c]
call fcn.140175020
mov eax, 1
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
add rsp, 0x20
pop rbx
ret

Function at 0x14006be10
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14006be50
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ecx, ecx
mov dword [rbx], eax
cmp eax, 0xffffffff
setne cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x14006bfa0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x14006c460
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x14006c487
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x14006c470
movzx eax, r9b
ret
Function at 0x14006c630
Capabilities:
Access the windows event log
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x168
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
test rax, rax
je 0x14006c6ed
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x14006c6ed
mov qword [rsp + 0x160], rsi
lea rbx, [rsp + 0x188]
call fcn.14001bff0
mov r9, qword [rsp + 0x180]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rbx
mov esi, 0x100
xor ebx, ebx
mov r8d, esi
mov rcx, qword [rax]
or rcx, 1
mov qword [rsp + 0x20], rbx
call fcn.14017b8e0
or ecx, 0xffffffff
mov qword [rsp + 0x20], rbx
test eax, eax
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x60]
cmovs eax, ecx
mov rcx, rdi
test eax, eax
cmovs eax, esi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rsi, qword [rsp + 0x160]
add rsp, 0x168
pop rdi
pop rbx
ret
lea rbx, [rsp + 0x188]
call fcn.14001bff0
mov r9, qword [rsp + 0x180]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rbx
mov r8d, 0xff
xor ebx, ebx
mov rcx, qword [rax]
or rcx, 1
mov qword [rsp + 0x20], rbx
call fcn.14017b8e0
mov byte [rsp + 0x15f], bl
call fcn.14006c4d0
xor ecx, ecx
test eax, eax
jle 0x14006c7ab
lea rdx, str.OpenSSL
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov rdi, rax
test rax, rax
je 0x14006c7c3
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x60]
mov ecx, 1
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov edx, ecx
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov word [rsp + 0x28], cx
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
jne 0x14006c798
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
add rsp, 0x168
pop rdi
pop rbx
ret
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.OpenSSL:_FATAL
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_MessageBoxA]
add rsp, 0x168
pop rdi
pop rbx
ret

Function at 0x1400710e0
Capabilities:
Get thread local storage value

Disassembly:
lea rcx, [0x140271398]
jmp fcn.14006be10

Function at 0x14007a460
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
je 0x14007a4c8
movzx eax, byte [rcx]
test al, al
je 0x14007a4c8
mov qword [rsp + 0x30], rsi
mov esi, 0x100
movsx ecx, al
call fcn.1400c3c50
or eax, esi
lea rdi, [rdi + 1]
mov ecx, eax
add esi, 0x100
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol ebx, cl
xor ebx, eax
movzx eax, byte [rdi]
test al, al
jne 0x14007a485
mov rsi, qword [rsp + 0x30]
mov eax, ebx
shr eax, 0x10
xor eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ab4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rsi, r8d
mov rbx, rdx
mov r8, rsi
mov rbp, rcx
call fcn.140175c20
test eax, eax
jle case.0x1400ab599.2
xor r8d, r8d
test esi, esi
jle 0x1400ab519
mov rdx, rbp
mov rcx, rbx
sub rdx, rbx
nop dword [rax]
movzx eax, byte [rcx]
cmp byte [rdx + rcx], al
jne 0x1400ab519
inc rcx
inc r8d
mov rax, rcx
sub rax, rbx
cmp rax, rsi
jl 0x1400ab500
lea edx, [rsi - 1]
movsxd rax, edx
test edx, edx
js 0x1400ab546
mov r9, rbp
lea rcx, [rax + rbx]
sub r9, rbx
nop dword [rax]
cmp byte [rcx + r9], 0
jne 0x1400ab546
cmp byte [rcx], 0xff
jne 0x1400ab546
dec edx
dec rcx
cmp rcx, rbx
jns 0x1400ab530
cmp r8d, edx
jl case.0x1400ab599.2
jle 0x1400ab55e
lea eax, [r8*8]
jmp 0x1400ab5e0
movsxd rax, r8d
movzx r9d, byte [rax + rbx]
movzx r10d, byte [rax + rbp]
movzx edx, r9b
xor dl, r10b
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x1400ab599.2
lea r11, [0x140000000]
cdqe
movzx eax, byte [r11 + rax + 0xab618]
mov ecx, dword [r11 + rax*4 + 0xab5f8]
add rcx, r11
jmp rcx
mov eax, 7
jmp 0x1400ab5ca
mov eax, 6
jmp 0x1400ab5ca
mov eax, 5
jmp 0x1400ab5ca
mov eax, 4
jmp 0x1400ab5ca
mov eax, 3
jmp 0x1400ab5ca
mov eax, 2
jmp 0x1400ab5ca
mov eax, 1
test dl, r10b
jne case.0x1400ab599.2
and r9b, dl
cmp r9b, dl
jne case.0x1400ab599.2
lea eax, [rax + r8*8]
jmp 0x1400ab5e0
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret