joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002af0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x140009010]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rdi, rcx
mov qword [rsp + 0x38], rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
lea r8d, [rbx + 0x1f]
lea rdx, str.SOFTWAREMicrosoftCryptography
lea rcx, [rsp + 0x70]
call fcn.1400024a0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea r8d, [rbx + 0xb]
lea rdx, str.MachineGuid
lea rcx, [rsp + 0x50]
call fcn.1400024a0
nop
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0xf
mov byte [rdi], bl
mov dword [rsp + 0x30], 1
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rdx, qword [rsp + 0x70]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002c72
mov dword [rsp + 0x48], 0x100
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140002c66
lea rax, [rbp - 0x70]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140002c20
mov rax, qword [rdi + 0x18]
cmp rbx, rax
ja 0x140002c57
mov rsi, rdi
cmp rax, 0x10
jb 0x140002c3e
mov rsi, qword [rdi]
mov qword [rdi + 0x10], rbx
mov r8, rbx
lea rdx, [rbp - 0x70]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], 0
jmp 0x140002c66
lea r9, [rbp - 0x70]
mov rdx, rbx
mov rcx, rdi
call fcn.140004510
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140002cb2
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002cad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002cad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004930
movdqa xmm0, xmmword [0x140006890]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140002d04
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002cff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002cff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004930
mov rax, rdi
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1400047f0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140004650
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1400046b1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140004670
mov ecx, dword [r9]
jmp 0x140004798
cmp ecx, 0x4e0
jb 0x140004798
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400046d0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140004720
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x1400052a4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400052ee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400052ee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400052ee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400052ee
cmp dword [rcx + 0x84], 0xe
jbe 0x1400052ee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400052f0
xor al, al
add rsp, 0x28
ret
Function at 0x6db1af40
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6db3c5e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6db1b0c8
mov rax, qword [0x6db3c5e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6db1af8c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6db1b015
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6db1af70
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6db1b0fd
mov rax, qword [0x6db3c5e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6db3c5e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6db1b0e0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6db1b00e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6db1b070
add dword [0x6db3c5e4], 1
cmp edi, 8
jae 0x6db1b043
test dil, 4
jne 0x6db1b0b4
test edi, edi
je 0x6db1b038
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6db1b0cf
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6db1b038
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6db1b05c
jmp 0x6db1b038
add rsi, qword [0x6db3c5e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6db1b00e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6db1b038
xor esi, esi
jmp 0x6db1af97
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6db1b038
mov rax, qword [0x6db3c5e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6db1b850
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6db3c8c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6db3c8a0]
test rbx, rbx
je 0x6db1b8a4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6db1b89b
test rsi, rsi
je 0x6db1b89b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6db1b880
lea rcx, [0x6db3c8c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6db1bae0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6db1baf0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6db1bb00
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6db1bb41
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6db1bb38
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6db1bb43
add rax, 0x28
cmp rax, r9
jne 0x6db1bb24
xor eax, eax
ret

Function at 0x6db1bbe0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6db391f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6db1bc4d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6db1bc4d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6db1bc4d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6db1bc44
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6db1bc4f
add rax, 0x28
cmp rax, r9
jne 0x6db1bc30
xor eax, eax
add rsp, 0x28
ret

Function at 0x6db1bd50
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6db391f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6db1bd70
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6db1bd68
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6db1bdcd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6db1bdc4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6db1bdd4
add rax, 0x28
cmp rax, r9
jne 0x6db1bdb0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6db1bdf0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6db391f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6db1be5e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6db1be5e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6db1be5e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6db1be5e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6db1be55
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6db1be65
add rcx, 0x28
cmp rcx, rax
jne 0x6db1be40
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6db1be78
jmp 0x6db1be5e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6db1be86
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6db1be5e
test r9d, r9d
jg 0x6db1be70
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6db1c1c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x40a5a0
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x258
xor r9d, r9d
xor r8d, r8d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x48], rcx
add ecx, 1
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x3c], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
setg al
add rsp, 0x258
ret
mov rax, qword [rcx + 0x128]
cmp byte [rax], 0
je 0x40d8e8
mov eax, 1
ret
mov rcx, qword [rcx + 0x118]
jmp 0x40a5a0

Function at 0x40a5f0
Capabilities:
Get socket status

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
mov r12, rcx
mov rcx, r8
mov rdi, r8
mov rbp, rdx
call sub.msvcrt.dll_strlen
lea ebx, [rax + 1]
cdqe
mov byte [rdi + rax], 0xa
test ebx, ebx
jle 0x40a692
xor esi, esi
lea r14, [rsp + 0x40]
lea r13, [rsp + 0x38]
lea r15, [rsp + 0x34]
nop word [rax + rax]
mov rcx, qword [rbp]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x38], 0
mov r8, r14
mov qword [rsp + 0x48], rcx
add ecx, 1
mov dword [rsp + 0x40], 1
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x40a6a5
mov rcx, qword [r12]
lea rdx, [rdi + rsi]
mov r9, r15
movsxd r8, ebx
call qword [sym.imp.libcurl_4.dll_curl_easy_send]
test eax, eax
jne 0x40a6a0
movsxd rdx, dword [rsp + 0x34]
sub ebx, edx
add rsi, rdx
test ebx, ebx
jg 0x40a638
mov eax, 1
jmp 0x40a6a7
cmp eax, 0x51
je 0x40a638
xor eax, eax
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x40bed0
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x148
mov qword [rsp + 0x40], 0
mov rbx, rcx
mov r13, rdx
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call qword [sym.imp.libcurl_4.dll_curl_easy_init]
mov r12, rax
test rax, rax
je 0x40c210
lea rsi, [rsp + 0x40]
mov r8, rbx
mov edx, 0x2712
mov rcx, rax
mov rbx, qword [sym.imp.libcurl_4.dll_curl_easy_setopt]
call rbx
mov r8d, 1
mov edx, 0x4a
mov rcx, r12
call rbx
mov r8d, 0xf
mov edx, 0x4e
mov rcx, r12
call rbx
mov r8, rsi
mov edx, 0x271a
mov rcx, r12
call rbx
mov r8d, 1
mov edx, 0x63
mov rcx, r12
call rbx
mov r8d, 1
mov edx, 0x79
mov rcx, r12
call rbx
lea r8, [0x0040a4d0]
mov edx, 0x4e2b
mov rcx, r12
call rbx
lea r8, [rsp + 0x20]
mov edx, 0x2711
mov rcx, r12
call rbx
mov rax, qword [0x00664480]
mov r8, qword [rax]
test r8, r8
je 0x40c1a0
mov edx, 0x2714
mov rcx, r12
call rbx
mov rax, qword [0x00664490]
mov edx, 0x65
mov rcx, r12
mov r8d, dword [rax]
call rbx
mov rcx, r12
call qword [sym.imp.libcurl_4.dll_curl_easy_perform]
test eax, eax
jne 0x40c1f0
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x40c15b
cmp qword [rsp + 0x28], 0
jne 0x40c190
lea rdx, str.Empty_data_received_for_config
mov ecx, 1
xor r13d, r13d
call fcn.0040a6c0
mov rcx, r12
call qword [sym.imp.libcurl_4.dll_curl_easy_cleanup]
mov rax, r13
add rsp, 0x148
pop rbx
pop rsi
pop r12
pop r13
ret
mov r8, r13
xor edx, edx
call fcn.005cd0b0
mov r13, rax
jmp 0x40c16f
lea rcx, str.http_proxy
call sub.msvcrt.dll_getenv
test rax, rax
je 0x40c138
lea rcx, str.all_proxy
call sub.msvcrt.dll_getenv
lea rcx, str.all_proxy
test rax, rax
je 0x40c230
call sub.msvcrt.dll_getenv
mov rcx, r12
mov edx, 0x2714
mov r8, rax
call rbx
mov rcx, r12
call qword [sym.imp.libcurl_4.dll_curl_easy_perform]
test eax, eax
je 0x40c149
nop dword [rax]
mov r8, rsi
lea rdx, str.Remote_config_read_failed:__s
mov ecx, 1
xor r13d, r13d
call fcn.0040a6c0
jmp 0x40c16f
lea rdx, str.Remote_config_init_failed_
mov ecx, 1
xor r13d, r13d
call fcn.0040a6c0
jmp 0x40c178
lea rcx, str.ALL_PROXY
call sub.msvcrt.dll_getenv
test rax, rax
je 0x40c250
lea rcx, str.ALL_PROXY
jmp 0x40c1c9
lea r8, [0x0060cbe3]
mov edx, 0x2714
mov rcx, r12
call rbx
jmp 0x40c138
Function at 0x40d8d0
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x258
xor r9d, r9d
xor r8d, r8d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x48], rcx
add ecx, 1
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x3c], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
setg al
add rsp, 0x258
ret
mov rax, qword [rcx + 0x128]
cmp byte [rax], 0
je 0x40d8e8
mov eax, 1
ret
mov rcx, qword [rcx + 0x118]
jmp 0x40a5a0
Function at 0x415380
Capabilities:
Hash data using sha512

Disassembly:
push rdi
push rbx
sub rsp, 0x68
mov rbx, rcx
test rcx, rcx
je 0x4154aa
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x415480
xor eax, eax
lea rdi, [rcx + 0x48]
mov byte [rsp + 0x20], dl
movdqu xmm0, xmmword [0x0060f460]
mov word [rsp + 0x3e], ax
and rdi, 0xfffffffffffffff8
mov eax, ecx
sub eax, edi
mov byte [rsp + 0x31], 0
mov qword [rsp + 0x29], 0
mov qword [rsp + 0x21], 0x10100
mov qword [rsp + 0x32], 0
mov dword [rsp + 0x3a], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rcx + 0x40], 0
mov qword [rcx + 0xe8], 0
lea ecx, [rax + 0xf0]
xor eax, eax
shr ecx, 3
rep stosq qword [rdi], rax
mov dword [rbx + 0xe4], edx
pxor xmm0, xmmword [rsp + 0x20]
movups xmmword [rbx], xmm0
movdqu xmm0, xmmword [0x0060f470]
pxor xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx + 0x10], xmm0
movdqu xmm0, xmmword [0x0060f480]
pxor xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx + 0x20], xmm0
movdqu xmm0, xmmword [0x0060f490]
pxor xmm0, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x30], xmm0
add rsp, 0x68
pop rbx
pop rdi
ret
mov edx, 0xf0
call fcn.00417fe0
cmp byte [rbx + 0xe8], 0
je 0x41549b
mov qword [rbx + 0x58], 0xffffffffffffffff
mov qword [rbx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
jmp 0x415471
mov eax, 0xffffffff
jmp 0x415471

Function at 0x4154c0
Capabilities:
Hash data using sha512

Disassembly:
push r13
push r12
push rdi
sub rsp, 0xe0
mov r10, r8
mov r12, rcx
mov r8, r9
test rcx, rcx
je 0x415659
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x415628
lea rax, [r9 - 1]
cmp rax, 0x3f
ja 0x415628
test r10, r10
je 0x415628
lea rdi, [rcx + 0x48]
xor eax, eax
mov byte [rsp + 0x21], r9b
lea r13, [rsp + 0x60]
and rdi, 0xfffffffffffffff8
mov byte [rsp + 0x20], dl
movdqu xmm0, xmmword [0x0060f460]
mov qword [rsp + 0x2a], 0
mov word [rsp + 0x3e], ax
xor eax, eax
mov qword [rsp + 0x22], 0x101
mov qword [rsp + 0x32], 0
mov dword [rsp + 0x3a], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rcx + 0x40], 0
mov qword [rcx + 0xe8], 0
sub ecx, edi
add ecx, 0xf0
shr ecx, 3
rep stosq qword [rdi], rax
mov ecx, 0x10
mov rdi, r13
mov dword [r12 + 0xe4], edx
rep stosq qword [rdi], rax
mov rdx, r10
mov rcx, r13
pxor xmm0, xmmword [rsp + 0x20]
movups xmmword [r12], xmm0
movdqu xmm0, xmmword [0x0060f470]
pxor xmm0, xmmword [rsp + 0x30]
movups xmmword [r12 + 0x10], xmm0
movdqu xmm0, xmmword [0x0060f480]
pxor xmm0, xmmword [rsp + 0x40]
movups xmmword [r12 + 0x20], xmm0
movdqu xmm0, xmmword [0x0060f490]
pxor xmm0, xmmword [rsp + 0x50]
movups xmmword [r12 + 0x30], xmm0
call sub.msvcrt.dll_memcpy
mov r8d, pe_nt_image_headers64
mov rdx, r13
mov rcx, r12
call fcn.004150b0
mov edx, pe_nt_image_headers64
mov rcx, r13
call fcn.00417fe0
xor eax, eax
add rsp, 0xe0
pop rdi
pop r12
pop r13
ret
mov edx, 0xf0
mov rcx, r12
call fcn.00417fe0
cmp byte [r12 + 0xe8], 0
je 0x415649
mov qword [r12 + 0x58], 0xffffffffffffffff
mov qword [r12 + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
jmp 0x415617
mov eax, 0xffffffff
jmp 0x415617
Function at 0x417ff0
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x828
mov r12, rcx
mov rbx, rdx
test rcx, rcx
je 0x418010
test rdx, rdx
jne 0x418021
add rsp, 0x828
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
mov r10d, dword [rdx + 0x18]
mov r11, qword [rdx]
lea r9, [rsp + 0x20]
mov ecx, pe_nt_image_headers64
mov rdi, r9
lea r8, [rsp + 0x420]
mov eax, r10d
shl rax, 0xa
lea rsi, [r11 + rax - 0x400]
rep movsq qword [rdi], qword [rsi]
mov esi, dword [rdx + 0x1c]
cmp esi, 1
jbe 0x4180f2
cmp esi, 3
jbe 0x418137
lea eax, [rsi - 4]
lea r13d, [r10 + r10 - 1]
mov edi, 3
and eax, 0xfffffffe
lea r14d, [rax + 5]
mov r8d, r13d
add r13d, r10d
mov rax, r9
xor edx, edx
mov ecx, r13d
shl r8, 0xa
shl rcx, 0xa
add r8, r11
add rcx, r11
nop dword [rax]
movdqu xmm0, xmmword [r8 + rdx]
movdqu xmm1, xmmword [r8 + rdx + 0x10]
add rax, 0x20
pxor xmm0, xmmword [rax - 0x20]
pxor xmm1, xmmword [rax - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
movdqu xmm2, xmmword [rcx + rdx + 0x10]
movdqu xmm3, xmmword [rcx + rdx]
add rdx, 0x20
pxor xmm1, xmm2
pxor xmm0, xmm3
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
cmp rdx, 0x400
jne 0x418098
lea eax, [rdi + 2]
add r13d, r10d
cmp eax, r14d
je 0x41813c
mov edi, eax
jmp 0x418078
mov rdi, r8
mov rsi, r9
mov ecx, pe_nt_image_headers64
mov edx, dword [r12 + 8]
rep movsq qword [rdi], qword [rsi]
mov rcx, qword [r12]
mov r9d, 0x400
lea r8, [rsp + 0x420]
call fcn.00415ac0
mov edx, dword [rbx + 0x10]
mov rax, qword [r12 + 0x68]
mov rcx, qword [rbx]
shl rdx, 0xa
test rax, rax
je 0x418189
call rax
jmp 0x418010
mov edi, 1
add edi, 1
lea r8, [rsp + 0x420]
mov ecx, edi
imul ecx, r10d
sub ecx, 1
mov edx, ecx
mov rax, r9
shl rdx, 0xa
add rdx, r11
nop dword [rax]
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmmword [rax]
add rax, 0x10
add rdx, 0x10
movups xmmword [rax - 0x10], xmm0
cmp rax, r8
jne 0x418160
add ecx, r10d
cmp esi, edi
jbe 0x4180f2
add edi, 1
jmp 0x418150
call qword [sym.imp.msvcrt.dll__aligned_free]
jmp 0x418010
Function at 0x41d4f0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov r9, r8
test rcx, rcx
je 0x41d540
test rdx, rdx
je 0x41d540
mov r8, rdx
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov qword [rbx], rax
sete al
movzx eax, al
neg eax
add rsp, 0x30
pop rbx
ret
mov eax, 0xffffffff
jmp 0x41d531
Function at 0x4372f0
Capabilities:
Hash data using sha512

Disassembly:
push r13
push r12
sub rsp, 0x28
movdqu xmm1, xmmword [0x0060fdc0]
pxor xmm0, xmm0
movdqu xmm2, xmmword [0x0060fdd0]
movdqu xmm3, xmmword [0x0060fde0]
movdqu xmm4, xmmword [0x0060fdf0]
mov r12, rcx
mov r13, rdx
mov qword [rcx + 0xd0], 0
mov rdx, r8
movups xmmword [rcx + 0x80], xmm1
mov r8, r9
movups xmmword [rcx + 0x90], xmm2
movups xmmword [rcx + 0xa0], xmm3
movups xmmword [rcx + 0xb0], xmm4
movups xmmword [rcx + 0xc0], xmm0
call fcn.00436fb0
mov rdx, r13
mov rcx, r12
add rsp, 0x28
pop r12
pop r13
jmp fcn.004370c0