joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140182f40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, r9
mov rbx, rdx
mov r14, rcx
mov rdx, qword [rcx]
mov rdi, rbx
sub rdi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r9, 0xfffffffffffffff
cmp rax, r9
je 0x140183169
lea r8, [rax + 1]
mov qword [rsp + 0x30], r8
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r9
sub rax, rdx
cmp rcx, rax
jbe 0x1401830ae
mov rsi, r9
mov qword [rsp + 0x98], r9
mov rcx, rsi
shl rcx, 4
call fcn.140003e30
mov r15, rax
mov qword [rsp + 0x40], rax
and rdi, 0xfffffffffffffff0
lea r12, [rdi + rax]
lea rdi, [r12 + 0x10]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x90], rdi
mov ecx, 0x18
call fcn.140361120
mov r9, rax
mov rax, qword [rsp + 0xc0]
movzx ecx, byte [rax]
mov byte [r9], cl
mov rax, qword [rsp + 0xb8]
movzx ecx, byte [rax]
mov byte [r9 + 1], cl
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rax]
mov dword [r9 + 4], ecx
mov rax, qword [r13]
mov qword [r9 + 8], rax
mov rax, qword [rsp + 0xa0]
mov qword [r9 + 0x10], rax
mov qword [rsp + 0x48], r9
lea r13, [r12 + 8]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0
lea r8, [0x140183530]
xor edx, edx
xor ecx, ecx
call fcn.14036f31c
mov qword [r12], rax
test rax, rax
je 0x140183156
mov qword [rsp + 0x90], r12
mov rcx, qword [r14 + 8]
mov rax, qword [r14]
mov rdx, r15
cmp rbx, rcx
jne 0x1401830d2
cmp rax, rcx
je 0x140183130
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x140183090
jmp 0x140183130
lea rax, [rdx + rcx]
mov rsi, r8
cmp rax, r8
cmovae rsi, rax
mov qword [rsp + 0x98], rsi
cmp rsi, r9
ja 0x14018316f
jmp 0x140182fb8
cmp rax, rbx
je 0x1401830fd
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x1401830e0
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x90], r15
cmp rbx, rcx
je 0x140183130
sub rdi, rbx
nop dword [rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rbx + rdi], xmm1
add rbx, 0x10
cmp rbx, rcx
jne 0x140183110
nop word [rax + rax]
mov r9, rsi
mov r8, qword [rsp + 0x30]
mov rdx, r15
mov rcx, r14
call fcn.140174c50
mov rax, r12
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r13], 0
mov ecx, 6
call fcn.14035f924
nop
call fcn.140014000
int3
call fcn.140003c20
int3
Function at 0x140183280
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, r9
mov rbx, rdx
mov r14, rcx
mov rdx, qword [rcx]
mov rdi, rbx
sub rdi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r9, 0xfffffffffffffff
cmp rax, r9
je 0x140183499
lea r8, [rax + 1]
mov qword [rsp + 0x30], r8
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r9
sub rax, rdx
cmp rcx, rax
jbe 0x1401833de
mov rsi, r9
mov qword [rsp + 0x98], r9
mov rcx, rsi
shl rcx, 4
call fcn.140003e30
mov r15, rax
mov qword [rsp + 0x40], rax
and rdi, 0xfffffffffffffff0
lea r12, [rdi + rax]
lea rdi, [r12 + 0x10]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x90], rdi
mov ecx, 0x20
call fcn.140361120
mov r9, rax
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rax]
mov qword [r9], rcx
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rax]
mov dword [r9 + 8], ecx
mov rax, qword [r13]
mov qword [r9 + 0x10], rax
mov rax, qword [rsp + 0xa0]
mov qword [r9 + 0x18], rax
mov qword [rsp + 0x48], r9
lea r13, [r12 + 8]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0
lea r8, [0x140183570]
xor edx, edx
xor ecx, ecx
call fcn.14036f31c
mov qword [r12], rax
test rax, rax
je 0x140183486
mov qword [rsp + 0x90], r12
mov rcx, qword [r14 + 8]
mov rax, qword [r14]
mov rdx, r15
cmp rbx, rcx
jne 0x140183402
cmp rax, rcx
je 0x140183460
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x1401833c0
jmp 0x140183460
lea rax, [rdx + rcx]
mov rsi, r8
cmp rax, r8
cmovae rsi, rax
mov qword [rsp + 0x98], rsi
cmp rsi, r9
ja 0x14018349f
jmp 0x1401832f8
cmp rax, rbx
je 0x14018342d
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x140183410
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x90], r15
cmp rbx, rcx
je 0x140183460
sub rdi, rbx
nop dword [rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rbx + rdi], xmm1
add rbx, 0x10
cmp rbx, rcx
jne 0x140183440
nop word [rax + rax]
mov r9, rsi
mov r8, qword [rsp + 0x30]
mov rdx, r15
mov rcx, r14
call fcn.140174c50
mov rax, r12
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r13], 0
mov ecx, 6
call fcn.14035f924
nop
call fcn.140014000
int3
call fcn.140003c20
int3
Function at 0x1401836d0
Capabilities:
Delete service
Stop service

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140518628]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x1401836f8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jne 0x140183716
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140361100
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 0x68], rsi
xor esi, esi
mov qword [rsp + 0x70], rdi
mov dil, 1
cmp byte [rbx], sil
jne 0x140183771
lea r8, [rsp + 0x20]
lea edx, [rsi + 1]
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rbx + 0x18]
test eax, eax
movzx edi, dil
cmove edi, esi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140183771
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.e_43_1me_1_37m_msr_____e_0m
lea rdx, str._s_e_0_31mfailed_to_remove_WinRing0_driver__error__ue_0m
lea ecx, [rsi + 3]
call fcn.1400265f0
xor dil, dil
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, dil
mov qword [rbx + 0x18], rsi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140361100
add rsp, 0x50
pop rbx
ret
Function at 0x1401859c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov esi, dword [rcx + 8]
mov r14, rcx
mov eax, dword [rcx + 0xc]
lea ebx, [rsi + 4]
cmp ebx, eax
ja 0x140185a06
nop dword [rax]
mov rax, qword [r14]
mov edx, esi
mov r9, qword [r14 + 0x10]
mov ecx, esi
shl rcx, 6
add rcx, qword [rax + 0x18]
call fcn.1401ad4d4
mov eax, dword [r14 + 0xc]
add esi, 4
add ebx, 4
cmp ebx, eax
jbe 0x1401859e0
cmp esi, eax
jae 0x140185be3
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r15
mov r15d, dword [0x140518630]
nop dword [rax]
nop dword [rax + rax]
mov rdi, qword [r14 + 0x10]
mov r9d, 0x40
mov rax, qword [r14]
mov ecx, esi
mov ebx, esi
mov rbp, qword [rdi]
mov edx, dword [rdi + 0x20]
add rdx, rcx
shl rbx, 6
add rbx, qword [rax + 0x18]
movzx ecx, byte [rdi + 0x24]
mov r8, rbx
mov eax, dword [rdi + 0x1c]
imul rdx, rax
mov dword [rsp + 0x28], 0x40
shr rdx, cl
mov ecx, esi
imul edx, dword [rdi + 0x18]
mov qword [rsp + 0x20], rbx
sub ecx, edx
shl rcx, 6
movups xmm0, xmmword [rcx + rbp]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rcx + rbp + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [rcx + rbp + 0x20]
movups xmmword [rbx + 0x20], xmm0
movups xmm1, xmmword [rcx + rbp + 0x30]
mov ecx, 0x200
movups xmmword [rbx + 0x30], xmm1
xor dword [rbx], esi
call fcn.140015a30
xor r10d, r10d
xor r11d, r11d
movzx ecx, byte [rdi + 0x24]
mov rdx, r11
and edx, 0xf
mov eax, r10d
xor eax, esi
imul r8d, eax, 0x1000193
mov eax, dword [rdi + 0x1c]
xor r8d, dword [rbx + rdx*4]
mov edx, dword [rdi + 0x20]
add rdx, r8
imul rdx, rax
shr rdx, cl
imul edx, dword [rdi + 0x18]
sub r8d, edx
mov edx, r8d
shl rdx, 6
add rdx, rbp
cmp r15d, 2
jl 0x140185b6a
lea rax, [rdx + 0x3c]
lea rcx, [rbx + 0x3c]
cmp rbx, rax
ja 0x140185b03
cmp rcx, rdx
jae 0x140185b6a
movdqu xmm1, xmmword [rbx]
movdqa xmm2, xmmword [0x1404dafd0]
movdqu xmm0, xmmword [rdx]
pmulld xmm1, xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rdx + 0x10]
movdqu xmmword [rbx], xmm1
movdqu xmm1, xmmword [rbx + 0x10]
pmulld xmm1, xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rdx + 0x20]
movdqu xmmword [rbx + 0x10], xmm1
movdqu xmm1, xmmword [rbx + 0x20]
pmulld xmm1, xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rdx + 0x30]
movdqu xmmword [rbx + 0x20], xmm1
movdqu xmm1, xmmword [rbx + 0x30]
pmulld xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rbx + 0x30], xmm1
jmp 0x140185b97
mov rax, rbx
sub rdx, rbx
mov r9d, reloc.WS2_32.dll_recv
nop word [rax + rax]
imul ecx, dword [rax], 0x1000193
lea rax, [rax + 4]
xor ecx, dword [rdx + rax - 4]
mov dword [rax - 4], ecx
sub r9, 1
jne 0x140185b80
inc r10d
inc r11
cmp r10d, 0x200
jne 0x140185ab0
mov dword [rsp + 0x28], 0x40
mov r9d, 0x40
mov r8, rbx
mov qword [rsp + 0x20], rbx
mov ecx, r10d
call fcn.140015a30
inc esi
cmp esi, dword [r14 + 0xc]
jb 0x140185a30
mov r15, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140185c70
Capabilities:
Create thread

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r12, r8
mov rbx, rdx
mov r14, rcx
mov rdx, qword [rcx]
mov rdi, rbx
sub rdi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r9, 0xfffffffffffffff
cmp rax, r9
je 0x140185e6c
lea r8, [rax + 1]
mov qword [rsp + 0xa8], r8
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r9
sub rax, rdx
cmp rcx, rax
jbe 0x140185dae
mov rsi, r9
mov qword [rsp + 0x98], r9
mov rcx, rsi
shl rcx, 4
call fcn.140003e30
mov r15, rax
mov qword [rsp + 0x38], rax
and rdi, 0xfffffffffffffff0
lea r13, [rdi + rax]
lea rdi, [r13 + 0x10]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x90], rdi
mov ecx, 0x18
call fcn.140361120
movups xmm0, xmmword [r12]
movups xmmword [rax], xmm0
movsd xmm1, qword [r12 + 0x10]
movsd qword [rax + 0x10], xmm1
mov qword [rsp + 0x40], rax
lea r12, [r13 + 8]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140185e80]
xor edx, edx
xor ecx, ecx
call fcn.14036f31c
mov qword [r13], rax
test rax, rax
je 0x140185e59
mov qword [rsp + 0x90], r13
mov rcx, qword [r14 + 8]
mov rax, qword [r14]
mov rdx, r15
cmp rbx, rcx
jne 0x140185dd2
cmp rax, rcx
je 0x140185e30
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x140185d90
jmp 0x140185e30
lea rax, [rdx + rcx]
mov rsi, r8
cmp rax, r8
cmovae rsi, rax
mov qword [rsp + 0x98], rsi
cmp rsi, r9
ja 0x140185e72
jmp 0x140185ce7
cmp rax, rbx
je 0x140185dfd
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x140185de0
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x90], r15
cmp rbx, rcx
je 0x140185e30
sub rdi, rbx
nop dword [rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rdi + rbx], xmm1
add rbx, 0x10
cmp rbx, rcx
jne 0x140185e10
nop word [rax + rax]
mov r9, rsi
mov r8, qword [rsp + 0xa8]
mov rdx, r15
mov rcx, r14
call fcn.140174c50
mov rax, r13
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r12], 0
mov ecx, 6
call fcn.14035f924
nop
call fcn.140014000
int3
call fcn.140003c20
int3
Function at 0x14018ccd0
Capabilities:
Resolve dns

Disassembly:
push rbx
push rsi
sub rsp, 0x4f8
mov rax, qword [0x140518628]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rbx, r8
mov dword [rsp + 0x40], 0x80
mov rsi, rdx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x14018cdba
movzx eax, word [rsp + 0x50]
mov qword [rsp + 0x4f0], rdi
mov edi, dword [rsp + 0x40]
cmp ax, 2
je 0x14018cd2f
cmp ax, 0x17
jne 0x14018cd3f
movzx ecx, word [rsp + 0x52]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rbx], eax
xor edx, edx
lea rcx, [rsp + 0xd0]
mov r8d, 0x401
call fcn.140363e40
xor eax, eax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
lea r8, [rsp + 0xd0]
mov r9d, 0x401
mov qword [rsp + 0x20], rax
mov edx, edi
lea rcx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov rdi, qword [rsp + 0x4f0]
test eax, eax
jne 0x14018cdba
lea rax, [rsp + 0xd0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14018cda0
lea rdx, [rsp + 0xd0]
mov rcx, rsi
call fcn.140005260
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.140361100
add rsp, 0x4f8
pop rsi
pop rbx
ret
mov rcx, qword [rcx + 8]
jmp 0x14018ccd0

Function at 0x1401918a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call qword [rax + reloc.WS2_32.dll_htonl]
test al, al
je 0x1401918f0
cmp rbx, 0x7fffffff
ja 0x1401918f0
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_recv]
cdqe
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rax, 0xffffffffffffffff
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140191910
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
je 0x140191960
cmp rbx, 0x7fffffff
ja 0x140191960
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_send]
cdqe
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rax, 0xffffffffffffffff
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140191980
Capabilities:
Resolve dns

Disassembly:
push rbx
push rsi
sub rsp, 0x4f8
mov rax, qword [0x140518628]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rbx, r8
mov dword [rsp + 0x40], 0x80
mov rsi, rdx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x14018cdba
movzx eax, word [rsp + 0x50]
mov qword [rsp + 0x4f0], rdi
mov edi, dword [rsp + 0x40]
cmp ax, 2
je 0x14018cd2f
cmp ax, 0x17
jne 0x14018cd3f
movzx ecx, word [rsp + 0x52]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rbx], eax
xor edx, edx
lea rcx, [rsp + 0xd0]
mov r8d, 0x401
call fcn.140363e40
xor eax, eax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
lea r8, [rsp + 0xd0]
mov r9d, 0x401
mov qword [rsp + 0x20], rax
mov edx, edi
lea rcx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov rdi, qword [rsp + 0x4f0]
test eax, eax
jne 0x14018cdba
lea rax, [rsp + 0xd0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14018cda0
lea rdx, [rsp + 0xd0]
mov rcx, rsi
call fcn.140005260
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.140361100
add rsp, 0x4f8
pop rsi
pop rbx
ret
mov rcx, qword [rcx + 8]
jmp 0x14018ccd0
Function at 0x1401983c0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rdi, qword [rcx + 0x400]
mov rbp, rcx
mov r14, qword [rdx]
mov rbx, rdx
mov qword [rsp + 0x20], rcx
add rcx, 0x408
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
call fcn.14035fbf4
test eax, eax
jne 0x140198569
mov rcx, rdi
mov qword [rsp + 0x68], r15
call fcn.1401fd430
lea rcx, [rbp + 0x408]
mov rdi, rax
call fcn.14035fc18
test rdi, rdi
je 0x14019851d
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 1
mov edx, 0x8004667e
mov rcx, r14
call qword [sym.imp.WS2_32.dll_ioctlsocket]
xor edx, edx
mov ecx, r14d
call fcn.14024d340
xor r9d, r9d
mov rcx, rax
mov r15, rax
lea edx, [r9 + 0x66]
lea r8d, [r9 + 1]
call fcn.14023d270
mov r8, r15
mov rdx, r15
mov rcx, rdi
call fcn.1401fdc60
cmp qword [rbp + 0x20], 0x10
lea r9, [rbp + 8]
jb 0x140198481
mov r9, qword [r9]
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 0x37]
call fcn.1401fc530
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140198580
cmp al, 1
jne 0x1401984d6
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
lea edx, [r9 + 0x66]
call fcn.14023d270
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 0
mov edx, 0x8004667e
mov rcx, r14
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov al, 1
mov qword [rbx + 8], rdi
jmp 0x140198549
mov rcx, rdi
call fcn.1401fdfc0
lea rcx, [rbp + 0x408]
call fcn.14035fbf4
test eax, eax
jne 0x140198561
mov rcx, rdi
call fcn.1401fc9f0
lea rcx, [rbp + 0x408]
call fcn.14035fc18
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 0
mov edx, 0x8004667e
mov rcx, r14
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x140198547
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x140198547
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx], 0xffffffffffffffff
xor al, al
mov r15, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov ecx, eax
call fcn.14035f8e8
int3
mov ecx, eax
call fcn.14035f8e8
int3
Function at 0x140198940
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x58
mov rax, qword [0x140518628]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov qword [rsp + 0x30], rcx
cmp qword [rcx + 0x20], 0x10
lea rsi, [rcx + 8]
mov rbp, rdx
mov byte [rsp + 0x20], 0
mov edi, 2
mov r15d, ebx
mov rdx, rsi
jb 0x140198984
mov rdx, qword [rsi]
lea r8, [rsp + 0x38]
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x1401989a0
mov r15d, reloc.WS2_32.dll_recv
jmp 0x1401989c4
cmp qword [rsi + 0x18], 0x10
jb 0x1401989aa
mov rsi, qword [rsi]
lea r8, [rsp + 0x24]
mov rdx, rsi
mov ecx, edi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x1401989c9
mov r15d, 4
mov edi, 7
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
lea edx, [r9 + 0x55]
call fcn.14024c510
mov r12, rax
test rax, rax
je 0x140198ab2
mov qword [rsp + 0xa0], r13
mov rcx, rax
mov qword [rsp + 0x50], r14
xor r13b, r13b
xor r14b, r14b
call fcn.14024da10
mov dword [rsp + 0x28], eax
test eax, eax
jle 0x140198aa5
nop
test r14b, r14b
jne 0x140198aa0
mov edx, ebx
mov rcx, r12
call fcn.14024dc40
mov rsi, rax
cmp dword [rax], edi
jne 0x140198a8a
mov rcx, qword [rax + 8]
call fcn.14001f270
mov rcx, qword [rsi + 8]
mov rbp, rax
call fcn.1401fe090
movsxd r8, eax
cmp edi, 2
je 0x140198a79
cmp edi, 7
jne 0x140198a8a
mov r8, r15
lea rcx, [rsp + 0x38]
mov rdx, rbp
call fcn.140363690
test eax, eax
je 0x140198a74
mov r8, r15
lea rcx, [rsp + 0x24]
mov rdx, rbp
call fcn.140363690
test eax, eax
jne 0x140198a8a
mov r13b, 1
jmp 0x140198a8a
mov rcx, qword [rsp + 0x30]
mov rdx, rbp
call fcn.140198ae0
movzx r14d, al
inc ebx
cmp ebx, dword [rsp + 0x28]
jl 0x140198a10
test r14b, r14b
jne 0x140198aa0
test r13b, r13b
je 0x140198aa5
mov byte [rsp + 0x20], 1
mov r13, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x50]
mov rcx, r12
call fcn.14024ded0
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140361100
add rsp, 0x58
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14019c830
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rdi, rcx
cmp dword [rcx + 0x278], 0
jne 0x14019c8e7
lea rbx, [rcx - 8]
lea rax, [0x14019c920]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0
mov ecx, 0x18
call fcn.140361120
mov qword [rax], rbx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + 8], xmm0
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1401a1240]
xor edx, edx
xor ecx, ecx
call fcn.14036f31c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14019c8f8
cmp dword [rdi + 0x278], 0
jne 0x14019c8f2
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi + 0x270], xmm0
cmp dword [rdi + 0x278], 0
je 0x14019c90b
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140360044
test eax, eax
jne 0x14019c916
xorps xmm0, xmm0
movups xmmword [rdi + 0x270], xmm0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call fcn.14036c448
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call fcn.14035f924
nop
mov ecx, 1
call fcn.14035f924
int3
mov ecx, eax
call fcn.14035f8e8
int3
Function at 0x1401a5520
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rdx + 0x3f8]
lea r8, [rcx + 0x3f8]
cmp rcx, rax
ja 0x1401a5562
xor r9d, r9d
cmp r8, rdx
jb 0x1401a5562
mov r8d, 0x80
lea rax, [rcx + r9*8]
sub rdx, rcx
sub r8, r9
nop dword [rax + rax]
mov rcx, qword [rax + rdx]
xor qword [rax], rcx
lea rax, [rax + 8]
sub r8, 1
jne 0x1401a5550
ret
lea rax, [rcx + 0x10]
sub rdx, rcx
mov ecx, reloc.WS2_32.dll_recv
nop
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [rdx + rax - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rdx + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
sub rcx, 1
jne 0x1401a5570
ret
Function at 0x1401ad378
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x140518628]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rdx
mov rsi, rcx
test dl, 0x3f
je 0x1401ad3a7
xor al, al
jmp 0x1401ad4b6
mov r14d, 0x40
shr rbx, 6
mov dword [rsp + 0x28], r14d
mov ecx, 0x200
mov qword [rsp + 0x20], rsi
lea r9d, [r14 - 0x20]
call fcn.140015a30
lea edi, [r14 - 0x3f]
cmp ebx, edi
je 0x1401ad402
mov ecx, edi
lea r8d, [rdi - 1]
shl rcx, 6
mov r9d, r14d
add rcx, rsi
shl r8, 6
mov dword [rsp + 0x28], r14d
add r8, rsi
mov qword [rsp + 0x20], rcx
mov ecx, 0x200
call fcn.140015a30
inc edi
cmp edi, ebx
jne 0x1401ad3d1
mov ebp, 3
xor edi, edi
test ebx, ebx
je 0x1401ad4aa
xor edx, edx
mov r9d, edi
shl r9, 6
add r9, rsi
mov eax, dword [r9]
div ebx
lea eax, [rbx - 1]
mov r8d, edx
add eax, edi
xor edx, edx
shl r8, 6
div ebx
mov ecx, edx
lea rdx, [rsp + 0x30]
shl rcx, 6
sub r8, rdx
add r8, rsi
mov edx, reloc.WS2_32.dll_recv
movups xmm0, xmmword [rcx + rsi]
movups xmm1, xmmword [rcx + rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rcx + rsi + 0x20]
movaps xmmword [rsp + 0x40], xmm1
movups xmm1, xmmword [rcx + rsi + 0x30]
lea rcx, [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm1
mov eax, dword [r8 + rcx]
xor dword [rcx], eax
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x1401ad474
mov dword [rsp + 0x28], r14d
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r9
mov ecx, 0x200
mov r9d, r14d
call fcn.140015a30
inc edi
cmp edi, ebx
jne 0x1401ad411
sub rbp, 1
jne 0x1401ad407
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140361100
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret