joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401aed70
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.1401b53e0
test al, al
je 0x1401aeda5
mov ecx, 2
call qword [fcn.14009dfe0]
lea rdx, str.libunwind:__Unwind_SetIP_context_p__value0x_0llx__n
mov rcx, rax
mov r8, rdi
mov r9, rsi
call fcn.1401aec90
mov rcx, rdi
mov edx, 0xffffffff
mov r8, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1401b54e0

Function at 0x1401b4f70
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x140259008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x1401b4fdc
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x1401b4fdc
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x1401b4fdc
movzx edx, word [rax + 6]
test edx, edx
je 0x1401b4fdc
sub rcx, qword [0x140259008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x1401b4fc8
add rax, 0x28
dec edx
je 0x1401b4fdc
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x1401b4fc0
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x1401b4fc0
jmp 0x1401b4fde
xor eax, eax
ret

Function at 0x1401b4fe0
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x140259008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x1401b5015
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x1401b5015
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x1401b5015
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1401b5090
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140259008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1401b50bc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1401b50bc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1401b50be
xor eax, eax
ret
Function at 0x1401b5220
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rdi, rdx
mov rsi, rcx
cmp byte [0x1402dab02], 1
jne 0x1401b5245
cmp byte [0x1402dab01], 0
jne 0x1401b5264
jmp 0x1401b5284
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
mov byte [0x1402dab02], 1
test rax, rax
setne byte [0x1402dab01]
je 0x1401b5284
mov ecx, 2
call qword [fcn.14009dfe0]
lea rdx, str.libunwind:___unw_init_local_cursor_p__context_p__n
mov rcx, rax
mov r8, rsi
mov r9, rdi
call fcn.14009d230
lea rax, [0x140269930]
mov qword [rsi], rax
lea rax, [0x1402da958]
mov qword [rsi + 8], rax
xorps xmm0, xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x40], xmm0
mov qword [rsi + 0x50], 0
lea rax, [rsi + 0x580]
lea rcx, [rsi + 0xb0]
movaps xmmword [rsi + 0x580], xmm0
movaps xmmword [rsi + 0x590], xmm0
movaps xmmword [rsi + 0x5a0], xmm0
movaps xmmword [rsi + 0x5b0], xmm0
movaps xmmword [rsi + 0x5c0], xmm0
movaps xmmword [rsi + 0x5d0], xmm0
movaps xmmword [rsi + 0x5e0], xmm0
movaps xmmword [rsi + 0x5f0], xmm0
movaps xmmword [rsi + 0x600], xmm0
movaps xmmword [rsi + 0x610], xmm0
movaps xmmword [rsi + 0x620], xmm0
movaps xmmword [rsi + 0x630], xmm0
movaps xmmword [rsi + 0x640], xmm0
movups xmmword [rsi + 0x649], xmm0
mov qword [rsi + 0x80], rcx
mov qword [rsi + 0x98], rax
mov rax, qword [rdi]
mov rcx, qword [rdi + 8]
mov rdx, qword [rdi + 0x80]
movups xmm0, xmmword [rdi + 0x10]
movdqu xmm1, xmmword [rdi + 0x30]
pshufd xmm1, xmm1, 0x4e
movdqu xmm2, xmmword [rdi + 0x20]
pshufd xmm2, xmm2, 0x4e
movups xmm3, xmmword [rdi + 0x40]
movups xmm4, xmmword [rdi + 0x50]
movups xmm5, xmmword [rdi + 0x60]
movups xmm6, xmmword [rdi + 0x70]
mov dword [rsi + 0xe0], 0x10000b
mov qword [rsi + 0x128], rax
movaps xmmword [rsi + 0x130], xmm0
mov qword [rsi + 0x140], rcx
movdqu xmmword [rsi + 0x148], xmm1
movdqu xmmword [rsi + 0x158], xmm2
movups xmmword [rsi + 0x168], xmm3
movups xmmword [rsi + 0x178], xmm4
movups xmmword [rsi + 0x188], xmm5
movups xmmword [rsi + 0x198], xmm6
mov qword [rsi + 0x1a8], rdx
test rdx, rdx
je 0x1401b53cb
mov rcx, rsi
call fcn.14009de30
test al, al
jne 0x1401b53d2
mov byte [rsi + 0x658], 1
xor eax, eax
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x1401b53e0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp byte [0x1402dab02], 1
jne 0x1401b53fc
cmp byte [0x1402dab01], 0
setne al
add rsp, 0x28
ret
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
test rax, rax
setne al
setne byte [0x1402dab01]
mov byte [0x1402dab02], 1
add rsp, 0x28
ret
Function at 0x1401b5430
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov edi, edx
mov rbx, rcx
cmp byte [0x1402dab02], 1
jne 0x1401b5453
cmp byte [0x1402dab01], 0
jne 0x1401b5472
jmp 0x1401b5497
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
mov byte [0x1402dab02], 1
test rax, rax
setne byte [0x1402dab01]
je 0x1401b5497
mov ecx, 2
call qword [fcn.14009dfe0]
mov qword [rsp + 0x20], rsi
lea rdx, str.libunwind:___unw_get_reg_cursor_p__regNum_d__value_p__n
mov rcx, rax
mov r8, rbx
mov r9d, edi
call fcn.14009d230
mov rax, qword [rbx]
mov rax, qword [rax + 0x10]
mov rcx, rbx
mov edx, edi
call qword [0x1402e4008]
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x1401b54cb
mov rax, qword [rbx]
mov rax, qword [rax + 0x18]
mov rcx, rbx
mov edx, edi
call qword [0x1402e4008]
mov qword [rsi], rax
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x1401b54e0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rbx, r8
mov edi, edx
mov rsi, rcx
cmp byte [0x1402dab02], 1
jne 0x1401b5504
cmp byte [0x1402dab01], 0
jne 0x1401b5523
jmp 0x1401b5548
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
mov byte [0x1402dab02], 1
test rax, rax
setne byte [0x1402dab01]
je 0x1401b5548
mov ecx, 2
call qword [fcn.14009dfe0]
mov qword [rsp + 0x20], rbx
lea rdx, str.libunwind:___unw_set_reg_cursor_p__regNum_d__value0x_llx__n
mov rcx, rax
mov r8, rsi
mov r9d, edi
call fcn.14009d230
mov rax, qword [rsi]
mov rax, qword [rax + 0x10]
mov rcx, rsi
mov edx, edi
call qword [0x1402e4008]
mov ebp, 0xffffe672
test al, al
je 0x1401b55e9
mov rax, qword [rsi]
mov rax, qword [rax + 0x20]
mov rcx, rsi
mov edx, edi
mov r8, rbx
call qword [0x1402e4008]
xor ebp, ebp
cmp edi, 0xffffffff
jne 0x1401b55e9
mov rax, qword [rsi]
mov rax, qword [rax + 0x48]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [0x1402e4008]
mov rax, qword [rsi]
mov rax, qword [rax + 0x68]
xor ebp, ebp
mov rcx, rsi
xor edx, edx
call qword [0x1402e4008]
cmp qword [rsp + 0x50], 0
je 0x1401b55e9
mov rax, qword [rsi]
mov rax, qword [rax + 0x18]
mov rcx, rsi
mov edx, 0xfffffffe
call qword [0x1402e4008]
add rax, qword [rsp + 0x50]
mov rcx, qword [rsi]
mov r9, qword [rcx + 0x20]
mov rcx, rsi
mov edx, 0xfffffffe
mov r8, rax
mov rax, r9
call qword [0x1402e4008]
mov eax, ebp
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x1401b5600
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp byte [0x1402dab02], 1
jne 0x1401b561c
cmp byte [0x1402dab01], 0
jne 0x1401b563b
jmp 0x1401b5658
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
mov byte [0x1402dab02], 1
test rax, rax
setne byte [0x1402dab01]
je 0x1401b5658
mov ecx, 2
call qword [fcn.14009dfe0]
lea rdx, str.libunwind:___unw_step_cursor_p__n
mov rcx, rax
mov r8, rsi
call fcn.14009d230
mov rax, qword [rsi]
mov rax, qword [rax + 0x40]
mov r8, qword [0x1402e4008]
mov rcx, rsi
xor edx, edx
add rsp, 0x20
pop rsi
jmp r8
Function at 0x1401b5680
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
cmp byte [0x1402dab02], 1
jne 0x1401b56a0
cmp byte [0x1402dab01], 0
jne 0x1401b56bf
jmp 0x1401b56df
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
mov byte [0x1402dab02], 1
test rax, rax
setne byte [0x1402dab01]
je 0x1401b56df
mov ecx, 2
call qword [fcn.14009dfe0]
lea rdx, str.libunwind:___unw_get_proc_info_cursor_p__info_p__n
mov rcx, rax
mov r8, rdi
mov r9, rsi
call fcn.14009d230
mov rax, qword [rdi]
mov rax, qword [rax + 0x48]
mov rcx, rdi
mov rdx, rsi
call qword [0x1402e4008]
xor ecx, ecx
cmp qword [rsi + 8], 0
mov eax, 0xffffe66b
cmovne eax, ecx
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1401b5710
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp byte [0x1402dab02], 1
jne 0x1401b572c
cmp byte [0x1402dab01], 0
jne 0x1401b574b
jmp 0x1401b5768
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
mov byte [0x1402dab02], 1
test rax, rax
setne byte [0x1402dab01]
je 0x1401b5768
mov ecx, 2
call qword [fcn.14009dfe0]
lea rdx, str.libunwind:___unw_resume_cursor_p__n
mov rcx, rax
mov r8, rsi
call fcn.14009d230
mov rax, qword [rsi]
mov rax, qword [rax + 0x50]
mov rcx, rsi
call qword [0x1402e4008]
mov eax, 0xffffe674
add rsp, 0x20
pop rsi
ret

Function at 0x1401b5790
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp byte [0x1402dab02], 1
jne 0x1401b57b9
cmp byte [0x1402dab01], 0
jne 0x1401b57d8
jmp 0x1401b57fc
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
mov byte [0x1402dab02], 1
test rax, rax
setne byte [0x1402dab01]
je 0x1401b57fc
mov ecx, 2
call qword [fcn.14009dfe0]
mov dword [rsp + 0x20], edi
lea rdx, str.libunwind:___unw_get_proc_name_cursor_p__buf_p__bufLen_lu__n
mov rcx, rax
mov r8, r14
mov r9, rbx
call fcn.14009d230
mov rax, qword [r14]
mov rax, qword [rax + 0x60]
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [0x1402e4008]
xor ecx, ecx
test al, al
mov eax, 0xffffe674
cmovne eax, ecx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1401b5830
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp byte [0x1402daaaf], 1
jne 0x1401b584c
cmp byte [0x1402daaae], 0
setne al
add rsp, 0x28
ret
lea rcx, str.LIBUNWIND_PRINT_UNWINDING
call sub.msvcrt.dll_getenv
test rax, rax
setne al
setne byte [0x1402daaae]
mov byte [0x1402daaaf], 1
add rsp, 0x28
ret
Function at 0x1401b8462
Capabilities:
Inspect section memory permissions

Disassembly:
push rbx
push rsi
push rdi
push rbp
mov esi, 1
mov eax, 0
xor ecx, ecx
cpuid
mov edi, eax
cmp edi, 2
jb 0x1401b8481
or esi, 0x2000000
test edi, 0x500
je 0x1401b8491
or esi, 2
jmp 0x1401b85ca
mov eax, 1
xor ecx, ecx
cpuid
test ecx, 0x40000000
je 0x1401b84a8
or esi, 0x4000000
test ecx, 0x2000000
je 0x1401b84b6
or esi, 0x80000000
test ecx, 0x800000
je 0x1401b84c4
or esi, 0x8000000
test ecx, 0x1000
je 0x1401b84d2
or esi, 0x20000000
test ecx, 2
je 0x1401b84e0
or esi, 0x40000000
test ecx, 0x100000
je 0x1401b84ee
or esi, 0x80
test ecx, 0x80000
je 0x1401b84f9
or esi, 0x40
test ecx, 0x200
je 0x1401b8504
or esi, 0x20
test ecx, 1
je 0x1401b850f
or esi, 0x10
test edx, 0x4000000
je 0x1401b851a
or esi, 8
test edx, 0x2000000
je 0x1401b8525
or esi, 4
test edx, 0x800000
je 0x1401b8530
or esi, 2
test ecx, 0x8000000
je 0x1401b85ca
test ecx, 0x10000000
je 0x1401b85ca
xor ecx, ecx
xgetbv
mov ebp, eax
and eax, 6
cmp eax, 6
jne 0x1401b85ca
or esi, 0x100
cmp edi, 7
jb 0x1401b8595
mov eax, 7
xor ecx, ecx
cpuid
test ebx, 0x20
je 0x1401b8579
or esi, 0x400
and ebp, 0xe0
cmp ebp, 0xe0
jne 0x1401b8595
test ebx, 0x10000
je 0x1401b8595
or esi, 0x800
mov eax, 0x80000000
xor ecx, ecx
cpuid
cmp eax, 0x80000001
jb 0x1401b85ca
mov eax, 0x80000001
xor ecx, ecx
cpuid
test ecx, 0x10000
je 0x1401b85bc
or esi, 0x10000000
test ecx, 0x800
je 0x1401b85ca
or esi, 0x200
mov eax, esi
pop rbp
pop rdi
pop rsi
pop rbx
ret

Function at 0x1401b9b00
Capabilities:
Hash data using sha512

Disassembly:
push rsi
push rdi
sub rsp, 0xf8
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [0x14026e290]
movaps xmmword [rsp + 0x20], xmm0
movaps xmm0, xmmword [0x14026e2a0]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [0x14026e2b0]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [0x14026e2c0]
movaps xmmword [rsp + 0x50], xmm0
lea rdi, [rsp + 0x20]
mov rcx, rdi
call fcn.1401b86f0
mov rcx, rdi
mov rdx, rsi
call fcn.1401b9920
xor eax, eax
add rsp, 0xf8
pop rdi
pop rsi
ret
Function at 0x1401e8020
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
movdqa xmmword [rsp + 0x90], xmm7
movaps xmmword [rsp + 0x80], xmm6
mov qword [rsp + 0x70], rcx
lea rax, [r9 + 0x30]
mov qword [rsp + 0x68], rax
lea eax, [r8*8]
lea ecx, [rdx*8]
shr rdx, 0x1d
shr r8, 0x1d
movd xmm0, r8d
movd xmm1, eax
punpckldq xmm1, xmm0
movd xmm0, edx
movd xmm2, ecx
punpckldq xmm2, xmm0
punpcklqdq xmm2, xmm1
movdqu xmm6, xmmword [r9 + 0x30]
pxor xmm6, xmm2
lea rax, [r9 + 0x50]
mov qword [rsp + 0x50], rax
lea r12, [r9 + 0x40]
lea rax, [r9 + 0x20]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x78], r9
lea rax, [r9 + 0x10]
mov qword [rsp + 0x60], rax
mov edi, 7
lea rbx, [rsp + 0x40]
lea r14, [rsp + 0x30]
lea r15, [rsp + 0x20]
mov rbp, qword [rsp + 0x78]
nop dword [rax]
mov rsi, qword [rsp + 0x50]
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x20], xmm0
mov rcx, rbx
mov rdx, r14
mov r8, r15
call fcn.14023fcd0
movdqa xmm7, xmmword [rsp + 0x40]
pxor xmm7, xmm6
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x20], xmm0
mov rcx, rbx
mov rdx, r14
mov r8, r15
call fcn.14023fcd0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
mov r13, qword [rsp + 0x68]
movups xmm0, xmmword [r13]
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x20], xmm0
mov rcx, rbx
mov rdx, r14
mov r8, r15
call fcn.14023fcd0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r12], xmm0
mov rsi, qword [rsp + 0x58]
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [r13]
movaps xmmword [rsp + 0x20], xmm0
mov rcx, rbx
mov rdx, r14
mov r8, r15
call fcn.14023fcd0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r13], xmm0
mov r13, qword [rsp + 0x60]
movups xmm0, xmmword [r13]
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x20], xmm0
mov rcx, rbx
mov rdx, r14
mov r8, r15
call fcn.14023fcd0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [r13]
movaps xmmword [rsp + 0x20], xmm0
mov rcx, rbx
mov rdx, r14
mov r8, r15
call fcn.14023fcd0
movdqu xmm0, xmmword [rsp + 0x40]
movdqu xmmword [r13], xmm0
movdqu xmmword [rbp], xmm7
dec edi
jne 0x1401e80d0
mov rax, qword [rsp + 0x50]
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [r12]
pxor xmm1, xmm0
mov rax, qword [rsp + 0x68]
movdqu xmm0, xmmword [rax]
mov rax, qword [rsp + 0x58]
movdqu xmm2, xmmword [rax]
pxor xmm2, xmm0
pxor xmm2, xmm1
mov rax, qword [rsp + 0x60]
movdqu xmm0, xmmword [rax]
pxor xmm0, xmm7
pxor xmm0, xmm2
mov rax, qword [rsp + 0x70]
movdqu xmmword [rax], xmm0
movaps xmm6, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x90]
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401e9660
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov edi, 1
xor r14d, r14d
mov r15, qword [str.h__]
mov r12, qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
nop word cs:[rax + rax]
mov edx, edi
mov rcx, r14
call qword [r15]
test rax, rax
je 0x1401e96d2
mov rbx, rax
mov rcx, rsi
mov rdx, rax
mov r8d, edi
call r12
test eax, eax
je 0x1401e96c6
cmp eax, edi
je 0x1401e96c6
cmp eax, 0x8001
jae 0x1401e96c6
mov r14, rbx
cmp eax, edi
mov edi, eax
jae 0x1401e9690
jmp 0x1401e96e0
mov rax, qword [0x1402654c0]
mov rcx, rbx
jmp 0x1401e96dc
mov rax, qword [0x1402654c0]
mov rcx, r14
call qword [rax]
xor ebx, ebx
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1401ed920
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rsi, r9
mov qword [r9], 0
lea r9, [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
test eax, eax
jne 0x1401eda82
mov r13, qword [rsp + 0x28]
test r13, r13
je 0x1401eda6d
xor ebp, ebp
xorps xmm6, xmm6
xor edi, edi
jmp 0x1401ed983
mov r14, rbp
mov r13, qword [r13 + 0x28]
mov rbp, r14
test r13, r13
je 0x1401eda56
mov rcx, qword [r13 + 0x18]
test rcx, rcx
je 0x1401ed9a0
call sub.msvcrt.dll_strlen
mov rbx, rax
inc rbx
jmp 0x1401ed9a2
xor ebx, ebx
mov eax, dword [r13 + 4]
cmp eax, 2
je 0x1401ed9c0
cmp eax, 0x17
jne 0x1401ed970
mov r15d, 0x1c
cmp qword [r13 + 0x20], 0
jne 0x1401ed9cd
jmp 0x1401ed970
mov r15d, 0x10
cmp qword [r13 + 0x20], 0
je 0x1401ed970
cmp qword [r13 + 0x10], r15
jb 0x1401ed970
lea rcx, [rbx + r15]
add rcx, 0x30
mov rax, qword [0x1402654c8]
call qword [rax]
test rax, rax
je 0x1401eda9a
mov r14, rax
movups xmm0, xmmword [r13]
movups xmmword [rax], xmm0
mov dword [rax + 0x10], r15d
lea r12, [rax + 0x30]
movups xmmword [rax + 0x18], xmm6
mov qword [rax + 0x28], 0
mov qword [rax + 0x20], r12
mov rdx, qword [r13 + 0x20]
mov rcx, r12
mov r8, r15
call sub.msvcrt.dll_memcpy
test rbx, rbx
je 0x1401eda3d
lea rax, [r14 + 0x18]
add r12, r15
mov qword [rax], r12
mov rdx, qword [r13 + 0x18]
mov rcx, r12
mov r8, rbx
call sub.msvcrt.dll_memcpy
test rdi, rdi
cmove rdi, r14
test rbp, rbp
je 0x1401ed973
mov qword [rbp + 0x28], r14
jmp 0x1401ed973
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1401eda66
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
xor ebx, ebx
test rdi, rdi
jne 0x1401eda7f
mov ebx, 0x2af9
mov ecx, 0x2af9
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor edi, edi
mov qword [rsi], rdi
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1401edaaa
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ebx, 8
test rdi, rdi
je 0x1401eda7d
mov r14, qword [0x1402654c0]
nop dword [rax + rax]
mov r15, qword [rdi + 0x28]
mov rcx, rdi
call qword [r14]
mov rdi, r15
test r15, r15
jne 0x1401edac0
jmp 0x1401eda7d
Function at 0x1401edd20
Capabilities:
Convert ip address from string

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov esi, edx
mov rdi, rcx
lea r8, [rsp + 0x28]
mov ecx, 2
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1401edd94
mov rax, qword [0x1402654c8]
mov ecx, 0x40
call qword [rax]
test rax, rax
je 0x1401ede26
mov rbx, rax
mov rax, qword [0x1402654d0]
mov rcx, rdi
call qword [rax]
test rax, rax
je 0x1401ede2a
mov rdi, rax
lea rax, [rbx + 0x20]
mov ecx, dword [rsp + 0x28]
mov dword [rbx + 0x20], ecx
mov qword [rbx], rdi
mov qword [rbx + 8], 0
mov dword [rbx + 0x10], 0x40002
jmp 0x1401eddf4
lea r8, [rsp + 0x30]
mov ecx, 0x17
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1401ede26
mov rax, qword [0x1402654c8]
mov ecx, 0x40
call qword [rax]
test rax, rax
je 0x1401ede26
mov rbx, rax
mov rax, qword [0x1402654d0]
mov rcx, rdi
call qword [rax]
test rax, rax
je 0x1401ede2a
mov rdi, rax
lea rax, [rbx + 0x20]
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx], rdi
mov qword [rbx + 8], 0
mov dword [rbx + 0x10], 0x100017
mov rcx, rbx
add rcx, 0x30
mov qword [rbx + 0x18], rcx
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], 0
mov rcx, rbx
mov edx, esi
call fcn.1401edae0
mov rsi, rax
mov rax, qword [0x1402654c0]
mov rcx, rdi
call qword [rax]
jmp 0x1401ede2c
xor esi, esi
jmp 0x1401ede38
xor esi, esi
mov rax, qword [0x1402654c0]
mov rcx, rbx
call qword [rax]
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x1401ee6d0
Capabilities:
Convert ip address from string

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
lea r8, [rsp + 0x28]
mov ecx, 2
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_inet_pton]
mov ecx, eax
mov al, 1
test ecx, ecx
jg 0x1401ee70b
lea r8, [rsp + 0x30]
mov ecx, 0x17
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
setg al
add rsp, 0x40
pop rsi
ret
Function at 0x1401f0720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov r14, rdx
test r9b, r9b
jne 0x1401f0794
lea rdx, [0x140278247]
mov rcx, rdi
call sub.msvcrt.dll_strstr
lea r15, [rax + 2]
test rax, rax
cmove r15, rdi
mov rcx, r15
mov edx, 0x3f
call sub.msvcrt.dll_strchr
mov r14, rax
mov rcx, r15
mov edx, 0x2f
call sub.msvcrt.dll_strchr
mov r15, rax
test rax, rax
je 0x1401f087b
test r14, r14
je 0x1401f0892
cmp r15, r14
cmovb r14, r15
xor ebp, ebp
test rsi, rsi
je 0x1401f0868
movzx r13d, byte [rsp + 0x90]
xor r13b, 1
lea r15, [0x140278221]
lea r12, [0x140278243]
nop word [rax + rax]
cmp rdi, r14
jb 0x1401f0800
movzx eax, byte [rdi]
cmp eax, 0x3f
je 0x1401f07e6
cmp eax, 0x20
jne 0x1401f07eb
test r13b, 1
jne 0x1401f081f
mov r8d, 1
mov rcx, rbx
mov rdx, r15
jmp 0x1401f080c
xor r13d, r13d
jmp 0x1401f0800
cmp al, 0x20
jb 0x1401f0800
cmp al, 0x20
je 0x1401f0800
cmp eax, 0x7f
je 0x1401f0800
cmp al, 0x7f
jae 0x1401f082d
nop dword [rax]
mov r8d, 1
mov rcx, rbx
mov rdx, rdi
call fcn.1401a20f0
test eax, eax
jne 0x1401f0863
inc rdi
dec rsi
jne 0x1401f07c0
jmp 0x1401f0868
mov r8d, 3
mov rcx, rbx
mov rdx, r12
jmp 0x1401f080c
mov byte [rsp + 0x25], 0x25
mov rcx, rax
shr rcx, 4
lea rdx, str.0123456789abcdef
movzx ecx, byte [rcx + rdx]
mov byte [rsp + 0x26], cl
and eax, 0xf
movzx eax, byte [rax + rdx]
mov byte [rsp + 0x27], al
mov r8d, 3
mov rcx, rbx
lea rdx, [rsp + 0x25]
jmp 0x1401f080c
mov ebp, 7
mov eax, ebp
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov r15, rax
add r15, rdi
test r14, r14
jne 0x1401f078d
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov r14, rax
add r14, rdi
jmp 0x1401f078d
Function at 0x1401f2690
Capabilities:
Convert ip address from string

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
movzx eax, byte [rdx]
test eax, eax
je 0x1401f2751
mov r15, r8
mov rsi, rdx
cmp eax, 0x5b
jne 0x1401f2758
mov edi, 0x16
cmp r15, 4
jb 0x1401f2773
mov rbx, rcx
inc rsi
add r15, 0xfffffffffffffffe
lea rdx, str.0123456789abcdefABCDEF:.
mov rcx, rsi
call sub.msvcrt.dll_strspn
cmp r15, rax
jne 0x1401f2781
mov byte [rsi + r15], 0
lea r8, [rsp + 0x50]
mov ecx, 0x17
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x1401f2773
lea rdx, [rsp + 0x50]
lea r8, [rsp + 0x20]
mov r9d, 0x2e
mov ecx, 0x17
call qword [sym.imp.WS2_32.dll_inet_ntop]
test rax, rax
je 0x1401f274a
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_strlen
cmp rax, r15
jae 0x1401f274a
mov rdi, rax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call sub.msvcrt.dll_strcpy
mov byte [rdi + rsi + 1], 0
mov r15, rdi
mov byte [rsi + r15], 0x5d
jmp 0x1401f2771
mov edi, 0xe
jmp 0x1401f2773
lea rdx, str.__r_n_t_:_______________
mov rcx, rsi
call sub.msvcrt.dll_strcspn
mov edi, 0x15
cmp rax, r15
jne 0x1401f2773
xor edi, edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov r14, rax
cmp byte [rsi + rax], 0x25
jne 0x1401f2773
lea r15, [r14 + rsi]
inc r15
lea rdx, [0x140278326]
mov r8d, 2
mov rcx, r15
call sub.msvcrt.dll_strncmp
test eax, eax
je 0x1401f27df
movzx eax, byte [r15]
mov ecx, 0x16
test al, al
je 0x1401f27db
xor edx, edx
nop dword [rax]
cmp al, 0x5d
je 0x1401f27f3
cmp rdx, 0xe
ja 0x1401f27f3
mov byte [rsp + rdx + 0x20], al
movzx eax, byte [r15 + rdx + 1]
inc rdx
test al, al
jne 0x1401f27c0
mov edi, ecx
jmp 0x1401f2773
movzx eax, byte [r15 + 2]
cmp eax, 0x5d
je 0x1401f27aa
test eax, eax
je 0x1401f27aa
add r15, 2
jmp 0x1401f27ae
test rdx, rdx
je 0x1401f27db
cmp al, 0x5d
jne 0x1401f27db
mov byte [rsp + rdx + 0x20], 0
mov rax, qword [0x1402654d0]
lea rcx, [rsp + 0x20]
call qword [rax]
mov qword [rbx + 0x28], rax
test rax, rax
je 0x1401f2827
mov word [rsi + r14], 0x5d
mov r15, r14
jmp 0x1401f26e6
mov ecx, 7
jmp 0x1401f27db

Function at 0x1401f5680
Capabilities:
Encode data using xor

Disassembly:
test rcx, rcx
je 0x1401f56a2
nop word cs:[rax + rax]
cmp byte [rcx], 0
lea rcx, [rcx + 1]
sete al
setns dl
xor dl, al
jne 0x1401f5690
ret
mov al, 1
ret