joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140080af0
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbp, r8
mov rdi, rdx
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.WWW_Authenticate:
mov rcx, r9
mov rbx, r9
call fcn.140046530
test eax, eax
je 0x140080b34
mov esi, dword [rdi + 0x150]
cmp esi, 0x191
je 0x140080b5b
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.Proxy_authenticate:
mov rcx, rbx
call fcn.140046530
test eax, eax
je 0x140080ba1
mov esi, dword [rdi + 0x150]
cmp esi, 0x197
jne 0x140080ba1
mov rcx, rbx
call fcn.14004c450
mov rbx, rax
test rax, rax
jne 0x140080b73
lea eax, [rbx + 0x1b]
jmp 0x140080d63
cmp esi, 0x197
mov r8, rbx
mov rcx, rdi
sete dl
call fcn.14004e100
mov rcx, rbx
mov edi, eax
call qword [fcn.140086522]
test edi, edi
je 0x140080d61
mov eax, edi
jmp 0x140080d63
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Content_Length:
mov rcx, rbx
call fcn.140046530
test eax, eax
je 0x140080bfc
mov r8d, dword [rdi + 0x150]
lea eax, [r8 - 0xc8]
cmp eax, 0x64
jae 0x140080be1
lea rdx, str.Ignoring_Content_Length_in_CONNECT__03d_response
mov rcx, rdi
call fcn.140040be0
jmp 0x140080d61
xor edx, edx
lea r9, [rbp + 0x2a8]
lea rcx, [rbx + 0xf]
lea r8d, [rdx + 0xa]
call fcn.140052ba0
jmp 0x140080d61
lea r9, str.close
mov qword [rsp + 0x20], 5
mov r8d, recv
lea rdx, str.Connection:
mov rcx, rbx
call fcn.14004c380
test al, al
jne 0x140080d5a
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.Transfer_Encoding:
mov rcx, rbx
call fcn.140046530
test eax, eax
je 0x140080cb9
mov r8d, dword [rdi + 0x150]
lea eax, [r8 - 0xc8]
cmp eax, 0x64
jae 0x140080c69
lea rdx, str.Ignoring_Transfer_Encoding_in_CONNECT__03d_response
mov rcx, rdi
call fcn.140040be0
jmp 0x140080d61
lea r9, str.chunked
mov qword [rsp + 0x20], 7
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.Transfer_Encoding:
mov rcx, rbx
call fcn.14004c380
test al, al
je 0x140080d61
lea rdx, str.CONNECT_responded_chunked
mov rcx, rdi
call fcn.140040be0
mov rcx, rdi
mov byte [rbp + 0x2b4], 1
call fcn.140074b30
jmp 0x140080d61
lea r9, str.close
mov qword [rsp + 0x20], 5
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.Proxy_Connection:
mov rcx, rbx
call fcn.14004c380
test al, al
jne 0x140080d5a
mov r8d, 7
lea rdx, str.HTTP_1.
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140080d61
movzx eax, byte [rbx + 7]
sub al, 0x30
cmp al, 1
ja 0x140080d61
cmp byte [rbx + 8], 0x20
jne 0x140080d61
movsx ecx, byte [rbx + 9]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140080d61
movsx edx, byte [rbx + 0xa]
lea eax, [rdx - 0x30]
cmp al, 9
ja 0x140080d61
movsx r8d, byte [rbx + 0xb]
lea eax, [r8 - 0x30]
cmp al, 9
ja 0x140080d61
movzx eax, byte [rbx + 0xc]
sub al, 0x30
cmp al, 9
jbe 0x140080d61
lea ecx, [rcx + rcx*4]
lea ecx, [rdx + rcx*2]
lea ecx, [rcx + rcx*4]
lea ecx, [rcx - 0xa68]
lea ecx, [r8 + rcx*2]
mov dword [rdi + 0x150], ecx
mov dword [rdi + 0x1384], ecx
jmp 0x140080d61
mov byte [rbp + 0x2b5], 1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140082490
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [section..data]
mov rdi, rax
test rax, rax
jne 0x1400824d2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140082519
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140082572
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x140082530
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400825b3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400981c1]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400981c2]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140082580
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x140085814
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1400e2550
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1400e257c
xor al, al
jmp 0x1400e26a0
movdqa xmm0, xmmword [0x140102ae0]
movdqa xmm1, xmmword [0x140102af0]
mov rax, qword [r9]
xor r11d, r11d
mov qword [rsp + 0x50], r12
mov rcx, r8
movdqa xmmword [rsp], xmm0
movdqa xmm0, xmmword [0x140102b00]
movdqa xmmword [rsp + 0x10], xmm1
lea r12, [r8 + rax]
mov edx, r11d
movdqa xmm1, xmmword [0x140102b10]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm1
test rbx, rbx
je 0x1400e2692
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1400e25f9
mov r11d, 2
jmp 0x1400e261d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1400e2613
mov r11d, 1
jmp 0x1400e261d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, r12
ja 0x1400e26b5
mov eax, r10d
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov eax, r10d
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1400e265a
mov byte [rcx + 2], 0x3d
jmp 0x1400e266a
shr r10, 6
and r10d, 0x3f
movzx eax, byte [rsp + r10]
mov byte [rcx + 2], al
add rcx, 3
add r8, 3
test r11, r11
je 0x1400e267c
mov byte [rcx], 0x3d
jmp 0x1400e2683
movzx eax, byte [rsp + r9]
mov byte [rcx], al
inc rcx
inc r8
cmp rdx, rbx
jb 0x1400e25e0
sub rcx, rsi
mov al, 1
mov qword [rbp], rcx
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor al, al
jmp 0x1400e269b

Function at 0x1401dd29a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not r15b
lea r15, [rdx + r15*8 + 0x3f2501b1]
not r15
mov dl, 0x8b
mov qword [rsp + 0x40], rdx
lea rbx, [rbx + 0xf4d4a0d]
mov qword [rsp + 0x40], 0x10d17cab
push 0x130551c6
push r8
sub r15d, dword [rsp + 0xc]
not r15d
xchg qword [rsp + 0x80], rbx
movabs r8, 0xed366cc5805265e
push rbp
jno 0x14031cbc7
xor byte [rdx], dh
add eax, 0x548d17f1
cmp al, 0x78
out dx, eax
fimul dword [rbx]
lodsd eax, dword [rsi]
std
invalid
mov r8, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
add qword [rsp + 0x60], 0xffffffffbfeb143c
add qword [rsp + 0x48], 0xffffffffbfcd4e63
and bpl, dl
test byte [rsp + 0x17], r15b
ja 0x1403643ae
jae 0x14014862a
lea r14, [rdx + r14*4 + 0x29ac2c31]
cmovbe rdx, qword [rsp + 0x60]
call fcn.1400e6550
jae 0x1401f07a3
movabs r9, 0x39d716a926a90cf3
lea r9, [r9 + r9 + 0x4b0f3a16]
mov r9d, 0x571a00ec
pushfq
test r9d, 0x5f8942c7
push r14
seto r9b
xchg qword [rsp + r9 - 0x5719ffe8], rcx
jle 0x1402703e9
call fcn.140154978

Function at 0x1402072aa
Capabilities:
Encode data using xor

Disassembly:
call fcn.1401ae386
jmp 0x140207311
adc dh, cl
xor ah, byte [rsi]
sahf
jne 0x140207313
iretd
Function at 0x140225903
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r14d, 0x26913460
mov r14, qword [rsp + 0x58]
setne cl
setbe byte [rsp + 0x30]
add ecx, dword [rsp + 0x14]
add cx, 0x6b03
lea r12, [r8*4 + 0x1f2f0375]
setl byte [rsp + 0x10]
not word [rsp + 0x30]
mov r8, qword [rsp + 0x50]
and rcx, r12
jo 0x140356e89
not r12
cmp qword [rsp + 0x60], rcx
setne byte [rsp + 0x10]
lea r12, [r12 + rcx*8 + 0x41c61ef0]
lea rcx, [rcx*2 + 0x21ba2877]
ja 0x14015bbe6

Function at 0x14022a9cb
Capabilities:
Encode data using xor

Disassembly:
add rbx, 0x623a15ac
setns bl
setns bl
mov rbx, qword [rsp + 8]
mov rbx, qword [rbx]
mov qword [rsp + 8], 0x48e72c7d
neg qword [rsp + 8]
push r11
mov r11, qword [rsp + 0x10]
sub byte [rsp + 0x10], r11b
xor qword [rsp + 0x10], 0x668a7444
lea rbx, [rbx + 0x606f0c8c]
push rsi
or r11b, 0xa8
call fcn.1402040ce
int 0x5e
adc ebx, dword [rcx - 0x74178331]
movsd dword [rdi], dword [rsi]
jb 0x14022a9d2
insd dword [rdi], dx
insd dword [rdi], dx
invalid

Function at 0x14029f842
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov rdx, qword [rsp + 0x18]
neg qword [rsp + 0x10]
call fcn.1402318f4

Function at 0x14029f88b
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1400837c0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8002
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov rcx, rsi
call fcn.1400428c0
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x20], ebp
lea edx, [r8 + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x10
jne 0x14008381e
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rbx
mov dword [rsp + 0x20], ebp
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14008382e
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140083840
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140085070
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
jl 0x140083796
call fcn.14034a26d

Function at 0x1402d6c57
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
test ebx, ebx
setl bl
setbe bl
sete byte [rsp + 0xb0]
mov r9, qword [rsp + 0xb8]
seta byte [rsp + 0x30]
cmp dword [rsp + 0x30], 0x344c1dca
call fcn.140146c9f
bnd jnp 0x1402a988e
jae 0x14f948bb3
invalid
lea rsp, [rsp + 0x30]
call fcn.1403f111b
or eax, dword [rcx]
jge 0x1402a98d4
sbb byte [rdi - 0xb63f466], ah
and eax, 0x8ec5ee0e
fucompi st(4)
invalid
movabs dword [0x3a1b70f97f63fee4], eax
xor ah, byte [rbx]
xchg edx, eax
invalid
xor rbx, 0x6d655854
mov r10, qword [rsp + 0x90]
jne 0x1402a9848
Function at 0x1402fcae8
Capabilities:
Encode data using xor

Disassembly:
xor dl, byte [rsp + 0x1b]
and word [rsp + 0x18], 0x1a34
sub edx, edx
lea rdi, [rdi + 0x4b1c59a9]
sub dl, dl
lea rdx, [rdx + rbx*8 + 0x67197aed]
not byte [rsp + 0x18]
xor dl, 0x2a
sub bl, dh
call fcn.140311b63
xor bx, 0x2b2f
ja 0x1402c1132

Function at 0x1403121c6
Capabilities:
Encode data using xor

Disassembly:
call fcn.140286311
push 0x8da0e68
mov rbx, qword [rsp + 0x10]
mov rbx, qword [rbx]
jae 0x1401d444b
xor r12b, r12b
or r12d, r12d
movzx r12d, r12w
mov r12, qword [rsp + 0x18]
seto byte [rsp + 0x30]
or byte [rsp + 0x30], 0x96
neg word [rsp + 0x30]
or qword [rsp + 0x30], 0x63a3193c
and word [rsp + 0x20], 0x4e37
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x40]
ret

Function at 0x14031caf7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rbp, qword [rsp + 0x18]
not dword [rsp + 0x58]
call fcn.1400da5a3

Function at 0x14031cb05
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movabs rdi, 0x3cf32e403a3d0bca
movsx di, di
not di
sete dil
sub edi, 0x5b831ea3
lea rax, [rax + 1]
or rdi, rsi
push rcx
add rsi, rdi
and di, di
add qword [rsp + 8], 0x4ff49
or si, 0x2fca
mov rcx, rsi
mov qword [rsp + 0x38], rax
seto dil
push rbx
movabs rbx, 0x3f5041c40100be9
push rbx
bswap rcx
nop
call fcn.14025dc7d

Function at 0x14031cb5d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r14, qword [rsp + 0x20]
mov r8, qword [rsp + 0x60]
bswap r8d
sete r8b
neg qword [rsp + 0x10]
call fcn.14029f8b5

Function at 0x14031cb9e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rbx, qword [rsp + 0x40]
mov rbx, qword [rbx]
mov rdi, r9
mov rdx, r9
neg r8b
mov qword [rsp + 0x40], r9
or bpl, byte [rsp + 0x47]
call fcn.1402c22bb

Function at 0x14031cbbe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not byte [rsp + 8]
call fcn.14034af39
Function at 0x140320e30
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x1400539af
lea r8, [rbp - 0x69]
mov rcx, rdi
lea rdx, [rbp - 0x29]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1400539af
cmp dword [rbp - 0x69], 0x10
jl 0x1400539af
lea edx, [r12 + 1]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x1400539af
xor r8d, r8d
lea edx, [r12 + 1]
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_socket]
mov qword [r14], rax
cmp rax, 0xffffffffffffffff
je 0x1400539af
lea r8d, [r12 + 0x10]
mov rcx, rax
lea rdx, [rbp - 0x29]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1400539af
lea edx, [r12 + 1]
mov rcx, rdi
call fcn.1400790b0
test eax, eax
js 0x1400539af
lea edx, [r12 + 1]
mov qword [rbp - 0x19], rdi
mov r8d, 0x3e8
mov dword [rbp - 0x11], 0x300
lea rcx, [rbp - 0x19]
call fcn.140052280
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_accept]
mov qword [r14 + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1400539af
lea rcx, [rbp - 0x59]
call fcn.1400347d0
mov ebx, 9
lea rdx, [rbp - 9]
mov r8d, ebx
lea rsi, [rbp + 7]
xor ecx, ecx
movups xmm6, xmmword [rax]
call fcn.140054120
test eax, eax
jne 0x1400539af
mov rcx, qword [r14]
lea rdx, [rbp - 9]
xor r9d, r9d
mov r8d, ebx
call qword [sym.imp.WS2_32.dll_send]
nop
mov rax, qword [r14 + 8]
lea rcx, [rbp - 0x19]
mov edx, 1
mov qword [rbp - 0x19], rax
mov r8d, 0x3e8
mov dword [rbp - 0x11], 0x300
call fcn.140052280
mov rcx, qword [r14 + 8]
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x140053a11
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rcx, [rbp - 0x39]
movdqa xmmword [rbp - 0x49], xmm6
mov r15d, eax
call fcn.1400347d0
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x59]
movups xmm0, xmmword [rax]
movaps xmmword [rbp - 0x59], xmm0
call fcn.140034860
cmp rax, 0xea60
jg 0x1400539af
cmp r15d, 0x2733
je 0x140053930
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [r14]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [r14 + 8]
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, 0xffffffff
mov r15, qword [rsp + 0xd0]
mov r13, qword [rsp + 0x110]
mov r12, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x100]
movaps xmm6, xmmword [rsp + 0xc0]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140085070
add rsp, 0xd8
pop r14
pop rdi
pop rbx
pop rbp
ret
sub rbx, rcx
je 0x140053a1e
add rsi, rcx
jmp 0x140053930
mov rax, qword [rbp - 9]
cmp rax, qword [rbp + 7]
jne 0x1400539af
movzx eax, byte [rbp - 1]
cmp al, byte [rbp + 0xf]
jne 0x1400539af
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x1400539d0
mov rcx, qword [rsp + 0x10]
push r12
movabs r12, 0x78ec195a0f30303b
pushfq
test r12, 0x5caa2976
jl 0x14005381e
lea rcx, [rcx + 1]
and r12d, r12d
push r9
call fcn.14023bfe4
Function at 0x1403308c5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x60], rsi
sete r10b
lea r12, [rdi + r12*8 + 0x3ad777be]
movzx edi, byte [rsp + 0x1b]
movabs r14, 0x74d4683d3db02a3e
mov rdi, qword [rsp + 0x18]
add rdi, r10
or r14w, 0x31f4
push r12
add qword [rsp + 0x48], 0xfffffffffff628a4
mov qword [rsp], r14
call fcn.14029c691

Function at 0x1403547b8
Capabilities:
Encode data using xor

Disassembly:
neg r11
add r11d, 0x3b011597
push rdi
mov r11, qword [rsp + 0x18]
movabs rdi, 0x18fa2ba85e335982
call fcn.1401b1209
sub edi, edx
sbb al, ch
xor cl, dl
in eax, 0xff
pop rbx
lodsq rax, qword [rsi]
pop rdi
cli
jle 0x1403547cf
je 0x14035482f
lea edi, [rdi + rax*4 + 0x62fb4d6e]
dec dword [rax - 0x47]
mov dh, 0x60
invalid

Function at 0x140364404
Capabilities:
Encode data using xor

Disassembly:
mov r14, qword [rsp + 0x98]
jle 0x14030f6fa
mov rsi, qword [rsp + 0x90]
cmp byte [rsp + 0x80], 0x99
call fcn.14017c99a
Function at 0x14006f03a
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push r15
xor rax, rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.1400f3290
mov qword [rsp + 0x28], 0
jmp 0x14006f05b
mov rax, qword [rsp + 0x50]
cmp rax, qword [rsp + 0x28]
jl 0x14006f157
push 0
pop rcx
call fcn.1400d796c
and rax, rax
je 0x14006f14c
mov qword [rsp + 0x30], 0xffffffffffffffff
call fcn.14007b080
mov qword [rsp + 0x30], rax
mov r15, qword [rsp + 0x30]
and r15, r15
jle 0x14006f115
call fcn.1400dc61c
mov rax, rax
push rax
mov r15, qword [0x141ef5888]
cmp r15, qword [rsp]
jne 0x14006f0d2
sub rsp, 8
push qword [rsp + 0x40]
pop rcx
sub rsp, 0x20
call fcn.14006cfd1
add rsp, 0x28
mov r15, rax
and r15, r15
jne 0x14006f0d0
jmp 0x14006f112
xor r15, r15
cmp r15, qword [rsp]
jne 0x14006f0fb
sub rsp, 8
push qword [rsp + 0x40]
pop rcx
sub rsp, 0x20
call fcn.140059e05
add rsp, 0x28
mov r15, rax
and r15, r15
jne 0x14006f0f9
jmp 0x14006f112
sub rsp, 8
push 3
pop rcx
sub rsp, 0x20
call fcn.1400d76dc
add rsp, 0x28
pop rax
jmp 0x14006f120
push 5
pop rcx
call fcn.1400d76dc
push 0x1b
pop rcx
call sub.USER32.dll_GetKeyState
mov r15, rax
cmp r15, 1
jle 0x14006f141
mov qword [0x141ef57f8], 1
jmp 0x14006f14c
mov qword [0x141ef57f8], 0
inc qword [rsp + 0x28]
jno 0x14006f05b
xor rax, rax
add rsp, 0x40
pop r15
ret
Function at 0x14007c06c
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
push r15
mov rax, 7
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14007c07f
sub rsp, 0x28
call fcn.1400f3290
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400f2e00
add rsp, 0x10
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.1400f2e00
add rsp, 0x10
push qword [rsp + 0x28]
pop rcx
call fcn.14007cacb
push qword [rsp + 0x30]
movabs rcx, 0x1401c27bc
pop rdx
call fcn.1400f3090
or rax, rax
je 0x14007c1b0
cmp dword [0x141ef5b64], 0
je 0x14007c18e
movabs rax, 0x1401c1e1c
push rax
push 0xffffffffffffffff
pop rcx
pop rdx
call fcn.1400ca00c
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14007c18c
movabs rax, 0x1401d2190
push rax
push qword [rsp + 0x40]
pop rcx
pop rdx
call fcn.1400ca094
mov qword [rsp + 0x40], rax
sub rsp, 8
push 0
movsxd r15, dword [0x141ef5b6c]
or r15, 0xf003f
mov rax, r15
push rax
mov rax, qword [0x141ef5a50]
mov rax, rax
push rax
push qword [0x141ef5a78]
push qword [rsp + 0x68]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400caa88
add rsp, 0x30
mov qword [rsp + 0x48], rax
push qword [rsp + 0x38]
pop rcx
call fcn.1400c9ef8
jmp 0x14007c1ab
mov rax, qword [0x141ef5a50]
mov rax, rax
push rax
push qword [0x141ef5a78]
pop rcx
pop rdx
call sub.ADVAPI32.dll_RegDeleteKeyW
mov qword [rsp + 0x48], rax
jmp 0x14007c275
lea rax, [rsp + 0x58]
mov rax, rax
push rax
push qword [0x141ef5a78]
push qword [rsp + 0x40]
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.dll_RegConnectRegistryW
movsxd rax, eax
mov qword [rsp + 0x50], rax
cmp dword [0x141ef5b64], 0
je 0x14007c25a
movabs rax, 0x1401c1e1c
push rax
push 0xffffffffffffffff
pop rcx
pop rdx
call fcn.1400ca00c
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14007c258
push 0
movsxd r15, dword [0x141ef5b6c]
or r15, 0xf003f
mov rax, r15
push rax
mov rax, qword [0x141ef5a50]
mov rax, rax
push rax
push qword [rsp + 0x70]
movabs rax, 0x1401d2190
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400cb69c
add rsp, 0x30
mov qword [rsp + 0x48], rax
push qword [rsp + 0x38]
pop rcx
call fcn.1400c9ef8
jmp 0x14007c275
mov rax, qword [0x141ef5a50]
mov rax, rax
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
call sub.ADVAPI32.dll_RegDeleteKeyW
mov qword [rsp + 0x48], rax
mov r15, qword [rsp + 0x48]
and r15, r15
jne 0x14007c288
mov rax, 1
jmp 0x14007c28b
xor rax, rax
push rax
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.1400f3330
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400f3330
add rsp, 0x28
pop rax
add rsp, 0x60
pop r15
ret
Function at 0x14008165c
Capabilities:
Get graphical window text

Disassembly:
push r15
xor rax, rax
push rax
sub rsp, 0x28
call fcn.1400f3290
mov rcx, qword [rsp + 0x60]
call fcn.140083cac
mov r15, qword [0x141ef5f78]
and r15, r15
jne 0x1400816a6
push 0
push 0
pop rcx
pop rdx
call sub.USER32.dll_FindWindowW
mov qword [0x141ef5f80], rax
mov qword [0x141ef5f78], 1
jmp 0x1400816bf
push 2
push qword [0x141ef5f80]
pop rcx
pop rdx
call sub.USER32.dll_GetWindow
mov qword [0x141ef5f80], rax
mov r15, qword [0x141ef5f80]
and r15, r15
je 0x140081795
push 0xfffffffffffffff0
push qword [0x141ef5f80]
pop rcx
pop rdx
call sub.USER32.dll_GetWindowLongPtrW
mov r15, rax
and r15, 0x10000000
cmp r15, 0x10000000
jne 0x140081793
push 0xffffffffffffffec
push qword [0x141ef5f80]
pop rcx
pop rdx
call sub.USER32.dll_GetWindowLongPtrW
mov r15, rax
and r15, 0x80
cmp r15, 0x80
je 0x140081793
push rcx
sub rsp, 0x28
call fcn.1400f2f60
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400f2f60
add rsp, 0x28
pop rcx
push rax
push 0x100
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400efa10
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.1400f2fb0
push 0x100
push qword [rsp + 0x30]
push qword [0x141ef5f80]
pop rcx
pop rdx
pop r8
call sub.USER32.dll_GetWindowTextW
push qword [rsp + 0x28]
movabs rcx, 0x1401c10c4
pop rdx
call fcn.1400f3090
or rax, rax
jne 0x140081793
jmp 0x1400817b0
jmp 0x1400817a0
mov qword [0x141ef5f78], 0
mov r15, qword [0x141ef5f80]
and r15, r15
jne 0x140081675
mov rcx, qword [rsp + 0x28]
push rcx
sub rsp, 0x28
call fcn.1400f2f60
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400f30f0
add rsp, 0x28
pop rax
push rax
call fcn.1400f3160
pop rdx
add rax, rdx
jmp 0x1400817e9
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400f3330
add rsp, 0x28
pop rax
add rsp, 0x30
pop r15
ret