joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c9f0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xe0
xor eax, eax
xor ebx, ebx
lea rcx, [rsp + 0x78]
lea r8d, [rbx + 0x60]
xor edx, edx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.1400140c0
lea rax, [rsp + 0x50]
lea rdx, [0x1400485e0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000ca7d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0xe0
pop rbx
ret
Function at 0x140012520
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
lea rdi, [rcx + 0x10]
xor edx, edx
mov rbx, rcx
lea r9, [0x1400319b0]
lea rcx, [0x14003a568]
lea r8d, [rdx + 0x17]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400125b7
mov rcx, qword [rdi]
xor edi, edi
add rbx, 0x18
mov rax, qword [rcx]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea rdx, str.ROOTCIMV2
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [rax + 0x18]
test eax, eax
js 0x1400125b7
mov rcx, qword [rbx]
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rdi
lea edx, [rdi + 0xa]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x140015ea0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140015eb6
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140015eb8
xor eax, eax
test eax, eax
je 0x140015ec8
mov ecx, eax
call fcn.140018be4
or eax, 0xffffffff
jmp 0x140015eca
xor eax, eax
add rsp, 0x28
ret
Function at 0x140067800
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
movaps xmmword [rsp + 0x40], xmm9
mov rax, qword [0x1402ea010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x18]
mov rsi, rcx
movss xmm0, dword [rax + 0x88]
addss xmm0, dword [0x14029a7b8]
movss dword [rax + 0x88], xmm0
movss xmm9, dword [rcx + 0x3c]
mov rcx, qword [rcx + 0x68]
mulss xmm9, dword [0x14029a61c]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdi, qword [rsi + 0x50]
mov rbx, qword [rsi + 0x48]
test al, al
je 0x140067980
mov qword [rsp + 0x98], rbp
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm7
movaps xmmword [rsp + 0x50], xmm8
cmp rbx, rdi
je 0x1400678a4
nop dword [rax]
mov rcx, qword [rbx]
mov dl, 1
mov rax, qword [rcx]
call qword [rax + 0x20]
add rbx, 8
cmp rbx, rdi
jne 0x140067890
mov rax, qword [rsi + 0x18]
movss xmm7, dword [0x14029a758]
movss xmm8, dword [rax + 0x88]
movaps xmm0, xmm8
addss xmm0, xmm7
movss dword [rax + 0x88], xmm0
mov rbp, qword [rsi + 0x50]
mov rdi, qword [rsi + 0x48]
cmp rdi, rbp
je 0x14006790f
nop word [rax + rax]
mov rbx, qword [rdi]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + reloc.WSOCK32.dll_htonl]
test al, al
je 0x140067906
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
test al, al
je 0x140067906
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x48]
add rdi, 8
cmp rdi, rbp
jne 0x1400678e0
mov rax, qword [rsi + 0x18]
mov rcx, qword [rsi + 0x60]
movss dword [rsp + 0x20], xmm9
movss dword [rsp + 0x24], xmm8
movss xmm6, dword [rax + 0x88]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rsi + 0x70]
addss xmm6, xmm7
movss dword [rsp + 0x28], xmm0
lea rdx, [rsp + 0x20]
movss dword [rsp + 0x2c], xmm6
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rax, qword [rsi + 0x18]
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x70]
mov rbp, qword [rsp + 0x98]
movss xmm0, dword [rax + 0x88]
addss xmm0, xmm7
addss xmm0, xmm7
movaps xmm7, xmmword [rsp + 0x60]
jmp 0x1400679e6
cmp rbx, rdi
je 0x140067999
mov rcx, qword [rbx]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x20]
add rbx, 8
cmp rbx, rdi
jne 0x140067985
mov rax, qword [rsi + 0x18]
lea rdx, [rsp + 0x20]
mov rcx, qword [rsi + 0x70]
movss xmm0, dword [rsi + 0x3c]
movss xmm1, dword [rax + 0x88]
movss dword [rsp + 0x24], xmm1
movss dword [rsp + 0x2c], xmm1
movss dword [rsp + 0x20], xmm9
movss dword [rsp + 0x28], xmm0
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rax, qword [rsi + 0x18]
movss xmm0, dword [rax + 0x88]
addss xmm0, dword [0x14029a758]
movss dword [rax + 0x88], xmm0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1402447f0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop rdi
ret
Function at 0x1400681e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rax, qword [0x1402ea010]
xor rax, rsp
mov qword [rsp + 0x30], rax
movss xmm6, dword [0x14029a7b8]
mov rsi, rcx
mov rdx, qword [rcx + 0x68]
movaps xmm2, xmm6
call fcn.1400660d0
mov rax, qword [rsi + 0x18]
movss xmm0, dword [rax + 0x88]
addss xmm0, xmm6
movss dword [rax + 0x88], xmm0
cmp byte [rsi + 0x78], 0
mov rax, qword [rsi + 0x18]
je 0x14006833d
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rdi
movaps xmmword [rsp + 0x50], xmm7
movss xmm7, dword [0x14029a758]
movaps xmmword [rsp + 0x40], xmm8
movss xmm8, dword [rax + 0x88]
movaps xmm0, xmm8
addss xmm0, xmm7
movss dword [rax + 0x88], xmm0
mov rbp, qword [rsi + 0x50]
mov rdi, qword [rsi + 0x48]
cmp rdi, rbp
je 0x1400682c7
mov qword [rsp + 0x88], rbx
nop dword [rax + rax]
mov rbx, qword [rdi]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + reloc.WSOCK32.dll_htonl]
test al, al
je 0x1400682b6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
test al, al
je 0x1400682b6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x48]
add rdi, 8
cmp rdi, rbp
jne 0x140068290
mov rbx, qword [rsp + 0x88]
mov rax, qword [rsi + 0x18]
xorps xmm0, xmm0
mov rcx, qword [rsi + 0x60]
movss dword [rsp + 0x20], xmm0
movss dword [rsp + 0x24], xmm8
movss xmm6, dword [rax + 0x88]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rsi + 0x70]
addss xmm6, xmm7
movss dword [rsp + 0x28], xmm0
lea rdx, [rsp + 0x20]
movss dword [rsp + 0x2c], xmm6
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rax, qword [rsi + 0x18]
movaps xmm8, xmmword [rsp + 0x40]
mov rdi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
movss xmm0, dword [rax + 0x88]
addss xmm0, xmm7
addss xmm0, xmm7
movaps xmm7, xmmword [rsp + 0x50]
jmp 0x140068388
movss xmm2, dword [rax + 0x88]
lea rdx, [rsp + 0x20]
mov rcx, qword [rsi + 0x70]
xorps xmm0, xmm0
movss xmm1, dword [rsi + 0x3c]
movss dword [rsp + 0x20], xmm0
movss dword [rsp + 0x24], xmm2
movss dword [rsp + 0x28], xmm1
movss dword [rsp + 0x2c], xmm2
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rax, qword [rsi + 0x18]
movss xmm0, dword [rax + 0x88]
addss xmm0, dword [0x14029a758]
movss dword [rax + 0x88], xmm0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1402447f0
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rsi
ret
Function at 0x1400a30b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1402ea010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, qword [rcx + 0xe28]
movzx esi, dl
mov byte [rcx + 0xf40], dl
mov rdi, rcx
test dl, dl
je 0x1400a30fd
mov rdx, qword [rcx + 0xe40]
mov rcx, r14
mov rax, qword [r14]
call qword [rax + 0x100]
jmp 0x1400a3117
mov rbx, qword [r14]
xor edx, edx
mov rcx, r14
call qword [rbx + 0xf8]
mov rdx, rax
mov rcx, r14
call qword [rbx + 0x100]
mov rcx, qword [rdi + 0xe30]
movzx edx, sil
xor dl, 1
mov rcx, qword [rcx + 0xc0]
call fcn.140213d90
mov rcx, qword [rdi + 0xed8]
movzx edx, sil
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rdi + 0xe70]
movzx edx, sil
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rbp, qword [rdi + 0xf18]
mov rbx, qword [rdi + 0xf10]
cmp rbx, rbp
je 0x1400a3186
nop word [rax + rax]
mov rcx, qword [rbx]
movzx edx, sil
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
add rbx, 8
cmp rbx, rbp
jne 0x1400a3170
mov rcx, qword [rdi + 0xf08]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov rax, qword [rdi + 0xe30]
movzx edx, sil
mov rcx, qword [rax + 0x80]
mov rbx, qword [rcx + 0x418]
mov rcx, qword [rdi + 0xe68]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_htonl]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
test sil, sil
je 0x1400a31fb
mov r8d, 0x101
call qword [rax + 0x18]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax + reloc.WSOCK32.dll_htonl]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax + 0x68]
mov rcx, qword [rdi + 0xe28]
mov dl, 1
mov rax, qword [rcx]
call qword [rax + 0x1e0]
jmp 0x1400a320f
mov r8d, 0xc0
call qword [rax + 0x18]
mov rax, qword [rbx]
mov dl, 1
mov rcx, rbx
call qword [rax + 0x68]
cmp byte [rdi + 0xf40], 0
mov rax, qword [rdi + 0xe30]
mov rbx, qword [rax + 0x98]
je 0x1400a324b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xa8]
mov rax, qword [rbx]
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
call qword [rax + 0x190]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1402447f0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400c42b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x1402ea010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rdx
cmp qword [rcx + 0x48], 0
je 0x1400c4316
mov r8d, 1
lea rdx, [0x140285d20]
mov rcx, rbx
call fcn.14002a9d0
mov r8d, dword [rbx + 0x10]
inc r8d
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400c4304
mov rdx, qword [rbx]
mov rax, qword [rdi + 0x48]
xor r9d, r9d
mov rcx, qword [rax + 0x10]
call qword [sym.imp.WSOCK32.dll_send]
nop
mov rcx, rbx
call fcn.140007550
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1402447f0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400c4e20
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0xfa0]
mov eax, 0x10a0
call fcn.140245a00
sub rsp, rax
mov rax, qword [0x1402ea010]
xor rax, rsp
mov qword [rbp + 0xf90], rax
mov rbx, rcx
mov word [rcx + 0x11], 0x100
mov byte [rcx + 0x10], 0
cmp dword [rcx + 0x20], 0x14
jae 0x1400c4fda
mov qword [rcx + 0x3c], rdx
mov rax, rdx
shr rax, 0x20
movzx ecx, ax
movzx r10d, dl
mov eax, edx
shr eax, 8
movzx r9d, al
mov eax, edx
shr eax, 0x10
movzx r8d, al
shr edx, 0x18
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], r10d
lea rcx, str.Trying_to_establish_UDP_Connection_with__d._d._d._d:_d_established_n
call fcn.1400c3ec0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], reloc.WSOCK32.dll_ntohs
mov byte [rsp + 0x30], dil
mov eax, dword [rbx + 0x18]
movups xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x14029b1d0]
movdqa xmmword [rbp - 0x80], xmm1
mov byte [rsp + 0x70], dil
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], edi
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.1400075d0
mov dword [rsp + 0x6c], reloc.WSOCK32.dll_sendto
mov eax, dword [rbp - 0x80]
add eax, 0x14
mov dword [rsp + 0x68], eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400c4f50
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4f47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c4f47
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140244ae4
nop dword [rax]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
lea rcx, [rsp + 0x50]
call fcn.1400c4d40
mov rdi, qword [rbx + 0x48]
mov esi, dword [rsp + 0x68]
cmp qword [sym.imp.WSOCK32.dll_socket], 0
je 0x1400c4fc2
mov eax, 2
mov word [rsp + 0x30], ax
mov ecx, dword [rbx + 0x3c]
call qword [sym.imp.WSOCK32.dll_htonl]
mov dword [rsp + 0x34], eax
movzx ecx, word [rbx + 0x40]
call qword [sym.imp.WSOCK32.dll_htons]
mov word [rsp + 0x32], ax
mov dword [rsp + 0x28], reloc.WSOCK32.dll_recv
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, esi
lea rdx, [rbp - 0x70]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.WSOCK32.dll_sendto]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x24], eax
inc dword [rbx + 0x20]
lea rcx, [rsp + 0x70]
call fcn.140007550
jmp 0x1400c4fdf
call fcn.1400c5010
mov rcx, qword [rbp + 0xf90]
xor rcx, rsp
call fcn.1402447f0
lea r11, [rsp + 0x10a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400c5160
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1060
call fcn.140245a00
sub rsp, rax
mov rax, qword [0x1402ea010]
xor rax, rsp
mov qword [rsp + 0x1050], rax
cmp byte [rcx + 0x10], 0
mov rbx, rcx
je 0x1400c525b
mov rdi, qword [rdx + 0x10]
cmp rdi, 0xfec
jae 0x1400c525b
mov r8d, dword [rcx + 0x18]
inc r8d
mov byte [rsp + 0x43], 0
mov eax, r8d
mov byte [rsp + 0x42], r8b
sar eax, 0x10
mov byte [rsp + 0x40], al
mov eax, r8d
sar eax, 8
cmp qword [rdx + 0x18], 0x10
mov byte [rsp + 0x41], al
jb 0x1400c51d7
mov rdx, qword [rdx]
mov r8, rdi
lea rcx, [rsp + 0x44]
call sub.VCRUNTIME140.dll_memcpy
mov rsi, qword [rbx + 0x48]
add edi, 4
cmp qword [sym.imp.WSOCK32.dll_socket], 0
mov dword [rsp + 0x1040], edi
je 0x1400c525b
mov ecx, dword [rbx + 0x3c]
mov eax, 2
mov word [rsp + 0x30], ax
call qword [sym.imp.WSOCK32.dll_htonl]
movzx ecx, word [rbx + 0x40]
mov dword [rsp + 0x34], eax
call qword [sym.imp.WSOCK32.dll_htons]
mov rcx, qword [rsi + 0x10]
lea rdx, [rsp + 0x40]
mov word [rsp + 0x32], ax
xor r9d, r9d
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], reloc.WSOCK32.dll_recv
mov r8d, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WSOCK32.dll_sendto]
cmp eax, edi
jne 0x1400c525b
mov eax, dword [rsp + 0x1040]
add dword [rbx + 0x38], eax
mov al, 1
jmp 0x1400c525d
xor al, al
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.1402447f0
lea r11, [rsp + 0x1060]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400c60e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rax, qword [rdx]
mov qword [rcx], rax
xor esi, esi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rsi
mov word [rcx + 0x20], si
mov qword [rcx + 0x28], rsi
mov qword [rcx + 0x30], rsi
mov qword [rcx + 0x38], rsi
mov qword [rcx + 0x40], rsi
mov qword [rcx + 0x48], rsi
mov qword [rcx + 0x50], rsi
mov qword [rcx + 0x58], rsi
mov qword [rcx + 0x60], rsi
mov qword [rcx + 0x68], rsi
mov qword [rcx + 0x70], rsi
mov qword [rcx + 0x78], rsi
mov qword [rcx + 0x80], rsi
add rcx, 0x88
lea edx, [rsi + 2]
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
nop
xor eax, eax
mov word [rdi + 0xd8], ax
lea ecx, [rsi + 0x60]
call fcn.140244aa8
mov rbx, rax
mov qword [rsp + 0x50], rax
mov dword [rax + 8], 1
lea rax, vtable.ClientConnection_TCP.0
mov qword [rbx], rax
mov dword [rbx + 0x14], 0x9233
mov eax, 0x927f
mov word [rbx + 0x18], ax
mov dword [rbx + 0x24], 0x2dc6c0
xorps xmm0, xmm0
movups xmmword [rbx + 0x28], xmm0
mov qword [rbx + 0x38], rsi
mov qword [rbx + 0x40], reloc.WSOCK32.dll_ntohs
mov byte [rbx + 0x28], sil
mov dword [rbx + 0x50], esi
mov word [rbx + 0x54], si
mov byte [rsp + 0x48], sil
lea ecx, [rsi + 0x18]
call fcn.140244aa8
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x48]
movzx edx, word [rbx + 0x18]
mov rcx, rax
call fcn.1400c3f20
nop
mov qword [rbx + 0x48], rax
cmp byte [rsp + 0x48], sil
je 0x1400c61ef
test rax, rax
je 0x1400c620f
mov rcx, qword [rax]
mov r8, qword [rcx]
lea edx, [rsi + 1]
mov rcx, rax
call r8
jmp 0x1400c620f
mov word [rbx + 0x11], 0
mov byte [rbx + 0x13], 0
mov byte [rbx + 0x10], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x58], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x5c], eax
mov qword [rdi + 8], rbx
mov byte [rsp + 0x48], 0
mov ecx, 0x18
call fcn.140244aa8
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x48]
mov rcx, rax
call fcn.1400c4a10
nop
mov qword [rdi + 0x18], rax
mov eax, esi
xchg byte [rdi + 0xd8], al
xchg byte [rdi + 0xd9], sil
mov rax, rdi
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x14010b070
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
xor r8d, r8d
mov rbx, rcx
test edx, edx
je 0x14010b0b0
sub edx, 1
je 0x14010b0aa
sub edx, 1
je 0x14010b0a2
sub edx, 1
je 0x14010b09a
cmp edx, 1
jne 0x14010b0b0
lea r8d, [rdx + 0xf]
jmp 0x14010b0b0
mov r8d, 8
jmp 0x14010b0b0
mov r8d, 4
jmp 0x14010b0b0
mov r8d, 2
mov rcx, qword [rcx + 0x138]
mov edx, r8d
mov rax, qword [rcx]
call qword [rax + 0x140]
mov rcx, qword [rbx + 0x128]
lea rdx, [rbx + 8]
mov rcx, qword [rcx + 0xb8]
add rsp, 0x20
pop rbx
jmp fcn.140106f50

Function at 0x14010b0e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor bl, bl
mov ebp, edx
mov r14, rcx
mov edi, 0x100
test edx, edx
je 0x14010b11e
sub edx, 1
je 0x14010b119
cmp edx, 1
jne 0x14010b11e
mov edi, 0x400
jmp 0x14010b11e
mov edi, 0x200
mov rax, qword [rcx + 0x128]
mov rsi, qword [rax + 0xa8]
mov rcx, rsi
mov rax, qword [rsi]
call qword [rax + 0x60]
mov r15d, 1
mov rcx, rsi
cmp eax, edi
mov rax, qword [rsi]
cmovne ebx, r15d
call qword [rax + 0x68]
movzx ebx, bl
mov edx, edi
cmp eax, edi
mov rcx, rsi
mov rax, qword [rsi]
cmovne ebx, r15d
call qword [rax + 0x78]
mov rax, qword [rsi]
mov edx, edi
mov rcx, rsi
call qword [rax + 0x80]
test ebp, ebp
je 0x14010b188
sub ebp, r15d
je 0x14010b181
cmp ebp, r15d
jne 0x14010b18d
mov edi, 0x800
jmp 0x14010b18d
mov edi, 0x5e8
jmp 0x14010b18d
mov edi, 0x400
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x70]
mov edx, edi
mov rcx, rsi
cmp eax, edi
mov rax, qword [rsi]
je 0x14010b1aa
call qword [rax + 0x88]
jmp 0x14010b1b4
call qword [rax + 0x88]
test bl, bl
je 0x14010b1c0
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0xa8]
mov rcx, qword [r14 + 0x128]
lea rdx, [r14 + 8]
mov rcx, qword [rcx + 0xb8]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.140106f50

Function at 0x14010b1f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rbx, rcx
movss xmm6, dword [0x14029acd0]
test edx, edx
je 0x14010b237
sub edx, 1
je 0x14010b22d
sub edx, 1
je 0x14010b223
cmp edx, 1
jne 0x14010b23f
movss xmm6, dword [0x14029accc]
jmp 0x14010b23f
movss xmm6, dword [0x14029acc8]
jmp 0x14010b23f
movss xmm6, dword [0x14029acc4]
jmp 0x14010b23f
movss xmm6, dword [0x14029acc0]
mov rax, qword [rcx + 0x128]
mov rcx, qword [rax + 0x160]
movss dword [rax + 0x4cc], xmm6
test rcx, rcx
je 0x14010b267
movaps xmm2, xmm6
mov edx, 1
call fcn.14021c330
mov rax, qword [rbx + 0x128]
mov rcx, qword [rax + 0x160]
movss dword [rax + 0x4d0], xmm6
test rcx, rcx
je 0x14010b28f
movaps xmm2, xmm6
mov edx, 2
call fcn.14021c330
mov rcx, qword [rbx + 0x128]
lea rdx, [rbx + 8]
mov rcx, qword [rcx + 0xb8]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
jmp fcn.140106f50
Function at 0x14010b2b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
movss xmm2, dword [0x14029ac70]
mov rbx, rcx
test edx, edx
je 0x14010b2e1
sub edx, 1
je 0x14010b2d9
cmp edx, 1
jne 0x14010b2e1
movss xmm2, dword [0x14029ac84]
jmp 0x14010b2e1
movss xmm2, dword [0x14029ac7c]
mov rax, qword [rcx + 0x128]
mov rcx, qword [rax + 0x160]
movss dword [rax + 0x4d4], xmm2
test rcx, rcx
je 0x14010b306
mov edx, 3
call fcn.14021c330
mov rcx, qword [rbx + 0x128]
lea rdx, [rbx + 8]
mov rcx, qword [rcx + 0xb8]
add rsp, 0x20
pop rbx
jmp fcn.140106f50
Function at 0x14010b600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rax, qword [rcx + 0x128]
mov rsi, qword [rax + 0x158]
test edx, edx
setne r8b
lea rbx, [rsi + 0x70]
mov rcx, qword [rbx]
test rcx, rcx
setne al
cmp al, r8b
je 0x14010b695
test edx, edx
je 0x14010b67f
mov ecx, 0xa0
call fcn.140244aa8
mov qword [rsp + 0x40], rax
movss xmm2, dword [0x14029a608]
mov rdx, qword [rsi + 0x10]
mov rcx, rax
call fcn.140009f00
mov rcx, rax
lea rax, [rsp + 0x20]
cmp rbx, rax
je 0x14010b686
mov r8, qword [rbx]
mov qword [rbx], rcx
test r8, r8
je 0x14010b695
mov rax, qword [r8]
mov rcx, r8
jmp 0x14010b68e
mov qword [rbx], 0
test rcx, rcx
je 0x14010b695
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
lea rdx, [rdi + 8]
mov rcx, qword [rdi + 0x128]
mov rcx, qword [rcx + 0xb8]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.140106f50

Function at 0x14010b6c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rax, qword [rcx + 0x128]
mov rsi, qword [rax + 0x158]
test edx, edx
setne r8b
lea rbx, [rsi + 0x30]
mov rcx, qword [rbx]
test rcx, rcx
setne al
cmp al, r8b
je 0x14010b74d
test edx, edx
je 0x14010b737
mov ecx, 0x98
call fcn.140244aa8
mov qword [rsp + 0x40], rax
mov rdx, qword [rsi + 0x10]
mov rcx, rax
call fcn.14000e7e0
mov rcx, rax
lea rax, [rsp + 0x20]
cmp rbx, rax
je 0x14010b73e
mov r8, qword [rbx]
mov qword [rbx], rcx
test r8, r8
je 0x14010b74d
mov rax, qword [r8]
mov rcx, r8
jmp 0x14010b746
mov qword [rbx], 0
test rcx, rcx
je 0x14010b74d
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
lea rdx, [rdi + 8]
mov rcx, qword [rdi + 0x128]
mov rcx, qword [rcx + 0xb8]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.140106f50
Function at 0x140125230
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx ebx, dl
mov rdi, rcx
mov edx, ebx
mov byte [rcx + 0x173], bl
call fcn.1401202d0
mov rcx, qword [rdi + 0x1c0]
movzx edx, bl
call fcn.1401112e0
mov rcx, qword [rdi + 0x188]
movss xmm1, dword [0x14029a7e4]
mov rax, qword [rcx]
call qword [rax + 0x228]
mov rcx, qword [rdi + 0x230]
movzx esi, bl
xor sil, 1
movzx edx, sil
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rax, qword [rdi + 0x178]
mov byte [rdi + 0x290], 1
mov rax, qword [rax + 0x158]
mov rcx, qword [rax + 0x90]
test bl, bl
je 0x14012530b
xor ebx, ebx
mov dword [rcx + 0x78], ebx
mov rcx, qword [rdi + 0x1d8]
mov rax, qword [rdi + 0x1e0]
sub rax, rcx
sar rax, 3
test rax, rax
je 0x14012531e
mov rcx, qword [rcx + rbx*8]
movzx edx, sil
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rdi + 0x1d8]
inc rbx
mov rax, qword [rdi + 0x1e0]
sub rax, rcx
sar rax, 3
cmp rbx, rax
jb 0x1401252d0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov dword [rcx + 0x78], 0x40a00000
movzx edx, sil
mov rcx, rdi
call fcn.14011ff60
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140245404
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14024544e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14024544e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14024544e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14024544e
cmp dword [rcx + 0x84], 0xe
jbe 0x14024544e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140245450
xor al, al
add rsp, 0x28
ret