joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003185b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180065480]
jne 0x18002bd1a
rol rcx, 0x10
test cx, 0xffff
jne 0x18002bd16
repz ret
ror rcx, 0x10
jmp 0x1800317b4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18006aa60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x18006ab58]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180031839
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18006aa60]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18003185b
mov rax, qword [rsp + 0x88]
mov qword [0x18006ab58], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18006aaf8], rax
mov rax, qword [0x18006ab58]
mov qword [0x18006a9d0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18006aae0], rax
mov dword [0x18006a9c0], 0xc0000409
mov dword [0x18006a9c4], 1
mov rax, qword [0x180065480]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180065488]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18006aa58], eax
mov ecx, 1
call fcn.18003cd00
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180050c40]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18006aa58], 0
jne 0x1800318e2
mov ecx, 1
call fcn.18003cd00
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x18003f9f8
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.180032ce8
xor ebx, ebx
mov rdi, rax
cmp qword [0x18006b7d0], rbx
jne 0x18003fafe
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x18003fbd3
lea rdx, [0x180053428]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18003fbd3
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x180053418]
mov rcx, rsi
mov qword [0x18006b7d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x180053400]
mov rcx, rsi
mov qword [0x18006b7d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x18006b7e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x18006b7f0], rax
test rax, rax
je 0x18003faf5
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x18006b7e8], rax
jmp 0x18003fb05
mov rax, qword [0x18006b7e8]
jmp 0x18003fb0c
mov rax, qword [0x18006b7e8]
mov r11, qword [0x18006b7f0]
cmp rax, rdi
je 0x18003fb74
cmp r11, rdi
je 0x18003fb74
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x18006b7f0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x18003fb74
test rax, rax
je 0x18003fb74
call rsi
test rax, rax
je 0x18003fb6e
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18003fb6e
test byte [rsp + 0x38], 1
jne 0x18003fb74
bts ebp, 0x15
jmp 0x18003fbb2
mov rcx, qword [0x18006b7d8]
cmp rcx, rdi
je 0x18003fbb2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18003fbb2
call rax
mov rbx, rax
test rax, rax
je 0x18003fbb2
mov rcx, qword [0x18006b7e0]
cmp rcx, rdi
je 0x18003fbb2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18003fbb2
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18006b7d0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18003fbd3
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x18003fbd5
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140001128
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov r13, rcx
cmp qword [0x140004070], rbx
lea rcx, [rsp + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x78], rax
mov qword [rcx], rbx
jne 0x14000115f
call fcn.1400016bc
cmp qword [0x140004098], rbx
jne 0x14000116d
call fcn.14000166c
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalMemoryRanges]
mov rdx, qword [0x140004090]
mov r12d, ebx
mov rcx, qword [0x140004088]
lea r14, [rax + 8]
lea rcx, [rcx + rdx*8]
mov qword [rsp + 0x68], rcx
mov rdi, qword [r14 - 8]
test rdi, rdi
jne 0x1400011a3
cmp qword [r14], rbx
je 0x14000125e
mov rbp, qword [r14]
sar rbp, 0xc
sar rdi, 0xc
add rbp, rdi
cmp rdi, rbp
jge 0x14000123b
lea rsi, [rdi + rdi*2]
shl rsi, 4
mov rax, qword [0x140004098]
mov r15, qword [rsi + rax]
cmp r15, 2
jb 0x140001221
cmp qword [rsi + rax + 8], rcx
jne 0x140001221
movabs rax, 0xffff800000000000
shr r15, 0xd
or r15, rax
lea rdx, [rsp + 0x70]
mov rax, rdi
shl rax, 0xc
mov qword [0x140004068], rax
mov ecx, dword [r13]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000121c
cmp r15, qword [rsp + 0x70]
je 0x14000122f
mov rcx, qword [rsp + 0x68]
inc rdi
add rsi, 0x30
cmp rdi, rbp
jl 0x1400011c2
jmp 0x14000123b
mov rcx, qword [0x140004068]
test rcx, rcx
jne 0x140001255
inc r12d
add r14, 0x10
cmp r12d, 0xc8
jge 0x14000125e
mov rcx, qword [rsp + 0x68]
jmp 0x140001191
mov rax, qword [r13 + 8]
mov qword [rax], rcx
jmp 0x140001265
mov rbx, 0xffffffffc0000001
mov rax, qword [rsp + 0x78]
lea rcx, [rsp + 0x58]
mov qword [rcx], rax
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000128c
Capabilities:
Find process by pid

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx], 0xc7a2b9
mov rbx, rcx
jne 0x140001339
movsxd rax, dword [rcx + 4]
test eax, eax
je 0x140001339
and qword [r11 + 8], 0
lea rdx, [r11 + 8]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140001339
mov rdi, qword [0x140004068]
test rdi, rdi
je 0x140001339
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdx, qword [rbx + 8]
mov rcx, rdi
mov rsi, qword [rbx + 0x18]
call fcn.140001b80
test rax, rax
je 0x140001339
mov ecx, eax
lea r9, [rsp + 0x38]
and ecx, 0xfff
mov edx, 0x1000
sub edx, ecx
mov rcx, rax
cmp edx, esi
cmovl esi, edx
and qword [rsp + 0x38], 0
cmp byte [rbx + 0x20], 0
mov rdx, qword [rbx + 0x10]
movsxd r8, esi
je 0x140001330
call fcn.140001a1c
jmp 0x140001335
call fcn.140001b0c
xor eax, eax
jmp 0x14000133e
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140001350
Capabilities:
Find process by pid

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x20
lea r14, [rsp + 0x28]
xor ebx, ebx
mov rsi, qword [r14]
mov rdi, rcx
mov qword [r14], rbx
cmp dword [rcx], 0xc7a2b9
jne 0x1400013b7
movsxd rax, dword [rcx + 4]
test eax, eax
je 0x1400013b7
mov rcx, rax
mov qword [r11 + 8], rbx
lea rdx, [r11 + 8]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400013b7
mov rcx, qword [rsp + 0x30]
call sub.ntoskrnl.exe_PsGetProcessSectionBaseAddress
mov rcx, rax
test rax, rax
jne 0x1400013d7
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov ebx, 0xc0000001
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
mov qword [r14], rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov rax, qword [rdi + 8]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1400013bc
Function at 0x140133910
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
jmp 0x14013394e
xchg r8, rax
mov qword [rsp + 0x10], r8
xchg r8, rax
jmp 0x1401339a8
xchg rbp, rax
mov dword [rsp + 8], 0
xchg rbx, rax
mov rbx, qword [rsp + 0x30]
xchg rbx, rax
jmp 0x140133928
sub rsp, 0x28
lea rax, [0x140133bb0]
xchg rbp, rax
mov qword [rsp + 0x18], rbp
jmp 0x140133936
Function at 0x140001000
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
mov rdi, rdx
xor edx, edx
mov rsi, r9
mov rbp, r8
mov r11, rcx
lea r12, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov r10d, edx
cmp r9, 3
jb 0x1400010c7
mov ebx, 4
sub rbx, rcx
lea r9, [r10 + r11]
lea rax, [rbx + r9]
cmp rax, rdi
ja 0x14000117d
movzx eax, byte [rdx + rbp + 1]
movzx ecx, byte [rdx + rbp]
lea r8, [rdx + 3]
shl ecx, 8
add r10, 4
or ecx, eax
movzx eax, byte [rdx + rbp + 2]
shl ecx, 8
or ecx, eax
mov edx, ecx
mov eax, ecx
shr rax, 0x12
and edx, 0x3f
and eax, 0x3f
movzx eax, byte [rax + r12]
mov byte [r9], al
mov eax, ecx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r12]
mov byte [r10 + r11 - 3], al
mov eax, ecx
shr rax, 6
and eax, 0x3f
movzx eax, byte [rax + r12]
mov byte [r10 + r11 - 2], al
movzx eax, byte [rdx + r12]
mov rdx, r8
mov byte [r10 + r11 - 1], al
lea rax, [r8 + 3]
cmp rax, rsi
jbe 0x140001040
lea rax, [rdx + 2]
cmp rax, rsi
ja 0x14000112a
lea r8, [r10 + 4]
cmp r8, rdi
ja 0x14000112a
movzx eax, byte [rdx + rbp + 1]
movzx ecx, byte [rdx + rbp]
shl ecx, 8
or ecx, eax
shl ecx, 8
mov eax, ecx
mov edx, ecx
shr rax, 0x12
shr rdx, 6
and eax, 0x3f
movzx eax, byte [rax + r12]
mov byte [r10 + r11], al
mov eax, ecx
shr rax, 0xc
and eax, 0x3f
and edx, 0x3f
movzx eax, byte [rax + r12]
mov byte [r10 + r11 + 1], al
movzx eax, byte [rdx + r12]
mov byte [r10 + r11 + 3], 0x3d
mov byte [r10 + r11 + 2], al
jmp 0x14000117a
lea rax, [rdx + 1]
cmp rax, rsi
ja 0x14000117d
lea r8, [r10 + 4]
cmp r8, rdi
ja 0x14000117d
movzx eax, byte [rdx + rbp + 1]
movzx ecx, byte [rdx + rbp]
shl ecx, 8
or ecx, eax
shl ecx, 8
mov eax, ecx
mov edx, ecx
shr rax, 0x12
shr rdx, 0xc
and eax, 0x3f
and edx, 0x3f
movzx eax, byte [rax + r12]
mov byte [r10 + r11], al
movzx eax, byte [rdx + r12]
mov word [r10 + r11 + 2], 0x3d3d
mov byte [r10 + r11 + 1], al
mov r10, r8
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rax, r10
pop r12
ret
Function at 0x1400011a0
Capabilities:
Decode data using base64 via dword translation table
Encode data using base64

Disassembly:
push rdi
mov qword [rsp + 0x10], rbx
mov rbx, rdx
xor r10d, r10d
xor edx, edx
mov r11, r9
mov rdi, rcx
test r9, r9
je 0x140001304
mov qword [rsp + 0x18], rsi
lea rsi, [0x140048370]
nop word [rax + rax]
xor r9d, r9d
cmp r10, r11
jae 0x1400011f8
nop dword [rax + rax]
movzx eax, byte [r10 + r8]
movzx r9d, byte [rax + rsi]
cmp r9d, 0x40
jbe 0x1400011f8
inc r10
cmp r10, r11
jb 0x1400011e0
cmp byte [r10 + r8], 0x3d
je 0x1400012ff
mov rax, r10
inc r10
cmp rax, r11
jae 0x1400012ff
mov ecx, r9d
and ecx, 0x3f
shl ecx, 2
cmp r10, r11
jae 0x140001238
movzx eax, byte [r10 + r8]
movzx r9d, byte [rax + rsi]
cmp r9d, 0x40
jbe 0x140001238
inc r10
cmp r10, r11
jb 0x140001220
cmp byte [r10 + r8], 0x3d
je 0x1400012ff
mov rax, r10
inc r10
cmp rax, r11
jae 0x1400012ff
cmp rdx, rbx
jae 0x140001268
mov eax, r9d
shr eax, 4
and al, 3
or al, cl
inc rdx
mov byte [rdx + rdi - 1], al
cmp r10, r11
jae 0x1400012ff
mov ecx, r9d
and ecx, 0xf
shl ecx, 4
nop word [rax + rax]
movzx eax, byte [r10 + r8]
cmp al, 0x3d
je 0x140001297
movzx eax, al
movzx r9d, byte [rax + rsi]
cmp r9d, 0x40
ja 0x140001280
cmp byte [r10 + r8], 0x3d
je 0x1400012ff
inc r10
cmp rdx, rbx
jae 0x1400012b7
mov eax, r9d
shr eax, 2
and al, 0xf
or al, cl
inc rdx
mov byte [rdx + rdi - 1], al
cmp r10, r11
jae 0x1400012ff
mov ecx, r9d
and ecx, 3
shl ecx, 6
movzx eax, byte [r10 + r8]
cmp al, 0x3d
je 0x1400012dc
movzx eax, al
movzx r9d, byte [rax + rsi]
cmp r9d, 0x40
ja 0x1400012c5
cmp byte [r10 + r8], 0x3d
je 0x1400012ff
inc r10
cmp rdx, rbx
jae 0x1400012f6
or r9b, cl
inc rdx
mov byte [rdx + rdi - 1], r9b
cmp r10, r11
jb 0x1400011d0
mov rsi, qword [rsp + 0x18]
cmp rdx, rbx
mov rbx, qword [rsp + 0x10]
mov rax, rdx
jae 0x140001315
mov byte [rdx + rdi], 0
pop rdi
ret
Function at 0x1400043b0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
push rbx
push rbp
push rdi
sub rsp, 0x650
mov rbx, rdx
mov qword [rax + 0x10], 0
lea rax, [rax + 0x10]
mov qword [rsp + 0x38], rdx
mov rbp, rcx
lea rdx, [rsp + 0x30]
mov edi, 1
xor r9d, r9d
xor r8d, r8d
mov ecx, ebx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], edi
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x140004547
jns 0x140004415
lea rdx, str.redis:select___failed_n
xor ecx, ecx
call fcn.14000e460
mov ecx, edi
call fcn.1400272ac
int3
cmp eax, edi
je 0x14000442f
lea rdx, str.redis:select___failed_n
xor ecx, ecx
call fcn.14000e460
mov ecx, edi
call fcn.1400272ac
int3
lea rdx, [rsp + 0x240]
xor r9d, r9d
mov r8d, 0x400
mov rcx, rbx
mov qword [rsp + 0x670], rsi
call qword [sym.imp.WS2_32.dll_recv]
movsxd rsi, eax
test eax, eax
jne 0x14000446e
lea rdx, str.redis:recv___failed_n
xor ecx, ecx
call fcn.14000e460
mov ecx, edi
call fcn.1400272ac
int3
mov ebx, dword [rbp + 0x1a0]
mov qword [rsp + 0x680], r12
xor r12d, r12d
mov qword [rsp + 0x648], r13
mov qword [rsp + 0x640], r15
test eax, eax
je 0x14000451f
lea r13, [rsp + 0x240]
lea r15, [0x140000000]
cmp ebx, 7
ja case.0x1400044bc.5
mov eax, ebx
mov ecx, dword [r15 + rax*4 + 0x462c]
add rcx, r15
jmp rcx
movzx eax, byte [r13]
cmp al, 0x2b
je 0x1400044d3
cmp al, 0x3a
jne 0x140004554
mov ebx, edi
jmp 0x140004511
mov ebx, 2
jmp 0x140004511
movzx ecx, byte [r13]
call fcn.1400290cc
test eax, eax
jne 0x140004511
movzx eax, byte [r13]
cmp al, 0xd
je 0x140004511
cmp al, 0xa
jne 0x140004591
mov rax, qword [rbp + 0x198]
xor ebx, ebx
test rax, rax
je 0x14000457b
dec rax
mov qword [rbp + 0x198], rax
inc r12d
inc r13
mov eax, r12d
cmp rax, rsi
jb 0x1400044a6
mov dword [rbp + 0x1a0], ebx
xor edi, edi
mov r13, qword [rsp + 0x648]
mov r12, qword [rsp + 0x680]
mov r15, qword [rsp + 0x640]
mov rsi, qword [rsp + 0x670]
mov eax, edi
add rsp, 0x650
pop rdi
pop rbp
pop rbx
ret
mov eax, r12d
lea r9, [rsp + r12 + 0x240]
lea rdx, str.redis:_unexpected_data:__.s_n
sub rsi, rax
xor ecx, ecx
mov r8, rsi
call fcn.14000e460
mov ecx, edi
call fcn.1400272ac
int3
lea rdx, str.redis:_out_of_sync_n
xor ecx, ecx
call fcn.14000e460
mov ecx, edi
call fcn.1400272ac
int3
mov eax, r12d
lea r9, [rsp + r12 + 0x240]
lea rdx, str.redis:_unexpected_data:__.s_n
sub rsi, rax
xor ecx, ecx
mov r8, rsi
call fcn.14000e460
mov ecx, edi
call fcn.1400272ac
int3
movzx edx, byte [rsp + r12 + 0x240]
lea r9, [rsp + r12 + 0x240]
lea eax, [r12 - 2]
movsx eax, byte [rax + r15 + 0x49570]
mov r8d, r12d
cmp eax, edx
jne 0x1400045f4
inc ebx
cmp dl, 0xa
jne case.0x1400044bc.5
mov dword [rbp + 0x1a0], 0
jmp 0x140004527
sub rsi, r8
lea rdx, str.redis:_unexpected_data:__.s_n
xor ecx, ecx
mov r8, rsi
call fcn.14000e460
mov ecx, edi
call fcn.1400272ac
int3
lea rdx, str.redis:_unexpected_state:__u_n
mov r8d, ebx
xor ecx, ecx
call fcn.14000e460
mov ecx, edi
call fcn.1400272ac
int3
Function at 0x1400095a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
movzx eax, byte [rcx]
mov r11, rdx
mov rbx, rcx
not rax
lea rdi, [0x1400588d0]
mov r10d, recv
movzx r8d, al
mov r9d, dword [rdi + r8*4]
movzx r8d, byte [rcx + 1]
movzx ecx, byte [rcx + 2]
xor r9d, 0xffffff
mov eax, r9d
shr r9d, 8
xor r8, rax
movzx eax, r8b
mov edx, dword [rdi + rax*4]
xor edx, r9d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rbx + 3]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rbx + 4]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rbx + 5]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rbx + 6]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rbx + 7]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
mov edx, dword [rdi + rax*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov r9d, dword [rdi + rcx*4]
xor r9d, r8d
cmp r11, r10
jbe 0x1400096e5
lea r8, [rbx + 0xc]
nop word [rax + rax]
movzx ecx, byte [r8]
mov eax, r9d
inc r10d
xor rcx, rax
shr eax, 8
inc r8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
mov eax, r10d
cmp rax, r11
jb 0x1400096c0
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
not r9d
mov eax, r9d
movzx ecx, r9b
shr eax, 8
shl ecx, 8
movzx eax, al
or eax, ecx
mov ecx, r9d
shr r9d, 0x18
shl eax, 8
shr ecx, 0x10
movzx edx, cl
or eax, edx
shl eax, 8
or eax, r9d
ret
Function at 0x140017030
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov edi, dword [rcx + 0x130]
mov rsi, rdx
mov rbx, rcx
shr edi, 6
and edi, 1
cmp dword [rcx + 0xe0], 0x100
jne 0x140017137
mov rdi, qword [rcx + 0x190]
cmp rdi, 1
jge 0x14001711f
xor eax, eax
mov ebp, 2
xor r8d, r8d
lea edx, [rax + 1]
mov ecx, ebp
mov word [rsp + 0x40], ax
mov qword [rsp + 0x42], rax
mov dword [rsp + 0x4a], eax
mov word [rsp + 0x4e], ax
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400170bf
lea rdx, str.redis:_socket___failed_to_create_socket_n
xor ecx, ecx
call fcn.14000e460
lea ecx, [rbp - 1]
call fcn.1400272ac
int3
mov ecx, dword [rbx + 0x188]
call qword [sym.imp.WS2_32.dll_htonl]
movzx ecx, word [rbx + 0x18c]
mov dword [rsp + 0x44], eax
call qword [sym.imp.WS2_32.dll_htons]
lea rdx, [rsp + 0x40]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rdi
mov word [rsp + 0x40], bp
mov word [rsp + 0x42], ax
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x140017118
lea rdx, str.redis:_connect___failed_n
xor ecx, ecx
call fcn.14000e460
lea rcx, str.connect
call fcn.1400273b0
mov qword [rbx + 0x190], rdi
mov rax, qword [rbx + 0xd8]
mov rdx, rdi
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, rdi
jmp 0x1400171e2
cmp byte [rdx], 0x2d
jne 0x140017151
cmp byte [rdx + 1], 0
jne 0x140017151
call fcn.1400269ec
add rax, 0x30
jne 0x14001720a
xor eax, eax
mov ebp, 2
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea r8d, [rax + 7]
mov edx, 0x40000004
mov rcx, rsi
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x1400171a2
mov edx, 0x140
mov rcx, rax
call fcn.140029c50
cmp eax, 0xffffffff
jne 0x1400171f7
lea rcx, str._open_osfhandle
call fcn.1400273b0
lea rax, str.appending
lea rbx, str.writing
test edi, edi
cmovne rbx, rax
call fcn.1400269ec
lea rdx, str.out:_could_not_open_file_for__s_n
lea rcx, [rax + 0x60]
mov r8, rbx
call fcn.140026c00
mov rcx, rsi
call fcn.1400273b0
mov dword [0x1400daef4], 1
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
lea rdx, [0x140049af0]
mov ecx, eax
call fcn.140029d4c
test rax, rax
je 0x1400171a2
or dword [rbx + 0xf0], 1
jmp 0x1400171e2
Function at 0x14001a8e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x10
xor eax, eax
mov r10, rcx
lea r9, [rsp + 1]
mov qword [rsp], rax
mov qword [rsp + 8], rax
or r8d, 0xffffffff
mov dword [rsp + 4], 0x6765744c
mov dword [rsp + 0xc], 0xf0a577f
lea r11d, [rax + 4]
lea rbx, [0x14003ff20]
movzx ecx, byte [r9 - 1]
mov eax, r8d
shr r8d, 8
xor rcx, rax
add r9, 4
movzx eax, cl
mov edx, dword [rbx + rax*4]
movzx eax, byte [r9 - 4]
xor edx, r8d
mov ecx, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 3]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 2]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov r8d, dword [rbx + rax*4]
xor r8d, edx
dec r11
jne 0x14001a921
not r8d
lea r11, [rsp]
lea rbx, [rsp + 1]
mov eax, r8d
lea rdi, [rsp + 2]
lea rsi, [rsp + 3]
shr eax, 0x18
mov byte [rsp], r8b
sub r11, r10
mov byte [rsp + 3], al
mov eax, r8d
sub rbx, r10
shr eax, 0x10
sub rdi, r10
sub rsi, r10
mov byte [rsp + 2], al
mov eax, r8d
xor r8d, r8d
shr eax, 8
mov r9d, 0x66747032
mov byte [rsp + 1], al
cmp r8, 0x10
jae 0x14001aa29
lea rdx, [r8 + r10]
mov ecx, r9d
add r8, 4
movzx eax, byte [r11 + rdx]
shr ecx, 8
xor al, r9b
mov byte [rdx], al
movzx eax, byte [rbx + rdx]
xor al, cl
mov ecx, r9d
mov byte [r8 + r10 - 3], al
movzx eax, byte [rdi + rdx]
shr ecx, 0x10
xor al, cl
mov ecx, r9d
mov byte [r8 + r10 - 2], al
movzx eax, byte [rsi + rdx]
shr ecx, 0x18
xor al, cl
rol r9d, 1
mov byte [r8 + r10 - 1], al
cmp r8, 0x10
jb 0x14001a9db
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov eax, reloc.WS2_32.dll_recv
add rsp, 0x10
pop rdi
ret