joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020850
Capabilities:
Hash data using sha512

Disassembly:
push rdi
mov r8, rcx
test rdx, rdx
je 0x1400209e3
test rcx, rcx
je 0x1400209e3
lea r9, [rcx + 0x40]
xor eax, eax
movabs r10, 0x6a09e667f3bcc908
mov rdi, r9
mov ecx, 0x16
movabs r9, 0x3c6ef372fe94f82b
rep stosq qword [rdi], rax
mov qword [r8], r10
mov rax, rdx
movabs r10, 0xa54ff53a5f1d36f1
mov qword [r8 + 0x10], r9
not rax
movabs r9, 0x510e527fade682d1
movabs r11, 0xbb67ae8584caa73b
mov qword [r8 + 0x18], r10
add rax, r8
movabs r10, 0x9b05688c2b3e6c1f
mov qword [r8 + 0x20], r9
movabs r9, 0x1f83d9abfb41bd6b
mov qword [r8 + 0x28], r10
movabs r10, 0x5be0cd19137e2179
mov qword [r8 + 8], r11
mov qword [r8 + 0x30], r9
mov qword [r8 + 0x38], r10
cmp rax, 0x1e
jbe 0x140020950
vmovdqu xmm1, xmmword [rdx]
vinsertf128 ymm0, ymm1, xmmword [rdx + 0x10], 1
vxorps ymm0, ymm0, ymmword [0x140172b40]
vmovdqu xmmword [r8], xmm0
vextractf128 xmmword [r8 + 0x10], ymm0, 1
vmovdqu xmm2, xmmword [rdx + 0x20]
vinsertf128 ymm0, ymm2, xmmword [rdx + 0x30], 1
vxorps ymm0, ymm0, ymmword [0x140172b60]
vmovdqu xmmword [r8 + 0x20], xmm0
vextractf128 xmmword [r8 + 0x30], ymm0, 1
vzeroupper
movzx eax, byte [rdx]
mov dword [r8 + 0xe4], eax
xor eax, eax
pop rdi
ret
movabs rax, 0x6a09e667f3bcc908
xor rax, qword [rdx]
mov qword [r8], rax
movabs rax, 0xbb67ae8584caa73b
xor rax, qword [rdx + 8]
mov qword [r8 + 8], rax
movabs rax, 0x3c6ef372fe94f82b
xor rax, qword [rdx + 0x10]
mov qword [r8 + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
xor rax, qword [rdx + 0x18]
mov qword [r8 + 0x18], rax
movabs rax, 0x510e527fade682d1
xor rax, qword [rdx + 0x20]
mov qword [r8 + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
xor rax, qword [rdx + 0x28]
mov qword [r8 + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
xor rax, qword [rdx + 0x30]
mov qword [r8 + 0x30], rax
movabs rax, 0x5be0cd19137e2179
xor rax, qword [rdx + 0x38]
mov qword [r8 + 0x38], rax
jmp 0x140020938
mov eax, 0xffffffff
pop rdi
ret

Function at 0x1400209f0
Capabilities:
Hash data using sha512

Disassembly:
push rdi
sub rsp, 0x40
mov r8, rcx
test rcx, rcx
je 0x140020ace
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x140020ab5
lea r9, [rcx + 0x40]
xor eax, eax
mov ecx, 0x16
mov qword [rsp + 9], 0
movabs r10, 0x510e527fade682d1
mov rdi, r9
movabs r11, 0x9b05688c2b3e6c1f
mov qword [rsp + 0x12], 0
rep stosq qword [rdi], rax
mov qword [r8 + 0x20], r10
movabs r9, 0x1f83d9abfb41bd6b
movabs r10, 0x5be0cd19137e2179
mov byte [rsp], dl
mov qword [rsp + 1], 0x10100
vmovdqu xmm1, xmmword [rsp]
mov byte [rsp + 0x11], 0
mov qword [rsp + 0x18], 0
vinsertf128 ymm0, ymm1, xmmword [rsp + 0x10], 1
vxorps ymm0, ymm0, ymmword [0x140172b40]
vextractf128 xmmword [r8 + 0x10], ymm0, 1
mov qword [r8 + 0x28], r11
mov qword [r8 + 0x30], r9
mov qword [r8 + 0x38], r10
vmovdqu xmmword [r8], xmm0
mov dword [r8 + 0xe4], edx
vzeroupper
add rsp, 0x40
pop rdi
ret
cmp byte [rcx + 0xe8], 0
je 0x140020ac6
mov qword [rcx + 0x58], 0xffffffffffffffff
mov qword [r8 + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
jmp 0x140020aaf
Function at 0x140020d50
Capabilities:
Hash data using sha512

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0xe0
mov r10, r8
mov rbx, rcx
mov r8, r9
test rcx, rcx
je 0x140020e87
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x140020e6e
lea rax, [r9 - 1]
cmp rax, 0x3f
ja 0x140020e6e
test r10, r10
je 0x140020e6e
mov qword [rsp + 0x32], 0
mov ecx, r9d
movzx eax, dl
movabs rsi, 0x510e527fade682d1
mov qword [rsp + 0x2a], 0
lea r9, [rbx + 0x40]
mov ah, cl
mov ecx, 0x16
mov word [rsp + 0x20], ax
mov rdi, r9
xor eax, eax
rep stosq qword [rdi], rax
lea r9, [rsp + 0x60]
mov ecx, 0x10
movabs rdi, 0x9b05688c2b3e6c1f
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x22], 0x101
mov qword [rbx + 0x28], rdi
movabs rdi, 0x5be0cd19137e2179
mov qword [rbx + 0x20], rsi
movabs rsi, 0x1f83d9abfb41bd6b
mov qword [rbx + 0x38], rdi
mov rdi, r9
mov qword [rbx + 0x30], rsi
vmovdqu xmm1, xmmword [rsp + 0x20]
vinsertf128 ymm0, ymm1, xmmword [rsp + 0x30], 1
vxorps ymm0, ymm0, ymmword [0x140172b40]
rep stosq qword [rdi], rax
vmovdqu xmmword [rbx], xmm0
mov rcx, r9
vextractf128 xmmword [rbx + 0x10], ymm0, 1
mov dword [rbx + 0xe4], edx
mov rdx, r10
vzeroupper
call sym.memcpy
mov r8d, pe_nt_image_headers64
mov rcx, rbx
mov rdx, rax
call sym.randomx_blake2b_update
xor eax, eax
add rsp, 0xe0
pop rbx
pop rsi
pop rdi
ret
cmp byte [rbx + 0xe8], 0
je 0x140020e7f
mov qword [rbx + 0x58], 0xffffffffffffffff
mov qword [rbx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
jmp 0x140020e63
Function at 0x1400221f0
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
movabs r9, 0x8126b91cbf22495c
movabs r10, 0x84853bf7b62ce54e
lea rax, [r8 + 1]
mov rbp, rcx
mov r12, rdx
movabs rcx, 0x5851f42d4c957f2d
mov rdx, r8
movabs r8, 0xa77099df38c2d846
imul rax, rcx
movabs rcx, 0x810a978a59f5a1fc
lea r14, [rbp + 0x28]
lea rdi, [rbp + 0x8368]
lea rsi, [rsp + 0x20]
lea r13, [rsp + 0x60]
xor rcx, rax
xor r8, rax
vmovq xmm3, rax
xor r9, rax
vmovq xmm2, r8
vpinsrq xmm0, xmm3, rcx, 1
movabs r8, 0x2f2a56746ce62d78
movabs rcx, 0x494d2597179f8a62
vpinsrq xmm1, xmm2, r9, 1
xor r8, rax
movabs r9, 0x9237efb9ceaaec0c
xor rcx, rax
xor r9, rax
xor rax, r10
vinsertf128 ymm0, ymm0, xmm1, 1
vmovq xmm4, r8
vmovq xmm5, rcx
vmovdqu xmmword [rsp + 0x20], xmm0
vextractf128 xmmword [rsp + 0x30], ymm0, 1
vpinsrq xmm1, xmm4, rax, 1
vpinsrq xmm0, xmm5, r9, 1
vinsertf128 ymm0, ymm0, xmm1, 1
vmovdqu xmmword [rsp + 0x40], xmm0
vextractf128 xmmword [rsp + 0x50], ymm0, 1
vzeroupper
mov rbx, qword [rbp]
and edx, 0x3fffff
mov r8, rdi
mov rcx, rsi
shl rdx, 6
add rbx, rdx
mov rdx, r14
prefetchnta byte [rbx]
call dbg.randomx::executeSuperscalar(unsigned long long (&) [8], randomx::SuperscalarProgram&, std::vector<unsigned long long, std::allocator<unsigned long long> >*)
mov rdx, rbx
mov rax, rsi
nop dword [rax + rax]
mov rcx, qword [rdx]
add rdx, 8
xor qword [rax], rcx
add rax, 8
cmp r13, rax
jne 0x140022310
movsxd rax, dword [r14 + 0x1004]
add r14, 0x1068
mov rdx, qword [rsp + rax*8 + 0x20]
cmp r14, rdi
jne 0x1400222e0
vmovdqu xmm2, xmmword [rsp + 0x20]
vmovdqu xmm3, xmmword [rsp + 0x30]
vmovdqu xmm4, xmmword [rsp + 0x40]
vmovdqu xmmword [r12], xmm2
vmovdqu xmm5, xmmword [rsp + 0x50]
vmovdqu xmmword [r12 + 0x10], xmm3
vmovdqu xmmword [r12 + 0x20], xmm4
vmovdqu xmmword [r12 + 0x30], xmm5
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x140028c50
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov r8d, 0x40
lea r9, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140028c70
add rsp, 0x38
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
add rsp, 0x38
ret
Function at 0x14005abe0
Capabilities:
Encode data using base64

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov rax, qword [r9 + 0xa8]
mov r11, rcx
cmp qword [r9 + 0xa0], rax
jae 0x14005ae1b
mov rax, qword [r9 + 0x98]
movzx esi, word [0x140176090]
xor r10d, r10d
lea rcx, [0x140175fa0]
jmp 0x14005ad10
cmp rdx, 1
jbe 0x14005ad27
sub rdx, 2
mov word [r11], si
lea rbx, [r11 + 2]
add r10, 2
mov qword [r9 + 0x98], 0
cmp rdx, 3
jbe 0x14005ad27
mov r11, qword [r9 + 0xa0]
mov rax, qword [r9 + 0xa8]
sub rax, r11
cmp rax, 2
jbe 0x14005ad40
movsx eax, byte [r9 + r11 + 0xb0]
add r10, 4
sub rdx, 4
movzx edi, byte [r9 + r11 + 0xb1]
shl eax, 8
movzx eax, ax
or eax, edi
lea rdi, [r11 + 3]
mov qword [r9 + 0xa0], rdi
shl eax, 8
movzx r12d, byte [r9 + r11 + 0xb2]
lea r11, [rbx + 4]
mov edi, eax
or r12d, eax
shr eax, 0xc
mov r13d, r12d
and r12d, 0x3f
mov ebp, eax
shr edi, 0x12
sar r13d, 6
movzx eax, byte [rcx + r12]
and ebp, 0x3f
movzx edi, byte [rcx + rdi]
and r13d, 0x3f
movzx ebp, byte [rcx + rbp]
movzx r12d, byte [rcx + r13]
shl eax, 8
or eax, r12d
shl eax, 8
or eax, ebp
shl eax, 8
or eax, edi
mov dword [rbx], eax
mov rax, qword [r9 + 0x98]
mov rbx, qword [r9 + 0xa8]
add rax, 4
mov qword [r9 + 0x98], rax
cmp qword [r9 + 0xa0], rbx
jae 0x14005ae00
cmp rax, 0x48
ja 0x14005ac20
mov rbx, r11
cmp rdx, 3
ja 0x14005ac4f
test r10, r10
je 0x14005ae2d
mov rax, r10
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test r8b, r8b
je 0x14005ad30
mov eax, 0x3d3d
mov word [rbx + 2], ax
mov rax, qword [r9 + 0xa8]
mov rcx, qword [r9 + 0xa0]
cmp rax, rcx
je 0x14005ad30
sub rax, rcx
xor edx, edx
cmp rax, 2
jne 0x14005ad7b
movsx edx, byte [r9 + rcx + 0xb1]
shl edx, 8
movzx edx, dx
movsx eax, byte [r9 + rcx + 0xb0]
lea r8, [0x140175fa0]
xor ecx, ecx
shl eax, 0x10
and eax, 0xff0000
or edx, eax
shr eax, 0x12
mov cl, byte [r8 + rax]
mov eax, edx
sar eax, 0xc
and eax, 0x3f
movzx eax, byte [r8 + rax]
mov ch, al
mov word [rbx], cx
mov rax, qword [r9 + 0xa0]
add rax, 1
mov qword [r9 + 0xa0], rax
cmp rax, qword [r9 + 0xa8]
je 0x14005ade1
sar edx, 6
and edx, 0x3c
movzx eax, byte [r8 + rdx]
mov byte [rbx + 2], al
add qword [r9 + 0xa0], 1
add qword [r9 + 0x98], 4
add r10, 4
mov rax, r10
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test r8b, r8b
je 0x14005ad30
cmp rdx, 3
jbe 0x14005ad27
mov rbx, r11
jmp 0x14005ad45
xor r10d, r10d
test r8b, r8b
je 0x14005ad30
cmp rdx, 3
ja 0x14005ae13
mov r10, 0xfffffffffffffffe
mov rax, r10
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x14005b430
Capabilities:
Read file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rdi, rdx
mov rbx, r9
test r8, r8
je 0x14005b460
mov r9, qword [r9 + 0x40]
test r9, r9
je 0x14005b470
mov rdx, rdi
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp sym.fread
mov rax, 0xfffffffffffffffe
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov rcx, qword [rbx + 0x18]
lea rdx, [0x1401759c1]
mov qword [rsp + 0x28], r8
call sym.curlx_win32_fopen
mov r8, qword [rsp + 0x28]
test rax, rax
mov qword [rbx + 0x40], rax
mov r9, rax
jne 0x14005b44e
mov rax, 0xffffffffffffffff
jmp 0x14005b467
Function at 0x140060600
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x40
mov r8d, 0x1008
mov edx, 0xffff
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 4
mov rbx, rcx
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14006063b
cmp dword [rsp + 0x38], 1
je 0x140060648
add rsp, 0x40
pop rbx
ret
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
nop
add rsp, 0x40
pop rbx
ret

Function at 0x1400662f0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
sub rsp, 0x20
mov r8d, 4
mov rbx, rdx
call sym.Curl_ssl_random
cmp eax, 4
jne 0x14006632d
cmp byte [0x1401bbd64], 0
je 0x140066338
imul eax, dword [0x1401bbd60], 0x41c64e6d
add eax, 0x3039
mov dword [0x1401bbd60], eax
rol eax, 0x10
mov dword [rbx], eax
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov dword [rbx], 0
xor ecx, ecx
mov r9d, 2
mov rdx, rbx
mov r8d, 4
call sym.BCryptGenRandom
test eax, eax
setne al
movzx eax, al
add eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140066370
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
mov r8, rdx
xor edx, edx
call sym.memset
xor ecx, ecx
mov r9d, 2
mov r8d, ebx
mov rdx, rax
call sym.BCryptGenRandom
test eax, eax
setne al
movzx eax, al
add eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140066580
Capabilities:
Move file

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movups xmmword [rsp + 0x40], xmm6
lea rbx, [rsp + 0x30]
mov rdi, rcx
lea r12, [rsp + 0x20]
mov rsi, rdx
mov rcx, rbx
call sym.Curl_now
mov rcx, rdi
movdqu xmm6, xmmword [rsp + 0x30]
call sym.strdup
mov rcx, rsi
mov rdi, rax
call sym.strdup
mov rbp, qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov rsi, rax
jmp 0x140066600
mov rcx, rbx
call sym.Curl_now
mov rdx, r12
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm6
call sym.Curl_timediff
cmp rax, 0x3e8
ja 0x140066640
mov ecx, 1
call r13
mov r8d, 1
mov rdx, rsi
mov rcx, rdi
call rbp
test eax, eax
je 0x1400665d8
test rdi, rdi
je 0x14006661f
mov rcx, rdi
call sym.free
test rsi, rsi
je 0x14006662c
mov rcx, rsi
call sym.free
xor eax, eax
movups xmm6, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test rdi, rdi
je 0x14006664d
mov rcx, rdi
call sym.free
test rsi, rsi
je 0x14006665a
mov rcx, rsi
call sym.free
mov eax, 1
jmp 0x14006662e
Function at 0x140067290
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1400672d0
test edx, edx
je 0x1400672d0
mov r9d, edx
mov rax, rcx
shl r9, 4
add r9, rcx
jmp 0x1400672b9
add rax, 0x10
cmp rax, r9
je 0x1400672d0
cmp qword [rax], 0xffffffffffffffff
je 0x1400672b0
add rsp, 0x28
jmp sym.Curl_poll.part.0
test r8, r8
je 0x1400672ec
js 0x1400672f3
mov eax, 0xfffffffe
cmp r8, rax
cmovle rax, r8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x28
ret
mov ecx, 0x2726
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, 0xffffffff
jmp 0x1400672ee

Function at 0x14006bfb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test rcx, rcx
mov r11, rcx
setne al
test rdx, rdx
setne r8b
xor r10d, r10d
or r11, rdx
sete r10b
and al, r8b
mov r9d, eax
jne 0x14006bfe0
mov eax, r10d
ret
movzx r8d, byte [rcx]
lea r10, [0x140178080]
test r8b, r8b
jne 0x14006c030
movzx eax, byte [rdx]
xor r9d, r9d
test al, al
sete r10b
xor r10d, r9d
movzx r10d, r10b
mov eax, r10d
ret
movzx eax, byte [r10 + rax]
cmp byte [r10 + r8], al
jne 0x14006c040
movzx r8d, byte [rcx + 1]
add rcx, 1
lea rax, [rdx + 1]
test r8b, r8b
je 0x14006c048
mov rdx, rax
movzx eax, byte [rdx]
test al, al
jne 0x14006c010
jmp 0x14006bff6
xor r10d, r10d
jmp 0x14006bfd2
movzx eax, byte [rdx + 1]
xor r9d, r9d
jmp 0x14006bff6

Function at 0x14006c480
Capabilities:
Get common file path

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x14006c5d0
lea rdx, str.LoadLibraryExA
mov rcx, rax
mov r12, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call r12
lea rdx, [0x140178198]
mov rcx, rsi
mov rdi, rax
call sym.strpbrk
mov rbp, rax
test rax, rax
je 0x14006c500
test rdi, rdi
je 0x14006c520
mov r8d, 8
xor edx, edx
mov rcx, rsi
mov rax, rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp rax
test rdi, rdi
je 0x14006c540
lea rdx, str.AddDllDirectory
mov rcx, rbx
call r12
test rax, rax
je 0x14006c540
mov r8d, 0x800
jmp 0x14006c4e1
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r13, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor edx, edx
xor ecx, ecx
call r13
mov ebx, eax
test eax, eax
je 0x14006c5d0
mov rcx, rsi
call sym.strlen
lea ecx, [rbx + 1]
add rcx, rax
mov rax, qword [0x140186a50]
call qword [rax]
mov r12, rax
test rax, rax
je 0x14006c5ae
mov edx, ebx
mov rcx, rax
call r13
test eax, eax
je 0x14006c5ae
mov rcx, r12
call sym.strlen
mov rdx, rsi
mov byte [r12 + rax], 0x5c
lea rcx, [r12 + rax + 1]
call sym.strcpy
test rdi, rdi
je 0x14006c5e2
mov r8d, 8
xor edx, edx
mov rcx, r12
call rdi
mov rbp, rax
mov rax, qword [0x140186a40]
mov rcx, r12
call qword [rax]
mov rax, rbp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor ebp, ebp
mov rax, rbp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
jmp 0x14006c5ae
Function at 0x14006c5f0
Capabilities:
Initialize winsock library

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x1d0
and ecx, 2
je 0x14006c632
lea rdx, [rsp + 0x30]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14006c746
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x14006c740
shr ax, 8
cmp ax, 2
jne 0x14006c740
call sym.Curl_sspi_global_init
mov ebx, eax
test eax, eax
je 0x14006c650
mov eax, ebx
add rsp, 0x1d0
pop rbx
pop rsi
pop rdi
ret
lea rcx, str.iphlpapi.dll
call sym.Curl_load_library
mov qword [0x1401bbda0], rax
test rax, rax
je 0x14006c684
lea rdx, str.if_nametoindex
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14006c684
mov qword [0x1401bbd88], rax
lea rcx, str.ws2_32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x14006c6d9
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FreeAddrInfoExW
mov rcx, rax
call rdi
lea rdx, str.GetAddrInfoExCancel
mov rcx, rsi
mov qword [0x1401bbd80], rax
call rdi
lea rdx, str.GetAddrInfoExW
mov rcx, rsi
mov qword [0x1401bbd78], rax
call rdi
mov qword [0x1401bbd70], rax
xor r8d, r8d
xor edx, edx
mov r9d, 2
mov ecx, 6
mov dword [rsp + 0x20], 3
call sym.curlx_verify_windows_version
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
mov edx, 2
mov ecx, 6
mov byte [0x1401bbd91], al
call sym.curlx_verify_windows_version
lea rcx, [0x1401bbd98]
mov byte [0x1401bbd90], al
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, ebx
add rsp, 0x1d0
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ebx, 2
mov eax, ebx
add rsp, 0x1d0
pop rbx
pop rsi
pop rdi
ret
Function at 0x1400754b0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call sym.read
cdqe
add rsp, 0x28
ret
Function at 0x1400787c0
Capabilities:
Convert ip address from string

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, qword [rdx + 0x10]
mov rax, qword [rdx + 0x18]
mov rbx, rcx
lea rcx, str.SSL_PROXY
cmp qword [rdx], rcx
je 0x140078888
mov rdi, qword [rax + 0x50]
mov r13, qword [rax + 0x58]
mov r12d, dword [rax + 0x544]
test rdi, rdi
je 0x140078870
mov rdx, qword [rbx]
test rdx, rdx
je 0x140078811
mov rcx, rdi
call sym.strcmp
test eax, eax
je 0x140078870
mov rcx, rbx
call sym.Curl_ssl_peer_cleanup
mov r14, qword [0x140186a70]
mov rcx, rdi
call qword [r14]
mov qword [rbx], rax
mov rsi, rax
test rax, rax
je 0x1400789a0
test r13, r13
je 0x140078849
mov rdx, r13
mov rcx, rdi
call sym.strcmp
test eax, eax
jne 0x1400788a8
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], 0
cmp byte [rsi], 0
jne 0x140078920
mov dword [rbx + 0x18], 0
cmp byte [rsi], 0
jne 0x1400788d0
nop word [rax + rax]
mov dword [rbp + 0x50], r12d
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdi, qword [rax + 0xd8]
mov r13, qword [rax + 0xe0]
mov r12d, dword [rax + 0xe8]
jmp 0x1400787f8
mov rcx, r13
call qword [r14]
mov qword [rbx + 8], rax
test rax, rax
je 0x1400789a0
mov rsi, qword [rbx]
mov qword [rbx + 0x10], 0
test rsi, rsi
je 0x14007885e
jmp 0x140078855
mov rcx, rsi
call sym.strlen
mov rdi, rax
test rax, rax
jne 0x140078950
mov edx, 1
mov rax, qword [0x1401869f0]
mov ecx, 1
call qword [rax]
mov qword [rbx + 0x10], rax
mov rcx, rax
test rax, rax
je 0x1400789a0
mov rdx, qword [rbx]
mov r8, rdi
call sym.Curl_strntolower
mov rax, qword [rbx + 0x10]
mov byte [rax + rdi], 0
jmp 0x140078870
lea r13, [rsp + 0x20]
mov rdx, rsi
mov ecx, 2
mov rdi, qword [sym.imp.WS2_32.dll_inet_pton]
mov r8, r13
call rdi
mov edx, 1
test eax, eax
je 0x140078978
mov dword [rbx + 0x18], edx
jmp 0x140078870
lea rax, [rax - 1]
cmp byte [rsi + rdi - 1], 0x2e
cmovne rax, rdi
cmp rax, 0xfffe
ja 0x140078870
lea rdx, [rax + 1]
mov rdi, rax
jmp 0x1400788e5
mov r8, r13
mov rdx, rsi
mov ecx, 0x17
call rdi
test eax, eax
jne 0x1400789b8
mov dword [rbx + 0x18], 0
mov rsi, qword [rbx]
jmp 0x140078865
mov rcx, rbx
call sym.Curl_ssl_peer_cleanup
mov eax, 0x1b
jmp 0x140078876
mov edx, 2
jmp 0x140078942
Function at 0x140079190
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea r8, [0x140179020]
mov edx, 0xc
mov r9d, dword [rcx + 0x84]
mov rdi, qword [rcx + 0xe8]
lea rsi, [rsp + 0x24]
mov rbx, rcx
mov rcx, rsi
call sym.curl_msnprintf
mov rcx, qword [rbx + 0x88]
mov rdx, rsi
lea r9, [rbx + 0xb0]
lea r8, [rbx + 0xb8]
call sym.Curl_getaddrinfo_ex
mov esi, eax
test eax, eax
jne 0x140079290
mov rcx, qword [rbx + 0x78]
call sym.pthread_mutex_lock
mov eax, dword [rbx + 0x80]
test eax, eax
jne 0x140079260
mov rcx, qword [rbx + 0xa0]
cmp rcx, 0xffffffffffffffff
jne 0x140079230
mov dword [rbx + 0x80], 1
mov rcx, qword [rbx + 0x78]
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor r9d, r9d
mov byte [rsp + 0x23], 1
lea rdx, [rsp + 0x23]
mov r8d, 1
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140079209
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rbx + 0xa8], eax
jmp 0x140079209
mov rcx, qword [rbx + 0x78]
call sym.pthread_mutex_unlock
mov rcx, rbx
call sym.destroy_thread_sync_data
mov rax, qword [0x140186a40]
mov rcx, rdi
call qword [rax]
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rbp, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbp
test eax, eax
jne 0x1400792b0
mov dword [rbx + 0xa8], esi
jmp 0x1400791e9
call rbp
mov edx, 8
test eax, eax
cmove eax, edx
mov dword [rbx + 0xa8], eax
jmp 0x1400791e9
Function at 0x14007fa70
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14007fa88
call sym.Curl_host_is_ipnum
test al, al
je 0x14007fa98
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rcx, rbx
call sym.strlen
mov edx, 0x2e
mov rcx, rbx
mov r8, rax
mov rdi, rax
call sym.Curl_memrchr
test rax, rax
je 0x14007fae0
sub rax, rbx
mov edx, 0x2e
mov rcx, rbx
mov r8, rax
call sym.Curl_memrchr
test rax, rax
je 0x14007fae0
add rax, 1
mov rdx, rax
sub rdx, rbx
mov rbx, rax
sub rdi, rdx
add rdi, rbx
cmp rbx, rdi
jae 0x14007fb50
mov ecx, 0x1505
nop dword [rax]
mov rax, rcx
add rbx, 1
shl rax, 5
lea rsi, [rax + rcx]
movsx ecx, byte [rbx - 1]
call sym.Curl_raw_toupper
movsx rax, al
xor rax, rsi
mov rcx, rax
cmp rdi, rbx
jne 0x14007faf0
movabs rdx, 0x410410410410411
mul rdx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
mov rdx, rax
shl rdx, 6
sub rdx, rax
mov rax, rcx
sub rax, rdx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov eax, 0x1a
jmp 0x14007fa8a
Function at 0x140081a20
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov qword [r9], 0
mov rbp, r9
lea r9, [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r14d, eax
test eax, eax
jne 0x140081b9b
mov rbx, qword [rsp + 0x38]
mov r12, qword [0x140186a50]
xor r15d, r15d
xor r13d, r13d
test rbx, rbx
je 0x140081bf9
mov dword [rsp + 0x2c], eax
nop
mov rcx, qword [rbx + 0x18]
xor esi, esi
test rcx, rcx
je 0x140081a84
call sym.strlen
lea rsi, [rax + 1]
mov eax, dword [rbx + 4]
cmp eax, 2
je 0x140081bb0
mov r14d, 0x1c
cmp eax, 0x17
jne 0x140081b70
cmp qword [rbx + 0x20], 0
je 0x140081b70
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140081b70
cmp rax, r14
jb 0x140081b70
lea rcx, [r14 + rsi + 0x30]
call qword [r12]
mov rdi, rax
test rax, rax
je 0x140081bc0
movdqu xmm0, xmmword [rbx]
mov r9, qword [rbx + 0x20]
lea rcx, [rax + 0x30]
mov dword [rax + 0x10], r14d
mov qword [rax + 0x18], 0
lea r11, [rdi + 0x38]
mov qword [rax + 0x28], 0
and r11, 0xfffffffffffffff8
mov qword [rax + 0x20], rcx
movups xmmword [rax], xmm0
mov rax, qword [r9]
mov qword [rdi + 0x30], rax
mov rax, qword [r9 + r14 - 8]
mov qword [rcx + r14 - 8], rax
mov rax, rcx
sub rax, r11
sub r9, rax
add eax, r14d
and eax, 0xfffffff8
cmp eax, 8
jb 0x140081b40
and eax, 0xfffffff8
xor edx, edx
mov r8d, edx
add edx, 8
mov r10, qword [r9 + r8]
mov qword [r11 + r8], r10
cmp edx, eax
jb 0x140081b2e
test rsi, rsi
je 0x140081b58
add rcx, r14
mov rdx, qword [rbx + 0x18]
mov r8, rsi
mov qword [rdi + 0x18], rcx
call sym.memcpy
test r13, r13
cmove r13, rdi
test r15, r15
je 0x140081b68
mov qword [r15 + 0x28], rdi
mov r15, rdi
nop dword [rax + rax]
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x140081a70
mov rcx, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x2c]
test rcx, rcx
je 0x140081b92
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r13, r13
je 0x140081bf9
mov qword [rbp], r13
mov eax, r14d
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r14d, 0x10
jmp 0x140081a9f
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140081bd0
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rbx, qword [0x140186a40]
test r13, r13
je 0x140081bee
nop dword [rax]
mov rcx, r13
mov r13, qword [r13 + 0x28]
call qword [rbx]
test r13, r13
jne 0x140081be0
xor r13d, r13d
mov r14d, 8
jmp 0x140081b97
mov ecx, 0x2af9
mov r14d, 0x2af9
xor r13d, r13d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
jmp 0x140081b97