joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400559d0
Capabilities:
Encode data using xor

Disassembly:
movsxd rax, edx
cmp rax, 1
jle 0x140055add
lea r8, [rcx + 0x16]
lea r9, [rax - 1]
lea r10, [0x140000000]
nop
movzx ecx, byte [r8 - 3]
movzx eax, byte [r8 - 4]
add r8, 0x10
mov edx, dword [r10 + rcx*4 + 0x1ca470]
xor edx, dword [r10 + rax*4 + 0x1ca070]
movzx eax, byte [r8 - 0x15]
xor edx, dword [r10 + rax*4 + 0x1c9c70]
movzx eax, byte [r8 - 0x16]
xor edx, dword [r10 + rax*4 + 0x1c9870]
mov dword [r8 - 0x16], edx
movzx ecx, byte [r8 - 0xf]
movzx eax, byte [r8 - 0x11]
mov edx, dword [r10 + rcx*4 + 0x1ca470]
xor edx, dword [r10 + rax*4 + 0x1c9c70]
movzx eax, byte [r8 - 0x12]
xor edx, dword [r10 + rax*4 + 0x1c9870]
movzx eax, byte [r8 - 0x10]
xor edx, dword [r10 + rax*4 + 0x1ca070]
mov dword [r8 - 0x12], edx
movzx ecx, byte [r8 - 0xb]
movzx eax, byte [r8 - 0xc]
mov edx, dword [r10 + rcx*4 + 0x1ca470]
xor edx, dword [r10 + rax*4 + 0x1ca070]
movzx eax, byte [r8 - 0xd]
xor edx, dword [r10 + rax*4 + 0x1c9c70]
movzx eax, byte [r8 - 0xe]
xor edx, dword [r10 + rax*4 + 0x1c9870]
mov dword [r8 - 0xe], edx
movzx eax, byte [r8 - 8]
movzx ecx, byte [r8 - 7]
mov edx, dword [r10 + rcx*4 + 0x1ca470]
xor edx, dword [r10 + rax*4 + 0x1ca070]
movzx eax, byte [r8 - 9]
xor edx, dword [r10 + rax*4 + 0x1c9c70]
movzx eax, byte [r8 - 0xa]
xor edx, dword [r10 + rax*4 + 0x1c9870]
dec r9
mov dword [r8 - 0xa], edx
jne 0x1400559f0
xor eax, eax
ret
Function at 0x14005bd40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x18
call fcn.1400035e0
sub rsp, rax
mov rax, qword [0x1401ad1c0]
mov qword [rsp + 8], rax
mov qword [rsp + 0x38], rdi
mov cx, 1
xor r8w, r8w
lea rdi, [0x140000000]
nop
movsx rax, cx
movsx ecx, cx
mov word [rdi + rax*2 + 0x1fbc20], r8w
add ecx, ecx
mov eax, 0x33af3e2f
inc r8w
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13d
sub ecx, edx
cmp r8w, 0x9e
jl 0x14005bd70
cmp cx, 1
jne 0x14005bdf9
mov cx, reloc.mfc110.dll_Ordinal_316
xor r8w, r8w
nop
nop
nop
movsx rax, cx
movsx ecx, cx
mov word [rdi + rax*2 + 0x1fbc20], r8w
add ecx, ecx
mov eax, 0x33af3e2f
inc r8w
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13d
sub ecx, edx
cmp r8w, 0x9e
jl 0x14005bdc0
jmp 0x14005be37
mov r8w, 0x9e
nop
movsx rax, cx
movsx ecx, cx
mov word [rdi + rax*2 + 0x1fbc20], r8w
add ecx, ecx
mov eax, 0x33af3e2f
inc r8w
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13d
sub ecx, edx
cmp r8w, reloc.mfc110.dll_Ordinal_316
jl 0x14005be00
mov r11d, 0x9d
mov qword [rsp + 0x30], rbx
mov word [0x1401fb220], 1
mov word [0x1401fb49a], 0xffff
mov bx, 1
mov r9d, 1
mov r10, r11
movsx ebx, bx
mov eax, 0x33af3e2f
add ebx, ebx
imul ebx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13d
sub ebx, edx
movsx rdx, bx
mov rcx, rdx
neg rcx
movzx eax, word [rdi + rcx*2 + 0x1fbe9c]
mov word [rsp], ax
movzx eax, word [rdi + rcx*2 + 0x1fbe98]
xor cx, cx
mov word [rsp + 2], ax
movzx eax, word [rdi + rdx*2 + 0x1fbc1e]
mov word [rsp + 4], ax
movzx eax, word [rdi + rdx*2 + 0x1fbc22]
xor dx, dx
mov word [rsp + 6], ax
nop
nop
nop
nop
movsx rax, dx
movzx r8d, word [rsp + rax*2]
cmp r8w, 0x9e
jge 0x14005befb
movsx rax, cx
imul rax, rax, 0x13d
add rax, r9
inc cx
mov word [rdi + rax*2 + 0x1fb220], r8w
inc dx
cmp cx, 2
jl 0x14005bed0
inc r9
dec r10
jne 0x14005be61
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov ax, reloc.WSOCK32.dll_recv
mov r8d, 0xffff0000
lea r9d, [r10 + 0x10]
mov ecx, r8d
and ecx, r11d
je 0x14005bf37
add r10w, ax
mov r11d, ecx
mov eax, r9d
cdq
sub eax, edx
mov edx, r8d
sar eax, 1
movsx r9d, ax
mov ecx, r9d
shr edx, cl
xor r8d, edx
test ax, ax
jne 0x14005bf28
mov word [0x1401fbc14], r10w
mov rcx, qword [rsp + 8]
call fcn.14006b6a0
add rsp, 0x18
ret
Function at 0x14005c100
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc88
call fcn.1400035e0
sub rsp, rax
xor eax, eax
mov qword [rsp + 0xc98], rbx
mov qword [rsp + 0xca0], rsi
mov qword [r8], rax
mov qword [r8 + 8], rax
mov dword [r8 + 0x10], eax
mov rax, qword [rdx]
mov r9d, dword [rdx + 0x10]
mov qword [rsp + 0xca8], rdi
mov qword [rsp], rax
mov rax, qword [rdx + 8]
mov edi, 0x9d
mov qword [rsp + 8], rax
mov rax, qword [rcx]
mov rsi, r8
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov dword [rsp + 0x10], r9d
mov qword [rsp + 0x28], rax
mov eax, dword [rcx + 0x10]
lea r10, [rsp + 0x34]
mov dword [rsp + 0x30], eax
mov rbx, rdi
nop
nop
nop
nop
mov eax, dword [r10 - 0x14]
mov rdx, r10
mov r11d, 5
mov dword [r10], eax
mov eax, dword [r10 - 0x10]
mov dword [r10 + 4], eax
mov eax, dword [r10 - 0xc]
mov dword [r10 + 8], eax
mov eax, dword [r10 - 8]
mov dword [r10 + 0xc], eax
mov eax, dword [r10 - 4]
mov r8b, al
mov dword [r10 + 0x10], eax
and r8d, 1
shl r8d, 0x1d
nop
nop
mov eax, dword [rdx]
add rdx, 4
mov ecx, eax
shr ecx, 1
or ecx, r8d
mov r8d, eax
mov dword [rdx - 4], ecx
shl r8d, 0x1f
dec r11
jne 0x14005c1c0
and dword [r10], 0x3fffffff
dec rbx
mov r10, rdx
jne 0x14005c180
movsx rax, word [0x1401fb220]
lea r11, [rsp]
mov rdx, rsi
lea rcx, [rax + rax*4]
sub r11, rsi
lea r8, [rsp + rcx*4 + 0x20]
lea ecx, [rbx + 5]
nop
nop
mov eax, dword [r11 + rdx]
add rdx, 4
add r8, 4
and eax, dword [r8 - 4]
dec rcx
mov dword [rdx - 4], eax
jne 0x14005c210
lea rbx, [0x1401fb49c]
jmp 0x14005c236
mov r9d, dword [rsp + 0x10]
and r9d, 1
lea rdx, [rsp]
mov r8d, 5
shl r9d, 0x1d
nop
nop
mov eax, dword [rdx]
add rdx, 4
mov ecx, eax
shr ecx, 1
or ecx, r9d
mov r9d, eax
mov dword [rdx - 4], ecx
shl r9d, 0x1f
dec r8
jne 0x14005c250
movsx rax, word [rbx - 0x27a]
and dword [rsp], 0x3fffffff
mov rdx, rsi
lea rcx, [rax + rax*4]
movsx rax, word [rbx]
mov r10d, 5
lea r8, [rsp + rcx*4 + 0x20]
lea rcx, [rax + rax*4]
lea r9, [rsp + rcx*4 + 0x20]
nop
nop
mov ecx, dword [r8]
mov eax, dword [r11 + rdx]
add rdx, 4
xor ecx, dword [r9]
add r9, 4
add r8, 4
and eax, ecx
xor dword [rdx - 4], eax
dec r10
jne 0x14005c2a0
add rbx, 2
dec rdi
jne 0x14005c231
mov rdi, qword [rsp + 0xca8]
mov rsi, qword [rsp + 0xca0]
mov rbx, qword [rsp + 0xc98]
add rsp, 0xc88
ret
Function at 0x14005c300
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x78
call fcn.1400035e0
sub rsp, rax
cmp edx, 0x13d
mov qword [rsp + 0x80], rbx
mov rbx, rcx
jne 0x14005c34e
sub rbx, r8
mov r9d, 0xa
nop
nop
mov eax, dword [rbx + r8]
add r8, 4
dec r9
mov dword [r8 - 4], eax
jne 0x14005c330
mov rbx, qword [rsp + 0x80]
add rsp, 0x78
ret
xor eax, eax
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rdi
mov edi, socket
mov qword [rsp], rax
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], eax
mov esi, edx
mov r11d, edi
mov al, dl
shr rsi, 5
lea r9d, [rdi - 0xa]
sub r11w, si
and ax, 0x1f
je 0x14005c42d
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x70], r12
mov ecx, 0x20
sub cx, ax
movsx r12d, ax
movsx rax, r11w
mov qword [rsp + 0x68], r13
mov rbp, r9
lea r10, [rsp + rax*4]
movsx r13d, cx
add rbx, 0x24
nop
nop
nop
mov edx, dword [rbx]
mov ecx, r12d
dec r11w
mov eax, edx
sub rbx, 4
shl eax, cl
mov ecx, r13d
or dword [r10], eax
shr edx, cl
movsx rax, r11w
or dword [rsp + rax*4], edx
dec rbp
lea r10, [rsp + rax*4]
jne 0x14005c3f0
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x88]
jmp 0x14005c458
lea r10d, [r11 + rsi - 0xb]
nop
nop
nop
nop
movsx rax, r10w
movsx rdx, r11w
dec r11w
mov ecx, dword [rbx + rax*4]
or dword [rsp + rdx*4], ecx
dec r10w
jns 0x14005c440
movsx rax, si
mov rsi, qword [rsp + 0x90]
mov r11, rdi
sub r11, rax
mov cx, reloc.WSOCK32.dll_inet_ntoa
movzx edx, di
cmp r11, rdi
ja 0x14005c4a9
lea r10, [rsp + 0x2c]
nop
nop
mov eax, dword [r10]
dec cx
dec dx
shr eax, 0x1d
or dword [rsp + rdi*4], eax
movsx rax, cx
lea r10, [rsp + rax*4]
mov eax, dword [rsp + rax*4]
shl eax, 3
or dword [rsp + rdi*4], eax
movsx rdi, dx
cmp rdi, r11
jae 0x14005c480
mov eax, dword [rsp + 0x2c]
mov rdi, qword [rsp + 0x98]
lea r10, [rsp + 0x2c]
and eax, 0x10000000
mov rcx, r8
neg eax
sbb edx, edx
sub r10, r8
nop
nop
mov eax, dword [r10 + rcx]
add rcx, 4
xor eax, edx
dec r9
mov dword [rcx - 4], eax
jne 0x14005c4d0
and dword [r8], 0xfffffff
mov rbx, qword [rsp + 0x80]
add rsp, 0x78
ret
Function at 0x140060250
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x78
call fcn.1400035e0
sub rsp, rax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rdi
xor esi, esi
mov edi, 5
mov rbx, r8
mov qword [rsp + 0x70], r12
mov rbp, rcx
mov r9, rdi
mov rax, rcx
mov r12, rdx
mov r8d, esi
nop
nop
or r8d, dword [rax]
add rax, 4
dec r9
jne 0x1400602a0
test r8d, r8d
jne 0x1400602d5
mov rdx, rbx
mov rcx, r12
call fcn.14005ba80
mov rcx, rbx
call fcn.14005ba10
lea rdx, [rbx + 0x14]
mov rcx, rbx
call fcn.14005ba80
jmp 0x140060452
lea rdx, [rsp + 0x50]
call fcn.14005c500
lea rcx, [rsp + 0x50]
call fcn.14005b9c0
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov rcx, r12
call fcn.14005c100
lea rcx, [rsp + 0x38]
call fcn.14005ba10
mov r11d, esi
lea rax, [rsp + 0x38]
mov rcx, rdi
xor r11d, dword [rax]
add rax, 4
dec rcx
jne 0x140060310
mov r9d, 0xffffffff
mov r8w, reloc.WSOCK32.dll_recv
nop
nop
nop
movsx ecx, r8w
mov edx, r11d
sar r8w, 1
shr r9d, cl
shr edx, cl
mov eax, r9d
and eax, r11d
mov r11d, edx
xor r11d, eax
test r8w, r8w
jg 0x140060330
test r11d, r11d
je 0x140060372
mov rcx, rbx
call fcn.14005ba60
lea rcx, [rbx + 0x14]
call fcn.14005ba60
mov eax, 1
jmp 0x140060454
lea rcx, [rsp + 0x20]
call fcn.14005ba60
xor dx, dx
mov r8d, 1
nop
nop
nop
mov rax, rsi
mov ecx, 4
mov r10d, 4
shr rax, 5
sub cx, ax
movsx eax, dx
inc eax
shr rax, 5
sub r10w, ax
movsx rax, cx
mov r9d, dword [rsp + rax*4 + 0x20]
xor r9d, dword [rsp + rax*4 + 0x38]
and r9d, r8d
cmp r10w, cx
jne 0x1400603da
lea eax, [r9 + r9]
movsx rcx, r10w
or dword [rsp + rcx*4 + 0x20], eax
add r8d, r8d
jmp 0x1400603ee
test r9d, r9d
mov r8d, 1
je 0x1400603ee
movsx rax, r10w
mov dword [rsp + rax*4 + 0x20], r8d
inc dx
inc rsi
cmp dx, 0x9e
jl 0x140060390
mov eax, dword [rsp + 0x20]
xor eax, dword [rsp + 0x38]
bt eax, 0x1d
jae 0x140060421
mov rcx, rbx
call fcn.14005ba60
lea rcx, [rbx + 0x14]
call fcn.14005ba60
mov eax, 2
jmp 0x140060454
lea rdx, [rsp + 0x20]
mov r8, rbx
mov rcx, rbp
call fcn.14005c100
lea rcx, [rbx + 0x14]
call fcn.14005ba60
sub rbp, rbx
nop
mov eax, dword [rbx + rbp]
add rbx, 4
xor eax, dword [rbx - 4]
dec rdi
mov dword [rbx + 0x10], eax
jne 0x140060440
xor eax, eax
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
add rsp, 0x78
ret
Function at 0x140060490
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x58
call fcn.1400035e0
sub rsp, rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rsi, rdx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x78], rdi
mov rbx, rcx
mov rdi, r8
call fcn.14005ba80
lea rcx, [rsp + 0x20]
call fcn.14005b9c0
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14005c100
cmp word [rsi], 0
mov rbx, qword [rsp + 0x68]
je 0x1400604f9
lea rdx, [rsi + 2]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.14005c100
jmp 0x140060501
mov rcx, rdi
call fcn.14005ba60
lea r8, [rsp + 0x38]
lea rcx, [rsi + 0x16]
mov rsi, qword [rsp + 0x70]
sub r8, rdi
mov edx, 5
nop
nop
nop
mov eax, dword [r8 + rdi]
add rdi, 4
add rcx, 4
xor eax, dword [rdi - 4]
xor eax, dword [rcx - 4]
dec rdx
mov dword [rdi - 4], eax
jne 0x140060520
mov rdi, qword [rsp + 0x78]
add rsp, 0x58
ret
Function at 0x140060550
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xb8
call fcn.1400035e0
sub rsp, rax
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xc8], rbp
mov qword [rsp + 0xd0], rsi
mov rsi, rcx
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0xb0], r12
lea rcx, [rsp + 0x20]
mov qword [rsp + 0xa8], r13
mov r12, r8
mov r13, r9
mov rbx, rdx
call fcn.14005ba60
lea rcx, [rsp + 0x68]
call fcn.14005ba60
lea rax, [rsp + 0x20]
mov rbp, rsi
mov r10, rsi
mov edi, 5
sub rbp, rbx
sub r10, rax
xor edx, edx
lea r11, [rbx + 0x14]
mov r8, rdi
nop
lea rcx, [rsp + rdx + 0x20]
add r11, 4
add rdx, 4
mov eax, dword [r10 + rcx]
xor eax, dword [r11 - 0x18]
mov dword [rcx], eax
mov eax, dword [r11 + rbp - 4]
xor eax, dword [r11 - 4]
dec r8
mov dword [rsp + rdx + 0x64], eax
jne 0x1400605d0
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
call fcn.14005c500
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x80]
call fcn.14005c100
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.14005ba80
lea rcx, [rsp + 0x38]
call fcn.14005b9c0
cmp word [r13], 0
je 0x140060687
lea r8, [rsp + 0x38]
lea r9, [rsp + 0x50]
mov r10, r12
sub r8, rbx
sub r9, rbx
lea rcx, [r13 + 2]
sub r10, rbx
mov rdx, rdi
mov eax, dword [r9 + rbx]
add rbx, 4
add rcx, 4
xor eax, dword [r8 + rbx - 4]
xor eax, dword [rbx + rbp - 4]
xor eax, dword [rcx - 4]
xor eax, dword [rbx - 4]
dec rdx
mov dword [r10 + rbx - 4], eax
jne 0x140060660
jmp 0x1400606bd
lea rdx, [rsp + 0x38]
lea r8, [rsp + 0x50]
mov r9, r12
sub rdx, rbx
sub r8, rbx
sub r9, rbx
mov rcx, rdi
mov eax, dword [rbx + rbp]
add rbx, 4
xor eax, dword [rbx + r8 - 4]
xor eax, dword [rbx + rdx - 4]
xor eax, dword [rbx - 4]
dec rcx
mov dword [rbx + r9 - 4], eax
jne 0x1400606a0
mov r13, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xc0]
lea r8, [rsp + 0x20]
sub rsi, r12
mov rcx, r12
sub r8, r12
mov rdx, rdi
nop
nop
nop
mov eax, dword [rcx + rsi]
add rcx, 4
xor eax, dword [rcx - 4]
dec rdx
mov dword [rcx + r8 - 4], eax
jne 0x1400606f0
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.14005c100
lea rcx, [r12 + 0x14]
mov r12, qword [rsp + 0xb0]
lea r11, [rsp + 0x38]
nop
nop
mov eax, dword [rcx + rsi]
add rcx, 4
add r11, 4
xor eax, dword [rcx - 0x18]
xor eax, dword [r11 - 4]
dec rdi
mov dword [rcx - 4], eax
jne 0x140060730
mov rdi, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xd0]
add rsp, 0xb8
ret
Function at 0x140060890
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.1400035e0
sub rsp, rax
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rbp
mov qword [rsp + 0xc0], rsi
mov rsi, rdx
lea rdx, [rsp + 0x38]
mov qword [rsp + 0xc8], rdi
mov qword [rsp + 0xa0], r12
mov rbp, r8
mov r12, rcx
call fcn.14005c500
lea rdx, [r12 + 0x14]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.14005c100
lea r11, [rsp + 0x20]
mov r9, r12
sub r9, r11
xor ebx, ebx
mov edi, 5
mov rdx, rbx
mov r8, rdi
nop
nop
nop
lea rax, [rsp + rdx + 0x20]
add rdx, 4
mov ecx, dword [r9 + rax]
xor ecx, dword [rax]
dec r8
mov dword [rsp + rdx + 0x4c], ecx
jne 0x140060910
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
call fcn.14005ba80
lea rcx, [rsp + 0x68]
call fcn.14005b9c0
cmp word [rbp], bx
je 0x14006097e
lea rdx, [rbp + 2]
mov rcx, rbx
mov r8, rdi
nop
nop
nop
nop
mov eax, dword [rsp + rcx + 0x68]
add rcx, 4
add rdx, 4
xor eax, dword [rsp + rcx + 0x4c]
xor eax, dword [rdx - 4]
dec r8
mov dword [rcx + rsi - 4], eax
jne 0x140060960
jmp 0x1400609a5
mov rcx, rbx
mov rdx, rdi
nop
nop
nop
mov eax, dword [rsp + rcx + 0x68]
add rcx, 4
xor eax, dword [rsp + rcx + 0x4c]
dec rdx
mov dword [rcx + rsi - 4], eax
jne 0x140060990
mov rbp, qword [rsp + 0xb8]
mov qword [rsp + 0x20], 0xffffffffffffffff
and dword [rsp + 0x20], 0x3fffffff
mov qword [rsp + 0x28], 0xffffffffffffffff
mov dword [rsp + 0x30], 0xffffffff
mov rcx, rbx
mov rdx, rdi
nop
nop
nop
mov eax, dword [rsp + rcx + 0x50]
add rcx, 4
xor dword [rsp + rcx + 0x1c], eax
dec rdx
jne 0x1400609e0
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.14005c100
lea rdx, [rsp + 0x38]
mov rcx, r12
call fcn.14005ba80
lea rcx, [rsp + 0x38]
call fcn.14005b9c0
mov r12, qword [rsp + 0xa0]
lea r11, [rsi + 0x14]
mov rsi, qword [rsp + 0xc0]
mov eax, dword [rsp + rbx + 0x80]
add r11, 4
add rbx, 4
xor eax, dword [rsp + rbx + 0x34]
dec rdi
mov dword [r11 - 4], eax
jne 0x140060a31
mov rdi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa8
ret
Function at 0x140060a70
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x178
call fcn.1400035e0
sub rsp, rax
mov rax, qword [0x1401ad1c0]
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x160], rsi
mov qword [rsp + 0x150], r12
mov r12, rdx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x148], r13
mov rsi, r8
mov r13, r9
call fcn.14005ba80
xor ecx, ecx
lea rax, [rsp + 0x20]
mov edx, 5
or ecx, dword [rax]
add rax, 4
dec rdx
jne 0x140060ac3
test ecx, ecx
jne 0x140060ae8
mov rcx, rsi
call fcn.14005ba60
lea rcx, [rsi + 0x14]
call fcn.14005ba60
jmp 0x140060c8c
mov qword [rsp + 0x170], rbx
xor bx, bx
test byte [rsp + 0x30], 1
je 0x140060b31
movzx eax, byte [rsp + 0x30]
mov ecx, 2
and al, 3
sub cl, al
movsx rax, bx
mov byte [rsp + rax + 0x90], cl
jns 0x140060b3d
mov cx, 4
nop
nop
movsx rax, cx
inc dword [rsp + rax*4 + 0x20]
jne 0x140060b3d
dec cx
jns 0x140060b20
jmp 0x140060b3d
movsx rax, bx
mov byte [rsp + rax + 0x90], 0
and dword [rsp + 0x30], 0xfffffffe
lea rcx, [rsp + 0x20]
call fcn.14005ba10
inc bx
xor ecx, ecx
lea rax, [rsp + 0x20]
mov edx, 5
nop
nop
or ecx, dword [rax]
add rax, 4
dec rdx
jne 0x140060b60
test ecx, ecx
jne 0x140060af3
mov rdx, rsi
mov rcx, r12
mov qword [rsp + 0x168], rbp
dec bx
call fcn.14005ba80
lea rcx, [r12 + 0x14]
lea rdx, [rsi + 0x14]
call fcn.14005ba80
test bx, bx
jle 0x140060c7c
movsx rax, bx
mov qword [rsp + 0x158], rdi
lea rdi, [rsp + rax + 0x90]
lea rdx, [rsp + 0x38]
mov r8, r13
mov rcx, rsi
call fcn.140060890
mov al, byte [rdi - 1]
dec rdi
dec bx
cmp al, 0xff
je 0x140060c0b
test al, al
je 0x140060bee
cmp al, 1
jne 0x140060c6b
lea rdx, [rsp + 0x38]
mov r9, r13
mov r8, rsi
mov rcx, r12
call fcn.140060550
jmp 0x140060c6b
lea rcx, [rsp + 0x38]
mov rdx, rsi
call fcn.14005ba80
lea rdx, [rsi + 0x14]
lea rcx, [rsp + 0x4c]
call fcn.14005ba80
jmp 0x140060c6b
lea rdx, [rsp + 0x60]
mov rcx, r12
call fcn.14005ba80
lea rcx, [rsp + 0x74]
call fcn.14005ba60
lea rdx, [rsp + 0x74]
mov r11, r12
sub rdx, r12
mov ecx, 5
nop
nop
nop
nop
mov eax, dword [r11 + 0x14]
add r11, 4
xor eax, dword [r11 - 4]
dec rcx
mov dword [rdx + r11 - 4], eax
jne 0x140060c40
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
mov r9, r13
mov r8, rsi
call fcn.140060550
test bx, bx
jg 0x140060bb0
mov rdi, qword [rsp + 0x158]
mov rbp, qword [rsp + 0x168]
mov rbx, qword [rsp + 0x170]
mov r13, qword [rsp + 0x148]
mov r12, qword [rsp + 0x150]
mov rsi, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x130]
call fcn.14006b6a0
add rsp, 0x178
ret
Function at 0x140065320
Capabilities:
Get session user name

Disassembly:
push rdi
mov eax, 0x140
call fcn.1400035e0
sub rsp, rax
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x150], rbx
mov rbx, rdx
mov rdi, rcx
lea rcx, str.mpssession
call fcn.140064d20
cmp eax, 0xffffffff
jne 0x1400654b9
lea rdx, str.Global
mov rcx, rdi
call fcn.140064c90
test eax, eax
jne 0x1400654bd
mov dword [0x1401fd2a0], 1
mov r8, rbx
lea rdx, str.session_name
mov rcx, rdi
call fcn.140064e00
test eax, eax
je 0x1400653ef
xor ecx, ecx
call qword [sym.imp.MSVCR110.dll__time64]
mov rcx, rax
call qword [sym.imp.MSVCR110.dll_srand]
call qword [sym.imp.MSVCR110.dll_rand]
mov r8d, eax
lea rdx, [0x14019142c]
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCR110.dll_sprintf]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x168]
call fcn.140062e90
nop
lea rdx, [rsp + 0x168]
mov rcx, rbx
call fcn.140063130
nop
lea rcx, [rsp + 0x168]
call fcn.140063030
mov dword [0x1401fd2a0], 0
mov dword [rsp + 0x160], Ordinal_266
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1400654a1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x168]
call fcn.140062e90
nop
mov r8b, 0x5f
mov dl, 0x20
lea rcx, [rsp + 0x168]
call fcn.140063b10
lea rdx, [0x14019b724]
lea rcx, [rsp + 0x20]
call fcn.140062e90
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x168]
call fcn.140063130
nop
lea rcx, [rsp + 0x20]
call fcn.140063030
mov rdx, rbx
lea rcx, [rsp + 0x168]
call fcn.140063130
lea rdx, [rsp + 0x168]
mov rcx, rbx
call fcn.140063060
nop
lea rcx, [rsp + 0x168]
call fcn.140063030
mov rdx, rbx
lea rcx, [rsp + 0x168]
call fcn.140062d90
mov rcx, rax
call fcn.140066e10
xor eax, eax
jmp 0x1400654c0
or eax, 0xffffffff
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret

Function at 0x1400654e0
Capabilities:
Get common file path

Disassembly:
push rdi
mov eax, 0x430
call fcn.1400035e0
sub rsp, rax
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x448], rbx
mov qword [rsp + Ordinal_1111], rsi
mov rsi, rdx
lea rdi, [rcx + 8]
mov rcx, rdi
call fcn.140063530
test eax, eax
je 0x140065523
or eax, 0xffffffff
jmp 0x1400655b3
mov rcx, rdi
call fcn.140063510
lea ebx, [rax - 1]
test ebx, ebx
js 0x140065570
mov edx, ebx
mov rcx, rdi
call fcn.1400630e0
cmp al, 0x5c
je 0x14006554a
cmp al, 0x2f
je 0x14006554a
dec ebx
jns 0x140065532
jmp 0x140065570
test ebx, ebx
js 0x140065570
mov r8d, ebx
lea rdx, [rsp + 0x440]
mov rcx, rdi
call fcn.140063550
nop
mov rdx, rax
mov rcx, rsi
call fcn.140063060
nop
jmp 0x1400655a4
lea rdx, [rsp + 0x30]
mov ecx, Ordinal_1026
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x440]
call fcn.140062e90
nop
lea rdx, [rsp + 0x440]
mov rcx, rsi
call fcn.140063060
nop
lea rcx, [rsp + 0x440]
call fcn.140063030
xor eax, eax
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140075e00
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x2c], 0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
jmp 0x140075e41
mov rax, qword [rsp + 0x20]
add rax, 1
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
test eax, eax
je 0x140075e67
mov rax, qword [rsp + 0x20]
movsx eax, byte [rax]
cmp eax, 0x2e
jne 0x140075e65
mov eax, dword [rsp + 0x2c]
add eax, 1
mov dword [rsp + 0x2c], eax
jmp 0x140075e33
cmp dword [rsp + 0x2c], 3
je 0x140075e72
xor eax, eax
jmp 0x140075e9c
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xffffffff
jne 0x140075e8c
xor eax, eax
jmp 0x140075e9c
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x28]
mov dword [rax], ecx
mov eax, 1
add rsp, 0x38
ret

Function at 0x1400761c0
Capabilities:
Resolve dns

Disassembly:
mov word [rsp + 0x20], r9w
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x30]
mov qword [rax], 0
mov rax, qword [rsp + 0x70]
mov byte [rax], 0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WSOCK32.dll_gethostbyname]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400762d5
mov rax, qword [rsp + 0x28]
movsx eax, word [rax + 0x10]
cmp eax, 2
jne 0x1400762b4
mov rax, qword [rsp + 0x28]
movsx rax, word [rax + 0x12]
cmp rax, 4
jne 0x1400762b4
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x20], rax
jmp 0x14007625b
mov rax, qword [rsp + 0x20]
add rax, 8
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp qword [rax], 0
je 0x1400762b4
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov r9d, dword [rax]
movzx r8d, word [rsp + 0x68]
mov edx, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x58]
call fcn.140075eb0
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
jne 0x1400762a1
mov eax, 8
jmp 0x14007632a
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
add rax, 0x28
mov qword [rsp + 0x30], rax
jmp 0x14007624d
mov r9d, Ordinal_1026
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
mov edx, Ordinal_1026
mov rcx, qword [rsp + 0x70]
call sub.MSVCR110.dll_strncpy_s
xor eax, eax
jmp 0x14007632a
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0x2af9
je 0x140076309
cmp dword [rsp + 0x38], 0x2afa
je 0x140076310
cmp dword [rsp + 0x38], 0x2afb
je 0x140076317
cmp dword [rsp + 0x38], 0x2afc
je 0x14007631e
jmp 0x140076325
mov eax, 0x2af9
jmp 0x14007632a
mov eax, 0x2afa
jmp 0x14007632a
mov eax, 0x2afb
jmp 0x14007632a
mov eax, 0x2af9
jmp 0x14007632a
mov eax, 0x2af9
add rsp, 0x48
ret