joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140169af0
Capabilities:
Initialize winsock library

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x1f0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140479080]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
movzx ebx, r8w
mov rdi, rcx
mov qword [rsp + 0x30], rcx
lea rax, vtable.artemis::CClientSocket.0
mov qword [rcx], rax
add rcx, 8
xor esi, esi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], sil
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], sil
jne 0x140169b50
call fcn.14000b830
nop
mov word [rdi + 0x28], bx
mov qword [rdi + 0x2c], rsi
mov qword [rdi + 0x34], rsi
lea rbx, [rdi + 0x40]
mov qword [rsp + 0x20], rbx
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
call fcn.1401056e0
mov qword [rbx], rax
mov qword [rdi + 0x50], rsi
mov dword [rdi + 0x58], 0xffffffff
mov qword [rdi + 0x5c], rsi
mov word [rdi + 0x64], 0
mov dword [rdi + 0x68], esi
mov qword [rdi + 0x70], rsi
lea rbx, [rdi + 0x78]
mov qword [rsp + 0x20], rbx
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x20], rsi
mov ecx, reloc.WS2_32.dll_recv
call fcn.14023ed4c
mov qword [rbx], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov rax, qword [rbx]
mov qword [rax], rbx
mov dword [rdi + 0xa0], 0xfff
mov qword [rdi + 0xa8], rsi
mov dword [rdi + 0xd0], esi
mov eax, dword [0x1404a3188]
test eax, eax
jne 0x140169c09
lea ecx, [rax + 2]
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov eax, dword [0x1404a3188]
inc eax
mov dword [0x1404a3188], eax
mov rax, rdi
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.14023ed20
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140169ee0
Capabilities:
Get socket status
Resolve dns
Send data
Send data on socket
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 0x98]
mov rsi, rcx
mov qword [rsp + 0x20], rdx
inc rax
mov rdx, qword [rcx + 0x88]
mov qword [rsp + 0x28], r8
cmp rdx, rax
ja 0x140169f22
add rcx, 0x78
call fcn.1401046f0
mov rdx, qword [rsi + 0x88]
lea rax, [rdx - 1]
and qword [rsi + 0x90], rax
mov rcx, qword [rsi + 0x98]
add rcx, qword [rsi + 0x90]
mov rax, qword [rsi + 0x88]
dec rax
and rcx, rax
mov rax, qword [rsi + 0x80]
cmp qword [rax + rcx*8], 0
lea rdi, [rcx*8]
jne 0x140169f7a
mov ecx, reloc.WS2_32.dll_recv
call fcn.14023ed4c
mov rcx, qword [rsi + 0x80]
mov qword [rdi + rcx], rax
mov rax, qword [rsi + 0x80]
mov rax, qword [rdi + rax]
mov rcx, rsi
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rax], xmm0
inc qword [rsi + 0x98]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.140169fb0
Function at 0x14016aa30
Capabilities:
Set socket configuration

Disassembly:
mov byte [rsp + 0x10], dl
sub rsp, 0x28
movsxd rax, dword [rcx + 0x58]
mov byte [rcx + 0x65], 1
cmp eax, 0xffffffff
je 0x14016aa60
mov rcx, rax
mov dword [rsp + 0x38], 1
lea r8, [rsp + 0x38]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret
Function at 0x14017e180
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x140479080]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x60]
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x14017e1bb
mov rcx, qword [rbx + 0x60]
mov edx, 9
call qword [sym.imp.USER32.dll_ShowWindow]
cmp byte [rbx + 0x80], 0
mov rcx, qword [rbx + 0x60]
jne 0x14017e241
mov edx, 0xfffffff0
mov byte [rbx + 0x80], 1
mov r8d, 0x82000000
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [rbx + 0x60]
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x78], gethostbyaddr
call qword [sym.imp.USER32.dll_GetWindowPlacement]
mov edx, 2
lea rcx, [rsp + 0x94]
call qword [sym.imp.USER32.dll_MonitorFromRect]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x28
mov rcx, rax
call qword [sym.imp.USER32.dll_GetMonitorInfoA]
mov ecx, dword [rsp + 0x60]
mov rdx, 0xffffffffffffffff
mov r9d, dword [rsp + 0x58]
sub ecx, r9d
mov eax, dword [rsp + 0x5c]
mov r8d, dword [rsp + 0x54]
sub eax, r8d
jmp 0x14017e2ae
xor edx, edx
mov byte [rbx + 0x80], 0
call qword [sym.imp.USER32.dll_ShowWindow]
mov r8d, dword [rbx + 0x40]
mov edx, 0xfffffff0
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, dword [rbx + 0x14]
lea rcx, [rsp + 0x40]
mov r9d, dword [rbx + 0x10]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetRect]
mov edx, dword [rbx + 0x40]
lea rcx, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.USER32.dll_AdjustWindowRect]
mov ecx, dword [rsp + 0x4c]
mov rdx, 0xfffffffffffffffe
sub ecx, dword [rsp + 0x44]
mov eax, dword [rsp + 0x48]
sub eax, dword [rsp + 0x40]
mov r9d, dword [rbx + 0xc]
mov r8d, dword [rbx + 8]
mov dword [rsp + 0x30], 0x160
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbx + 0x60]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14023ed20
add rsp, 0xb0
pop rbx
ret
Function at 0x1401843a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140479080]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r11, rcx
mov rbx, rcx
movzx ecx, byte [rcx]
mov r10d, r9d
mov rdi, r8
movzx esi, dl
test cl, cl
je 0x140184457
test r10d, r10d
jne 0x1401843f9
movzx eax, cl
xor eax, 0x20
sub eax, 0xa1
cmp eax, 0x3c
jae 0x140184447
mov eax, 1
cdqe
add rbx, rax
jmp 0x14018444c
cmp r10d, 1
jne 0x140184417
lea eax, [rcx + 0x5f]
cmp al, 0x53
jbe 0x14018440b
cmp cl, 0x8e
jne 0x140184447
mov eax, 1
cdqe
add rbx, rax
jmp 0x14018444c
cmp r10d, 2
jne 0x140184447
test cl, cl
jns 0x140184447
mov r8d, 0xffffffff
movsx r9d, cl
mov eax, r8d
lea edx, [r10 + 0x7e]
sar edx, 1
lea eax, [r8 + 1]
mov r8d, eax
test edx, r9d
jne 0x140184432
cdqe
add rbx, rax
jmp 0x14018444c
cmp byte [rbx], sil
je 0x140184457
movzx ecx, byte [rbx + 1]
inc rbx
test cl, cl
jne 0x1401843d8
test rdi, rdi
je 0x1401844c2
movdqa xmm0, xmmword [0x1404107f0]
lea rcx, [rsp + 0x20]
mov r8, rbx
mov byte [rsp + 0x20], 0
sub r8, r11
mov rdx, r11
movdqu xmmword [rsp + 0x30], xmm0
call fcn.14000b830
lea rax, [rsp + 0x20]
cmp rdi, rax
je 0x1401844b8
mov rcx, rdi
call fcn.14000b5d0
movups xmm0, xmmword [rsp + 0x20]
mov byte [rsp + 0x20], 0
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
movdqa xmm0, xmmword [0x1404107f0]
movdqu xmmword [rsp + 0x30], xmm0
movups xmmword [rdi + 0x10], xmm1
lea rcx, [rsp + 0x20]
call fcn.14000b5d0
mov rax, rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14023ed20
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x140186890
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x1d8], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jne 0x1401868f3
add rcx, 0x1e8
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], r8
mov rdx, qword [rcx + 8]
cmp qword [rcx + 0x10], rdx
je 0x1401868e4
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdx], xmm0
add qword [rcx + 8], 0x10
jmp 0x1401869a6
lea r8, [rsp + 0x20]
call fcn.14010bd40
jmp 0x1401869a6
cmp qword [rcx + 0x200], 0
jne 0x14018691b
mov r8d, dword [rbx + 0xd8]
lea rdx, [rbx + 0x200]
add rcx, 0x1c8
call fcn.1401784d0
test al, al
jne 0x140186937
mov r9, qword [rbx + 0x200]
mov r8, rsi
mov edx, 1
mov rcx, rbp
call fcn.140267024
cmp rax, rsi
je 0x14018693b
mov al, 1
jmp 0x1401869a8
cmp qword [rbx + 0x150], 1
jbe 0x1401869a6
xor edi, edi
nop word [rax + rax]
mov rax, qword [rbx + 0x130]
test rax, rax
jne 0x140186961
mov rax, rdi
jmp 0x140186964
mov rax, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 8]
dec rcx
and rcx, qword [rbx + 0x148]
mov rcx, qword [rax + rcx*8]
mov rcx, qword [rcx]
call fcn.14023ed44
sub qword [rbx + 0x150], 1
jne 0x140186995
mov qword [rbx + 0x148], rdi
jmp 0x14018699c
inc qword [rbx + 0x148]
cmp qword [rbx + 0x150], 1
ja 0x140186950
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140191fb0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
call qword [rax + gethostname]
mov r9d, dword [rsi + 0x84]
mov ebx, eax
sub r9d, eax
cmp rbp, r9
cmova rbp, r9
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x140192004
mov r8, rbp
mov edx, 1
mov rcx, rdi
call fcn.140267854
mov r8, rax
jmp 0x140192007
xor r8d, r8d
mov rax, qword [rsi + 0x88]
test rax, rax
je 0x140192080
cmp byte [rax + 0x50], 0
je 0x140192080
cmp byte [rsi + 0x98], 0
jne 0x140192080
lea r10, [rax + 0x54]
xor r9d, r9d
mov eax, 0x66666667
imul ebx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ebx, eax
test r8, r8
je 0x140192080
movsxd rdx, ebx
nop word [rax + rax]
movzx eax, byte [rdx + r10]
lea rcx, [rdx + 1]
xor byte [rdi], al
lea rdi, [rdi + 1]
inc r9d
lea eax, [rbx + 1]
xor ebx, ebx
cmp rcx, 0x14
cmovl ebx, eax
xor edx, edx
cmp rcx, 0x14
mov eax, r9d
cmovl rdx, rcx
cmp rax, r8
jb 0x140192050
mov rbx, qword [rsp + 0x30]
mov rax, r8
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140194400
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x370], rbx
mov rax, qword [0x140479080]
xor rax, rsp
mov qword [rbp + 0x230], rax
mov ebx, edx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
xor edx, edx
mov r8d, 0x90
lea rcx, [rbp - 0x7c]
call fcn.14025e440
mov dword [rbp - 0x80], __WSAFDIsSet
lea rcx, [rbp - 0x80]
call qword [case.0x14024b920.9]
xor esi, esi
cmp dword [rbp - 0x70], 2
je 0x140194562
mov eax, esi
cmp ebx, 0x19
cmovne eax, ebx
mov ebx, eax
cmp eax, 0x17
jne 0x140194562
lea ebx, [rsi + 2]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
lea r8, [rsp + 0x28]
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x1401944ca
lea rdx, [rbp + 0x20]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x28]
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
movdqa xmm0, xmmword [0x1404107e0]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], si
lea rax, [rbp + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], si
jne 0x1401944f3
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.1400ae980
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.1400b1b00
nop
mov rdx, rax
mov rcx, rdi
call fcn.14000b200
nop
lea rcx, [rsp + 0x58]
call fcn.14000b5d0
nop
lea rcx, [rsp + 0x38]
call fcn.1400ae780
mov rax, rdi
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.14023ed20
mov rbx, qword [rsp + 0x370]
add rsp, 0x340
pop rdi
pop rsi
pop rbp
ret
cmp ebx, 0x25
jne 0x14019457b
mov edx, 0x104
lea rcx, [rbp + 0x20]
call qword [case.0x14024b920.10]
jmp 0x1401944d5
cmp ebx, 0x24
jne 0x140194483
mov edx, 0x104
lea rcx, [rbp + 0x20]
call qword [0x1402b1118]
jmp 0x1401944d5
Function at 0x140194a20
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x160], rbx
mov rax, qword [0x140479080]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov rdi, r9
movzx esi, r8b
mov rbx, rdx
mov rdx, rcx
lea rcx, [rbp - 0x20]
call fcn.1400aa050
nop
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1400ae460
nop
lea rcx, [rbp - 0x20]
call fcn.1400ae780
mov rdx, rbx
lea rcx, [rbp]
call fcn.1400aa050
nop
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.1400ae460
nop
lea rcx, [rbp]
call fcn.1400ae780
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x30]
call fcn.14025e440
mov dword [rsp + 0x30], WSAStartup
mov dword [rsp + 0x34], 0x40
lea rax, str.open
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rax, qword [rbp - 0x40]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x60], 1
cmp qword [rbx + 0x10], 0
je 0x140194b00
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rax, qword [rbp - 0x60]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140194b50
cmp qword [rsp + 0x68], 0x20
jbe 0x140194b50
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140194b4c
test sil, sil
je 0x140194b34
mov edx, 0xffffffff
call qword [str.ZYR_]
mov rcx, qword [rbp - 0x68]
test rdi, rdi
je 0x140194b46
mov rdx, rdi
call qword [0x1402b1128]
mov rcx, qword [rbp - 0x68]
call qword [str.JR_]
xor bl, bl
jmp 0x140194b52
mov bl, 1
lea rcx, [rbp - 0x60]
call fcn.1400ae780
nop
lea rcx, [rbp - 0x40]
call fcn.1400ae780
movzx eax, bl
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.14023ed20
mov rbx, qword [rsp + 0x160]
add rsp, 0x130
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401a16a0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rdi, [rcx + 0x1040]
xor esi, esi
nop dword [rax + rax]
mov rdx, qword [rdi]
mov rax, rsi
mov r8, qword [rdi + 0x18]
test rdx, rdx
je 0x1401a16d2
mov rax, qword [rdx]
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 8]
dec rcx
and rcx, r8
mov r10, qword [rax + rcx*8]
test rdi, rdi
je 0x1401a16f3
test rdx, rdx
je 0x1401a16f3
mov rax, qword [rdx]
jmp 0x1401a16f6
mov rax, rsi
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 8]
dec rcx
mov rdx, qword [rbx + 0x1038]
and rcx, r8
mov r8d, dword [r10 + 8]
sub r8d, dword [rbx + 0x1038]
mov r9, qword [rax + rcx*8]
movsxd rcx, dword [rbx + 0x30]
add rdx, qword [r9]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1401a17d8
movsxd rdx, eax
add rdx, qword [rbx + 0x1038]
mov qword [rbx + 0x1038], rdx
mov rax, qword [rdi]
test rax, rax
jne 0x1401a1751
mov rax, rsi
jmp 0x1401a1754
mov rax, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 8]
dec rcx
and rcx, qword [rdi + 0x18]
mov rcx, qword [rax + rcx*8]
cmp rdx, qword [rcx + 8]
jb 0x1401a17c6
mov qword [rbx + 0x1038], rsi
mov rax, qword [rdi]
test rax, rax
jne 0x1401a1781
mov rax, rsi
jmp 0x1401a1784
mov rax, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 8]
dec rcx
and rcx, qword [rdi + 0x18]
mov rcx, qword [rax + rcx*8]
mov rcx, qword [rcx]
call fcn.14023ed44
sub qword [rbx + 0x1060], 1
jne 0x1401a17b2
mov qword [rbx + 0x1058], rsi
jmp 0x1401a17b9
inc qword [rbx + 0x1058]
cmp qword [rbx + 0x1060], rsi
jne 0x1401a16c0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x1401a17c6
mov dword [rbx + 0x28], WSAGetLastError
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rbx + 0x2c], eax
movsxd rax, dword [rbx + 0x30]
cmp eax, 0xffffffff
je 0x1401a181d
mov rcx, rax
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
movsxd rcx, dword [rbx + 0x30]
call qword [sym.imp.WS2_32.dll_closesocket]
mov dword [rbx + 0x30], 0xffffffff
mov rbx, qword [rsp + 0x30]
mov al, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1401a49f0
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x80
mov qword [rax - 0x78], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x140479080]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, rdx
mov r14, rcx
mov qword [rsp + 0x28], rdx
mov rcx, qword [rcx + 0x80]
test rcx, rcx
jne 0x1401a4a5b
xor eax, eax
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdx], al
xor r8d, r8d
lea rdx, [0x1402c797a]
mov rcx, rsi
call fcn.14000b830
jmp 0x1401a4afc
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [rax + 1]
movsxd rcx, edi
mov eax, 2
mul rcx
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.14023ed88
mov rbp, rax
mov r8d, edi
mov rdx, rax
mov rcx, qword [r14 + 0x80]
call qword [sym.imp.USER32.dll_GetWindowTextW]
movdqa xmm0, xmmword [0x1404107e0]
movdqu xmmword [rsp + 0x40], xmm0
xor eax, eax
mov word [rsp + 0x30], ax
nop dword [rax]
inc rbx
cmp word [rbp + rbx*2], ax
jne 0x1401a4ab0
mov r8, rbx
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.1400ae980
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1400b1b00
nop
mov rdx, rax
mov rcx, rsi
call fcn.14000b200
nop
lea rcx, [rsp + 0x50]
call fcn.14000b5d0
nop
lea rcx, [rsp + 0x30]
call fcn.1400ae780
mov rax, rsi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14023ed20
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1401c0f30
Capabilities:
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x140479080]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov rdi, r8
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0x38]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], r8
mov rsi, rdx
mov r14, rcx
mov ebx, 0x200
nop dword [rax]
lea rax, [rsp + 0x20]
sub r8, rax
sub r8, 0x18
je 0x1401c0fb0
lea rdx, [rsp + 0x38]
call fcn.1401b1d50
inc dword [rsp + 0x28]
lea rax, [rsp + 0x38]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
call fcn.1401b3b00
cmp rbx, rdi
lea rcx, [rsp + 0x38]
mov rax, rdi
mov r9, rsi
cmovbe rax, rbx
mov edx, 1
mov r8, rax
mov rbx, rax
call fcn.140267854
mov r8, qword [rsp + 0x20]
add r8, rax
mov qword [rsp + 0x20], r8
sub rdi, rax
je 0x1401c0ff0
cmp rax, rbx
jne 0x1401c0ff0
mov rcx, qword [rsp + 0x30]
jmp 0x1401c0f80
lea rax, [rsp + 0x20]
sub r8, rax
sub r8, 0x18
je 0x1401c1023
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x38]
call fcn.1401b1d50
mov edx, dword [rsp + 0x28]
lea rax, [rsp + 0x38]
inc edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], edx
jmp 0x1401c1027
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call fcn.1401b27b0
mov dword [rsp + 0x28], 1
test rdi, rdi
je 0x1401c1050
mov edx, 0xffffffff
mov rcx, r14
call fcn.1401b1cd0
test rax, rax
je 0x1401c1055
mov eax, 1
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.14023ed20
add rsp, 0x250
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1401d1950
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rdx, [rsp + 0x30]
mov rcx, qword [rcx + 8]
mov r8d, 8
call fcn.1401d4d10
test rax, rax
jne 0x1401d19d9
mov rdi, qword [rsp + 0x30]
test rdi, rdi
jne 0x1401d1995
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rdx, qword [rbx + 0x10]
mov r8, rdi
mov rcx, qword [rbx]
call fcn.1401d4db0
mov rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, rax
mov rsi, rax
call fcn.1401d4d10
test rax, rax
jne 0x1401d19d9
mov rcx, qword [rbx]
lea r8, [rdi - 1]
mov rdx, rsi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1401cc240
lea rdx, str.unexpected_end
mov rcx, rbx
call fcn.1401d1920
int3
Function at 0x1401e9340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x1c]
mov r12d, 0x40
mov rbx, qword [rcx + 0x20]
movsxd r15, edx
lea r13, [rax + rax*2]
shl r13, 4
lea r8, [r15 + r15*4]
add r13, rbx
mov rdi, qword [rcx + r8*8 + 0x50]
test edx, edx
movsxd rax, dword [rcx + r8*8 + 0x48]
lea rcx, [rax + rax*8]
mov eax, 0x80
lea r8, [rcx*8]
cmovne r12d, eax
lea r14, [r8 + rdi]
mov qword [rsp + 0x50], r8
cmp rdi, r14
jae 0x1401e9597
cmp rbx, r13
jae 0x1401e9597
mov qword [rsp + 0x58], rbp
add rbx, 8
mov qword [rsp + 0x60], rsi
mov ecx, 0x300
mov edx, 0x100
movabs r9, 0xe38e38e38e38e39
movzx eax, word [rbx - 8]
test r12d, eax
jne 0x1401e957c
and ax, cx
cmp ax, dx
je 0x1401e957c
cmp r15d, 1
jne 0x1401e93f7
mov edx, dword [rbx]
movzx eax, word [rbx + 6]
jmp 0x1401e93fe
mov edx, dword [rbx - 4]
movzx eax, word [rbx + 4]
movsx r11d, ax
movsx eax, word [rdi]
cmp eax, r11d
js 0x1401e941a
mov r9d, dword [rdi + 8]
sub r9d, dword [rdi + 4]
add r9d, edx
jmp 0x1401e9559
movsx ecx, word [r14 - 0x48]
cmp r11d, ecx
js 0x1401e9434
mov r9d, dword [r14 - 0x40]
sub r9d, dword [r14 - 0x44]
add r9d, edx
jmp 0x1401e9554
mov rax, r9
xor ecx, ecx
imul r8
mov r8, rdx
sar r8, 2
mov rax, r8
shr rax, 0x3f
add r8, rax
cmp r8, 8
jg 0x1401e948e
test r8, r8
jle 0x1401e9474
mov rdx, rdi
nop dword [rax + rax]
movsx eax, word [rdx]
cmp eax, r11d
jge 0x1401e9474
inc rcx
add rdx, 0x48
cmp rcx, r8
jl 0x1401e9460
lea rax, [rcx + rcx*8]
lea r9, [rdi + rax*8]
movsx eax, word [rdi + rax*8]
cmp eax, r11d
jne 0x1401e94c8
mov r9d, dword [r9 + 8]
jmp 0x1401e954f
test r8, r8
jle 0x1401e94c8
nop dword [rax]
nop word [rax + rax]
lea rdx, [r8 + rcx]
sar rdx, 1
lea rax, [rdx + rdx*8]
lea r9, [rdi + rax*8]
movsx eax, word [rdi + rax*8]
cmp r11d, eax
jge 0x1401e94bd
mov r8, rdx
jmp 0x1401e94c3
jle 0x1401e9485
lea rcx, [rdx + 1]
cmp rcx, r8
jl 0x1401e94a0
lea rax, [rcx + rcx*8]
mov r10d, dword [rdi + rax*8 - 0x38]
lea rsi, [rdi + rax*8]
test r10d, r10d
jne 0x1401e94f6
movsx edx, word [rsi]
mov ecx, dword [rsi + 8]
movsx ebp, word [rsi - 0x48]
sub ecx, dword [rsi - 0x40]
sub edx, ebp
call fcn.1401faf20
mov r10d, eax
mov dword [rsi - 0x38], eax
jmp 0x1401e94fa
movzx ebp, word [rsi - 0x48]
movsx edx, bp
mov eax, r10d
mov ecx, r11d
sub ecx, edx
sub edx, r11d
mov r8d, ecx
sar r8d, 0x1f
and r8d, 0xfffffffe
inc r8d
test ecx, ecx
cmovns edx, ecx
mov ecx, r8d
neg ecx
movsxd r9, edx
cdq
xor eax, edx
sub eax, edx
cdqe
imul r9, rax
add r9, 0x8000
sar r9, 0x10
test r10d, r10d
mov eax, r9d
cmovns ecx, r8d
neg eax
test ecx, ecx
cmovle r9d, eax
add r9d, dword [rsi - 0x40]
mov r8, qword [rsp + 0x50]
mov ecx, 0x300
test r15d, r15d
jne 0x1401e9564
mov dword [rbx + 8], r9d
jmp 0x1401e9568
mov dword [rbx + 0xc], r9d
or word [rbx - 8], r12w
mov edx, 0x100
movabs r9, 0xe38e38e38e38e39
add rbx, 0x30
lea rax, [rbx - 8]
cmp rax, r13
jb 0x1401e93d0
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret