joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140175050
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
cmp qword [rdx + 0x10], 1
mov rbx, rdx
mov rdi, rcx
je 0x14017507c
mov edx, dword [rdx]
jmp 0x1401750af
mov rcx, qword [rdx + 8]
movabs rax, 0x4800144005b3
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul edx, ecx, 0x3e8
add edx, dword [rbx]
xor r14d, r14d
lea rsi, [0x140629e90]
movabs r15, 0x4d54ee85da812030
sub edx, 0x79
je 0x14017519a
sub edx, 0x450
je 0x140175160
sub edx, 6
je 0x140175126
cmp edx, 1
jne 0x1401751eb
mov rcx, qword [0x140629e98]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x140175118
mov rax, qword [0x140629e90]
mov edx, 0x2751
mov rcx, rsi
call qword [rax + 0x30]
mov dword [rbp - 0x20], 0x2751
jmp 0x1401751cb
mov al, 1
mov dword [rbp - 0x20], 0x2751
jmp 0x1401751cb
mov rcx, qword [0x140629e98]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x140175155
mov rax, qword [0x140629e90]
mov edx, 0x2743
mov rcx, rsi
call qword [rax + 0x30]
mov dword [rbp - 0x20], 0x2743
jmp 0x1401751cb
mov al, 1
mov dword [rbp - 0x20], 0x2743
jmp 0x1401751cb
mov rcx, qword [0x140629e98]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x14017518f
mov rax, qword [0x140629e90]
mov edx, 0x274d
mov rcx, rsi
call qword [rax + 0x30]
mov dword [rbp - 0x20], 0x274d
jmp 0x1401751cb
mov al, 1
mov dword [rbp - 0x20], 0x274d
jmp 0x1401751cb
mov rcx, qword [0x140629e98]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x1401751c2
mov rax, qword [0x140629e90]
mov edx, 0x274c
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x1401751c4
mov al, 1
mov dword [rbp - 0x20], 0x274c
movzx eax, al
mov qword [rbp - 0x18], rsi
add rax, 2
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov rax, qword [rbx + 0x10]
test al, 1
je 0x140175206
cmp rax, 1
jne 0x140175288
cmp dword [rbx], r14d
jne 0x140175288
cmp rdi, 0xffffffffffffffff
jne 0x14017525f
mov rcx, qword [0x140629e98]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x140175234
mov rax, qword [0x140629e90]
mov edx, 0x2719
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x140175236
mov al, 1
movzx eax, al
mov dword [rbp - 0x20], 0x2719
add rax, 2
mov qword [rbp - 0x18], rsi
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
jmp 0x140175288
xor r9d, r9d
mov dword [rsp + 0x20], r14d
mov edx, 0xffff
mov r8d, 0x7010
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
mov rcx, rbx
setne dl
call fcn.140174c30
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rbp
ret
Function at 0x140175860
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140628fc0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, qword [rbp + 0x50]
lea r9, [rbp - 0x18]
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov dword [rbp - 0x18], r15d
lea r8d, [r15 + 1]
mov dword [rsp + 0x20], r15d
call qword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, qword [0x140629e98]
lea r14, [0x140629e90]
movabs r12, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r15d
add rdx, r12
mov edi, eax
cmp rdx, 1
jbe 0x1401758f3
mov rcx, qword [0x140629e90]
mov edx, eax
mov r8, qword [rcx + 0x30]
mov rcx, r14
call r8
jmp 0x1401758f8
test edi, edi
setne al
movzx eax, al
movabs r10, 0x4800144005b3
add rax, 2
mov dword [rbp - 0x30], edi
mov qword [rbp - 0x28], r14
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov r9, qword [rbx + 0x10]
cmp r9, 1
je 0x140175936
mov eax, dword [rbx]
mov r8d, eax
jmp 0x140175966
mov rcx, qword [rbx + 8]
mov rax, r10
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x1401759a5
mov rcx, qword [0x140629e98]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x14017599a
mov rax, qword [0x140629e90]
mov edx, 0x2746
mov rcx, r14
call qword [rax + 0x30]
mov dword [rbp - 0x30], 0x2746
jmp 0x140175a12
mov al, 1
mov dword [rbp - 0x30], 0x2746
jmp 0x140175a12
cmp r9, 1
jne 0x1401759d8
mov rcx, qword [rbx + 8]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x140175a32
mov rcx, qword [0x140629e98]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x140175a09
mov rax, qword [0x140629e90]
mov edx, 0x274d
mov rcx, r14
call qword [rax + 0x30]
jmp 0x140175a0b
mov al, 1
mov dword [rbp - 0x30], 0x274d
movzx eax, al
mov qword [rbp - 0x28], r14
add rax, 2
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test esi, esi
je 0x140175a3d
mov eax, 0xffffffff
jmp 0x140175a54
mov eax, dword [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbp - 0x20], r15
movsd xmm0, qword [rbp - 0x20]
movsd qword [rbx + 0x10], xmm0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1404a0a30
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140176a30
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140628fc0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x140634f34], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x140176aa9
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1404a0a30
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [fcn.14012c0a0]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1404a0a30
add rsp, 0x40
pop rbx
ret
Function at 0x14017ac60
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x140628fc0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0xa0]
mov r11, r9
mov rax, qword [rcx + 8]
mov r10, r8
mov rsi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x98], 0
je 0x14017acb0
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call fcn.140177a10
jmp 0x14017ad48
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x14017acd0
mov rcx, qword [rsi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rdi
call fcn.140177a10
jmp 0x14017ad48
xor eax, eax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov r8d, r11d
mov eax, dword [rsp + 0x90]
mov rdx, r10
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
mov rbx, qword [rsp + 0x50]
je 0x14017ad3c
cmp eax, 0x3e5
je 0x14017ad3c
mov r9d, dword [rsp + 0x40]
mov r8d, eax
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.140177a10
jmp 0x14017ad48
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.140177980
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1404a0a30
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x14017ad60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
sub rsp, 0x58
mov rax, qword [0x140628fc0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, qword [rsp + 0xa0]
mov r11, r9
mov rax, qword [rcx + 8]
mov r10, r8
mov rdi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x98], 0
je 0x14017adb0
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call fcn.140177a10
jmp 0x14017ae61
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x14017add3
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rbx
call fcn.140177a10
jmp 0x14017ae61
mov eax, dword [rsp + 0x90]
lea r9, [rsp + 0x40]
xor edx, edx
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x44]
mov dword [rsp + 0x40], edx
mov r8d, r11d
mov qword [rsp + 0x28], rbx
mov rdx, r10
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rsi
call qword [sym.imp.WS2_32.dll_WSARecv]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x14017ae22
mov eax, 0x2746
jmp 0x14017ae2f
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
mov rsi, qword [rsp + 0x50]
je 0x14017ae55
cmp eax, 0x3e5
je 0x14017ae55
mov r9d, dword [rsp + 0x40]
mov r8d, eax
mov rcx, qword [rdi + 8]
mov rdx, rbx
call fcn.140177a10
jmp 0x14017ae61
mov rcx, qword [rdi + 8]
mov rdx, rbx
call fcn.140177980
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1404a0a30
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x140187ee0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x58
cmp byte [0x140634eb4], 0
je 0x140187ef1
test cl, cl
je 0x140187f63
mov byte [0x140634eb4], 1
test cl, cl
je 0x140187f15
mov edx, 0x24
lea rcx, [rsp + 0x30]
call fcn.140133640
lea rcx, [rsp + 0x30]
call fcn.14014c690
xor eax, eax
lea r8, [0x140187650]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [0x140634e08]
cmp rdx, qword [0x140634e10]
mov qword [rsp + 0x68], rax
je 0x140187f59
mov qword [rdx], rax
add qword [0x140634e08], 8
add rsp, 0x58
ret
lea r8, [rsp + 0x68]
call fcn.1401c66f0
add rsp, 0x58
ret

Function at 0x140188110
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
call fcn.140187f70
mov rsi, qword [0x140634e08]
mov rdi, qword [0x140634e00]
cmp rdi, rsi
je 0x140188160
nop word [rax + rax]
mov rbx, qword [rdi]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 8
cmp rdi, rsi
jne 0x140188140
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140191130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x140191164
cmp ecx, r10d
jge 0x140191152
mov rcx, rbx
call fcn.140190940
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x14019119e
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x14], ecx
movzx r9d, cl
test eax, eax
jg 0x140191180
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x1401911c6
mov rax, qword gs:[0x58]
mov edx, 0x28
mov rcx, qword [rax]
lea rax, str.zlib_corrupt
mov qword [rdx + rcx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x1401911f5
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r8
jb 0x1401911df
xor dl, dl
jmp 0x1401911e8
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x1401911d6
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x1401911a2
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x14019125f
mov rax, qword gs:[0x58]
mov edx, 0x28
mov rcx, qword [rax]
lea rax, str.read_past_buffer
mov qword [rdx + rcx], rax
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x140191279
mov rcx, rbx
call fcn.140190a80
test eax, eax
je 0x140191252
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call fcn.1404da2a0
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x14019d190
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x140628fc0]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rdx, rcx
xor esi, esi
cmp qword [rcx + 0x18], 0xf
jbe 0x14019d1cc
mov r8, qword [rcx]
add r8, qword [rcx + 0x10]
mov rdx, qword [rcx]
jmp 0x14019d1d3
mov r8, qword [rcx + 0x10]
add r8, rcx
lea rcx, [rsp + 0x78]
call fcn.1401b5ec0
nop
mov edx, 0x7e
lea rcx, [rsp + 0x38]
call fcn.140133640
mov rbx, rax
mov r8, rax
cmp qword [rax + 0x18], 0xf
jbe 0x14019d1fd
mov r8, qword [rax]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.1401b6ca0
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 7
cmova rdx, qword [rsp + 0x58]
cmp qword [rbx + 0x18], 0xf
jbe 0x14019d255
mov rbx, qword [rbx]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdx
mov r9d, 0xffffffff
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop
lea rcx, [rsp + 0x38]
call fcn.14014c690
lea r8, [rsp + 0x78]
cmp qword [rsp + 0x90], 7
cmova r8, qword [rsp + 0x78]
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 7
cmova rdx, qword [rsp + 0x58]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x58]
call fcn.1401aeab0
nop
lea rcx, [rsp + 0x78]
call fcn.1401aeab0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1404a0a30
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1401a8400
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x140628fc0]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x140635008], eax
inc eax
cmp eax, 1
jne 0x1401a844d
lea ecx, [rax + 1]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x14063500c], eax
test bl, bl
je 0x1401a84f1
xor ebx, ebx
lock xadd dword [0x14063500c], ebx
test ebx, ebx
je 0x1401a84f1
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x210], rsi
add rcx, qword [0x140629e98]
lea rsi, [0x140629e90]
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x1401a84a6
mov rax, qword [0x140629e90]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x1401a84a8
mov al, 1
lea rcx, str.C:_vcpkginstalledx64_windows_staticinclude_boost_asiodetailimplwinsock_init.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.throw_on_error
mov rsi, qword [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x48
mov dword [rsp + 0x34], 0x1a
test al, 1
jne 0x1401a8515
mov rax, rdi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1404a0a30
mov rbx, qword [rsp + 0x218]
add rsp, 0x200
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.140174820
int3
Function at 0x1401dc0b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
cmp byte [rcx + 0x19], 0
mov r12, r9
mov rdi, r8
mov r10, rdx
mov rbp, rcx
jge 0x1401dc120
mov rax, qword [rcx + 0x80]
xor ecx, ecx
mov rdx, qword [rax + 0x10]
mov dword [rsp + 0x20], edx
test r8, r8
je 0x1401dc10e
nop word [rax + rax]
mov rax, rcx
and eax, 3
movzx eax, byte [rsp + rax + 0x20]
xor byte [r10 + rcx], al
inc rcx
cmp rcx, rdi
jb 0x1401dc0f0
mov rax, qword [rbp + 0x80]
mov rcx, rdi
and ecx, 3
je 0x1401dc11c
shl cl, 3
ror rdx, cl
mov qword [rax + 0x10], rdx
mov rax, qword [rbp + 0x80]
mov rdx, r10
mov rbx, qword [rax]
add rbx, 0x50
mov r15, qword [rbx + 0x10]
lea r14, [rbx + 0x10]
mov rcx, rbx
call fcn.14014c6f0
mov r10, qword [rbp + 0x80]
mov rax, qword [r10]
cmp dword [rax + 0x70], 1
jne 0x1401dc1da
cmp qword [rbx + 0x18], 0xf
jbe 0x1401dc167
mov rdx, qword [rbx]
mov rbx, rdx
add rdx, qword [r14]
jmp 0x1401dc16d
mov rdx, qword [r14]
add rdx, rbx
lea rax, [r15 + rbx]
cmp rax, rdx
je 0x1401dc1da
lea rbx, [0x1405cddb0]
nop dword [rax]
cmp dword [r10 + 0x18], 0
movzx r8d, byte [rax]
mov r9d, r8d
movzx r11d, byte [r8 + rbx]
je 0x1401dc1a3
mov ecx, dword [r10 + 0x1c]
and r9d, 0x3f
shl ecx, 6
or r9d, ecx
jmp 0x1401dc1b2
mov r8d, 0xff
mov ecx, r11d
sar r8d, cl
and r9d, r8d
mov dword [r10 + 0x1c], r9d
mov ecx, dword [r10 + 0x18]
add ecx, 0x10
shl ecx, 4
add ecx, r11d
movzx r8d, byte [rcx + rbx]
mov dword [r10 + 0x18], r8d
cmp r8d, 1
je 0x1401dc1f0
inc rax
cmp rax, rdx
jne 0x1401dc180
sub qword [rbp + 0x30], rdi
mov rax, rdi
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
call fcn.14017ece0
mov qword [rsp + 0x30], rax
xor eax, eax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [r12], xmm0
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401fd550
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rdi, r8
mov rax, rdx
mov rbx, rcx
test r8, r8
je 0x1401fd589
xorps xmm0, xmm0
mov qword [rsp + 0x30], 0
movups xmmword [r8], xmm0
movsd xmm0, qword [rsp + 0x30]
movsd qword [r8 + 0x10], xmm0
test rax, rax
je 0x1401fd5b3
mov rdx, rbx
cmp qword [rcx + 0x18], 7
jbe 0x1401fd59b
mov rdx, qword [rcx]
cmp qword [rax + 0x18], 7
jbe 0x1401fd5a5
mov rax, qword [rax]
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
jmp 0x1401fd5c5
cmp qword [rcx + 0x18], 7
jbe 0x1401fd5bd
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1401fd5db
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xorps xmm0, xmm0
mov qword [rsp + 0x48], 0
movups xmmword [rsp + 0x20], xmm0
movsd xmm0, qword [rsp + 0x48]
movsd qword [rsp + 0x30], xmm0
lea r8, [rsp + 0x20]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.1401ff500
nop
cmp dword [rsp + 0x68], 3
je 0x1401fd62e
lea r9, str.boost::filesystem::create_directory
mov r8, rdi
mov rdx, rbx
mov ecx, esi
call fcn.140201e10
xor al, al
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1401fee40
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov esi, edx
movzx r14d, dl
shr esi, 4
mov r15, r8
and sil, 1
mov ebp, edx
mov rbx, rcx
and r14b, 1
je 0x1401feedf
and edx, 0xfffffffe
cmp qword [rcx + 0x18], 7
jbe 0x1401fee80
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1401feedf
call qword [sym.imp.KERNEL32.dll_GetLastError]
movsxd r10, eax
cmp r10d, 0x35
ja 0x1401feead
movabs rax, 0x2000000020800c
bt rax, r10
jb 0x1401fef7b
lea eax, [r10 - 0x43]
cmp eax, 0x38
ja 0x1401feeca
movabs rcx, 0x100000000100001
bt rcx, rax
jb 0x1401fef7b
cmp r10d, 0xa1
je 0x1401fef7b
mov ecx, r10d
jmp 0x1401fef69
mov rax, qword [rbx + 0x18]
mov rcx, rbx
test sil, sil
jne 0x1401feefc
cmp rax, 7
jbe 0x1401feef4
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1401fef0b
cmp rax, 7
jbe 0x1401fef05
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1401fef7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movsxd rdi, eax
cmp edi, 0x35
ja 0x1401fef2d
movabs rax, 0x2000000020800c
bt rax, rdi
jb 0x1401fef7b
lea eax, [rdi - 0x43]
cmp eax, 0x38
ja 0x1401fef45
movabs rcx, 0x100000000100001
bt rcx, rax
jb 0x1401fef7b
cmp edi, 0xa1
je 0x1401fef7b
test r14b, r14b
je 0x1401fef67
cmp qword [rbx + 0x18], 7
mov rcx, rbx
jbe 0x1401fef5f
mov rcx, qword [rbx]
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, edi
lea r9, str.boost::filesystem::remove
mov r8, r15
mov rdx, rbx
call fcn.140201e10
xor al, al
jmp 0x1401fef81
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1401ff680
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x140628fc0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r14, r8
mov rdi, rdx
mov rsi, rcx
cmp qword [rdx + 0x18], 7
jbe 0x1401ff6ad
mov rdx, qword [rdx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x1401ff6c5
lea rcx, [rsp + 0x48]
call fcn.1401b6dd0
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 7
cmova rcx, qword [rsp + 0x48]
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x88
lea r8d, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x1401ff75e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401ff759
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401ff80f
call fcn.1404a0a50
movdqa xmm0, xmmword [0x1405da360]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], bp
cmp rbx, 0xffffffffffffffff
jne 0x1401ff7d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 5
jne 0x1401ff7c6
mov rcx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x1401ff791
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x1401ff7be
bt eax, 0xa
jb 0x1401ff7c6
mov edx, eax
mov rcx, rdi
call fcn.1401fdba0
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
mov dword [rsi], ebx
mov dword [rsi + 4], eax
jmp 0x1401ff7f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov r9, r14
mov r8, rdi
mov edx, ebp
mov rcx, rsi
call fcn.1401fde90
nop
jmp 0x1401ff7f4
mov r9, r14
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.1401ff1e0
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1404a0a30
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1404b7494
nop
int3
Function at 0x1402047c0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
lea r8, [rsp + 0x30]
mov edx, 4
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1402047ea
mov eax, dword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
lea rdx, str.error_while_reading
mov rcx, rbx
call fcn.140204800
int3