joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007fc0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x520
mov rax, qword [0x140013138]
xor rax, rsp
mov qword [rsp + 0x518], rax
mov dword [rsp + 0x510], 0
mov dword [rsp + 0x270], 0
lea rax, [rsp + 0x278]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
mov qword [rsp + 0x2e0], 0
lea rax, [rsp + 0x2e8]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
cmp qword [rsp + 0x548], 0
je 0x140008051
mov rax, qword [rsp + 0x548]
mov qword [rax], 0
mov dword [rsp + 0x270], 0x68
mov rax, qword [rsp + 0x530]
cmp qword [rax + 0x48], 0
je 0x1400080c2
mov rax, qword [rsp + 0x540]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x538]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x530]
mov rax, qword [rax + 0x48]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x530]
mov r9, qword [rax + 0x40]
lea r8, [0x1400023f0]
mov edx, 0x208
lea rcx, [rsp + 0x300]
call fcn.1400049c0
mov dword [rsp + 0x510], eax
jmp 0x1400080fb
mov rax, qword [rsp + 0x540]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x530]
mov r9, qword [rax + 0x40]
lea r8, [0x140002490]
mov edx, 0x208
lea rcx, [rsp + 0x300]
call fcn.1400049c0
mov dword [rsp + 0x510], eax
cmp dword [rsp + 0x510], 0
jge 0x140008122
lea rdx, [0x1400024f0]
mov ecx, dword [rsp + 0x510]
call fcn.140004f80
jmp 0x14000822b
mov r9d, dword [rsp + 0x538]
lea r8, [0x140002558]
mov edx, 0x208
lea rcx, [rsp + 0x60]
call fcn.1400049c0
mov dword [rsp + 0x510], eax
cmp dword [rsp + 0x510], 0
jge 0x14000816e
lea rdx, [0x1400024f0]
mov ecx, dword [rsp + 0x510]
call fcn.140004f80
jmp 0x14000822b
lea rax, [rsp + 0x60]
mov qword [rsp + 0x288], rax
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x270]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x300]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400081ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rsp + 0x300]
lea rdx, [0x140002590]
mov ecx, eax
call fcn.140004f80
jmp 0x14000822b
cmp qword [rsp + 0x548], 0
je 0x14000820f
mov rax, qword [rsp + 0x548]
mov rcx, qword [rsp + 0x2e0]
mov qword [rax], rcx
jmp 0x14000821d
mov rcx, qword [rsp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x2e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x510]
mov rcx, qword [rsp + 0x518]
xor rcx, rsp
call fcn.14000f700
add rsp, 0x520
pop rdi
ret
Function at 0x14000ea80
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x18
mov eax, dword [rsp + 0x20]
xor eax, 0xffffffff
mov dword [rsp], eax
mov dword [rsp + 4], 0
jmp 0x14000eab0
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 4], eax
jae 0x14000eaec
mov eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x28]
movzx eax, byte [rcx + rax]
mov ecx, dword [rsp]
xor ecx, eax
mov eax, ecx
and eax, 0xff
mov eax, eax
lea rcx, [0x1400032d0]
mov edx, dword [rsp]
shr edx, 8
mov eax, dword [rcx + rax*4]
xor eax, edx
mov dword [rsp], eax
jmp 0x14000eaa6
mov eax, dword [rsp]
xor eax, 0xffffffff
add rsp, 0x18
ret

Function at 0x14000ecf0
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x10], 0xffffffffffffffff
jne 0x14000ed11
mov eax, 0x80070057
jmp 0x14000ed55
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14000ed34
xor eax, eax
jmp 0x14000ed55
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x3e5
jne 0x14000ed4c
xor eax, eax
jmp 0x14000ed55
mov ecx, dword [rsp + 0x24]
call fcn.140003c40
add rsp, 0x38
ret
Function at 0x14000f444
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r13
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140013b08], rbx
je 0x14000f490
cmp rax, rbx
jne 0x14000f483
mov ebx, 1
mov esi, ebx
jmp 0x14000f495
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000f468
mov ebx, 1
mov eax, dword [0x140013b00]
cmp eax, ebx
jne 0x14000f4ab
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x14000f508
mov eax, dword [0x140013b00]
test eax, eax
jne 0x14000f502
mov dword [0x140013b00], ebx
lea r13, [0x140001378]
lea rdi, [0x140001360]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r13
jae 0x14000f4f4
test eax, eax
jne 0x14000f4f8
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000f4e9
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000f4d2
test eax, eax
je 0x14000f508
mov eax, 0xff
jmp 0x14000f5d9
mov dword [0x14001357c], ebx
mov eax, dword [0x140013b00]
cmp eax, ebx
jne 0x14000f52f
lea rdx, [0x140001358]
lea rcx, [0x140001348]
call sub.msvcrt.dll__initterm
mov dword [0x140013b00], 2
test esi, esi
jne 0x14000f53c
xor eax, eax
xchg qword [0x140013b08], rax
cmp qword [0x140013b20], 0
je 0x14000f565
lea rcx, [0x140013b20]
call fcn.14000feec
test eax, eax
je 0x14000f565
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x140013b20]
mov r8, qword [0x140013560]
mov rdx, qword [0x140013568]
mov ecx, dword [0x140013558]
call fcn.14000a410
mov dword [0x140013578], eax
cmp dword [0x14001355c], 0
jne 0x14000f595
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14001357c], 0
jne 0x14000f5aa
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140013578]
jmp 0x14000f5d9
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret
sub rsp, 0x28
call fcn.140010000
add rsp, 0x28
jmp 0x14000f444
Function at 0x14000f700
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140013138]
jne 0x14000f71b
rol rcx, 0x10
test cx, 0xffff
jne 0x14000f717
ret 0
ror rcx, 0x10
jmp 0x1400100bc
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140013630]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rax, qword [0x140013728]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140010141
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140013630]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x140010163
mov rax, qword [rsp + 0x88]
mov qword [0x140013728], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400136c8], rax
mov rax, qword [0x140013728]
mov qword [0x1400135a0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400136b0], rax
mov dword [0x140013590], 0xc0000409
mov dword [0x140013594], 1
mov rax, qword [0x140013138]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140013140]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140001488]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14000f740
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x540
mov rax, qword [0x140013138]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x14000f7bd
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x14000f7dd
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, [0x140001420]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.14000f700
add rsp, 0x540
pop rbx
ret

Function at 0x14000ff58
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
test rcx, rcx
je 0x14000ffa5
cmp rcx, 0xffffffffffffffff
je 0x14000ffa5
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000ff9d
cmp dword [rcx + 0x3c], edx
jl 0x14000ff9d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14000ff9d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000ffa5
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140001264
Capabilities:
Get domain controller name

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [r11 - 0x18]
mov rsi, r8
mov rdx, rcx
mov qword [r11 - 0x20], rax
xor ebx, ebx
mov dword [rsp + 0x20], 0x40020010
xor r9d, r9d
mov qword [r11 - 0x18], rbx
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.NETAPI32.dll_DsGetDcNameW]
test eax, eax
jne 0x14000130e
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2 + 4], bx
jne 0x1400012bd
lea eax, [rax*2 + 2]
mov ecx, 0x40
mov edx, eax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
mov rcx, rax
test rax, rax
je 0x140001301
mov rax, qword [rsp + 0x30]
mov r8d, edi
mov ebx, 1
mov rdx, qword [rax]
add rdx, 4
call fcn.140006a10
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.NETAPI32.dll_NetApiBufferFree]
jmp 0x14000131c
mov edx, eax
lea rcx, str.ERROR_alibaba_net_getDC___DsGetDcName:__u_n
call fcn.140001398
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400049d0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x140002be4
Capabilities:
Get user security identifier

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, qword [rsp + 0xb0]
lea rax, [r11 - 0x40]
mov qword [r11 - 0x58], rax
lea r9, [r11 - 0x44]
xor esi, esi
lea rax, [r11 - 0x48]
and dword [rsp + 0x44], esi
mov rbx, rdx
and dword [rsp + 0x40], esi
mov rdi, r8
mov rbp, rcx
mov qword [r11 - 0x60], rax
and qword [r11 - 0x68], rsi
mov rdx, rcx
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x140002cd0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140002cd0
mov edx, dword [rsp + 0x44]
lea ecx, [rsi + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x140002cd0
mov edx, dword [rsp + 0x40]
lea ecx, [rsi + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x140002cc4
mov r8, qword [rbx]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x30], rdx
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x40]
mov rcx, r14
mov qword [rsp + 0x28], rdx
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov esi, eax
test eax, eax
jne 0x140002cd0
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rdi], rax
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov eax, esi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400049d0
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140002da8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.14000110c
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [0x14002fe68]
test rcx, rcx
je 0x140002dcc
call fcn.14000cb60
and qword [0x14002fe68], 0
lea rcx, [0x140002e48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov ecx, 1
call fcn.14000c5c4
mov rcx, rax
call fcn.14000ce38
mov edx, dword [0x14002ff30]
mov ecx, eax
call fcn.14000cc38
mov ecx, 2
call fcn.14000c5c4
mov rcx, rax
call fcn.14000ce38
mov edx, dword [0x14002ff28]
mov ecx, eax
call fcn.14000cc38
mov ecx, dword [0x14002ff2c]
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
xor ecx, ecx
cmp ebx, 0xc000004b
jne 0x140002e3e
call qword [sym.imp.KERNEL32.dll_ExitThread]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x14000e674
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000e470
Function at 0x140014448
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400144cf
mov rsi, rbx
cmp word [rax], bp
je 0x14001448e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140014478
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140014474
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000fcf4
mov rdi, rax
test rax, rax
je 0x1400144bc
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140006a10
mov rbp, rdi
xor ecx, ecx
call fcn.14000fcb8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400170d0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400170e6
mov al, 1
jmp 0x140017146
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400170f7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140017144
mov ecx, dword [rcx + 0x18]
nop
call fcn.140012f64
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140017144
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140017144
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140017144
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140017146
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1414d0058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1414d01df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1414d0089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1414d006f
add dl, dl
jne 0x1414d0096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1414d00f6
xor eax, eax
add dl, dl
jne 0x1414d00a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1414d01ad
add dl, dl
jne 0x1414d00b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1414d00c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1414d00d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1414d00dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1414d00ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1414d007e
mov eax, 1
add dl, dl
jne 0x1414d0106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1414d0113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1414d00fb
sub eax, ebx
mov ebx, 1
jne 0x1414d014c
mov ecx, 1
add dl, dl
jne 0x1414d012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1414d013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1414d0123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1414d007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1414d0168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1414d0175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1414d015d
cmp eax, 0x7d00
jae 0x1414d019b
cmp eax, 0x500
jb 0x1414d0196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1414d007e
cmp eax, 0x7f
ja 0x1414d019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1414d007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1414d01d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1414d007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000eec5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
sub rsp, 0x58
cmp byte [rcx + 0x79], 0
je 0x14000eed8
xor esi, esi
jmp 0x14000f0a1
mov rdi, rcx
mov rsi, qword [rcx + 0x48]
test byte [rcx], 1
je 0x14000ef13
lea rdx, [rdi + 8]
mov r9, qword [rdi + 0x50]
cmp qword [rdi + 0x38], 0xffffffffffffffff
mov rax, qword [rdi + 0x58]
mov rcx, qword [rdi + 0x60]
je 0x14000f008
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x30], 0
jmp 0x14000f017
cmp byte [rdi + 0x1a], 0
jne 0x14000f02f
mov rax, qword [rdi + 0x50]
mov rcx, qword [rdi + 8]
mov dl, byte [rdi + 0x18]
mov r8d, edx
xor r8b, 1
mov byte [rdi + 0x18], r8b
test rcx, rcx
je 0x14000ef4e
cmp rcx, rax
jae 0x14000ef48
cmp byte [rsi + rcx], 0xbf
jg 0x14000ef4e
jmp 0x14000f0ab
jne 0x14000f0ab
cmp rcx, rax
je 0x14000f026
movzx r9d, byte [rsi + rcx]
test r9b, r9b
js 0x14000ef66
mov r8d, r9d
jmp 0x14000efc2
mov r8d, r9d
and r8d, 0x1f
movzx r11d, byte [rsi + rcx + 1]
and r11d, 0x3f
cmp r9b, 0xdf
jbe 0x14000efb2
movzx r10d, byte [rsi + rcx + 2]
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
cmp r9b, 0xf0
jb 0x14000efbb
movzx r9d, byte [rsi + rcx + 3]
and r8d, 7
shl r8d, 0x12
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
or r8d, r9d
jmp 0x14000efc2
shl r8d, 6
or r8d, r11d
jmp 0x14000efc2
shl r8d, 0xc
or r8d, r10d
test dl, 1
jne 0x14000f033
cmp r8d, 0x110000
je 0x14000f02b
mov edx, 1
cmp r8d, 0x80
jb 0x14000effc
mov edx, 2
cmp r8d, 0x800
jb 0x14000effc
cmp r8d, 0x10000
mov edx, 4
sbb rdx, 0
add rcx, rdx
mov qword [rdi + 8], rcx
jmp 0x14000ef25
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x30], 1
lea rcx, [rsp + 0x40]
mov r8, rsi
call fcn.140082e40
jmp 0x14000f04a
test dl, 1
jne 0x14000f036
mov byte [rdi + 0x1a], 1
xor eax, eax
jmp 0x14000f045
mov rax, rcx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov eax, 1
mov qword [rsp + 0x40], rax
test byte [rsp + 0x40], 1
je 0x14000f06b
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rdi + 0x68]
sub rdx, rcx
add rsi, rcx
mov qword [rdi + 0x68], rax
jmp 0x14000f0a1
cmp byte [rdi + 0x79], 0
jne 0x14000eed1
mov byte [rdi + 0x79], 1
cmp byte [rdi + 0x78], 1
jne 0x14000f089
mov rsi, qword [rdi + 0x68]
mov rdx, qword [rdi + 0x70]
jmp 0x14000f09a
mov rsi, qword [rdi + 0x68]
mov rdx, qword [rdi + 0x70]
cmp rdx, rsi
je 0x14000eed1
sub rdx, rsi
add rsi, qword [rdi + 0x48]
mov rax, rsi
add rsp, 0x58
pop rdi
pop rsi
ret
ud2
Function at 0x140016fbc
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor ecx, ecx
test rbx, rbx
setne cl
call fcn.140017007
test rbx, rbx
je 0x140016ff5
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140017032
mov cl, byte [rdi + 8]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14001702a

Function at 0x140017032
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x140017058
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x140017042
mov qword [rcx], rax
ret
Function at 0x14002d5e7
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf0
mov rbx, rdx
mov rsi, rcx
mov ecx, 0x18
mov edx, 8
call fcn.14002bffd
mov rdi, rax
mov eax, 1
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov byte [rdi + 0x10], 0
cmp rbx, 0xffffffffffffffff
je 0x14002d7d9
xorps xmm0, xmm0
lea rdx, [rsp + 0x70]
movaps xmmword [rdx + 0x70], xmm0
movaps xmmword [rdx + 0x60], xmm0
movaps xmmword [rdx + 0x50], xmm0
movaps xmmword [rdx + 0x40], xmm0
movaps xmmword [rdx + 0x30], xmm0
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
lea r8, [rsp + 0x2c]
mov dword [r8], 0x80
mov rcx, rbx
call qword [sym.imp.ws2_32.dll_getpeername]
cmp eax, 0xffffffff
je 0x14002d67d
movsxd r8, dword [rsp + 0x2c]
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x70]
call fcn.14007c97b
jmp 0x14002d68e
call fcn.14008185d
mov qword [rsp + 0x38], rax
mov word [rsp + 0x30], 2
lea r14, [rsp + 0x50]
xorps xmm0, xmm0
lea rdx, [rsp + 0x70]
movaps xmmword [rdx + 0x70], xmm0
movaps xmmword [rdx + 0x60], xmm0
movaps xmmword [rdx + 0x50], xmm0
movaps xmmword [rdx + 0x40], xmm0
movaps xmmword [rdx + 0x30], xmm0
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
lea r8, [rsp + 0x2c]
mov dword [r8], 0x80
mov rcx, rbx
call qword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x14002d6ed
movsxd r8, dword [rsp + 0x2c]
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.14007c97b
movzx ebx, word [rsp + 0x50]
jmp 0x14002d702
call fcn.14008185d
mov qword [rsp + 0x58], rax
mov word [rsp + 0x50], 2
mov bx, 2
movzx ebp, word [rsp + 0x30]
cmp bp, 2
sete al
cmp bx, 2
sete cl
or cl, al
cmp cl, 1
jne 0x14002d725
and qword [rsi], 0
jmp 0x14002d7a8
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [r14]
movups xmm1, xmmword [r14 + 0x10]
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm1
mov ecx, 0x40
mov edx, 4
call fcn.14002bffd
mov r14, rax
movaps xmm0, xmmword [rsp + 0x70]
movaps xmm1, xmmword [rsp + 0x80]
movaps xmm2, xmmword [rsp + 0x90]
movaps xmm3, xmmword [rsp + 0xa0]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x30], xmm3
xor ecx, ecx
call fcn.14002cb94
mov qword [rsi], r14
lea rax, [0x1400ce368]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rdi
mov word [rsi + 0x18], 1
mov rdx, qword [rsp + 0x38]
mov ecx, ebp
call fcn.14002d7db
mov rdx, qword [rsp + 0x58]
mov ecx, ebx
call fcn.14002d7db
nop
add rsp, 0xf0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
ud2