joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009dfe0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [0x14026be10]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor esi, esi
lea r8, [rcx + 0x90]
mov r9d, esi
mov rdi, rcx
movzx eax, byte [r8 + 1]
movzx edx, byte [r8]
lea r8, [r8 + 4]
shl edx, 8
or edx, eax
movzx eax, byte [r8 - 2]
shl edx, 8
or edx, eax
movzx eax, byte [r8 - 1]
shl edx, 8
or edx, eax
mov dword [rsp + r9*4], edx
inc r9
cmp r9, 0x10
jl 0x14009e020
lea rax, [rsp + 8]
mov edx, 0x40
nop dword [rax]
mov ecx, dword [rax + 0x2c]
xor ecx, dword [rax + 0x18]
xor ecx, dword [rax - 8]
xor ecx, dword [rax]
lea rax, [rax + 4]
rol ecx, 1
mov dword [rax + 0x34], ecx
sub rdx, 1
jne 0x14009e060
mov r15d, dword [rdi + 0x14]
mov ebx, r15d
mov r12d, dword [rdi + 0x18]
mov r10d, r12d
mov ebp, dword [rdi + 0x1c]
mov r9d, ebp
mov r13d, dword [rdi + 0x20]
mov r11d, r13d
mov r14d, dword [rdi + 0x24]
nop dword [rax]
mov eax, r9d
lea r8d, [r14 + 0x5a827999]
and eax, r10d
mov ecx, r10d
not ecx
mov edx, ebx
and ecx, r11d
rol edx, 5
or ecx, eax
mov r14d, r11d
add edx, ecx
mov r11d, r9d
add edx, dword [rsp + rsi*4]
mov r9d, r10d
add r8d, edx
ror r9d, 2
inc rsi
mov r10d, ebx
mov ebx, r8d
cmp rsi, 0x14
jl 0x14009e0a0
mov edx, shutdown
nop word [rax + rax]
rol r8d, 5
add r14d, 0x6ed9eba1
add r8d, dword [rsp + rdx*4]
mov ecx, r11d
xor ecx, r9d
add r8d, r14d
xor ecx, r10d
mov r14d, r11d
mov r11d, r9d
add r8d, ecx
mov r9d, r10d
inc rdx
ror r9d, 2
mov r10d, ebx
mov ebx, r8d
cmp rdx, 0x28
jl 0x14009e0f0
mov edx, 0x28
nop
mov ecx, r9d
rol r8d, 5
or ecx, r10d
mov eax, r9d
and ecx, r11d
add r14d, 0x8f1bbcdc
and eax, r10d
add r8d, r14d
or ecx, eax
mov r14d, r11d
add ecx, dword [rsp + rdx*4]
mov r11d, r9d
mov r9d, r10d
add r8d, ecx
ror r9d, 2
inc rdx
mov r10d, ebx
mov ebx, r8d
cmp rdx, 0x3c
jl 0x14009e130
mov edx, 0x3c
nop word [rax + rax]
mov eax, dword [rsp + rdx*4]
add r14d, 0xca62c1d6
rol r8d, 5
mov ecx, r11d
xor ecx, r9d
add r8d, r14d
xor ecx, r10d
mov r14d, r11d
mov r11d, r9d
add eax, ecx
mov r9d, r10d
add r8d, eax
ror r9d, 2
inc rdx
mov r10d, ebx
mov ebx, r8d
cmp rdx, 0x50
jl 0x14009e180
add dword [rdi + 0x24], r14d
lea eax, [r15 + r8]
mov dword [rdi + 0x14], eax
lea eax, [r12 + r10]
mov dword [rdi + 0x18], eax
lea eax, [r9 + rbp]
mov dword [rdi + 0x1c], eax
lea eax, [r11 + r13]
mov dword [rdi + 0x20], eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140168e10
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400a0020
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [rcx + 0x80]
mov rbx, rcx
shr r8, 3
mov eax, 0x7f
and r8d, 0x7f
mov rdi, rdx
mov ecx, r8d
sub eax, r8d
add rcx, rbx
xor edx, edx
mov byte [rcx + 0x90], pe_nt_image_headers64
add rcx, 0x91
cmp eax, 0x10
jae 0x1400a0081
mov r8d, eax
call fcn.14016c710
mov rcx, rbx
call fcn.1400a0240
xor edx, edx
lea rcx, [rbx + 0x90]
lea r8d, [rdx + 0x70]
jmp 0x1400a0087
add eax, 0xfffffff0
mov r8d, eax
call fcn.14016c710
movzx eax, byte [rbx + 0x88]
lea rcx, [rbx + 0x107]
mov byte [rcx], al
movzx eax, byte [rbx + 0x89]
mov byte [rcx - 1], al
movzx eax, byte [rbx + 0x8a]
mov byte [rcx - 2], al
movzx eax, byte [rbx + 0x8b]
mov byte [rcx - 3], al
movzx eax, byte [rbx + 0x8c]
mov byte [rcx - 4], al
movzx eax, byte [rbx + 0x8d]
mov byte [rcx - 5], al
movzx eax, byte [rbx + 0x8e]
mov byte [rcx - 6], al
movzx eax, byte [rbx + 0x8f]
mov byte [rcx - 7], al
lea rcx, [rbx + 0x10f]
movzx eax, byte [rbx + 0x80]
mov byte [rcx], al
movzx eax, byte [rbx + 0x81]
mov byte [rcx - 1], al
movzx eax, byte [rbx + 0x82]
mov byte [rcx - 2], al
movzx eax, byte [rbx + 0x83]
mov byte [rcx - 3], al
movzx eax, byte [rbx + 0x84]
mov byte [rcx - 4], al
movzx eax, byte [rbx + 0x85]
mov byte [rcx - 5], al
movzx eax, byte [rbx + 0x86]
mov byte [rcx - 6], al
movzx eax, byte [rbx + 0x87]
mov byte [rcx - 7], al
mov rcx, rbx
call fcn.1400a0240
mov eax, dword [rbx + 0x10]
cmp eax, 0x180
je 0x1400a01c8
cmp eax, 0x200
jne 0x1400a0226
lea rcx, [rbx + 0x42]
mov r8d, 8
lea rdx, [rdi + 1]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx - 2]
lea rcx, [rcx + 8]
mov byte [rdx + 6], al
lea rdx, [rdx + 8]
movzx eax, byte [rcx - 9]
mov byte [rdx - 3], al
movzx eax, byte [rcx - 8]
mov byte [rdx - 4], al
movzx eax, byte [rcx - 7]
mov byte [rdx - 5], al
movzx eax, byte [rcx - 6]
mov byte [rdx - 6], al
movzx eax, byte [rcx - 5]
mov byte [rdx - 7], al
movzx eax, byte [rcx - 4]
mov byte [rdx - 8], al
movzx eax, byte [rcx - 3]
mov byte [rdx - 9], al
sub r8, 1
jne 0x1400a0170
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14009d2e0
lea rdx, [rbx + 0x42]
mov r8d, 6
lea rax, [rdi + 1]
nop word [rax + rax]
movzx ecx, byte [rdx - 2]
lea rdx, [rdx + 8]
mov byte [rax + 6], cl
lea rax, [rax + 8]
movzx ecx, byte [rdx - 9]
mov byte [rax - 3], cl
movzx ecx, byte [rdx - 8]
mov byte [rax - 4], cl
movzx ecx, byte [rdx - 7]
mov byte [rax - 5], cl
movzx ecx, byte [rdx - 6]
mov byte [rax - 6], cl
movzx ecx, byte [rdx - 5]
mov byte [rax - 7], cl
movzx ecx, byte [rdx - 4]
mov byte [rax - 8], cl
movzx ecx, byte [rdx - 3]
mov byte [rax - 9], cl
sub r8, 1
jne 0x1400a01e0
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14009d2e0
Function at 0x1400a44d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xe8
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x14026be10]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r14, r9
mov rbx, r8
mov rbp, rdx
mov r15, rcx
xor ecx, ecx
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x3c], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
xor sil, sil
test eax, eax
jne 0x1400a463e
mov ecx, dword [rsp + 0x38]
test ecx, ecx
je 0x1400a46a3
call fcn.140032550
mov rdi, rax
test rax, rax
je 0x1400a46a7
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov rdx, rbp
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r15d, eax
test eax, eax
jne 0x1400a45cf
mov r8d, dword [rsp + 0x38]
mov eax, dword [rsp + 0x3c]
cmp eax, 4
jne 0x1400a45a8
cmp r8d, eax
jne 0x1400a45bf
mov edx, dword [rdi]
mov rcx, rbx
call fcn.14002bb70
jmp 0x1400a45ca
cmp eax, 1
je 0x1400a45b2
cmp eax, 2
jne 0x1400a45bf
mov rdx, rdi
mov rcx, rbx
call fcn.14002bc30
jmp 0x1400a45ca
mov rdx, rdi
mov rcx, rbx
call fcn.14002c110
mov sil, 1
jmp 0x1400a4634
xor edx, edx
mov r8d, 0x90
lea rcx, [rsp + 0x40]
call fcn.14016c710
lea rcx, [rsp + 0x40]
call fcn.14002b840
nop
mov edx, r15d
lea rcx, [rsp + 0x40]
call fcn.14002c880
mov rbx, qword [r14]
lea rcx, [rsp + 0x40]
call fcn.14002ed10
mov r8, rax
lea rdx, str.RegistryQueryError2
mov rcx, r14
call qword [rbx + 0x58]
mov rax, qword [r14]
mov r8, rbp
lea rdx, str.ValueName
mov rcx, r14
call qword [rax + 0x58]
nop
lea rcx, [rsp + 0x40]
call fcn.14002b890
mov rcx, rdi
call fcn.140169534
jmp 0x1400a46a3
xor edx, edx
mov r8d, 0x90
lea rcx, [rsp + 0x40]
call fcn.14016c710
lea rcx, [rsp + 0x40]
call fcn.14002b840
nop
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.14002c880
mov rbx, qword [r14]
lea rcx, [rsp + 0x40]
call fcn.14002ed10
mov r8, rax
lea rdx, str.RegistryQueryError
mov rcx, r14
call qword [rbx + 0x58]
mov r9, qword [r14]
mov r8, rbp
lea rdx, str.ValueName
mov rcx, r14
call qword [r9 + 0x58]
nop
lea rcx, [rsp + 0x40]
call fcn.14002b890
movzx eax, sil
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140168e10
add rsp, 0xe8
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400ae410
Capabilities:
Reference http user-agent string

Disassembly:
push rdi
sub rsp, 0x100
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x118], rbx
mov rax, qword [0x14026be10]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
lea rax, vtable.HttpControl.0
mov qword [rcx], rax
add rcx, 8
call fcn.1400f1730
nop
lea rcx, [rdi + 0x38]
call fcn.140074f10
nop
mov byte [rdi + 0x58], 0
mov dword [rdi + 0x5c], 0
mov dword [rdi + 0x60], 0x7d0
lea rcx, [rdi + 0x68]
call fcn.14002b840
nop
mov byte [rdi + 0xf8], 1
mov qword [rdi + 0x100], 0
lea rcx, [rdi + 0x108]
call fcn.1400a8f10
nop
mov word [rdi + 0x168], 0x101
lea rcx, [rdi + 0x170]
call fcn.14002b840
nop
lea rcx, [rdi + 0x200]
call fcn.14002b840
nop
lea rcx, [rdi + 0x290]
call fcn.14003b980
nop
lea rcx, [rdi + 0x400]
call fcn.14003b980
nop
lea rcx, [rdi + 0x570]
call fcn.14003b980
nop
lea rcx, [rdi + 0x6e0]
call fcn.1400f17b0
nop
lea rcx, [rdi + 0x1288]
call fcn.14003b980
nop
mov byte [rdi + 0x13f8], 1
lea rcx, [rdi + 0x1400]
call fcn.14002b840
nop
mov word [rdi + 0x1490], 0x101
mov dword [rdi + 0x1494], 0x7d0
mov qword [rdi + 0x1498], 0
mov dword [rdi + 0x14a0], 0x4e20
mov dword [rdi + 0x14a4], 0xffff
mov byte [rdi + 0x14a8], 1
lea rcx, [rdi + 0x14b0]
call fcn.14002b840
nop
mov byte [rdi + 0x1540], 0
lea rcx, [rdi + 0x1548]
call fcn.14002b840
nop
mov word [rdi + 0x15d8], 0
xor edx, edx
mov r8d, 0xb8
lea rcx, [rsp + 0x30]
call fcn.14016c710
lea rcx, [rsp + 0x30]
call fcn.1400402b0
nop
mov byte [rdi + 0x160], 1
call fcn.1400ad1a0
mov qword [rdi + 0x30], rax
lea r9, [rsp + 0x30]
lea r8, str.text_html_application_xhtmlxml_application_xml_q0.9___q0.8
lea rdx, str.Accept
lea rcx, [rdi + 0x108]
call fcn.1400ab980
lea r9, [rsp + 0x30]
lea r8, str.keep_alive
lea rdx, str.Connection
lea rcx, [rdi + 0x108]
call fcn.1400ab980
lea r9, [rsp + 0x30]
lea r8, str.Mozilla_5.0__Windows_NT_6.3__WOW64__rv:49.0__Gecko_20100101_Firefox_49.0
lea rdx, str.User_Agent
lea rcx, [rdi + 0x108]
call fcn.1400ab980
lea r9, [rsp + 0x30]
lea r8, str.en_us_en_q0.5
lea rdx, str.Accept_Language
lea rcx, [rdi + 0x108]
call fcn.1400ab980
nop
lea rcx, [rsp + 0x30]
call fcn.1400402e0
nop
mov rax, rdi
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140168e10
mov rbx, qword [rsp + 0x118]
add rsp, 0x100
pop rdi
ret
Function at 0x1400c9230
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xcc], 0xc64d29ea
mov rdi, r8
movzx esi, dl
mov rbx, rcx
jne 0x1400c9269
mov rax, qword [rcx + 0xbb0]
test rax, rax
je 0x1400c929b
cmp dword [rax + 0x3c], 0xc64d29ea
je 0x1400c92b0
xor ecx, ecx
call fcn.140002260
cmp dword [rbx + 0xbc0], 2
mov rdx, rdi
jne 0x1400c9389
lea rcx, [rbx + 0x218]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140124190
cmp dword [rcx + 0xbc0], 2
jne 0x1400c9270
add rcx, 0x218
call fcn.140123fd0
test rax, rax
je 0x1400c9270
mov rdx, rdi
mov rcx, rax
call fcn.1401298d0
test al, al
je 0x1400c935e
test sil, sil
jne 0x1400c92df
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp byte [rdi + 0xa9], 0
je 0x1400c92f8
mov rax, qword [rdi]
lea rdx, str.Checking_SSH_channel...
mov rcx, rdi
call qword [rax + 0x30]
cmp qword [rbx + 0xbb0], 0
je 0x1400c931d
mov eax, dword [rbx + 0xbb8]
test eax, eax
setne al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp dword [rbx + 0xbc0], 2
jne 0x1400c9347
lea rcx, [rbx + 0x218]
call fcn.140123fc0
test eax, eax
setne al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor eax, eax
test eax, eax
setne al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp byte [rdi + 0xa9], 0
je 0x1400c9377
mov rax, qword [rdi]
lea rdx, str.SSH_tunnel_is_not_connected.
mov rcx, rdi
call qword [rax + 0x30]
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rcx, [rbx + 0x8f8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400f7d00
add rcx, 0x18
jmp fcn.140122a80

Function at 0x1400c9460
Capabilities:
Get socket status

Disassembly:
mov rax, qword [rcx + 0xbb0]
test rax, rax
je 0x1400c9474
mov rcx, rax
jmp fcn.14012c300
cmp dword [rcx + 0xbc0], 2
jne 0x1400c9489
add rcx, 0x218
jmp fcn.140124120
add rcx, 0x8f8
jmp fcn.1400f70d0
Function at 0x1400cd7a0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xdc0]
sub rsp, 0xec0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xf00], rbx
mov rax, qword [0x14026be10]
xor rax, rsp
mov qword [rbp + 0xdb0], rax
mov ebx, r9d
mov r15, r8
mov dword [rsp + 0x20], edx
mov qword [rsp + 0x28], rcx
mov r13, qword [rbp + 0xe28]
test r13, r13
jne 0x1400cd7ff
xor al, al
jmp 0x1400cd9e9
mov esi, 0x40
mov r14d, dword [rbp + 0xe20]
lea eax, [r14 - 2]
mov ecx, pe_nt_image_headers64
cmp eax, 1
cmovbe esi, ecx
mov ecx, r14d
call fcn.140050370
movsxd r12, eax
cmp ebx, esi
jle 0x1400cd84d
lea r9, [rbp + 0xc70]
mov r8d, r14d
mov edx, ebx
mov rcx, r15
call fcn.14004f9c0
lea r15, [rbp + 0xc70]
mov ebx, r12d
cmp r12d, esi
cmovg ebx, esi
mov edi, esi
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0xb50]
call fcn.14016c710
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0xbe0]
call fcn.14016c710
movsxd rbx, ebx
mov r8, rbx
mov rdx, r15
lea rcx, [rbp + 0xb50]
call fcn.14016a920
mov r8, rbx
mov rdx, r15
lea rcx, [rbp + 0xbe0]
call fcn.14016a920
xor ecx, ecx
mov eax, ecx
movdqa xmm2, xmmword [str.6666666666666666_]
movdqa xmm3, xmmword [0x1401e5cc0]
nop dword [rax]
movdqu xmm0, xmmword [rbp + rax + 0xb50]
pxor xmm0, xmm2
movdqu xmmword [rbp + rax + 0xb50], xmm0
movdqu xmm0, xmmword [rbp + rax + 0xbe0]
movdqa xmm1, xmm3
pxor xmm1, xmm0
movdqu xmmword [rbp + rax + 0xbe0], xmm1
movdqu xmm0, xmmword [rbp + rax + 0xb60]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rbp + rax + 0xb60], xmm1
movdqu xmm0, xmmword [rbp + rax + 0xbf0]
pxor xmm0, xmm3
movdqu xmmword [rbp + rax + 0xbf0], xmm0
add ecx, 0x20
add rax, 0x20
cmp rax, rdi
jl 0x1400cd8b0
movsxd rax, ecx
cmp rax, rdi
jge 0x1400cd948
nop dword [rax]
nop dword [rax + rax]
xor byte [rbp + rax + 0xb50], 0x36
xor byte [rbp + rax + 0xbe0], 0x5c
inc rax
cmp rax, rdi
jl 0x1400cd930
lea rcx, [rsp + 0x40]
call fcn.1400343d0
nop
mov dword [rbp + 0xb48], 2
lea rax, [rbp + 0xb50]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x748], esi
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x20]
mov dword [rbp + 0x74c], eax
lea r8, [rbp + 0xcb0]
mov edx, r14d
lea rcx, [rsp + 0x40]
call fcn.14004fbe0
mov r8, rdi
lea rdx, [rbp + 0xbe0]
lea rcx, [rbp + 0xcf0]
call fcn.14016a920
mov r8, r12
lea rcx, [rbp + 0xcf0]
add rcx, rdi
lea rdx, [rbp + 0xcb0]
call fcn.14016a920
lea edx, [r12 + rsi]
mov r9, r13
mov r8d, r14d
lea rcx, [rbp + 0xcf0]
call fcn.14004f9c0
nop
lea rcx, [rsp + 0x40]
call fcn.1400345b0
mov al, 1
mov rcx, qword [rbp + 0xdb0]
xor rcx, rsp
call fcn.140168e10
mov rbx, qword [rsp + 0xf00]
add rsp, 0xec0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400cdab0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push r12
push r13
push r14
sub rsp, 0x2b0
mov rax, qword [0x14026be10]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r12, qword [rsp + 0x300]
mov ebp, r9d
mov ebx, r8d
mov r14, rdx
mov r13, rcx
test r12, r12
jne 0x1400cdaf2
xor al, al
jmp 0x1400cdcbb
mov qword [rsp + 0x2a8], rsi
lea eax, [r9 - 2]
mov ecx, pe_nt_image_headers64
mov qword [rsp + 0x2a0], rdi
cmp eax, 1
mov qword [rsp + 0x298], r15
mov esi, 0x40
cmovbe esi, ecx
mov ecx, ebp
call fcn.140050370
movsxd r15, eax
cmp ebx, esi
jle 0x1400cdb52
lea r9, [rsp + 0x140]
mov r8d, ebp
mov edx, ebx
mov rcx, r14
call fcn.14004f9c0
cmp r15d, esi
lea r14, [rsp + 0x140]
mov ebx, r15d
cmovg ebx, esi
mov r8d, esi
lea rcx, [rsp + 0x20]
xor edx, edx
mov edi, esi
call fcn.14016c710
mov r8d, esi
lea rcx, [rsp + 0xb0]
xor edx, edx
call fcn.14016c710
movsxd rbx, ebx
lea rcx, [rsp + 0x20]
mov r8, rbx
mov rdx, r14
call fcn.14016a920
mov r8, rbx
lea rcx, [rsp + 0xb0]
mov rdx, r14
call fcn.14016a920
movdqa xmm2, xmmword [str.6666666666666666_]
xor ecx, ecx
movdqa xmm3, xmmword [0x1401e5cc0]
mov eax, ecx
nop
movdqu xmm0, xmmword [rsp + rax + 0x20]
add ecx, 0x20
movdqa xmm1, xmm3
pxor xmm0, xmm2
movdqu xmmword [rsp + rax + 0x20], xmm0
movdqu xmm0, xmmword [rsp + rax + 0xb0]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rsp + rax + 0x30]
movdqu xmmword [rsp + rax + 0xb0], xmm1
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rsp + rax + 0xc0]
movdqu xmmword [rsp + rax + 0x30], xmm1
pxor xmm0, xmm3
movdqu xmmword [rsp + rax + 0xc0], xmm0
add rax, 0x20
cmp rax, rdi
jl 0x1400cdbb0
movsxd rax, ecx
cmp rax, rdi
jge 0x1400cdc35
nop dword [rax + rax]
xor byte [rsp + rax + 0x20], 0x36
xor byte [rsp + rax + 0xb0], 0x5c
inc rax
cmp rax, rdi
jl 0x1400cdc20
lea rax, [rsp + 0x20]
mov dword [r13 + 0x808], esi
lea r8, [rsp + 0x180]
mov qword [r13 + 8], rax
mov edx, ebp
mov rcx, r13
call fcn.14004fbe0
mov r8, rdi
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x1c0]
call fcn.14016a920
lea rcx, [rsp + 0x1c0]
mov r8, r15
add rcx, rdi
lea rdx, [rsp + 0x180]
call fcn.14016a920
lea edx, [r15 + rsi]
mov r9, r12
mov r8d, ebp
lea rcx, [rsp + 0x1c0]
call fcn.14004f9c0
mov r15, qword [rsp + 0x298]
mov al, 1
mov rdi, qword [rsp + 0x2a0]
mov rsi, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140168e10
add rsp, 0x2b0
pop r14
pop r13
pop r12
pop rbp
pop rbx
ret
Function at 0x1400e2130
Capabilities:
Hash data using crc32b

Disassembly:
push rdi
sub rsp, 0x20
cmp byte [0x140271ff0], 0
jne 0x1400e2352
movzx eax, byte [0x140271ff1]
mov qword [rsp + 0x30], rbx
test al, al
jne 0x1400e2324
cmp qword [0x140271ff8], 0
jne 0x1400e234d
mov ecx, 0x100
mov byte [0x140271ff1], 1
call fcn.1400325e0
mov rdi, rax
test rax, rax
je 0x1400e234d
xor ebx, ebx
mov r11, rax
mov r10d, ebx
nop word [rax + rax]
mov ecx, r10d
mov r8d, r10d
and ecx, 1
shr r8d, 1
shl ecx, 7
mov eax, r8d
mov edx, ecx
or edx, 0x40
and al, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
mov eax, r8d
or ecx, 0x20
and al, 1
cmove ecx, edx
shr r8d, 1
mov edx, ecx
mov eax, r8d
or edx, 0x10
and al, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
mov eax, r8d
or ecx, 8
and al, 1
cmove ecx, edx
shr r8d, 1
mov edx, ecx
mov eax, r8d
or edx, 4
and al, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
mov eax, r8d
or ecx, 2
and al, 1
cmove ecx, edx
mov eax, ecx
or eax, 1
and r8b, 2
cmove eax, ecx
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov eax, ecx
sar eax, 0x1f
add ecx, ecx
and eax, 0x4c11db7
mov r9d, ebx
xor eax, ecx
mov r8d, 0x1e
mov dword [r11], eax
test al, 1
je 0x1400e22a6
lea ecx, [r8 + 1]
mov edx, 1
shl edx, cl
or r9d, edx
shr eax, 1
test al, 1
je 0x1400e22b9
mov ecx, r8d
mov edx, 1
shl edx, cl
or r9d, edx
shr eax, 1
sub r8d, 2
cmp r8d, 0xfffffffe
jg 0x1400e2294
mov dword [r11], r9d
inc r10d
add r11, 4
cmp r10d, 0xff
jbe 0x1400e2190
cmp qword [0x140271ff8], rbx
jne 0x1400e2304
mov byte [0x140271ff1], bl
mov rbx, qword [rsp + 0x30]
mov qword [0x140271ff8], rdi
mov byte [0x140271ff0], 1
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call fcn.140169534
mov byte [0x140271ff1], bl
mov rbx, qword [rsp + 0x30]
mov byte [0x140271ff0], 1
add rsp, 0x20
pop rdi
ret
xor ebx, ebx
test al, al
je 0x1400e234d
nop word [rax + rax]
mov ecx, 2
call sub.KERNEL32.dll_Sleep
inc ebx
cmp ebx, 0xc8
ja 0x1400e234d
cmp byte [0x140271ff1], 0
jne 0x1400e2330
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e2360
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r11d, r8d
mov r10, rdx
mov rbx, rcx
test rdx, rdx
je 0x1400e241d
test r8d, r8d
je 0x1400e241d
cmp r11d, 0x10
jb 0x1400e23e0
mov eax, dword [rcx + 8]
mov qword [rsp + 0x10], rdi
mov edi, r11d
shr rdi, 4
xor r9d, r9d
nop word [rax + rax]
movzx edx, byte [r9 + r10]
mov r8d, eax
movzx ecx, al
inc r9
xor rdx, rcx
shr r8d, 8
mov rcx, qword [0x140271ff8]
mov edx, dword [rcx + rdx*4]
xor edx, r8d
mov dword [rbx + 8], edx
mov eax, edx
cmp r9, 0x10
jl 0x1400e23a0
add r11d, 0xfffffff0
add r10, 0x10
sub rdi, 1
jne 0x1400e2392
mov rdi, qword [rsp + 0x10]
test r11d, r11d
je 0x1400e241d
mov r8d, dword [rbx + 8]
nop dword [rax]
movzx eax, byte [r10]
lea r10, [r10 + 1]
movzx ecx, r8b
mov edx, r8d
xor rcx, rax
shr edx, 8
mov rax, qword [0x140271ff8]
mov ecx, dword [rax + rcx*4]
xor ecx, edx
mov dword [rbx + 8], ecx
mov r8d, ecx
add r11d, 0xffffffff
jne 0x1400e23f0
pop rbx
ret
Function at 0x1400f1d00
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xcc], 0xc64d29ea
mov rdi, r8
movzx esi, dl
mov rbx, rcx
jne 0x1400c80b9
mov rax, qword [rcx + 0xbb0]
test rax, rax
je 0x1400c80eb
cmp dword [rax + 0x3c], 0xc64d29ea
je 0x1400c8100
xor ecx, ecx
call fcn.140002260
cmp dword [rbx + 0xbc0], 2
mov r8, rdi
movzx edx, sil
jne 0x1400c8123
lea rcx, [rbx + 0x218]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1401230a0
cmp dword [rcx + 0xbc0], 2
jne 0x1400c80c0
add rcx, 0x218
call fcn.140123fd0
test rax, rax
je 0x1400c80c0
mov r8, rdi
movzx edx, sil
mov rcx, rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140130730
lea rcx, [rbx + 0x8f8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1400f3520
mov rcx, qword [rcx + 0x58]
test rcx, rcx
jne 0x1400f1d0c
mov al, 1
ret
jmp 0x1400c8080
sub rsp, 0x48
mov rax, qword [0x14026be10]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx + 0xb0]
cmp rcx, 0xffffffffffffffff
jne 0x1400f3554
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140168e10
add rsp, 0x48
ret
test dl, dl
mov dword [rsp + 0x30], 1
mov edx, 0xffff
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
mov r8d, 8
jne 0x1400f3585
lea r9, [rsp + 0x34]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140168e10
add rsp, 0x48
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
movzx ebp, dl
mov rbx, rcx
xor dil, dil
call fcn.140050de0
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x14012237c
mov r8, rsi
movzx edx, bpl
call 0x1400f3520
jmp 0x140122391
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x140122394
mov r8, rsi
movzx edx, bpl
call 0x1400c8080
movzx edi, al
mov rcx, rbx
call fcn.140050d80
mov rbx, qword [rsp + 0x30]
movzx eax, dil
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
add rcx, 0x18
jmp 0x140122340
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x14026be10]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, r8
movzx edi, dl
mov rbx, rcx
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.14006faf0
nop
lea rcx, [rbx + 0x550]
mov r8, rsi
movzx edx, dil
call 0x140122340
movzx ebx, al
lea rcx, [rsp + 0x28]
call fcn.14006fbb0
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140168e10
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400f2d20
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
cmp dword [rcx + 0xb8], 2
je fcn.1400f3dc0
jmp fcn.1400f3ed0