joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404e30
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x258
xor r9d, r9d
xor r8d, r8d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x30], edx
add ecx, 1
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x34], 0
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
setg al
add rsp, 0x258
ret

Function at 0x404e80
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x268
mov rdi, rcx
mov rcx, rdx
mov rbp, rdx
call sub.msvcrt.dll_strlen
lea rbx, [rax + 1]
mov byte [rbp + rax], 0xa
test rbx, rbx
jle 0x404f80
lea rax, [rsp + 0x50]
lea r14d, [rdi + 1]
xor esi, esi
lea r13, [rsp + 0x40]
mov r12, qword [sym.imp.WS2_32.dll_select]
mov r15, qword [sym.imp.WS2_32.dll_send]
mov qword [rsp + 0x38], rax
jmp 0x404ef0
sub rbx, rax
add rsi, rax
test rbx, rbx
jle 0x404f80
nop
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x58], rdi
mov ecx, r14d
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x20], r13
mov r8, qword [rsp + 0x38]
call r12
test eax, eax
jle 0x404f50
xor r9d, r9d
lea rdx, [rbp + rsi]
mov r8d, ebx
mov rcx, rdi
call r15
cdqe
test rax, rax
jns 0x404ee0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x404ef0
nop dword [rax + rax]
xor eax, eax
nop word cs:[rax + rax]
add rsp, 0x268
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, 1
jmp 0x404f60

Function at 0x4056b0
Capabilities:
Get socket status

Disassembly:
mov rax, qword [rcx + 0x128]
cmp byte [rax], 0
je 0x4056d0
mov eax, 1
ret
mov rcx, qword [rcx + 0x118]
jmp fcn.00404e30
Function at 0x4056e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x838
mov rdi, qword [rcx + 0x128]
mov edx, 0xa
mov rbx, rcx
mov rcx, rdi
call sub.msvcrt.dll_strchr
test rax, rax
je 0x405810
nop word cs:[rax + rax]
mov rcx, rdi
call sub.msvcrt.dll_strlen
lea rdx, [0x00464512]
mov rcx, rdi
mov rbp, rax
call sub.msvcrt.dll_strtok
test rax, rax
je 0x4059d0
mov rcx, rax
call sub.msvcrt.dll__strdup
mov rsi, rax
mov r9, rax
nop word cs:[rax + rax]
mov ecx, dword [r9]
add r9, 4
lea edx, [rcx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x405760
mov eax, edx
shr eax, 0x10
test edx, 0x8080
cmove edx, eax
lea rax, [r9 + 2]
cmove r9, rax
add dl, dl
sbb r9, 3
sub r9, rsi
lea rdx, [r9 + 1]
cmp rbp, rdx
jg 0x4057f0
mov rax, qword [rbx + 0x128]
mov byte [rax], 0
nop dword [rax + rax]
mov rax, qword [0x00474f90]
cmp byte [rax], 0
je 0x4057d0
lea rdx, str.___s
mov r8, rsi
mov ecx, 4
call fcn.00404fc0
mov rax, rsi
add rsp, 0x838
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rbx + 0x128]
sub rbp, r9
lea r8, [rbp + 1]
add rdx, rcx
call sub.msvcrt.dll_memmove
jmp 0x4057b0
lea rcx, [rsp + 0x28]
mov r12, qword [sym.imp.msvcrt.dll__time64]
call r12
mov rcx, qword [rbx + 0x118]
mov edx, 0x3c
call fcn.00404e30
test al, al
je 0x4059f0
lea rsi, [rsp + 0x30]
mov r14, qword [sym.imp.WS2_32.dll_recv]
xor r13d, r13d
mov ebp, 0x100
jmp 0x405940
mov rdi, qword [rbx + 0x128]
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov r8, rsi
mov r15, rax
nop word cs:[rax + rax]
mov r9d, dword [r8]
add r8, 4
lea edx, [r9 - 0x1010101]
not r9d
and edx, r9d
and edx, 0x80808080
je 0x405880
mov eax, edx
shr eax, 0x10
test edx, 0x8080
cmove edx, eax
lea rax, [r8 + 2]
cmove r8, rax
add dl, dl
sbb r8, 3
sub r8, rsi
lea rdx, [r8 + r15 + 1]
cmp rdx, qword [rbx + 0x120]
jb 0x4058f0
and rdx, 0xfffffffffffff800
mov rcx, rdi
add rdx, 0x800
mov qword [rbx + 0x120], rdx
call sub.msvcrt.dll_realloc
mov qword [rbx + 0x128], rax
mov rdi, rax
lea rcx, [rdi + r15]
mov rdx, rsi
call sub.msvcrt.dll_strcpy
nop dword [rax]
xor ecx, ecx
call r12
sub rax, qword [rsp + 0x28]
cmp rax, 0x3b
jg 0x4059c0
mov rdi, qword [rbx + 0x128]
mov edx, 0xa
mov rcx, rdi
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x405720
nop word cs:[rax + rax]
mov rax, r13
mov rdi, rsi
mov rcx, rbp
rep stosq qword [rdi], rax
xor r9d, r9d
mov rcx, qword [rbx + 0x118]
mov r8d, 0x7fc
mov rdx, rsi
call r14
cdqe
test rax, rax
je 0x4059a0
jns 0x405860
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4059a0
mov rcx, qword [rbx + 0x118]
mov edx, 1
call fcn.00404e30
test al, al
jne 0x405900
nop word cs:[rax + rax]
lea rdx, str.stratum_recv_line_failed
xor ecx, ecx
xor esi, esi
call fcn.00404fc0
jmp 0x4057d0
mov rdi, qword [rbx + 0x128]
jmp 0x405720
lea rdx, str.stratum_recv_line_failed_to_parse_a_newline_terminated_string
xor ecx, ecx
xor esi, esi
call fcn.00404fc0
jmp 0x4057d0
lea rdx, str.stratum_recv_line_timed_out
xor ecx, ecx
xor esi, esi
call fcn.00404fc0
jmp 0x4057d0
Function at 0x407ca0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
test edx, edx
mov r8, rcx
jle 0x407ed0
lea rsi, [0x00464b80]
sub edx, 1
mov rcx, qword [rcx]
lea r10, [0x00464a80]
lea r9, [0x00464b00]
lea rdi, [r8 + 8]
lea rbp, [rsi + rdx*8 + 8]
lea rbx, [r8 + 0xd0]
mov r11d, 0x66666667
nop dword [rax]
mov rax, qword [r8 + 0x50]
xor rax, qword [r8 + 0x28]
mov edx, 1
xor rax, qword [r8 + 0x78]
mov r13, qword [r8 + 0x30]
xor rax, qword [r8 + 0xa0]
xor r13, qword [r8 + 8]
xor r13, qword [r8 + 0x58]
xor r13, qword [r8 + 0x80]
xor r13, qword [r8 + 0xa8]
xor rax, rcx
mov rcx, r8
mov qword [rsp], rax
mov rax, qword [r8 + 0x38]
xor rax, qword [r8 + 0x10]
xor rax, qword [r8 + 0x60]
mov qword [rsp + 8], r13
xor rax, qword [r8 + 0x88]
xor rax, qword [r8 + 0xb0]
mov qword [rsp + 0x10], rax
mov rax, qword [r8 + 0x40]
xor rax, qword [r8 + 0x18]
xor rax, qword [r8 + 0x68]
xor rax, qword [r8 + 0x90]
xor rax, qword [r8 + 0xb8]
mov qword [rsp + 0x18], rax
mov rax, qword [r8 + 0x48]
xor rax, qword [r8 + 0x20]
xor rax, qword [r8 + 0x70]
xor rax, qword [r8 + 0x98]
xor rax, qword [r8 + 0xc0]
mov r14, rax
mov qword [rsp + 0x20], rax
nop word cs:[rax + rax]
mov rax, r13
lea r12d, [rdx + 1]
rol rax, 1
xor rax, r14
xor qword [rcx], rax
xor qword [rcx + 0x28], rax
xor qword [rcx + 0x50], rax
xor qword [rcx + 0x78], rax
xor qword [rcx + 0xa0], rax
add rcx, 8
cmp r12d, 6
je 0x407e20
lea r13d, [rdx + 4]
mov eax, r13d
imul r11d
mov eax, r13d
sar eax, 0x1f
sar edx, 1
sub edx, eax
lea eax, [rdx + rdx*4]
mov edx, r13d
sub edx, eax
mov eax, r12d
movsxd rdx, edx
mov r14, qword [rsp + rdx*8]
imul r11d
mov eax, r12d
sar eax, 0x1f
sar edx, 1
sub edx, eax
lea eax, [rdx + rdx*4]
mov edx, r12d
sub edx, eax
movsxd rax, edx
mov edx, r12d
mov r13, qword [rsp + rax*8]
jmp 0x407da0
mov rdx, qword [r8 + 8]
xor eax, eax
nop word cs:[rax + rax]
movsxd rcx, dword [r10 + rax]
lea r12, [r8 + rcx*8]
mov ecx, dword [r9 + rax]
add rax, 4
mov r13, qword [r12]
rol rdx, cl
cmp rax, 0x60
mov qword [r12], rdx
mov rdx, r13
jne 0x407e30
mov rax, rdi
nop word [rax + rax]
mov r13, qword [rax]
mov r14, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov r12, qword [rax - 8]
mov r15, r13
not r15
and r15, r14
not r14
and r14, rcx
not rcx
xor r15, r12
and rcx, rdx
not rdx
mov qword [rax - 8], r15
and rdx, r12
not r12
xor qword [rax], r14
xor qword [rax + 8], rcx
and r12, r13
xor qword [rax + 0x10], rdx
xor qword [rax + 0x18], r12
add rax, 0x28
cmp rax, rbx
jne 0x407e60
mov rcx, qword [rsi]
add rsi, 8
xor rcx, qword [r8]
cmp rsi, rbp
mov qword [r8], rcx
jne 0x407cf0
nop dword [rax]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x407ef0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x198
cmp r9d, 0xc8
mov rsi, rcx
mov r14d, edx
mov qword [rsp + 0x1f0], r8
mov dword [rsp + 0x1f8], r9d
je 0x4080a0
mov r9d, 0x64
sub r9d, dword [rsp + 0x1f8]
lea r12d, [r9 + r9]
lea ebp, [r12 + 7]
test r12d, r12d
lea eax, [r12 - 1]
cmovns ebp, r12d
mov dword [rsp + 0x2c], eax
sar ebp, 3
lea rbx, [rsp + 0xc0]
xor eax, eax
mov ecx, 0x19
cmp r12d, r14d
mov rdi, rbx
rep stosq qword [rdi], rax
jg 0x407fe0
mov eax, r12d
mov edi, r14d
movsxd r15, r12d
neg eax
sub edi, r12d
mov dword [rsp + 0x28], eax
lea eax, [rbp - 1]
lea r13, [rax*8 + 8]
nop word [rax + rax]
xor eax, eax
test ebp, ebp
jle 0x407fc0
nop word cs:[rax + rax]
mov rdx, qword [rsi + rax]
xor qword [rbx + rax], rdx
add rax, 8
cmp rax, r13
jne 0x407fa0
nop word cs:[rax + rax]
mov edx, 0x18
mov rcx, rbx
mov r14d, edi
call fcn.00407ca0
add edi, dword [rsp + 0x28]
add rsi, r15
lea eax, [rdi + r12]
cmp r12d, eax
jle 0x407f90
lea rdi, [rsp + 0x30]
movsxd r15, r14d
mov rdx, rsi
mov r8, r15
mov rcx, rdi
call sub.msvcrt.dll_memcpy
lea r10d, [r14 + 1]
mov r8d, r12d
xor edx, edx
mov byte [rsp + r15 + 0x30], 1
sub r8d, r10d
movsxd r10, r10d
lea rcx, [rdi + r10]
movsxd r8, r8d
call sub.msvcrt.dll_memset
movsxd r12, dword [rsp + 0x2c]
or byte [rsp + r12 + 0x30], 0x80
test ebp, ebp
jle 0x408060
sub ebp, 1
xor eax, eax
lea rcx, [rbp*8 + 8]
nop word cs:[rax + rax]
mov rdx, qword [rdi + rax]
xor qword [rbx + rax], rdx
add rax, 8
cmp rax, rcx
jne 0x408040
nop word cs:[rax + rax]
mov rcx, rbx
mov edx, 0x18
call fcn.00407ca0
movsxd r8, dword [rsp + 0x1f8]
mov rcx, qword [rsp + 0x1f0]
mov rdx, rbx
call sub.msvcrt.dll_memcpy
nop
add rsp, 0x198
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0x2c], 0x87
mov ebp, 0x11
mov r12d, 0x88
jmp 0x407f50
Function at 0x409bd0
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x120
cmp r8d, 0x3f
mov rbx, rcx
mov r12, rdx
mov r14d, r8d
jle 0x409de0
lea rsi, [rsp + 0xe0]
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0xa0]
lea r13, [rsp + 0x60]
nop
xor eax, eax
nop word cs:[rax + rax]
mov edx, dword [r12 + rax]
mov dword [rsi + rax], edx
xor edx, dword [rbx + rax]
mov dword [rbp + rax], edx
add rax, 4
cmp rax, 0x40
jne 0x409c20
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call fcn.00408e30
mov r8d, 0x1000000
mov rdx, rsi
mov rcx, rdi
call fcn.00408e30
mov r8d, 0x2000000
mov rdx, rdi
mov rcx, rsi
call fcn.00408e30
mov r8d, 0x3000000
mov rdx, rsi
mov rcx, rdi
call fcn.00408e30
mov r8d, 0x4000000
mov rdx, rdi
mov rcx, rsi
call fcn.00408e30
mov r8d, 0x5000000
mov rdx, rsi
mov rcx, rdi
call fcn.00408e30
mov r8d, 0x6000000
mov rdx, rdi
mov rcx, rsi
call fcn.00408e30
mov r8d, 0x7000000
mov rdx, rsi
mov rcx, rdi
call fcn.00408e30
mov r8d, 0x8000000
mov rdx, rdi
mov rcx, rsi
call fcn.00408e30
mov r8d, 0x9000000
mov rdx, r13
mov rcx, rdi
call fcn.00408e30
xor r8d, r8d
mov rdx, rdi
mov rcx, rbp
call fcn.004080c0
mov r8d, 1
mov rdx, rsi
mov rcx, rdi
call fcn.004080c0
mov r8d, 2
mov rdx, rdi
mov rcx, rsi
call fcn.004080c0
mov r8d, 3
mov rdx, rsi
mov rcx, rdi
call fcn.004080c0
mov r8d, 4
mov rdx, rdi
mov rcx, rsi
call fcn.004080c0
mov r8d, 5
mov rdx, rsi
mov rcx, rdi
call fcn.004080c0
mov r8d, 6
mov rdx, rdi
mov rcx, rsi
call fcn.004080c0
mov r8d, 7
mov rdx, rsi
mov rcx, rdi
call fcn.004080c0
mov r8d, 8
mov rdx, rdi
mov rcx, rsi
call fcn.004080c0
mov r8d, 9
mov rdx, rbp
mov rcx, rdi
call fcn.004080c0
xor eax, eax
nop dword [rax + rax]
mov r9d, dword [rbp + rax]
xor r9d, dword [rbx + rax]
xor r9d, dword [r13 + rax]
mov dword [rbx + rax], r9d
add rax, 4
cmp rax, 0x40
jne 0x409d90
add dword [rbx + 0x40], 1
jne 0x409dc0
add dword [rbx + 0x44], 1
nop word cs:[rax + rax]
sub r14d, 0x40
add r12, 0x40
cmp r14d, 0x3f
jg 0x409c10
nop word cs:[rax + rax]
add rsp, 0x120
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x40ad20
Capabilities:
Hash data using sha256

Disassembly:
push rsi
push rbx
sub rsp, 0xa8
lea rbx, [rsp + 0x20]
mov rsi, rcx
shl r8, 3
mov dword [rsp + 0x20], 0x6a09e667
mov dword [rsp + 0x24], 0xbb67ae85
mov rcx, rbx
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov dword [rsp + 0x3c], 0x5be0cd19
mov dword [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x40], 0
call fcn.0040a860
mov r9d, 1
mov r8d, 0x81
mov rdx, rsi
mov rcx, rbx
call fcn.0040aa70
nop
add rsp, 0xa8
pop rbx
pop rsi
ret

Function at 0x40aea0
Capabilities:
Encode data using xor
Hash data using sha256

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
cmp r8, 0x40
mov rbp, rcx
mov rdi, rdx
mov rsi, r8
ja 0x40b0c0
nop
movabs rax, 0x3636363636363636
test rsi, rsi
mov dword [rbp], 0x6a09e667
mov dword [rbp + 4], 0xbb67ae85
mov dword [rbp + 8], 0x3c6ef372
mov dword [rbp + 0xc], 0xa54ff53a
mov dword [rbp + 0x10], 0x510e527f
mov dword [rbp + 0x14], 0x9b05688c
mov dword [rbp + 0x18], 0x1f83d9ab
mov dword [rbp + 0x1c], 0x5be0cd19
mov dword [rbp + 0x3c], 0
mov dword [rbp + 0x38], 0
mov dword [rbp + 0x34], 0
mov dword [rbp + 0x30], 0
mov dword [rbp + 0x2c], 0
mov dword [rbp + 0x28], 0
mov dword [rbp + 0x24], 0
mov dword [rbp + 0x20], 0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
je 0x40b0e0
lea rbx, [rsp + 0x40]
xor eax, eax
nop word cs:[rax + rax]
movzx edx, byte [rdi + rax]
xor byte [rbx + rax], dl
add rax, 1
cmp rax, rsi
jne 0x40af80
mov r8d, 0x200
mov rdx, rbx
mov rcx, rbp
call fcn.0040a860
movabs rax, 0x5c5c5c5c5c5c5c5c
test rsi, rsi
mov dword [rbp + 0x80], 0x6a09e667
mov dword [rbp + 0x84], 0xbb67ae85
mov dword [rbp + 0x88], 0x3c6ef372
mov dword [rbp + 0x8c], 0xa54ff53a
mov dword [rbp + 0x90], 0x510e527f
mov dword [rbp + 0x94], 0x9b05688c
mov dword [rbp + 0x98], 0x1f83d9ab
mov dword [rbp + 0x9c], 0x5be0cd19
mov dword [rbp + 0xbc], 0
mov dword [rbp + 0xb8], 0
mov dword [rbp + 0xb4], 0
mov dword [rbp + 0xb0], 0
mov dword [rbp + 0xac], 0
mov dword [rbp + 0xa8], 0
mov dword [rbp + 0xa4], 0
mov dword [rbp + 0xa0], 0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
je 0x40b090
xor eax, eax
nop word [rax + rax]
movzx edx, byte [rdi + rax]
xor byte [rbx + rax], dl
add rax, 1
cmp rax, rsi
jne 0x40b080
lea rcx, [rbp + 0x80]
mov r8d, 0x200
mov rdx, rbx
call fcn.0040a860
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rbx, [rsp + 0x20]
mov esi, 0x20
mov rcx, rbx
mov rdi, rbx
call fcn.0040ad20
jmp 0x40aec0
lea rbx, [rsp + 0x40]
jmp 0x40af90
Function at 0x40b0f0
Capabilities:
Encode data using xor
Hash data using sha224

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
cmp r8, 0x40
mov rbp, rcx
mov rdi, rdx
mov rsi, r8
ja 0x40b310
nop
movabs rax, 0x3636363636363636
test rsi, rsi
mov dword [rbp], 0xc1059ed8
mov dword [rbp + 4], 0x367cd507
mov dword [rbp + 8], 0x3070dd17
mov dword [rbp + 0xc], 0xf70e5939
mov dword [rbp + 0x10], 0xffc00b31
mov dword [rbp + 0x14], 0x68581511
mov dword [rbp + 0x18], 0x64f98fa7
mov dword [rbp + 0x1c], 0xbefa4fa4
mov dword [rbp + 0x3c], 0
mov dword [rbp + 0x38], 0
mov dword [rbp + 0x34], 0
mov dword [rbp + 0x30], 0
mov dword [rbp + 0x2c], 0
mov dword [rbp + 0x28], 0
mov dword [rbp + 0x24], 0
mov dword [rbp + 0x20], 0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
je 0x40b330
lea rbx, [rsp + 0x40]
xor eax, eax
nop word cs:[rax + rax]
movzx edx, byte [rdi + rax]
xor byte [rbx + rax], dl
add rax, 1
cmp rax, rsi
jne 0x40b1d0
mov r8d, 0x200
mov rdx, rbx
mov rcx, rbp
call fcn.0040a860
movabs rax, 0x5c5c5c5c5c5c5c5c
test rsi, rsi
mov dword [rbp + 0x80], 0xc1059ed8
mov dword [rbp + 0x84], 0x367cd507
mov dword [rbp + 0x88], 0x3070dd17
mov dword [rbp + 0x8c], 0xf70e5939
mov dword [rbp + 0x90], 0xffc00b31
mov dword [rbp + 0x94], 0x68581511
mov dword [rbp + 0x98], 0x64f98fa7
mov dword [rbp + 0x9c], 0xbefa4fa4
mov dword [rbp + 0xbc], 0
mov dword [rbp + 0xb8], 0
mov dword [rbp + 0xb4], 0
mov dword [rbp + 0xb0], 0
mov dword [rbp + 0xac], 0
mov dword [rbp + 0xa8], 0
mov dword [rbp + 0xa4], 0
mov dword [rbp + 0xa0], 0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
je 0x40b2e0
xor eax, eax
nop word [rax + rax]
movzx edx, byte [rdi + rax]
xor byte [rbx + rax], dl
add rax, 1
cmp rax, rsi
jne 0x40b2d0
lea rcx, [rbp + 0x80]
mov r8d, 0x200
mov rdx, rbx
call fcn.0040a860
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rbx, [rsp + 0x20]
mov esi, 0x1c
mov rcx, rbx
mov rdi, rbx
call fcn.0040ad20
jmp 0x40b110
lea rbx, [rsp + 0x40]
jmp 0x40b1e0
Function at 0x411b20
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push r14
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx]
mov edx, 1
lea rbp, [0x00467800]
mov rbx, rcx
mov qword [rax + 0x28], 8
mov rax, qword [rcx]
mov qword [rax + 0x20], 0xf
mov rax, qword [rcx]
mov qword [rax + 0x10], 0xf0
mov rsi, qword [rcx]
mov rcx, qword [rsi + 0x10]
call sub.msvcrt.dll_calloc
mov qword [rsi + 0x18], rax
mov rax, qword [rbx]
mov esi, 0x1c
mov rcx, qword [rax + 0x18]
mov rdx, qword [rax + 8]
mov r8, qword [rax]
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x20]
mov r10d, 8
lea rdi, [rcx + 4]
nop word cs:[rax + rax]
mov rdx, qword [rbx]
test r10b, 7
lea r11, [r10*4]
mov r9, qword [rdx + 0x18]
mov eax, dword [r9 + rsi]
mov dword [rsp + 0x20], eax
jne 0x411ca0
ror eax, 8
mov rdx, rcx
mov dword [rsp + 0x20], eax
nop dword [rax + rax]
test rdx, rdx
je 0x411be0
movzx eax, byte [rdx]
movzx eax, byte [rbp + rax]
mov byte [rdx], al
nop
add rdx, 1
cmp rdx, rdi
jne 0x411bd0
mov r9, qword [rbx]
mov rax, r10
xor edx, edx
mov r12, qword [r9 + 0x28]
mov r9, qword [r9 + 0x18]
div r12
lea rdx, [0x00467900]
movzx r8d, byte [rdx + rax - 1]
xor r8b, byte [rsp + 0x20]
mov byte [rsp + 0x20], r8b
nop word cs:[rax + rax]
xor edx, edx
nop word cs:[rax + rax]
mov r14, r10
lea rax, [r9 + r11]
sub r14, r12
lea r12, [rdx + r14*4]
xor r8b, byte [r9 + r12]
mov byte [rax + rdx], r8b
add rdx, 1
cmp rdx, 4
je 0x411c70
mov rax, qword [rbx]
movzx r8d, byte [rdx + rcx]
mov r9, qword [rax + 0x18]
mov r12, qword [rax + 0x28]
jmp 0x411c30
add r10, 1
add rsi, 4
cmp r10, 0x3c
jne 0x411ba0
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r14
ret
mov r12, qword [rdx + 0x28]
mov rax, r10
xor edx, edx
div r12
cmp rdx, 4
je 0x411cd0
nop word cs:[rax + rax]
movzx r8d, byte [rsp + 0x20]
jmp 0x411c20
mov rax, rcx
nop word cs:[rax + rax]
test rax, rax
je 0x411cf0
movzx edx, byte [rax]
movzx edx, byte [rbp + rdx]
mov byte [rax], dl
nop
add rax, 1
cmp rax, rdi
jne 0x411ce0
jmp 0x411cc0

Function at 0x412ef0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
push rbx
sub rsp, 0x28
test rcx, rcx
je 0x412fb0
test rdx, rdx
je 0x412fc0
lea r9, [rdx + 0x10]
lea r10, [0x00467800]
mov rax, rdx
nop word cs:[rax + rax]
test rax, rax
je 0x412f40
movzx r8d, byte [rax]
movzx r8d, byte [r10 + r8]
mov byte [rax], r8b
nop word cs:[rax + rax]
add rax, 1
cmp rax, r9
jne 0x412f20
mov rbx, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.00411d00
mov rcx, rbx
call fcn.00411f00
lea rcx, [rbx + 4]
call fcn.00411f00
lea rcx, [rbx + 8]
call fcn.00411f00
lea rcx, [rbx + 0xc]
call fcn.00411f00
xor eax, eax
nop dword [rax]
movzx edx, byte [rsi + rax]
xor byte [rbx + rax], dl
add rax, 1
cmp rax, 0x10
jne 0x412f80
xor al, al
nop word cs:[rax + rax]
add rsp, 0x28
pop rbx
pop rsi
ret
mov eax, 2
add rsp, 0x28
pop rbx
pop rsi
ret
mov eax, 3
jmp 0x412fa0
Function at 0x4130f0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1c8
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
mov edx, 2
je 0x413120
mov eax, edx
add rsp, 0x1c8
ret
movzx eax, word [rsp + 0x20]
cmp al, 2
je 0x413140
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov edx, 2
mov eax, edx
add rsp, 0x1c8
ret
shr ax, 8
cmp ax, 2
jne 0x413129
xor edx, edx
jmp 0x413110

Function at 0x4156d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
cmp byte [rcx + 0x269], 0
mov rdi, qword [rcx]
mov rbx, rcx
mov rsi, rdx
jne 0x415822
lea rbp, [rsp + 0x2c]
lea r12, [rsp + 0x30]
mov dword [rsp + 0x2c], pe_nt_image_headers64
mov rcx, rsi
mov r8, rbp
mov rdx, r12
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x415752
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rbx
mov edx, eax
mov esi, eax
call fcn.00423f60
lea rdx, str.getpeername___failed_with_errno__d:__s
mov r9, rax
mov r8d, esi
mov rcx, rdi
call fcn.00416f80
nop
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea r13, [rsp + 0xb0]
mov dword [rsp + 0x2c], pe_nt_image_headers64
mov r8, rbp
mov rcx, rsi
mov rdx, r13
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x415840
lea rsi, [rbx + 0xee]
lea r8, [rbx + 0x11c]
mov rcx, r12
mov rdx, rsi
call fcn.004154d0
test al, al
jne 0x4157c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov edx, eax
mov esi, eax
call fcn.00423f60
lea rdx, str.ssrem_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov r8d, esi
mov rcx, rdi
call fcn.00416f80
jmp 0x415742
mov rdx, qword [rbx + 0xee]
lea r8, [rbx + 0x150]
mov rcx, r13
mov qword [rbx + 0x70], rdx
mov rdx, qword [rsi + 8]
mov qword [rbx + 0x78], rdx
mov rdx, qword [rsi + 0x10]
mov qword [rbx + 0x80], rdx
mov rdx, qword [rsi + 0x18]
mov qword [rbx + 0x88], rdx
mov rdx, qword [rsi + 0x20]
mov qword [rbx + 0x90], rdx
mov edx, dword [rsi + 0x28]
mov dword [rbx + 0x98], edx
movzx edx, word [rsi + 0x2c]
mov word [rbx + 0x9c], dx
lea rdx, [rbx + 0x120]
call fcn.004154d0
test al, al
je 0x415880
mov rcx, rbx
call fcn.00415600
nop
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rbx
mov edx, eax
mov esi, eax
call fcn.00423f60
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r9, rax
mov r8d, esi
mov rcx, rdi
call fcn.00416f80
nop
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov edx, eax
mov esi, eax
call fcn.00423f60
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov r8d, esi
mov rcx, rdi
call fcn.00416f80
jmp 0x415742