joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008280
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rsi, r8
mov rbp, rdx
mov edi, ecx
test ecx, ecx
jg 0x1400082c0
test ecx, ecx
je 0x140008304
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x1400082a6
test eax, eax
je 0x1400082e1
add ebx, eax
cmp ebx, edi
jl 0x1400082e5
cmp ebx, edi
je 0x140008304
mov r8d, edi
movsxd rdx, ebx
sub r8d, ebx
add rdx, rsi
xor r9d, r9d
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x1400082d7
jmp 0x1400082a6
mov eax, edi
jmp 0x1400082ab

Function at 0x1400087d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor r14d, r14d
mov edi, r8d
mov dword [rsp + 0x60], r14d
mov rsi, rdx
mov rbp, rcx
mov ebx, r14d
test r8d, r8d
jg 0x140008804
test r8d, r8d
jne 0x14000884f
xor eax, eax
jmp 0x140008854
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000884f
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14000884f
add ebx, eax
cmp ebx, edi
jge 0x14000884b
mov r8d, edi
movsxd rdx, ebx
sub r8d, ebx
mov qword [rsp + 0x20], r14
add rdx, rsi
lea r9, [rsp + 0x60]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140008818
jmp 0x14000884f
mov eax, ebx
je 0x140008854
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14000a7b0
Capabilities:
Get token membership

Disassembly:
push rbx
sub rsp, 0x60
xor ebx, ebx
lea rcx, [rsp + 0x78]
xor eax, eax
mov r9d, 0x220
mov word [rsp + 0x7c], ax
mov dl, 2
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rax
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov byte [rsp + 0x7d], 5
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rsp + 0x70], eax
test eax, eax
jne 0x14000a812
add rsp, 0x60
pop rbx
ret
mov rdx, qword [rsp + 0x80]
lea r8, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rsp + 0x70]
test eax, eax
cmove ecx, ebx
mov dword [rsp + 0x70], ecx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rsp + 0x70]
add rsp, 0x60
pop rbx
ret
Function at 0x14000acc0
Capabilities:
Connect to http server
Create http request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [0x140033958], 0
mov rbx, r8
movzx esi, dx
mov dword [rsp + 0x68], 0x3a980
mov rbp, rcx
je 0x14000acf5
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rax, qword [0x140036d20]
xor edi, edi
cmp word [rax + 0x10], 1
jne 0x14000ad0b
movzx edx, word [rax + 0x18]
jmp 0x14000ad0d
mov edx, edi
test dl, 8
mov ecx, 0x84c03200
mov edx, 0x84400200
cmove ecx, edx
cmp word [rax + 0x320], 1
mov dword [0x140033968], ecx
jne 0x14000ad41
cmp word [rax + 0x328], 1
jne 0x14000ad41
bts ecx, 0x13
mov dword [0x140033968], ecx
cmp word [rax + 0x230], 1
jne 0x14000ad5d
cmp word [rax + 0x238], di
je 0x14000ad5d
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14000ad78
cmp word [rax + 0x200], 3
jne 0x14000ad70
mov r8, qword [rax + 0x208]
jmp 0x14000ad73
mov r8, rdi
mov edx, 3
xor r9d, r9d
mov dword [rsp + 0x20], edi
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [0x140033978], rax
mov r9d, 4
lea r8, [rsp + 0x68]
mov rcx, rax
lea edx, [r9 + 1]
call qword [sym.imp.WININET.dll_InternetSetOptionA]
mov rcx, qword [0x140033978]
lea r8, [rsp + 0x68]
mov r9d, 4
lea edx, [r9 + 2]
call qword [sym.imp.WININET.dll_InternetSetOptionA]
mov rax, qword [0x140033960]
xor r9d, r9d
mov rcx, qword [0x140033978]
movzx r8d, si
mov qword [rsp + 0x38], rax
mov rdx, rbp
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WININET.dll_InternetConnectA]
mov rdx, qword [0x140036d20]
mov r10, rax
mov qword [0x140033970], rax
cmp word [rdx + 0x230], 1
jne 0x14000aeb4
cmp word [rdx + 0x238], 4
jne 0x14000aeb4
cmp word [rdx + 0x210], 3
mov rbx, 0xffffffffffffffff
mov rax, rbx
jne 0x14000ae50
mov rcx, qword [rdx + 0x218]
nop
inc rax
cmp byte [rcx + rax], dil
jne 0x14000ae40
mov r8, rcx
jmp 0x14000ae5c
inc rax
cmp byte [rdi + rax], dil
jne 0x14000ae50
mov r8, rdi
mov r9d, eax
mov edx, 0x2b
mov rcx, r10
call qword [sym.imp.WININET.dll_InternetSetOptionA]
mov rcx, qword [0x140036d20]
cmp word [rcx + 0x220], 3
jne 0x14000ae93
mov rax, qword [rcx + 0x228]
inc rbx
cmp byte [rax + rbx], dil
jne 0x14000ae85
mov rdi, rax
jmp 0x14000ae9c
inc rbx
cmp byte [rdi + rbx], dil
jne 0x14000ae93
mov rcx, qword [0x140033970]
mov r9d, ebx
mov r8, rdi
mov edx, 0x2c
call qword [sym.imp.WININET.dll_InternetSetOptionA]
mov rcx, qword [0x140033958]
test rcx, rcx
je 0x14000aec6
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000af20
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x130
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x100
call fcn.140021acb
xor edi, edi
mov dword [rsp + 0x148], 0x100
lea r9, [rsp + 0x148]
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x30]
mov rcx, rbx
lea edx, [rdi + 0x13]
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x14000af87
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
cmp eax, 0xc8
sete dil
mov eax, edi
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
Function at 0x14000bcb0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140036d20]
xor r8d, r8d
mov r10, rdx
mov r11, rcx
cmp word [rax + 0x2b0], 1
jne 0x14000bcd8
movzx r9d, word [rax + 0x2b8]
jmp 0x14000bcdb
mov r9d, r8d
movzx ecx, word [rax + 0x2c0]
cmp cx, 1
jne 0x14000bcf1
movzx edx, word [rax + 0x2c8]
jmp 0x14000bcf4
mov edx, r8d
cmp r9w, dx
je 0x14000bd3f
cmp cx, 1
jne 0x14000bd08
movzx r8d, word [rax + 0x2c8]
movsx r8d, r8w
lea r9, [rsp + 0x40]
mov rdx, r10
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000bd3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r9d, r9d
xor r8d, r8d
mov edx, eax
lea ecx, [r9 + 0x11]
call fcn.14000a500
xor eax, eax
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret

Function at 0x14000be90
Capabilities:
Encode data using xor
Generate random numbers via winapi

Disassembly:
push rbx
push rdi
push r12
push r13
sub rsp, 0x38
xor edi, edi
mov dword [rsp + 0x20], 0xf0000020
mov r13d, edx
mov qword [rsp + 0x70], rdi
mov r12, rcx
lea r8, str.Microsoft_Base_Cryptographic_Provider_v1.0
xor edx, edx
lea rcx, [rsp + 0x70]
lea r9d, [rdi + 1]
mov ebx, edi
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14000bef4
lea r9d, [rdi + 1]
mov dword [rsp + 0x20], 0xf0000028
lea r8, str.Microsoft_Base_Cryptographic_Provider_v1.0
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov ebx, eax
test eax, eax
je 0x14000bf1f
mov rcx, qword [rsp + 0x70]
mov r8, r12
mov edx, r13d
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x70]
test eax, eax
cmove ebx, edi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test ebx, ebx
jne 0x14000bfd0
mov qword [rsp + 0x30], r15
mov r15d, r13d
mov ebx, edi
test r13d, r13d
je 0x14000bfbd
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], r14
dec r15d
mov r14d, 8
xor bpl, bpl
nop dword [rax]
dec r14d
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
mov esi, eax
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
cmp esi, eax
jne 0x14000bf72
xor ebx, 1
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
cmp esi, eax
je 0x14000bf65
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
mov esi, eax
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
cmp esi, eax
jne 0x14000bf91
xor edi, 1
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
cmp esi, eax
je 0x14000bf84
cmp ebx, edi
je 0x14000bf53
add bpl, bpl
or bpl, bl
test r14d, r14d
jne 0x14000bf50
mov rcx, r12
inc r12
mov byte [rcx], bpl
test r15d, r15d
jne 0x14000bf41
mov r14, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r15, qword [rsp + 0x30]
mov eax, r13d
add rsp, 0x38
pop r13
pop r12
pop rdi
pop rbx
ret
mov eax, ebx
add rsp, 0x38
pop r13
pop r12
pop rdi
pop rbx
ret
Function at 0x14000c710
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x40
mov r12, rcx
mov rsi, r9
lea rcx, [rdx + 0x30]
mov r14d, r8d
mov rbp, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x14000c7e0
lea r8, [rbp + 0x30]
mov qword [rsp + 0x70], r15
xor edx, edx
mov rcx, rax
call fcn.140021acb
mov ecx, dword [reloc.WS2_32.dll_accept]
call qword [sym.imp.WS2_32.dll_htonl]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.WS2_32.dll_htonl]
inc dword [reloc.WS2_32.dll_accept]
lea r15d, [rbp + 0x30]
mov dword [rdi], ebx
mov ecx, r14d
mov dword [rdi + 4], eax
mov ebx, 8
call qword [sym.imp.WS2_32.dll_htonl]
cmp r15d, 0xc
jl 0x14000c7a2
mov ebx, ntohl
mov dword [rdi + 8], eax
lea ecx, [rbx - 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rdi + 4], eax
lea r14d, [rbx + rbp]
cmp r14d, r15d
mov r15, qword [rsp + 0x70]
jg 0x14000c7d0
mov ecx, ebx
mov r8, rbp
add rcx, rdi
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
lea ecx, [r14 - 8]
mov ebx, r14d
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rdi + 4], eax
add ebx, 4
test ebx, ebx
jg 0x14000c7fc
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dword [rsi], 0
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, ebx
mov dword [rsp + 0x78], reloc.WS2_32.dll_recv
and eax, 0x8000000f
jge 0x14000c814
dec eax
or eax, 0xfffffff0
inc eax
test eax, eax
je 0x14000c824
cmp eax, 0x10
jge 0x14000c824
inc ebx
add eax, 1
jne 0x14000c818
movzx eax, word [0x140033994]
test ax, ax
je 0x14000c836
cmp ax, 1
jmp 0x14000c88c
mov ecx, dword [0x140033990]
lea rbp, [0x140034af0]
mov qword [rsp + 0x28], rbp
lea r8, [0x140036cc0]
mov r9d, reloc.WS2_32.dll_recv
mov dword [rsp + 0x20], 0
lea rdx, [0x140034ac8]
call fcn.1400132b0
test eax, eax
jne 0x14000c8d3
mov r9, rbp
mov r8d, ebx
mov rdx, rdi
mov rcx, rdi
call fcn.1400128b0
test eax, eax
jne 0x14000c8d3
mov rcx, rbp
call fcn.14000def0
test eax, eax
jne 0x14000c8d3
lea rcx, [rsp + 0x78]
movsxd rax, ebx
mov qword [rsp + 0x30], rcx
lea rdx, [0x140034ad8]
mov ecx, dword [0x140033988]
add rax, rdi
mov qword [rsp + 0x28], rax
mov r9, rdi
mov r8d, reloc.WS2_32.dll_recv
mov dword [rsp + 0x20], ebx
call fcn.140012eb0
test eax, eax
jne 0x14000c8d3
lea eax, [rbx + 0x10]
mov dword [rsi], eax
mov rax, rdi
jmp 0x14000c7e8
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x14000d800
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000d84a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000d84a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000d84a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000d84a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000d84a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000d84c
xor al, al
add rsp, 0x28
ret
Function at 0x14000daf0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, r9
mov r14, r8
mov edi, edx
mov rbx, rcx
test rcx, rcx
jne 0x14000db2c
lea r8d, [rcx + 0x25]
lea rcx, str.in___NULL
lea rdx, str.srcmisc_base64_base64_encode.c
call fcn.140013660
test r14, r14
jne 0x14000db48
lea r8d, [r14 + 0x26]
lea rdx, str.srcmisc_base64_base64_encode.c
lea rcx, str.out___NULL
call fcn.140013660
test rsi, rsi
jne 0x14000db64
lea r8d, [rsi + 0x27]
lea rdx, str.srcmisc_base64_base64_encode.c
lea rcx, str.outlen___NULL
call fcn.140013660
lea ecx, [rdi + 2]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea edx, [rdx*4 + 1]
cmp dword [rsi], edx
jae 0x14000db87
mov dword [rsi], edx
mov eax, 6
jmp 0x14000dcc1
mov r10, qword [rsp + 0x50]
xor r9d, r9d
mov eax, 0xaaaaaaab
mov qword [rsp + 0x30], rbp
mul edi
mov rcx, r14
mov ebp, r9d
shr edx, 1
lea edx, [rdx + rdx*2]
test edx, edx
je 0x14000dc22
dec edx
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
mov r11d, edx
lea ebp, [rdx + rdx*2]
nop dword [rax]
movzx eax, byte [rbx]
shr rax, 2
movzx eax, byte [rax + r10]
mov byte [rcx], al
movzx edx, byte [rbx]
movzx r8d, byte [rbx + 1]
shl edx, 4
shr r8d, 4
add r8d, edx
and r8d, 0x3f
movzx eax, byte [r8 + r10]
mov byte [rcx + 1], al
movzx eax, byte [rbx + 2]
movzx edx, byte [rbx + 1]
shr eax, 6
lea edx, [rax + rdx*4]
and edx, 0x3f
movzx eax, byte [rdx + r10]
mov byte [rcx + 2], al
movzx eax, byte [rbx + 2]
add rbx, 3
and eax, 0x3f
movzx eax, byte [rax + r10]
mov byte [rcx + 3], al
add rcx, 4
sub r11, 1
jne 0x14000dbc0
cmp ebp, edi
jae 0x14000dcb2
movzx r11d, byte [rbx]
lea r8d, [rbp + 1]
cmp r8d, edi
jae 0x14000dc3c
movzx r9d, byte [rbx + 1]
mov edx, r9d
mov rax, r11
shr edx, 4
shr rax, 2
shl r11d, 4
add edx, r11d
and edx, 0x3f
movzx eax, byte [rax + r10]
mov byte [rcx], al
movzx eax, byte [rdx + r10]
mov byte [rcx + 1], al
add rcx, 2
cmp dword [rsp + 0x58], 0
je 0x14000dc9b
cmp r8d, edi
jae 0x14000dc8b
and r9d, 0xf
shl r9d, 2
movsx edx, byte [r9 + r10]
mov byte [rcx], dl
mov byte [rcx + 1], 0x3d
add rcx, 2
jmp 0x14000dcb2
mov edx, 0x3d
mov byte [rcx], dl
mov byte [rcx + 1], dl
add rcx, 2
jmp 0x14000dcb2
cmp r8d, edi
jae 0x14000dcb2
and r9d, 0xf
shl r9d, 2
movzx edx, byte [r9 + r10]
mov byte [rcx], dl
inc rcx
mov rbp, qword [rsp + 0x30]
mov byte [rcx], 0
sub ecx, r14d
mov dword [rsi], ecx
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400128b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov ebp, r8d
mov rdi, rdx
mov rsi, rcx
test rcx, rcx
jne 0x1400128e4
lea r8d, [rcx + 0x1f]
lea rcx, str.pt___NULL
lea rdx, str.srcmodescbccbc_encrypt.c
call fcn.140013660
test rdi, rdi
jne 0x140012900
lea r8d, [rdi + 0x20]
lea rdx, str.srcmodescbccbc_encrypt.c
lea rcx, str.ct___NULL
call fcn.140013660
test rbx, rbx
jne 0x14001291c
lea r8d, [rbx + 0x21]
lea rdx, str.srcmodescbccbc_encrypt.c
lea rcx, str.cbc___NULL
call fcn.140013660
mov ecx, dword [rbx]
call fcn.140013700
test eax, eax
jne 0x140012a47
mov r8d, dword [rbx + 4]
lea eax, [r8 - 1]
cmp eax, 0x7f
ja 0x140012946
xor edx, edx
mov eax, ebp
div r8d
mov r11d, eax
test edx, edx
je 0x140012958
mov eax, reloc.WS2_32.dll_recv
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
movsxd rax, dword [rbx]
mov qword [rsp + 0x50], r12
lea r12, [0x14002f280]
lea rcx, [rax + rax*2]
shl rcx, 6
mov r10, qword [rcx + r12 + 0x60]
test r10, r10
je 0x14001299a
lea rax, [rbx + 0x88]
mov r8d, r11d
lea r9, [rbx + 8]
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rsi
call r10
jmp 0x140012a42
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r15
test ebp, ebp
je 0x140012a36
nop dword [rax]
xor edx, edx
test r8d, r8d
jle 0x1400129d4
mov r8, rsi
lea rax, [rbx + 8]
sub r8, rbx
movzx ecx, byte [r8 + rax - 8]
inc edx
xor byte [rax], cl
lea rax, [rax + 1]
cmp edx, dword [rbx + 4]
jl 0x1400129c1
movsxd rax, dword [rbx]
lea r8, [rbx + 0x88]
mov rdx, rdi
lea rcx, [rbx + 8]
lea r9, [rax + rax*2]
shl r9, 6
call qword [r9 + r12 + 0x28]
test eax, eax
jne 0x140012a38
xor edx, edx
cmp dword [rbx + 4], edx
jle 0x140012a23
mov r8, rdi
lea rcx, [rbx + 8]
sub r8, rbx
nop word [rax + rax]
movzx eax, byte [r8 + rcx - 8]
inc edx
mov byte [rcx], al
lea rcx, [rcx + 1]
cmp edx, dword [rbx + 4]
jl 0x140012a10
movsxd r8, dword [rbx + 4]
add rdi, r8
add rsi, r8
sub ebp, r8d
jne 0x1400129b0
xor eax, eax
mov r14, qword [rsp + 0x58]
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140013020
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x14002e020]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, r9
mov ebp, r8d
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
jne 0x140013060
lea r8d, [rdx + 0x25]
lea rdx, str.srcmodescbccbc_decrypt.c
lea rcx, str.pt___NULL
call fcn.140013660
test rdi, rdi
jne 0x14001307c
lea r8d, [rdi + 0x26]
lea rdx, str.srcmodescbccbc_decrypt.c
lea rcx, str.ct___NULL
call fcn.140013660
test rbx, rbx
jne 0x140013098
lea r8d, [rbx + 0x27]
lea rdx, str.srcmodescbccbc_decrypt.c
lea rcx, str.cbc___NULL
call fcn.140013660
mov ecx, dword [rbx]
call fcn.140013700
test eax, eax
jne 0x1400131b1
mov ecx, dword [rbx + 4]
lea eax, [rcx - 1]
cmp eax, 0xf
ja 0x1400130be
xor edx, edx
mov eax, ebp
div ecx
mov ecx, eax
test edx, edx
je 0x1400130c8
mov eax, reloc.WS2_32.dll_recv
jmp 0x1400131b1
movsxd rax, dword [rbx]
mov qword [rsp + 0x58], r15
lea r15, [0x14002f280]
lea r8, [rax + rax*2]
shl r8, 6
mov r10, qword [r8 + r15 + 0x68]
test r10, r10
je 0x14001310a
lea rax, [rbx + 0x88]
mov r8d, ecx
mov rcx, rdi
mov qword [rsp + 0x20], rax
lea r9, [rbx + 8]
mov rdx, rsi
call r10
jmp 0x1400131ac
mov qword [rsp + 0x60], r14
test ebp, ebp
je 0x1400131a5
nop word [rax + rax]
movsxd rax, dword [rbx]
lea r8, [rbx + 0x88]
lea rdx, [rsp + 0x30]
mov rcx, rdi
lea r9, [rax + rax*2]
shl r9, 6
call qword [r9 + r15 + gethostbyname]
test eax, eax
jne 0x1400131a7
xor r8d, r8d
cmp dword [rbx + 4], r8d
jle 0x140013193
mov r10, rdi
lea r9, [rsp + 0x30]
sub r10, rbx
lea rax, [rbx + 8]
add r10, 0xfffffffffffffff8
sub r9, rdi
mov r11, rsi
sub r11, rbx
nop dword [rax + rax]
lea rcx, [r10 + rax]
inc r8d
movzx edx, byte [r9 + rcx]
xor dl, byte [rax]
lea rax, [rax + 1]
movzx ecx, byte [rcx]
mov byte [rax - 1], cl
mov byte [r11 + rax - 9], dl
cmp r8d, dword [rbx + 4]
jl 0x140013170
movsxd rcx, dword [rbx + 4]
add rdi, rcx
add rsi, rcx
sub ebp, ecx
jne 0x140013120
xor eax, eax
mov r14, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400218c0
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140013de0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor edi, edi
mov dword [rsp + 0x58], edx
xor ebx, ebx
xor r14d, r14d
mov r13, r8
mov r15d, edx
mov r12, rcx
mov eax, edx
test edx, edx
je 0x140013e8b
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x60], rsi
dec r15d
test r13, r13
je 0x140013e21
call r13
mov ebp, 8
dec ebp
call sub.api_ms_win_crt_time_l1_1_0.dll_clock
mov esi, eax
call sub.api_ms_win_crt_time_l1_1_0.dll_clock
cmp esi, eax
jne 0x140013e44
xor ebx, 1
call sub.api_ms_win_crt_time_l1_1_0.dll_clock
cmp esi, eax
je 0x140013e38
call sub.api_ms_win_crt_time_l1_1_0.dll_clock
mov esi, eax
call sub.api_ms_win_crt_time_l1_1_0.dll_clock
cmp esi, eax
jne 0x140013e60
xor edi, 1
call sub.api_ms_win_crt_time_l1_1_0.dll_clock
cmp esi, eax
je 0x140013e54
cmp ebx, edi
je 0x140013e28
add r14d, r14d
or r14d, ebx
test ebp, ebp
jne 0x140013e26
mov byte [r12], r14b
inc r12
xor r14d, r14d
test r15d, r15d
jne 0x140013e16
mov eax, dword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140013ea0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ebx, edx
mov qword [rsp + 0x58], 0
mov rdi, rcx
mov dword [rsp + 0x20], 0xf0000020
xor edx, edx
lea rcx, [rsp + 0x58]
mov r9d, 1
lea r8, [0x140027660]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140013f02
lea r9d, [rax + 1]
mov dword [rsp + 0x20], 0xf0000028
lea r8, [0x140027660]
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140013f37
mov rcx, qword [rsp + 0x58]
mov r8, rdi
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
xor edx, edx
cmp eax, 1
jne 0x140013f31
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400166b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push r14
push r15
sub rsp, 0x38
mov esi, r9d
mov r15, r8
movsxd r14, edx
mov rbx, rcx
test rcx, rcx
jne 0x1400166e3
lea r8d, [rcx + 0x23]
lea rcx, str.hmac___NULL
lea rdx, str.srcmachmachmac_init.c
call fcn.140013660
test r15, r15
jne 0x1400166ff
lea r8d, [r15 + 0x24]
lea rdx, str.srcmachmachmac_init.c
lea rcx, str.key___NULL
call fcn.140013660
mov ecx, r14d
call fcn.140013730
test eax, eax
jne 0x14001685b
mov qword [rsp + 0x68], rbp
mov rbp, r14
shl rbp, 7
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x30], r13
lea r13, [0x140030a80]
mov dword [rbx + 0x1a0], r14d
mov r12d, dword [r13 + rbp + 0xc]
test esi, esi
jne 0x140016744
lea eax, [rsi + 3]
jmp 0x14001684c
mov ecx, dword [r13 + rbp + 0x10]
mov qword [rsp + 0x70], rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdi, rax
test rax, rax
je 0x140016779
mov ecx, dword [r13 + rbp + 0x10]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov qword [rbx + 0x348], rax
test rax, rax
jne 0x140016783
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov eax, ntohl
jmp 0x140016847
mov ecx, dword [r13 + rbp + 0x10]
mov rdx, r15
cmp esi, ecx
jbe 0x1400167ba
mov dword [rsp + 0x60], ecx
mov r9, rax
lea rcx, [rsp + 0x60]
mov r8d, esi
mov qword [rsp + 0x20], rcx
mov ecx, r14d
call fcn.14000e140
mov esi, eax
test eax, eax
jne 0x140016831
mov esi, r12d
jmp 0x1400167c5
mov r8, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [r13 + rbp + 0x10]
cmp esi, eax
jae 0x1400167e0
sub eax, esi
mov ecx, esi
add rcx, qword [rbx + 0x348]
mov edx, eax
call fcn.140016eb0
xor r9d, r9d
cmp dword [r13 + rbp + 0x10], r9d
jbe 0x14001680d
nop word [rax + rax]
mov rax, qword [rbx + 0x348]
movzx ecx, byte [r9 + rax]
xor cl, 0x36
mov byte [r9 + rdi], cl
inc r9d
cmp r9d, dword [r13 + rbp + 0x10]
jb 0x1400167f0
mov rcx, rbx
call qword [r13 + rbp + 0x58]
mov esi, eax
test eax, eax
jne 0x140016831
mov r8d, dword [r13 + rbp + 0x10]
mov rdx, rdi
mov rcx, rbx
call qword [r13 + rbp + 0x60]
mov esi, eax
test eax, eax
je 0x14001683d
mov rcx, qword [rbx + 0x348]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov eax, esi
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov r13, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop rsi
pop rbx
ret