joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006f8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140098010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x14006f906
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x14006f8f6
cmp byte [rax], cl
jne 0x14006f906
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x14006f8e7
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x14006fa6a
cmp byte [r8 + 1], dl
je 0x14006fa6a
lea r11, [rsp + 0x20]
mov r9, r8
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x14006f942
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x14006f96a
sub dl, 0x61
cmp dl, 0x19
ja 0x14006f95c
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x14006f96a
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x14006f925
jmp 0x14006f96d
inc r9
cmp r8, r9
jae 0x14006f99f
movabs rdx, 0x800000000000009
nop dword [rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x14006f994
bt rdx, rax
jb 0x14006f99a
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x14006f980
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.140035a30
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x14006f9d8
nop
inc rcx
cmp byte [rcx], 0x20
je 0x14006f9d0
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14006fa58
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x14006f9f3
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x14006fa09
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x14006fa46
movss xmm2, dword [0x1400863ac]
cmp al, 0x39
ja 0x14006fa46
movzx eax, al
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x14006fa20
cmp r9b, 0x2d
jne 0x14006fa65
xorps xmm1, xmmword [0x140086a50]
movaps xmm0, xmm1
jmp 0x14006fa6d
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14006fa6d
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400772f0
add rsp, 0x90
pop rbx
ret
Function at 0x14006fa90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140098010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x14006fad6
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x14006fac6
cmp byte [rax], cl
jne 0x14006fad6
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x14006fab7
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x14006fc34
cmp byte [r8 + 1], dl
je 0x14006fc34
lea r11, [rsp + 0x20]
mov r9, r8
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x14006fb12
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x14006fb3a
sub dl, 0x61
cmp dl, 0x19
ja 0x14006fb2c
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x14006fb3a
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x14006faf5
jmp 0x14006fb3d
inc r9
cmp r8, r9
jae 0x14006fb6f
movabs rdx, 0x800000000000009
nop dword [rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x14006fb64
bt rdx, rax
jb 0x14006fb6a
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x14006fb50
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140035a30
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x14006fba8
nop dword [rax + rax]
inc rcx
cmp byte [rcx], 0x20
je 0x14006fba0
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14006fc26
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x14006fbc3
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x14006fbd9
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x14006fc14
movsd xmm2, qword [0x140086378]
cmp al, 0x39
ja 0x14006fc14
movzx eax, al
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x14006fbf0
cmp r9b, 0x2d
jne 0x14006fc2f
xorps xmm1, xmmword [0x140086a40]
movaps xmm0, xmm1
jmp 0x14006fc37
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14006fc37
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400772f0
add rsp, 0x90
pop rbx
ret
Function at 0x14006fc50
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
mov r8, qword [0x1400c8400]
mov ecx, dword [r8 + 0x74]
call fcn.14003c770
test al, al
je 0x14006fc76
mov byte [0x1400c4a58], 0x42
mov al, 1
add rsp, 0x38
ret
movss xmm0, dword [r8 + 0x138]
movaps xmmword [rsp + 0x20], xmm6
xorps xmm6, xmm6
comiss xmm6, xmm0
jbe 0x14006fc9f
movaps xmm6, xmmword [rsp + 0x20]
mov al, 1
mov byte [0x1400c4a58], 0x3f
add rsp, 0x38
ret
comiss xmm0, xmm6
jbe 0x14006fcb7
movaps xmm6, xmmword [rsp + 0x20]
mov al, 1
mov byte [0x1400c4a58], 0x40
add rsp, 0x38
ret
mov ecx, 0xa0
mov qword [rsp + 0x30], rbx
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x14006fce6
mov rbx, qword [rsp + 0x30]
mov al, 1
movaps xmm6, xmmword [rsp + 0x20]
mov byte [0x1400c4a58], 0x37
add rsp, 0x38
ret
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x14006fd10
mov rbx, qword [rsp + 0x30]
mov al, 1
movaps xmm6, xmmword [rsp + 0x20]
mov byte [0x1400c4a58], 0x34
add rsp, 0x38
ret
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x14006fd3a
mov rbx, qword [rsp + 0x30]
mov al, 1
movaps xmm6, xmmword [rsp + 0x20]
mov byte [0x1400c4a58], 0x35
add rsp, 0x38
ret
mov ecx, 5
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x14006fd64
mov rbx, qword [rsp + 0x30]
mov al, 1
movaps xmm6, xmmword [rsp + 0x20]
mov byte [0x1400c4a58], 0x3c
add rsp, 0x38
ret
mov ecx, 6
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x14006fd8e
mov rbx, qword [rsp + 0x30]
mov al, 1
movaps xmm6, xmmword [rsp + 0x20]
mov byte [0x1400c4a58], 0x3d
add rsp, 0x38
ret
mov rdx, qword [0x1400c8400]
xor r8d, r8d
mov ecx, r8d
nop dword [rax + rax]
movsxd rax, ecx
movss xmm0, dword [rdx + rax*4 + 0x43c]
ucomiss xmm0, xmm6
jp 0x14006fdb3
je 0x14006fe08
inc ecx
cmp ecx, 5
jl 0x14006fda0
lea r10, [0x1400833c0]
lea r9, [0x140083d68]
mov ecx, r8d
call fcn.14003c770
test al, al
je 0x14006fdeb
mov rcx, r10
cmp dword [rcx + 0x10], r8d
je 0x14006fde6
add rcx, 0x18
cmp rcx, r9
jne 0x14006fdd7
cmp rcx, r9
jne 0x14006fe22
inc r8d
cmp r8d, 0x200
jl 0x14006fdc8
mov rbx, qword [rsp + 0x30]
xor al, al
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
ret
mov rbx, qword [rsp + 0x30]
add cl, 0x39
movaps xmm6, xmmword [rsp + 0x20]
mov al, 1
mov byte [0x1400c4a58], cl
add rsp, 0x38
ret
sub rcx, r10
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
mov r8, rdx
sar r8, 2
mov rax, r8
shr rax, 0x3f
add r8, rax
mov byte [0x1400c4a58], r8b
cmp r8b, 0x35
jne 0x14006fe6e
mov ecx, 0xa5
call fcn.14003c770
test al, al
movzx ecx, r8b
mov edx, 0x53
cmovne ecx, edx
mov byte [0x1400c4a58], cl
mov rbx, qword [rsp + 0x30]
mov al, 1
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x140070fc0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rax, qword [rcx + 0x98]
mov rdi, rcx
xor r9d, r9d
mov rcx, qword [rax + 8]
mov r8, qword [rdi + 0xa0]
mov rdx, qword [rdi + 0x58]
mov rax, qword [rcx]
call qword [rax + 0xb8]
xor ebx, ebx
cmp dword [rdi + 8], ebx
jle 0x140071064
mov esi, ebx
mov ebp, ebx
nop word [rax + rax]
mov rax, qword [rdi + 0x28]
mov ecx, dword [rdi + 4]
mov r9, qword [rdi + 0xa0]
add ecx, ebx
movsxd rdx, ecx
mov r8, qword [rax + rbp + 8]
imul r8, qword [rax + rbp]
mov rax, qword [rdi + 0x58]
mov qword [rsp + 0x20], r9
mov r9d, 2
mov rdx, qword [rax + rdx*8]
mov rax, qword [rdi + 0x40]
mov rcx, qword [rsi + rax]
call qword [sym.imp.cudart64_110.dll_cudaMemcpyAsync]
mov r14d, eax
test eax, eax
jne 0x14007108c
inc ebx
add rbp, 0x58
add rsi, 8
cmp ebx, dword [rdi + 8]
jl 0x140071010
mov rcx, qword [rdi + 0xa0]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
jmp qword [sym.imp.cudart64_110.dll_cudaStreamSynchronize]
lea rcx, str.CUDA_Error:_n
call fcn.14006fe80
lea rdx, str.C:UsersperscDesktopyolov8tensorRTyolov8tensorRTyolov8.hpp
lea rcx, str.____File:________s_n
call fcn.14006fe80
mov edx, 0x126
lea rcx, str.____Line:________d_n
call fcn.14006fe80
mov edx, r14d
lea rcx, str.____Error_code:__d_n
call fcn.14006fe80
mov ecx, r14d
call qword [sym.imp.cudart64_110.dll_cudaGetErrorString]
mov rdx, rax
lea rcx, str.____Error_text:__s_n
call fcn.14006fe80
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140077120
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400771a4
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14007cd40]
cmp byte [rcx + rax], 0
je 0x1400771a4
dec r8
sub rdx, 1
jne 0x14007718a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400781a0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400781ea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400781ea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400781ea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400781ea
cmp dword [rcx + 0x84], 0xe
jbe 0x1400781ea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400781ec
xor al, al
add rsp, 0x28
ret
Function at 0x140003030
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140003f30
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140003f30
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x1400030a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400090a4]
mov rbx, rcx
test esi, esi
jle 0x1400031d0
mov rax, qword [0x1400090a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400030eb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140003175
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400030d0
mov rcx, rbx
call fcn.140003af0
mov rdi, rax
test rax, rax
je 0x1400031f2
mov rax, qword [0x1400090a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140003c30
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400090a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400031d7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000316e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140003180
add dword [0x1400090a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400090a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000316e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140003030
nop dword [rax]
xor esi, esi
jmp 0x1400030f8
mov rax, qword [0x1400090a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140003030
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140003030
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140003760
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140009100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400090e0]
test rbx, rbx
je 0x1400037bc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400037b3
test rsi, rsi
je 0x1400037b3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003798
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140003af0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140006a40]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140003b10
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140003b18
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140003b10
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x140003b6d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140003b64
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140003b10
add rax, 0x28
cmp rax, r9
jne 0x140003b50
xor eax, eax
ret

Function at 0x140003b70
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006a40]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140003b8f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003b98
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140003b8f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140003c30
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006a40]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140003c4f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003c58
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x1800010c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x28

Function at 0x1800010d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r9, r8
movsxd rax, dword [rcx + 0x3c]
mov r8d, edx
mov rdi, rcx
mov esi, r8d
mov rbp, r9
mov r10d, dword [rax + rcx + 0x88]
mov edx, dword [r10 + rcx + 0x20]
mov eax, dword [r10 + rcx + 0x1c]
add rdx, rcx
mov r11d, dword [r10 + rcx + 0x24]
add rax, rcx
add r11, rcx
xor r10d, r10d
mov r13, rax
mov r12, rdx
mov rbx, r10
mov r14, r11
mov esi, ebx
inc rbx
mov r15d, dword [r12 + rbx*4 - 4]
add r15, rdi
mov rcx, r15
call fcn.180001218
xor r11d, r11d
test eax, eax
jbe 0x180001187
mov r8d, eax
mov ecx, 1
mov r9d, dword [rbp + 0x14]
xor r10d, r10d
shr r8d, 1
je 0x18000116c
imul r11d, r9d
movsx edx, byte [r15 + r10*2]
movzx ecx, dx
add r11d, ecx
imul r11d, r9d
movsx edx, byte [r15 + r10*2 + 1]
inc r10
movzx ecx, dx
add r11d, ecx
cmp r10, r8
jb 0x180001140
lea ecx, [r10 + r10 + 1]
lea edx, [rcx - 1]
cmp edx, eax
jae 0x180001187
movsxd rcx, ecx
imul r9d, r11d
movsx r15d, byte [rcx + r15 - 1]
movzx r11d, r15w
add r11d, r9d
movzx r15d, word [r14 + rbx*2 - 2]
mov eax, dword [r13 + r15*4]
add rax, rdi
cmp esi, r11d
jne 0x180001112
add rsp, 0x28
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x180002020
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
movsxd rcx, ecx
movzx r9d, word [r14 + rcx*2 - 2]
add r9d, r10d

Function at 0x180003f20
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x280], 0
je 0x180003f3d
call fcn.180057450
test eax, eax
jne 0x180003f63
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x1e8]
cmp rcx, 0xffffffffffffffff
je 0x180003f36
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x180003f36
mov al, 1
add rsp, 0x28
ret

Function at 0x1800041b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x18009ddc8]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x80
mov rax, rdx
mov rdi, r8
mov rsi, rcx
lea r8, [rsp + 0x20]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov rbx, r9
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x180004258
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, eax
mov ebx, eax
call fcn.18003d5c0
mov r8d, ebx
lea rdx, str.getsockname___failed_with_errno__d:__s
jmp 0x1800042e1
movzx eax, word [rsp + 0x30]
cmp eax, 2
je 0x180004293
cmp eax, 0x17
jne 0x18000429f
lea rdx, [rsp + 0x38]
mov ecx, eax
mov r8, rdi
mov r9d, reloc.WLDAP32.dll_Ordinal_46
call fcn.180023c70
test rax, rax
je 0x18000429f
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rbx], eax
jmp 0x1800042ec
lea rdx, [rsp + 0x34]
mov ecx, 2
jmp 0x18000426e
mov byte [rdi], 0
mov dword [rbx], 0
call fcn.180063140
mov dword [rax], 0x273f
call fcn.180063140
mov ebx, dword [rax]
call fcn.180063140
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.18003d5c0
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.180033740
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.180058650
add rsp, 0x1c0
pop rdi
pop rsi
pop rbx
ret
Function at 0x180015ad0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 1
mov edx, ebx
xor ecx, ecx
xor ebp, ebp
call qword [0x18009c020]
mov rdi, rax
test rax, rax
je 0x180015b4d
nop word [rax + rax]
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
mov rbp, rdi
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
je 0x180015b78
cmp ebx, esi
je 0x180015b78
cmp ebx, 0x8000
ja 0x180015b78
cmp ebx, esi
jb 0x180015b73
mov edx, ebx
mov rcx, rdi
call qword [0x18009c020]
mov rdi, rax
test rax, rax
jne 0x180015b10
mov rcx, rbp
call qword [fcn.180065170]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rdi
jmp 0x180015b58
mov rcx, rdi
jmp 0x180015b50

Function at 0x180016f70
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [fcn.180065184]
mov rdi, rax
test rax, rax
jne 0x180016fb2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x180016ff9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x180017052
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x180017010
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x180017093
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, str.6xn__
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x18007f0b7]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x180017060
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x180018500
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x18]
cmp byte [rax + 0x3ea], 0
jne fcn.18000b860
jmp fcn.180002260
Function at 0x1400016a0
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x14000f948]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1400016e0
mov eax, 0xff
jmp 0x140001883
mov r9d, dword [rsp + 0x3c]
and r9d, 0x7fff
mov edx, dword [rsp + 0x34]
mov ecx, edx
shl ecx, 8
mov eax, dword [rsp + 0x38]
add ecx, eax
mov r8d, dword [rsp + 0x40]
mov dword [0x140010048], r8d
mov dword [0x140010050], ecx
mov dword [0x140010054], edx
mov dword [0x140010058], eax
mov eax, r9d
bts eax, 0xf
cmp r8d, 2
cmove eax, r9d
mov dword [0x14001004c], eax
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140001776
movsxd rax, dword [0x14000003c]
lea rcx, [0x140000000]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x140001776
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x140001776
xor ebx, ebx
cmp dword [rax + 0x84], 0xe
jbe 0x140001778
cmp dword [rax + 0xf8], ebx
setne bl
jmp 0x140001778
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov edi, 1
mov ecx, edi
call fcn.140003dc8
test eax, eax
jne 0x1400017ae
cmp dword [0x140010028], 2
je 0x14000179a
call fcn.140003bb0
mov ecx, 0x1c
call fcn.140003bfc
mov ecx, 0xff
call fcn.1400037e0
call fcn.1400036c0
test eax, eax
jne 0x1400017da
cmp dword [0x140010028], 2
je 0x1400017c5
call fcn.140003bb0
mov ecx, 0x10
call fcn.140003bfc
mov ecx, 0xff
call fcn.1400037e0
nop
call fcn.140003e3c
test eax, eax
jns 0x1400017ed
mov ecx, 0x1b
call fcn.1400037fc
call sub.KERNEL32.dll_GetCommandLineW
mov qword [0x140012138], rax
call fcn.14000463c
mov qword [0x140010020], rax
call fcn.1400040cc
test eax, eax
jns 0x140001818
mov ecx, 8
call fcn.1400037fc
call fcn.140004400
test eax, eax
jns 0x14000182b
mov ecx, 9
call fcn.1400037fc
mov ecx, edi
call fcn.140003860
test eax, eax
je 0x14000183d
mov ecx, eax
call fcn.1400037fc
mov r8, qword [0x140010038]
mov qword [0x140010068], r8
mov rdx, qword [0x140010030]
mov ecx, dword [0x14001002c]
call fcn.140001200
mov edi, eax
mov dword [rsp + 0x24], eax
test ebx, ebx
je 0x1400018a4
call fcn.14000384c
jmp 0x140001881
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140001af0
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
mov ecx, eax
call fcn.140003ba0
nop
mov ecx, eax
call fcn.140003770
nop
int3
sub rsp, 0x28
call fcn.140136000
add rsp, 0x28
jmp 0x1400016a0