joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400edee0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov edi, r14d
mov ebp, r14d
mov rsi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl rdi, cl
add rdi, rdi
nop dword [rax]
mov r10, qword [rsi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x1400edf84
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x1400edf40
mov ecx, dword [r10]
jmp 0x1400ee067
cmp ecx, 0x4e0
jb 0x1400ee067
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400edfa0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400edff0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov ecx, edx
mov dword [r10], eax
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rdx, rcx
shr rdx, 0x12
xor rdx, rcx
cmp rdx, qword [rsi + 0x10]
ja 0x1400edf20
mov rax, qword [rsi + 8]
or rdi, rdx
add rbp, rax
cmp rbp, 0x40
jb 0x1400edf10
mov rbx, qword [rsp + 0x10]
mov rax, rdi
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop r14
ret
Function at 0x1400ee0f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x1340]
mov eax, 0x1440
call fcn.140147b60
sub rsp, rax
mov rdi, r8
mov rsi, rdx
mov rcx, qword [rcx]
call fcn.1400eb2d0
test al, al
jne 0x1400ee2b6
movdqa xmm0, xmmword [0x140196fc0]
movdqu xmmword [rsp + 0x38], xmm0
xor ebx, ebx
mov qword [rsp + 0x48], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
cmp qword [rdi + 0x18], 0x10
jb 0x1400ee158
mov rdi, qword [rdi]
lea r9, [rbp + 0x1350]
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x1400ee276
mov rax, qword [rbp + 0x1350]
test rax, rax
je 0x1400ee18f
inc rbx
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x1400ee183
call fcn.140125778
mov r8d, 0xffffffff
mov dword [rbp + 0x1334], r8d
mov dword [rbp - 0x4c], eax
mov edx, 1
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 - 0x4c], eax
inc rdx
cmp rdx, 0x270
jb 0x1400ee1b0
mov dword [rbp - 0x50], 0x270
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov ecx, 0x40
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
dec rcx
shr rax, 1
cmp rax, r8
ja 0x1400ee1f0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x20]
test rbx, rbx
jne 0x1400ee216
call fcn.1400edee0
jmp 0x1400ee21e
mov rdx, rbx
call fcn.1400edc80
mov rbx, qword [rbp + 0x1350]
test rax, rax
je 0x1400ee23a
nop word [rax + rax]
mov rbx, qword [rbx + 0x28]
sub rax, 1
jne 0x1400ee230
mov rax, qword [rbx + 0x20]
mov ecx, dword [rax + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov edx, eax
mov rcx, rsi
call fcn.1400ed5d0
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rax, rsi
lea r11, [rsp + 0x1440]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.1400eeea0
nop
mov r8, rax
lea rdx, str.Ipv4Resolver::resolve__getaddrinfo_failed_
lea rcx, [rbp - 0x78]
call fcn.140085ef0
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14000b240
lea rdx, [0x1401ddf08]
lea rcx, [rsp + 0x20]
call fcn.140148aa8
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
call fcn.1400952e0
lea rdx, [0x1401de758]
lea rcx, [rsp + 0x20]
call fcn.140148aa8
int3
Function at 0x1400fcf50
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
xor eax, eax
xchg byte [rcx], al
mov ecx, reloc.WS2_32.dll_recv
call fcn.140147620
test rax, rax
je 0x1400fcf7a
lea rcx, [0x1400fbb40]
mov qword [rax], rcx
mov qword [rax + 8], rbx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400fb590]
xor edx, edx
xor ecx, ecx
call fcn.14015b140
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400fcfc9
cmp dword [rbx + 0x10], 0
jne 0x1400fcfc3
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx + 8], xmm0
add rsp, 0x40
pop rbx
ret
call fcn.140157800
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call fcn.1401248c8
int3
Function at 0x140106f60
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
mov edx, 0x201000
xor ecx, ecx
mov r9d, 4
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx], rax
test rax, rax
je 0x140106f93
mov rax, rbx
add rsp, 0x40
pop rbx
ret
lea rcx, [rsp + 0x20]
call fcn.140106f30
lea rdx, [0x1401dedc0]
lea rcx, [rsp + 0x20]
call fcn.140148aa8
int3

Function at 0x140107030
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm0, xmmword [rcx]
movdqu xmmword [rdx + 0x10], xmm3
movdqa xmm2, xmm0
movdqu xmmword [rdx], xmm0
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
movdqa xmm4, xmm2
pxor xmm4, xmm1
pslldq xmm2, 4
pxor xmm4, xmm2
aeskeygenassist xmm0, xmm3, 1
pshufd xmm1, xmm0, 0xff
pxor xmm4, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x20], xmm4
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm4, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x30], xmm2
pslldq xmm1, 4
pxor xmm0, xmm4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 2
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x40], xmm3
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x50], xmm2
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x60], xmm3
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x70], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm4, xmm1
pxor xmm0, xmm3
pslldq xmm1, 4
pxor xmm4, xmm0
pxor xmm4, xmm1
aeskeygenassist xmm0, xmm2, 8
pshufd xmm1, xmm0, 0xff
pxor xmm4, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x80], xmm4
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm4, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm3, xmm1
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x90], xmm3
pslldq xmm1, 4
pxor xmm0, xmm4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0x10
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqu xmmword [rdx + 0xa0], xmm2
ret
Function at 0x1401219c0
Capabilities:
Get local ipv4 addresses
Get socket information
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x8c0
movzx edi, dx
mov r14, r8
mov r8d, dword [rsp + 0x910]
movzx edx, di
mov r15, r9
mov dword [r9], 0
mov rbp, rcx
call fcn.140122570
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140121a09
xor eax, eax
jmp 0x140121b45
mov qword [rsp + 0x8e0], rbx
mov rbx, qword [rsp + 0x900]
test rbx, rbx
je 0x140121aad
lea r8, [rsp + 0x8f8]
mov dword [rsp + 0x8f8], 0x80
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jns 0x140121a55
lea rcx, str.getsockname
call fcn.14015e868
jmp 0x140121aad
mov r9d, dword [rsp + 0x908]
lea rcx, [rsp + 0x40]
mov edx, dword [rsp + 0x8f8]
mov r8, rbx
mov dword [rsp + 0x30], 0xa
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov ebx, eax
test eax, eax
je 0x140121aad
mov ecx, 2
call fcn.14015878c
mov rcx, rax
lea rdx, str.getnameinfo___failed_:__d_n
mov r8d, ebx
call fcn.14007f080
mov dword [rsp + 0x30], edi
lea rax, [0x1401a2f9c]
mov qword [rsp + 0x28], rbp
lea r8, str.GET__s_HTTP__s_r_nHost:__s:_d_r_nConnection:_Close_r_nUser_Agent:_Windows__UPnP_1.1__MiniUPnPc_2.2.2_r_n_r_n
mov r9, r14
mov qword [rsp + 0x20], rax
mov edx, 0x800
lea rcx, [rsp + 0xc0]
call fcn.14011fd60
mov edi, eax
cmp eax, 0x800
jae 0x140121b6a
xor ebx, ebx
test eax, eax
jle 0x140121b1b
mov r8d, edi
movsxd rax, ebx
lea rdx, [rsp + 0xc0]
sub r8d, ebx
add rdx, rax
xor r9d, r9d
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x140121b5e
add ebx, eax
cmp ebx, edi
jl 0x140121af1
mov r8, qword [rsp + 0x918]
mov rdx, r15
mov rcx, rsi
call fcn.1401212d0
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, rbx
mov rbx, qword [rsp + 0x8e0]
lea r11, [rsp + 0x8c0]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
lea rcx, str.send
call fcn.14015e868
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x140121b3d
Function at 0x140121f10
Capabilities:
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x260
mov rsi, qword [rsp + 0x2a8]
mov rbx, 0xffffffffffffffff
mov rdi, rbx
mov rbp, r8
mov r14, rdx
mov r12, rcx
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140121f46
mov byte [rsp + 0x50], 0
cmp r9w, 0x50
je 0x140121f75
movzx r9d, r9w
lea r8, str.:_hu
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.14011fd60
mov rax, qword [rsp + 0x2a0]
lea r8, str.POST__s_HTTP__s_r_nHost:__s_s_r_nUser_Agent:_Windows__UPnP_1.1__MiniUPnPc_2.2.2_r_nContent_Length:__d_r_nContent_Type:_text_xml_r_nSOAPAction:___s__r_nConnection:_Close_r_nCache_Control:_no_cache_r_nPragma:_no_cache_r_n_r_n
mov rcx, qword [rsp + 0x2b0]
mov r9, r14
mov qword [rsp + 0x40], rax
mov edx, 0x200
mov dword [rsp + 0x38], edi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x60]
call fcn.14011fd60
movsxd r14, eax
cmp r14d, 0x200
jae 0x14012205b
mov qword [rsp + 0x280], r15
lea r15d, [r14 + rdi]
movsxd rcx, r15d
call fcn.140159b98
mov rbp, rax
test rax, rax
je 0x140122053
mov r8, r14
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140149970
movsxd r8, edi
lea rcx, [r14 + rbp]
mov rdx, rsi
call fcn.140149970
xor r9d, r9d
mov r8d, r15d
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.WS2_32.dll_send]
mov edi, eax
test eax, eax
jns 0x140122049
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call fcn.14015878c
mov rcx, rax
lea r8, str.send
mov r9d, ebx
lea rdx, str.Socket_error:__s___d_n
call fcn.14007f080
mov rcx, rbp
call fcn.14014e224
mov ebx, edi
mov r15, qword [rsp + 0x280]
lea r11, [rsp + 0x260]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
Function at 0x140122570
Capabilities:
Connect socket
Resolve dns

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r14
sub rsp, 0xa8
mov qword [rax + 0x10], rbp
xorps xmm0, xmm0
xor ebp, ebp
mov qword [rax - 0x28], r15
xorps xmm1, xmm1
movzx r9d, dx
mov r14d, r8d
mov r15, rcx
movdqu xmmword [rsp + 0x2c], xmm0
mov edi, 1
lea edx, [rbp + 8]
movdqu xmmword [rsp + 0x3c], xmm1
mov dword [rax - 0x7c], ebp
lea r8, [0x1401a358c]
lea rcx, [rax + 0x20]
mov qword [rsp + 0x20], 8
mov dword [rsp + 0x28], edi
call fcn.14011fd60
cmp byte [r15], 0x5b
jne 0x14012262f
movzx eax, byte [r15 + 1]
lea rbx, [r15 + 1]
test al, al
je 0x140122625
mov esi, ebp
cmp al, 0x5d
je 0x140122625
cmp rsi, 0x40
jge 0x140122625
movsxd rcx, edi
lea rdx, [0x1401a2fa4]
add rcx, r15
mov byte [rsp + rsi + 0x50], al
mov r8d, 3
call fcn.14015e460
test eax, eax
jne 0x140122613
add edi, 2
add rbx, 2
movzx eax, byte [rbx + 1]
inc rbx
inc ebp
inc rsi
inc edi
test al, al
jne 0x1401225e2
movsxd rax, ebp
mov byte [rsp + rax + 0x50], 0
jmp 0x140122642
mov r8d, 0x40
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.14015e4f0
lea r9, [rsp + 0xd0]
mov byte [rsp + 0x90], 0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r15, qword [rsp + 0xa0]
mov esi, eax
mov rbp, qword [rsp + 0xd8]
test eax, eax
je 0x1401226b0
mov ecx, 2
call fcn.14015878c
mov rcx, rax
lea rdx, str.getaddrinfo___error_:__d_n
mov r8d, esi
call fcn.14007f080
mov rax, 0xffffffffffffffff
add rsp, 0xa8
pop r14
pop rdi
pop rsi
pop rbx
ret
mov rbx, qword [rsp + 0xd0]
mov rdi, 0xffffffffffffffff
test rbx, rbx
je 0x14012272a
cmp rdi, 0xffffffffffffffff
je 0x1401226d3
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov r8d, dword [rbx + 0xc]
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140122719
mov rax, qword [rbx + 0x20]
mov rdx, rax
cmp word [rax], 0x17
jne 0x140122706
test r14d, r14d
je 0x140122706
mov dword [rax + 0x18], r14d
mov rdx, qword [rbx + 0x20]
mov r8d, dword [rbx + 0x10]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_connect]
mov esi, eax
test eax, eax
jns 0x140122722
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x1401226c4
mov rbx, qword [rsp + 0xd0]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp rdi, 0xffffffffffffffff
jne 0x140122772
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea ecx, [rdi + 3]
mov ebx, eax
call fcn.14015878c
mov rcx, rax
lea r8, str.socket
mov r9d, ebx
lea rdx, str.Socket_error:__s___d_n
call fcn.14007f080
mov rax, rdi
add rsp, 0xa8
pop r14
pop rdi
pop rsi
pop rbx
ret
test esi, esi
jns 0x1401227be
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call fcn.14015878c
mov rcx, rax
lea r8, str.connect
mov r9d, ebx
lea rdx, str.Socket_error:__s___d_n
call fcn.14007f080
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, 0xffffffffffffffff
add rsp, 0xa8
pop r14
pop rdi
pop rsi
pop rbx
ret
mov rax, rdi
add rsp, 0xa8
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140122b00
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x250
mov rsi, rdx
mov qword [rsp + 0x48], rcx
mov eax, 0x10624dd3
mov dword [rsp + 0x40], 1
imul r9d
mov edi, r8d
mov rbx, rcx
sar edx, 6
xor r8d, r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3e8
mov dword [rsp + 0x30], edx
lea rdx, [rsp + 0x40]
sub r9d, eax
imul eax, r9d, 0x3e8
xor r9d, r9d
lea ecx, [r9 + 0x40]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jns 0x140122ba7
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call fcn.14015878c
mov rcx, rax
lea r8, str.select
mov r9d, ebx
lea rdx, str.Socket_error:__s___d_n
call fcn.14007f080
mov eax, 0xffffffff
jmp 0x140122c05
jne 0x140122bad
xor eax, eax
jmp 0x140122c05
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test eax, eax
jns 0x140122bf0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call fcn.14015878c
mov rcx, rax
lea r8, str.recv
mov r9d, ebx
lea rdx, str.Socket_error:__s___d_n
call fcn.14007f080
mov rax, qword [rsp + 0x280]
test rax, rax
je 0x140122c03
mov dword [rax], 0
mov eax, edi
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x14013dda8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x140127a96
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x140127a79
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x140127a64

Function at 0x140159e98
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140159d23
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140159d23
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140159d23
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140159d23
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140159d23
cmp dword [rcx + 0x84], 0xe
jbe 0x140159d23
cmp dword [rcx + 0xf8], 0
je 0x140159d23
mov ecx, ebx
call fcn.140159dc4
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140159ba0
cmp dword [rbp + 0x20], 0
je 0x140159d70
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140159d78
int3
xor r8d, r8d
xor edx, edx
jmp 0x140159cbc
Function at 0x140007d40
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rcx, qword [0x14002d0a0]
test rcx, rcx
je 0x140007d7b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140007da0
mov rcx, qword [0x14002d0a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x1400300e0], 0
jne 0x140007db8
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [0x14002d0a0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140007d6e
mov edx, 0x414
lea r12, [rsp + 0x20]
lea rsi, [0x14001d3ca]
mov qword [rsp + 0x20], 0
lea rdi, [0x140030100]
movq xmm0, rsi
mov rcx, r12
mov dword [rsp + 0x28], 3
movq xmm6, rdi
mov word [rsp + 0x40], dx
mov rbp, qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, 0x14
punpcklqdq xmm6, xmm0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rsi
movaps xmmword [rsp + 0x30], xmm6
call rbp
mov r13, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140007e84
test al, 0x10
je 0x140007d84
mov ecx, 0x64
call r14
mov eax, 0x414
mov qword [rsp + 0x50], rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
movaps xmmword [rsp + 0x30], xmm6
call rbp
sub ebx, 1
je 0x140007d84
mov rcx, rdi
call r13
cmp eax, 0xffffffff
jne 0x140007e30
jmp 0x140007d84

Function at 0x14000e4f0
Capabilities:
Create directory

Disassembly:
push rdi
mov eax, 0x2020
push rsi
push rbx
call fcn.140015590
sub rsp, rax
mov eax, dword [0x140034100]
mov rsi, rcx
test eax, eax
je 0x14000e590
xor ebx, ebx
lea rdi, [0x140032100]
test eax, eax
jg 0x14000e52c
jmp 0x14000e540
add rbx, 1
cmp dword [0x140034100], ebx
jle 0x14000e540
mov rdx, qword [rdi + rbx*8]
mov rcx, rsi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14000e520
jmp 0x14000e577
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp rax, 2
jne 0x14000e555
cmp word [rsi + 2], 0x3a
je 0x14000e577
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000e5e0
movsxd rbx, dword [0x140034100]
cmp ebx, 0x3ff
jle 0x14000e5f8
mov eax, 1
add rsp, 0x2020
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
lea rbx, str.HOME
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rdi
call fcn.140007540
test al, al
je 0x14000e61a
movsxd rbx, dword [0x140034100]
mov rcx, rdi
lea rdi, [0x140032100]
call sub.msvcrt.dll__wcsdup
mov qword [rdi + rbx*8], rax
mov eax, dword [0x140034100]
add eax, 1
mov dword [0x140034100], eax
jmp 0x14000e511
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000e564
xor eax, eax
jmp 0x14000e57c
mov rcx, rsi
call sub.msvcrt.dll__wcsdup
add dword [0x140034100], 1
mov rdx, rax
lea rax, [0x140032100]
mov qword [rax + rbx*8], rdx
jmp 0x14000e577
mov rcx, rbx
call fcn.140007c80
nop
nop word cs:[rax + rax]
nop
Function at 0x140001058
Capabilities:
Execute command

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
movabs rax, 0x259817f80891efe7
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x30], rax
movabs rbx, 0x55ab4ef5b1a500aa
mov qword [rbp - 0x18], rbx
movabs rax, 0xdb2bdf8e1cf39441
mov qword [rbp - 0x28], rax
movabs rsi, 0x25ea179a08f8efab
movdqa xmm0, xmmword [rbp - 0x30]
movabs rax, 0x9ab2e9fc0a5c0909
mov qword [rbp - 0x20], rax
movabs rdi, 0xdb05dff71c819420
movdqa xmm1, xmmword [rbp - 0x20]
movabs r14, 0x9ab2e9900a30096d
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rdi
pxor xmm0, xmmword [rbp - 0x60]
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], rbx
pxor xmm1, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmmword [rbp - 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
jne 0x1400011ec
movabs rcx, 0x79766b3bbb403804
mov qword [rbp - 0x60], rsi
mov qword [rbp - 8], rcx
movabs rax, 0x58d79f37b8b86e6
mov qword [rbp - 0x30], rax
movabs rax, 0xb560bb9979f1f144
mov qword [rbp - 0x28], rax
movabs rax, 0xe8d080dc2810700e
movdqa xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movabs rax, 0x77c722919fdc72cb
mov qword [rbp - 0x18], rax
movabs rax, 0xd37be7fe0cfbc4d5
movdqa xmm1, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
movabs rax, 0xd37be7fe0cfbc4df
mov qword [rbp - 0x38], rcx
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x58], rdi
pxor xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm0, xmmword [rbp - 0x10]
pxor xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], rbx
pxor xmm1, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmmword [rbp - 0x20], xmm1
call fcn.140001008
mov qword [rbp - 0x58], rdi
lea rcx, [rbp - 0x60]
movabs rax, 0x25ea17ff7b8d8edb
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x60], rax
movdqa xmm0, xmmword [rbp - 0x60]
mov qword [rbp - 0x28], rdi
pxor xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x60], xmm0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x7fffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400011ec