joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a9f0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x268
mov rax, qword [0x140116008]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rsi, r9
mov r14d, r8d
mov rdi, rdx
mov rbp, rcx
mov ebx, r8d
test r8d, r8d
jle 0x14001aabb
xor r15d, r15d
nop dword [rax]
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
movsxd rcx, eax
cmp ecx, 0xffffffff
jne 0x14001aa69
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x14001aab3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test rsi, rsi
jne 0x14001aade
mov eax, 0xfffffff8
jmp 0x14001aabe
sub ebx, ecx
add rdi, rcx
cmp ebx, ecx
je 0x14001aab3
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], r15
lea ecx, [rbp + 1]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov dword [rsp + 0x30], 0x3c
lea r8, [rsp + 0x40]
mov qword [rsp + 0x48], rbp
xor edx, edx
mov dword [rsp + 0x40], 1
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x14001ab37
je 0x14001aaf7
test ebx, ebx
jg 0x14001aa30
mov eax, r14d
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14004ee60
add rsp, 0x268
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r9, rsi
lea rcx, str.ytcp
mov r8d, eax
mov edx, 0x2a7
call fcn.140019fe0
jmp 0x14001aabe
test rsi, rsi
je 0x14001ab30
lea rcx, str.ytcp
mov dword [rsp + 0x28], 0x2c2
mov qword [rsp + 0x20], rcx
lea r9, str.Timeout_during_TCP_write
mov rcx, rsi
lea r8, str._s___s:_d_
mov edx, 0x100
call fcn.1400217a0
nop dword [rax + rax]
mov eax, 0xfffffff9
jmp 0x14001aabe
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test rsi, rsi
je 0x14001aa62
mov r9, rsi
lea rcx, str.ytcp
mov r8d, eax
mov edx, 0x2bf
call fcn.140019fe0
jmp 0x14001aabe

Function at 0x14001ab70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x14001abc5
test rbx, rbx
je 0x14001abba
lea rcx, str.ytcp
mov dword [rsp + 0x28], 0x2d0
mov qword [rsp + 0x20], rcx
lea r9, str.No_more_data
mov rcx, rbx
lea r8, str._s___s:_d_
mov edx, 0x100
call fcn.1400217a0
mov eax, 0xfffffff7
add rsp, 0x30
pop rbx
ret
jns 0x14001ac0c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14001abdc
xor eax, eax
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test rbx, rbx
jne 0x14001abf0
lea eax, [rbx - 8]
add rsp, 0x30
pop rbx
ret
mov r9, rbx
lea rcx, str.ytcp
mov r8d, eax
mov edx, 0x2db
add rsp, 0x30
pop rbx
jmp fcn.140019fe0
add rsp, 0x30
pop rbx
ret
Function at 0x14001d550
Capabilities:
Encode data using base64
Hash data with md5

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x140116008]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
call fcn.140059e08
mov dword [rbp - 0x59], eax
call fcn.140009a00
movzx ecx, al
lea rdx, [rbp - 0x59]
xor r14d, r14d
mov dword [rbp - 0x55], ecx
lea rcx, [rbp - 0x49]
mov dword [rbp - 0x49], 0x67452301
mov dword [rbp - 0x45], 0xefcdab89
mov dword [rbp - 0x41], 0x98badcfe
lea r8d, [r14 + 2]
mov qword [rbp - 0x3d], 0x10325476
mov dword [rbp - 0x35], r14d
call fcn.140016c10
mov r8d, edi
lea rcx, [rbp - 0x49]
mov rdx, rbx
call fcn.140016c10
mov edx, dword [rbp - 0x39]
lea rcx, [rbp - 0x31]
shr edx, 3
and edx, 0x3f
mov eax, edx
add rcx, rax
mov eax, 0x3f
sub eax, edx
xor edx, edx
mov byte [rcx], 0x80
inc rcx
cmp eax, 8
jae 0x14001d630
mov r8d, eax
call fcn.1400500b0
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x49]
call fcn.140016420
xor eax, eax
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
jmp 0x14001d63b
add eax, 0xfffffff8
mov r8d, eax
call fcn.1400500b0
mov eax, dword [rbp - 0x39]
lea rdx, [rbp - 0x31]
mov dword [rbp + 7], eax
lea rcx, [rbp - 0x49]
mov eax, dword [rbp - 0x35]
mov dword [rbp + 0xb], eax
call fcn.140016420
movaps xmm0, xmmword [rbp - 0x49]
lea r10, [rbp + 0x17]
mov r11d, 0x1c
mov edi, 0xffff
movups xmmword [rbp + 0x17], xmm0
lea r9d, [r11 - 0xc]
lea ebx, [r11 + 0x13]
lea r15d, [rdi - 3]
nop word [rax + rax]
mov word [rbp - 0x57], di
test r9w, r9w
je 0x14001d746
movzx ecx, byte [r10]
inc r10
movzx eax, cl
and cl, 3
shl cl, 4
shr al, 2
mov byte [rbp - 0x59], al
mov byte [rbp - 0x58], cl
add r9w, di
je 0x14001d6ea
movzx edx, byte [r10]
inc r10
movzx eax, dl
and dl, 0xf
shr al, 4
or al, cl
shl dl, 2
mov byte [rbp - 0x58], al
mov byte [rbp - 0x57], dl
add r9w, di
je 0x14001d6ea
movzx ecx, byte [r10]
add r9w, di
movzx eax, cl
inc r10
shr al, 6
or al, dl
and cl, 0x3f
mov byte [rbp - 0x57], al
mov byte [rbp - 0x56], cl
lea rdx, [rbp - 0x59]
mov r8d, 4
movzx eax, byte [rdx]
cmp al, 0x19
ja 0x14001d6ff
add al, 0x41
jmp 0x14001d724
cmp al, 0x33
ja 0x14001d707
add al, 0x47
jmp 0x14001d724
cmp al, 0x3d
ja 0x14001d70f
add al, 0xfc
jmp 0x14001d724
cmp al, 0x3e
jne 0x14001d717
mov al, 0x2b
jmp 0x14001d724
cmp al, 0x3f
mov ecx, 0x3d
cmove ecx, ebx
movzx eax, cl
mov byte [rsi], al
inc rdx
inc rsi
sub r8, 1
jne 0x14001d6f4
add r11w, r15w
add r14w, 4
cmp r11w, 4
jae 0x14001d680
movzx eax, r14w
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14004ee60
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001d770
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
sub rsp, 0xb8
mov rax, qword [0x140116008]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rax, r8
movzx ebp, dx
mov r15, rcx
cmp dx, 0x50
jb 0x14001d7bf
movzx r9d, dx
lea r8, str.Bad_WebSocket_header___d__n
mov edx, 0x899
lea rcx, str.ytcp
call fcn.14000a9a0
xor eax, eax
jmp 0x14001d9f0
mov qword [rsp + 0xb0], rbx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0xa8], rsi
mov rdx, rax
movzx ebx, r9w
mov qword [rsp + 0xa0], rdi
mov r8d, ebx
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r14
call fcn.140050fe0
mov eax, dword [0x14010ba58]
xor r14d, r14d
movups xmm0, xmmword [str.258EAFA5_E914_47DA_95CA_C5AB0DC85B11]
mov edi, r14d
movups xmm1, xmmword [0x14010ba48]
movups xmmword [rsp + rbx + 0x30], xmm0
movups xmmword [rsp + rbx + 0x40], xmm1
mov dword [rsp + rbx + 0x50], eax
movzx eax, byte [0x14010ba5c]
mov byte [rsp + rbx + 0x54], al
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], dil
jne 0x14001d840
movups xmm0, xmmword [0x14007a0c8]
mov eax, dword [0x14007a0d8]
lea rsi, [0x140116fb0]
mov dword [0x140116fc0], eax
movaps xmmword [0x140116fb0], xmm0
nop word [rax + rax]
movzx edx, di
lea rcx, [rsp + 0x30]
call fcn.140015ef0
mov rcx, rsi
call fcn.1400161a0
mov eax, dword [0x140116fd4]
add edi, 0x40
movups xmm0, xmmword [0x140116fc4]
mov dword [0x140116fc0], eax
lea eax, [rdi - 9]
movaps xmmword [0x140116fb0], xmm0
cmp eax, ebx
jl 0x14001d870
mov rbx, rsi
mov edi, 5
mov ecx, dword [rbx]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbx], eax
lea rbx, [rbx + 4]
sub rdi, 1
jne 0x14001d8b1
lea r11d, [rdi + 0x50]
mov r10d, reloc.WS2_32.dll_sendto
mov edi, 0xffff
lea r8, [rsp + 0x30]
lea ebx, [r11 - 0x21]
lea r12d, [rdi - 3]
mov word [rsp + 0x22], di
test r10w, r10w
je 0x14001d9ae
movzx ecx, byte [rsi]
inc rsi
movzx eax, cl
and cl, 3
shl cl, 4
shr al, 2
mov byte [rsp + 0x20], al
mov byte [rsp + 0x21], cl
add r10w, di
je 0x14001d94f
movzx edx, byte [rsi]
inc rsi
movzx eax, dl
and dl, 0xf
shr al, 4
or al, cl
shl dl, 2
mov byte [rsp + 0x21], al
mov byte [rsp + 0x22], dl
add r10w, di
je 0x14001d94f
movzx ecx, byte [rsi]
add r10w, di
movzx eax, cl
inc rsi
shr al, 6
or al, dl
and cl, 0x3f
mov byte [rsp + 0x22], al
mov byte [rsp + 0x23], cl
lea rdx, [rsp + 0x20]
mov r9d, 4
nop word [rax + rax]
movzx eax, byte [rdx]
cmp al, 0x19
ja 0x14001d96b
add al, 0x41
jmp 0x14001d990
cmp al, 0x33
ja 0x14001d973
add al, 0x47
jmp 0x14001d990
cmp al, 0x3d
ja 0x14001d97b
add al, 0xfc
jmp 0x14001d990
cmp al, 0x3e
jne 0x14001d983
mov al, 0x2b
jmp 0x14001d990
cmp al, 0x3f
mov ecx, 0x3d
cmove ecx, ebx
movzx eax, cl
mov byte [r8], al
inc rdx
inc r8
sub r9, 1
jne 0x14001d960
add r11w, r12w
cmp r11w, 4
jae 0x14001d8e1
movzx r8d, bp
lea rcx, [rsp + 0x30]
mov rdx, r15
call fcn.14006eed0
mov r12, qword [rsp + 0x98]
test eax, eax
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa8]
sete r14b
mov rbx, qword [rsp + 0xb0]
mov eax, r14d
mov r14, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14004ee60
add rsp, 0xb8
pop r15
pop rbp
ret
Function at 0x14001da10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x140116008]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov edi, dword [rsp + 0x120]
mov r14, r9
mov r12, qword [rsp + 0x128]
mov esi, r8d
mov ebp, edx
mov r15, rcx
cmp edi, 0x7c
jle 0x14001da81
lea r9, str.ytcp
mov dword [rsp + 0x20], 0x8c1
lea r8, str.ASSERT_FAILED:_s:_d_n
mov edx, 0x8c1
lea rcx, str.ytcp
call fcn.14000a9a0
call fcn.140059e08
and sil, 7
shl bpl, 3
lea ecx, [rdi + 1]
mov byte [rsp + 0x30], 0x82
or cl, 0x80
mov edx, eax
mov byte [rsp + 0x31], cl
or sil, bpl
mov ecx, eax
shr edx, 0x18
shr ecx, 0x10
mov ebx, eax
xor sil, cl
shr eax, 8
mov byte [rsp + 0x32], cl
mov byte [rsp + 0x33], dl
mov byte [rsp + 0x34], bl
mov byte [rsp + 0x35], al
mov byte [rsp + 0x36], sil
test edi, edi
je 0x14001dad2
xor dl, byte [r14]
mov byte [rsp + 0x37], dl
cmp edi, 1
jle 0x14001dbac
lea eax, [rdi - 1]
movsxd r8, eax
lea rdx, [r14 + 1]
lea rcx, [rsp + 0x38]
call fcn.140050fe0
xor r8d, r8d
lea edx, [rdi + 2]
sar edx, 2
mov r9d, r8d
test edx, edx
jle 0x14001db83
cmp edx, 0x10
jb 0x14001db83
mov ecx, edx
movd xmm2, ebx
pshufd xmm2, xmm2, 0
and ecx, 0x8000000f
jge 0x14001db26
dec ecx
or ecx, 0xfffffff0
inc ecx
mov eax, edx
sub eax, ecx
movsxd rcx, eax
lea rax, [rsp + 0x48]
movdqu xmm0, xmmword [rax - 0x10]
lea rax, [rax + 0x40]
add r9d, 0x10
movdqa xmm1, xmm2
add r8, 0x10
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x40], xmm1
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm0, xmm2
movdqu xmmword [rax - 0x30], xmm0
movdqu xmm0, xmmword [rax - 0x20]
pxor xmm0, xmm2
movdqu xmmword [rax - 0x20], xmm0
cmp r8, rcx
jl 0x14001db32
movsxd rcx, r9d
movsxd rdx, edx
cmp rcx, rdx
jge 0x14001dbac
lea rax, [rsp + 0x38]
sub rdx, rcx
lea rax, [rax + rcx*4]
nop word [rax + rax]
xor dword [rax], ebx
lea rax, [rax + 4]
sub rdx, 1
jne 0x14001dba0
mov rcx, qword [r15 + 0x820]
lea r8d, [rdi + 7]
mov r9, r12
lea rdx, [rsp + 0x30]
call fcn.14001a9f0
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14004ee60
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400211e0
Capabilities:
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140116008]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor ebx, ebx
mov rdi, rdx
cmp dword [0x140158b90], ebx
jle 0x14002127e
lea rsi, [rcx + 0x10]
mov ebp, 2
xor eax, eax
mov ecx, 0x76c
mov qword [rsp + 0x40], rax
mov word [rsp + 0x40], bp
mov qword [rsp + 0x48], rax
call qword [sym.imp.WS2_32.dll_htons]
lea rcx, str.239.255.255.250
mov word [rsp + 0x42], ax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov rcx, qword [rsi]
lea rdx, str.M_SEARCH__HTTP_1.1_r_nHOST:239.255.255.250:1900_r_nMAN:_ssdp:discover__r_nMX:5_r_nST:urn:yoctopuce_com:device:hub:1_r_n_r_n
xor r9d, r9d
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 0x70]
call qword [sym.imp.WS2_32.dll_sendto]
test eax, eax
js 0x14002129d
inc ebx
add rsi, 8
cmp ebx, dword [0x140158b90]
jl 0x140021211
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14004ee60
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
test rdi, rdi
je 0x14002135c
mov dword [rsp + 0x28], eax
lea r9, str.ytcp
mov esi, 0x100
mov dword [rsp + 0x20], 0xeda
mov edx, esi
lea r8, str._s:_d:tcp__d_:
mov rcx, rdi
call fcn.1400217a0
mov rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp byte [rdi + rax], 0
jne 0x1400212e1
sub esi, eax
mov qword [rsp + 0x30], 0
cdqe
mov r9d, 0x400
add rax, rdi
mov dword [rsp + 0x28], esi
mov r8d, ebp
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x1200
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
nop dword [rax]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140021320
movsxd rax, ebx
test ebx, ebx
jle 0x14002135c
dec rax
mov edx, 1
add rax, rdi
sub rdx, rdi
nop
movzx ecx, byte [rax]
cmp cl, 0xa
je 0x14002134d
cmp cl, 0xd
jne 0x14002135c
mov byte [rax], 0
dec rax
lea rcx, [rdx + rax]
test rcx, rcx
jg 0x140021340
mov eax, 0xfffffff8
jmp 0x140021280
Function at 0x140021a00
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x10]
mov rdi, r8
mov rbx, rcx
cmp eax, 1
jne 0x140021a25
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
test eax, eax
jne 0x140021a6e
mov qword [rcx], r9
xor r8d, r8d
xor r9d, r9d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 8], rax
mov r9, rbx
xor eax, eax
mov r8, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x18], rax
mov rcx, qword [rbx + 8]
test rax, rax
jne 0x140021a7e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x140024190
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov eax, ecx
mov ebx, ecx
shr eax, 0x10
test al, al
je 0x1400241bb
cmp word [0x140158b94], 0
je 0x1400241c5
cmp dword [0x140158b98], ecx
jne 0x1400241c5
call fcn.140022460
movzx ecx, bx
add rsp, 0x20
pop rbx
jmp fcn.140047b20
add rsp, 0x20
pop rbx
ret

Function at 0x1400260d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x140116008]
xor rax, rsp
mov qword [rsp + 0x10], rax
movzx r9d, byte [0x1409639d8]
lea r11, [0x140118690]
xor edi, edi
mov esi, recv
mov edx, edi
mov r8d, esi
mov r10, rcx
mov eax, reloc.WS2_32.dll_recv
movzx ecx, r9b
sub cl, byte [rdx + r11]
mov byte [rsp + rdx], cl
lea rdx, [rdx + 1]
sub r8, 1
jne 0x140026111
nop word [rax + rax]
movzx r8d, si
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp]
movzx r11d, r8w
mov rbx, r10
lea r9, [rsp]
sub rbx, rcx
movzx edx, byte [r9]
xor byte [rbx + r9], dl
movzx ecx, byte [rbx + r9]
lea r9, [r9 + 1]
xor cl, dl
mov byte [r9 - 1], cl
sub r11, 1
jne 0x140026152
nop
movzx ecx, r8w
add r10, rcx
sub ax, r8w
je 0x14002618d
cmp ax, si
jae 0x140026130
movzx r8d, ax
cmp di, ax
jae 0x140026170
jmp 0x140026140
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.14004ee60
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140026440
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x140116008]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, 0xffffffffffffffff
mov rdi, rdx
mov rax, rbx
inc rax
cmp byte [rdx + rax], 0
jne 0x140026472
cmp rax, 0x18
jne 0x1400264b7
mov edx, eax
lea r9d, [rax - 8]
lea r8, [0x140158ba1]
mov rcx, rdi
call fcn.140044130
cmp ax, 0x10
jne 0x1400265f4
lea rcx, [0x140158ba1]
mov byte [0x140158ba0], al
call fcn.1400260d0
jmp 0x14002660a
cmp byte [rdx], 0
je 0x1400265f4
xor eax, eax
mov byte [0x140158ba0], 0x10
mov dword [rbp - 5], eax
mov r8, rbx
mov dword [rbp - 0x19], 0x67452301
mov dword [rbp - 0x15], 0xefcdab89
mov dword [rbp - 0x11], 0x98badcfe
mov qword [rbp - 0xd], 0x10325476
nop dword [rax]
inc r8
cmp byte [rcx + r8], al
jne 0x1400264f0
mov rdx, rcx
lea rcx, [rbp - 0x19]
call fcn.140016c10
mov r8d, 1
lea rdx, [0x140079884]
lea rcx, [rbp - 0x19]
call fcn.140016c10
lea rdx, [0x140118690]
mov r8, rbx
inc r8
cmp byte [rdx + r8], 0
jne 0x140026525
lea rcx, [rbp - 0x19]
call fcn.140016c10
mov r8d, 1
lea rdx, [0x140079884]
lea rcx, [rbp - 0x19]
call fcn.140016c10
nop
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140026550
mov r8, rbx
lea rcx, [rbp - 0x19]
mov rdx, rdi
call fcn.140016c10
mov edx, dword [rbp - 9]
lea rcx, [rbp - 1]
shr edx, 3
and edx, 0x3f
mov eax, edx
add rcx, rax
mov eax, 0x3f
sub eax, edx
xor edx, edx
mov byte [rcx], 0x80
inc rcx
cmp eax, 8
jae 0x1400265c3
mov r8d, eax
call fcn.1400500b0
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x19]
call fcn.140016420
xor eax, eax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rax
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], rax
jmp 0x1400265ce
add eax, 0xfffffff8
mov r8d, eax
call fcn.1400500b0
mov eax, dword [rbp - 9]
lea rdx, [rbp - 1]
mov dword [rbp + 0x37], eax
lea rcx, [rbp - 0x19]
mov eax, dword [rbp - 5]
mov dword [rbp + 0x3b], eax
call fcn.140016420
movaps xmm0, xmmword [rbp - 0x19]
movups xmmword [0x140158ba1], xmm0
jmp 0x14002660a
xor eax, eax
mov byte [0x140158bb0], al
mov qword [0x140158ba8], rax
mov qword [0x140158ba0], rax
lea rax, [0x140158ba0]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14004ee60
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140029770
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14011712c]
test eax, eax
jns 0x1400297ae
lea rcx, [0x140159040]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1400297dc
lea rcx, [0x140158bb8]
mov dword [0x14011712c], 1
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [0x14011712c]
test eax, eax
jle 0x1400297e6
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
sub rax, qword [0x140158bb8]
imul rax, rax, 0x3e8
cqo
idiv qword [0x140159040]
add rsp, 0x28
ret
mov dword [0x14011712c], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
add rsp, 0x28
ret

Function at 0x140029800
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x140117130]
lea r9, [rsp + 8]
mov dword [rsp + 8], 0
lea r11, [0x140158c40]
mov r10d, 4
movzx ecx, byte [r9]
lea r9, [r9 + 1]
movzx edx, ax
xor rdx, rcx
mov ecx, eax
shr ecx, 8
movzx r8d, dl
mov eax, dword [r11 + r8*4]
xor eax, ecx
sub r10, 1
jne 0x140029820
mov dword [0x140117130], eax
dec eax
ret

Function at 0x140029850
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov r9, rdx
cmp ax, r8w
jae 0x140029893
movzx r10d, r8w
lea r11, [0x140158c40]
nop word [rax + rax]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
movzx eax, cx
xor r8, rax
mov eax, ecx
shr eax, 8
movzx edx, r8b
mov ecx, dword [r11 + rdx*4]
xor ecx, eax
sub r10, 1
jne 0x140029870
mov eax, ecx
ret
Function at 0x14002dc60
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x140116008]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rax, rdx
lea r8, [rbp + 0x17]
mov edx, 0x20
mov rbx, rcx
mov rcx, rax
lea r9d, [rdx - 8]
call fcn.140044130
cmp ax, 0x18
jne 0x14002de37
mov eax, dword [rbx + 4]
mov ecx, 0xf1
xor edi, edi
mov dword [rbp - 0x59], reloc.WS2_32.dll_recv
cmp ax, cx
je 0x14002dcee
mov ecx, 0xf0
cmp ax, cx
je 0x14002dcee
movzx ecx, ax
call fcn.1400475c0
lea r8, [rbp - 0x59]
mov ebx, edi
lea rdx, [rbp + 0x37]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
js 0x14002dcfb
mov ebx, dword [rbp + 0x3b]
jmp 0x14002dcfb
mov ecx, 0x7f000001
call qword [sym.imp.WS2_32.dll_htonl]
mov ebx, eax
mov eax, ebx
mov byte [rbp + 0x32], bl
shr eax, 8
lea rdx, [rbp + 0x27]
mov byte [rbp + 0x30], al
lea rcx, [rbp - 0x49]
mov eax, ebx
mov dword [rbp - 0x49], 0x67452301
shr eax, 0x10
mov r8d, recv
shr ebx, 0x18
mov byte [rbp + 0x2f], al
mov byte [rbp + 0x31], bl
mov dword [rbp - 0x45], 0xefcdab89
mov dword [rbp - 0x41], 0x98badcfe
mov qword [rbp - 0x3d], 0x10325476
mov dword [rbp - 0x35], edi
call fcn.140016c10
mov edx, dword [rbp - 0x39]
lea rcx, [rbp - 0x31]
shr edx, 3
and edx, 0x3f
mov eax, edx
add rcx, rax
mov eax, 0x3f
sub eax, edx
xor edx, edx
mov byte [rcx], 0x80
inc rcx
cmp eax, 8
jae 0x14002dda2
mov r8d, eax
call fcn.1400500b0
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x49]
call fcn.140016420
xor eax, eax
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
jmp 0x14002ddad
add eax, 0xfffffff8
mov r8d, eax
call fcn.1400500b0
mov eax, dword [rbp - 0x39]
lea rdx, [rbp - 0x31]
mov dword [rbp + 7], eax
lea rcx, [rbp - 0x49]
mov eax, dword [rbp - 0x35]
mov dword [rbp + 0xb], eax
call fcn.140016420
movaps xmm0, xmmword [rbp - 0x49]
movq rax, xmm0
movups xmmword [rbp + 0x37], xmm0
cmp rax, qword [rbp + 0x17]
jne 0x14002de37
mov rax, qword [rbp + 0x3f]
cmp rax, qword [rbp + 0x1f]
jne 0x14002de37
call fcn.140009a00
movzx ecx, byte [rbp + 0x2d]
movzx r8d, byte [rbp + 0x2b]
movzx edx, byte [rbp + 0x29]
xor r8d, ecx
movzx ecx, byte [rbp + 0x2e]
xor edx, ecx
shl r8d, 8
movzx ecx, byte [rbp + 0x2a]
or r8d, edx
movzx edx, byte [rbp + 0x28]
xor edx, ecx
shl r8d, 8
movzx ecx, byte [rbp + 0x2c]
or r8d, edx
movzx edx, byte [rbp + 0x27]
xor edx, ecx
shl r8d, 8
or r8d, edx
sub eax, r8d
cmp eax, 0x6ddd00
setbe dil
mov eax, edi
jmp 0x14002de3c
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14004ee60
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14002e600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 8
mov r9, 0xffffffffffffffff
nop dword [rax + rax]
inc r9
cmp byte [rcx + r9], 0
jne 0x14002e610
mov r11, rcx
test r9w, r9w
je 0x14002e715
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov ebp, 0xf0f0
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
mov edi, 0xffff
mov qword [rsp], r14
mov r14d, 0x1f1f
lea esi, [rdi - 1]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r11]
add r9w, di
inc r11
mov rbx, rcx
cmp al, 0x3d
je 0x14002e6e9
cmp al, 0x26
je 0x14002e6e9
cmp al, 0x2b
jne 0x14002e67f
mov r10b, 0x20
jmp 0x14002e6ec
cmp al, 0x25
jne 0x14002e6e3
cmp r9w, 2
jb 0x14002e6fd
movzx eax, byte [r11 + 1]
add r9w, si
movzx ecx, byte [r11]
add r11, 2
shl cx, 8
add cx, ax
xor cx, bp
and cx, r14w
movzx eax, cx
movzx r8d, cl
shr ax, 8
movzx edx, al
movzx ecx, dl
and cl, 0x10
lea eax, [rdx - 7]
movzx r10d, al
lea eax, [r8 - 7]
cmove r10d, edx
movzx ecx, al
shl r10b, 4
movzx edx, r8b
and dl, 0x10
cmove ecx, r8d
add r10b, cl
jmp 0x14002e6ec
movzx r10d, al
jmp 0x14002e6ec
xor r10b, r10b
mov byte [rbx], r10b
lea rcx, [rbx + 1]
test r9w, r9w
jne 0x14002e660
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov r14, qword [rsp]
mov word [rcx], 0
lea rax, [rcx + 2]
mov byte [rcx + 2], 0
add rsp, 8
ret