joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400760a0
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
test r9d, r9d
mov edx, 0x40040003
mov eax, 0x400c0003
cmovne edx, eax
mov rdi, r8
xor eax, eax
mov rsi, rcx
mov rcx, qword [rbx + 0x120]
mov r9d, 0xff
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rdi + 0x70], rax
cmp rax, 0xffffffffffffffff
jne 0x140076115
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rdx, qword [rsi + 0x38]
xor r9d, r9d
mov r8, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x14007614d
mov rax, qword [rdi + 0x70]
mov rsi, qword [rsp + 0x58]
mov qword [rbx + 0x118], rax
mov eax, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [0x140100c70]
call fcn.1400732b0
int3
Function at 0x1400765e0
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test r9d, r9d
jne 0x140076683
call fcn.1400760a0
test eax, eax
jne 0x140076683
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x14007661c
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14007662a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x68], 0
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x140076668
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rsi + 0x48]
mov qword [rax + 0x68], rbx
mov qword [rsi + 0x48], rbx
inc dword [rdi + 0x78]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rbx + 0x68], rbx
mov qword [rsi + 0x48], rbx
inc dword [rdi + 0x78]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xorps xmm0, xmm0
mov qword [rsp + 0x30], r14
movups xmmword [rbx + 0x40], xmm0
lea rdx, [rbx + 0x40]
movups xmmword [rbx + 0x50], xmm0
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x14007672a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x14007672a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x1400766c7
xor eax, eax
jmp 0x1400766fb
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x70], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1400766eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400766f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x68], 0
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x140076722
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rsi + 0x48]
mov qword [rax + 0x68], rbx
jmp 0x140076726
mov qword [rbx + 0x68], rbx
mov qword [rsi + 0x48], rbx
mov r14, qword [rsp + 0x30]
inc dword [rdi + 0x78]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140076750
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
test dword [rdx + 0x58], 0x1000000
lea rdi, [rdx + 0x80]
mov rbx, rdx
mov rbp, rcx
je 0x1400767d9
mov qword [rdx + 0x238], 0
lea rcx, [0x140077860]
mov rdx, rdi
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
jne 0x140076906
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1400767c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rsi, [rdi + 0x40]
jmp 0x1400768c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
lea rsi, [rdi + 0x40]
or eax, 0x80070000
jmp 0x1400768c7
lea rsi, [rdi + 0x40]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm0
test dword [rdx + 0x58], 0x80000
je 0x140076802
mov rax, qword [rdx + 0xf0]
or rax, 1
mov qword [rdx + 0xd8], rax
mov rcx, qword [rbx + 0x118]
lea rdx, [0x140162e06]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140076857
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x140076857
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x140076847
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400768c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
jmp 0x1400768c7
test dword [rbx + 0x58], 0x80000
je 0x140076906
lea rcx, [rbx + 0xf8]
cmp qword [rcx], 0xffffffffffffffff
jne 0x140076906
mov rdx, qword [rbx + 0xf0]
lea r8, [0x1400748d0]
mov dword [rsp + 0x28], 4
mov r9, rdi
mov dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x140076906
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1400768b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400768c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
lea rsi, [rbx + 0xc0]
cdqe
mov qword [rsi], rax
mov qword [rbx + 0xe8], 0
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x1400768f9
mov rax, qword [rax + 0x68]
mov qword [rbx + 0xe8], rax
mov rax, qword [rbp + 0x48]
mov qword [rax + 0x68], rdi
mov qword [rbp + 0x48], rdi
jmp 0x140076927
mov qword [rbx + 0xe8], rdi
mov qword [rbp + 0x48], rdi
jmp 0x140076927
mov rcx, qword [rbx + 0x128]
test rcx, rcx
je 0x140076927
xor r9d, r9d
lea rdx, [0x140075fe0]
mov r8d, 0x32
call fcn.140074330
or dword [rbx + 0x58], 0x10000
inc dword [rbx + 0x78]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140076950
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov ebx, r8d
mov rdi, rdx
mov rbp, rcx
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
mov esi, r9d
call fcn.140074760
mov edx, ebx
lea r8, [rsp + 0x30]
mov rcx, rdi
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
call qword [rdi + 0x68]
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x140076a08
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140076a08
mov rcx, qword [rdi + 0x118]
lea r9, [rsp + 0x70]
cmp esi, eax
mov qword [rsp + 0x20], 0
cmova esi, eax
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400769f3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, [rsp + 0x40]
mov rdx, rdi
mov r8d, eax
mov rcx, rbp
call fcn.140076a40
jmp 0x140076a1a
mov edx, dword [rsp + 0x70]
lea r8, [rsp + 0x30]
mov rcx, rdi
call qword [rdi + reloc.WS2_32.dll_WSASetLastError]
mov eax, dword [rsp + 0x70]
jmp 0x140076a1c
lea r8, [rsp + 0x30]
mov rdx, 0xfffffffffffff024
mov rcx, rdi
call qword [rdi + reloc.WS2_32.dll_WSASetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140078be0
Capabilities:
Log keystrokes
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140160140]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
mov ecx, dword [rcx + 0x58]
btr ecx, 0xc
mov edx, ecx
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], ecx
jne 0x140078c2c
mov eax, ecx
and al, 5
cmp al, 4
jne 0x140078c2c
and ecx, 0xfffffffb
mov dword [rbx + 0x58], ecx
mov edx, ecx
test cl, 8
je 0x140078c2c
mov rax, qword [rbx + 8]
dec dword [rax + 8]
mov edx, dword [rbx + 0x58]
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0x88], rdi
bt edx, 0x10
jae 0x140078cc0
bt edx, 0x19
jae 0x140078c89
mov rcx, qword [rbx + 0x110]
lea r9, [rsp + 0x40]
xor eax, eax
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x70], eax
xorps xmm0, xmm0
mov eax, reloc.WS2_32.dll_recv
mov r8d, 1
movups xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x60], ax
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x140078cc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140078cc2
bt edx, 0x15
jb 0x140078cc0
lea rcx, [0x140162e50]
xor edi, edi
call fcn.140073d40
mov eax, 2
xchg dword [0x140162e08], eax
cmp eax, 1
je 0x140078ce8
lea rcx, [0x140162e50]
call fcn.140073d10
or dword [rbx + 0x58], 0x200000
xor eax, eax
mov rdi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400c86e0
add rsp, 0x90
pop rbx
ret
mov qword [rsp + 0x30], rdi
lea rcx, str.conout_
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov qword [rsp + 0xb0], rsi
mov edx, 0xc0000000
mov r8d, 3
mov dword [rsp + 0x20], 3
mov qword [rsp + 0x80], r14
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140078d4d
lea rdx, [0x140162e10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x140078d4d
lock or dword [0x140162e0c], 1
mov ebp, 1
mov dword [rsp + 0x50], 0xd0001
mov r14d, recv
mov word [rsp + 0x48], bp
mov ecx, r14d
mov dword [rsp + 0x4c], ebp
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rbx + 0x110]
lea r9, [rsp + 0x44]
mov r8d, ebp
mov word [rsp + 0x54], ax
lea rdx, [rsp + 0x48]
mov word [rsp + 0x56], r14w
mov dword [rsp + 0x58], edi
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov r14, qword [rsp + 0x80]
test eax, eax
jne 0x140078db1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp rsi, 0xffffffffffffffff
je 0x140078dc0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0xb0]
test edi, edi
je 0x140078cb9
mov eax, edi
jmp 0x140078cc2

Function at 0x14007a360
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48]
lea rcx, [0x140162ec0]
mov dword [0x140162ee8], eax
call fcn.140073bf0
test eax, eax
jne 0x14007a3bd
lea rax, [0x1403eaef8]
mov edx, 0x100
lea rcx, [0x140162ef0]
xor r8d, r8d
nop
mov qword [rax], rcx
add rcx, 0x2880
mov qword [rax - 8], r8
lea rax, [rax + 0x10]
sub rdx, 1
jne 0x14007a3a0
add rsp, 0x58
ret
lea rdx, str.uv_mutex_init
mov ecx, eax
call fcn.1400732b0
int3
Function at 0x14007b3f0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x478
mov rax, qword [0x140160140]
xor rax, rsp
mov qword [rsp + 0x460], rax
lea r8, [0x1403f4e00]
xor edx, edx
lea rcx, str.0.0.0.0
call fcn.140074770
test eax, eax
jne 0x14007b576
lea r8, [0x1403f4de0]
xor edx, edx
lea rcx, [0x140101528]
call fcn.1400747c0
test eax, eax
jne 0x14007b576
mov ecx, 0x43
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
je 0x14007b55e
mov ecx, 0x202
lea rdx, [rsp + 0x2c0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14007b57c
xor r8d, r8d
mov qword [rsp + 0x470], rbx
mov edx, 1
mov dword [0x1403f4e14], 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14007b4e8
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x274
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x2005
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14007b4df
test dword [rsp + 0x40], 0x20000
je 0x14007b4df
mov dword [0x1403f4e14], eax
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
xor r8d, r8d
mov dword [0x1403f4e10], 1
mov edx, 1
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14007b556
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x274
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x2005
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14007b54d
test dword [rsp + 0x40], 0x20000
je 0x14007b54d
mov dword [0x1403f4e10], eax
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov rbx, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400c86e0
add rsp, 0x478
ret
call fcn.1400dd5e0
int3
lea rdx, str.WSAStartup
mov ecx, eax
call fcn.1400732b0
int3

Function at 0x14007da80
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x68]
add rcx, 0x4d0
call fcn.1400933a0
mov rcx, qword [rbx + 0x68]
add rcx, 0x4d0
call fcn.140093830
mov ecx, 9
call fcn.140093770
mov rcx, qword [rbx + 0x68]
mov rdx, rax
add rcx, 0x4d0
xor r8d, r8d
call fcn.140093840
test eax, eax
jne 0x14007db3a
mov rcx, qword [rbx + 0x68]
add rcx, 0x4d0
call fcn.140093ae0
test eax, eax
jne 0x14007db3a
mov rcx, qword [rbx + 0x68]
add rcx, 0x4e8
call fcn.1400933a0
mov rcx, qword [rbx + 0x68]
add rcx, 0x4e8
call fcn.140093830
mov ecx, 0xa
call fcn.140093770
mov rcx, qword [rbx + 0x68]
mov rdx, rax
add rcx, 0x4e8
xor r8d, r8d
call fcn.140093840
test eax, eax
jne 0x14007db3a
mov rcx, qword [rbx + 0x68]
add rcx, 0x4e8
add rsp, 0x20
pop rbx
jmp fcn.140093ae0
add rsp, 0x20
pop rbx
ret

Function at 0x1400814d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test rcx, rcx
je 0x14008151c
cmp qword [rcx], 0
je 0x14008151c
cmp qword [rcx + 0x158], 0
jne fcn.140080cf0
mov rax, qword [rcx + 0x140]
mov dword [rcx + 0x148], reloc.WS2_32.dll_setsockopt
mov qword [rcx + 0x150], 2
mov byte [rax], dl
mov edx, 1
mov rax, qword [rcx + 0x140]
mov byte [rax + 1], r8b
jmp fcn.1400818e0
mov eax, 0xffff8f00
ret
Function at 0x140081ae0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
xor eax, eax
mov r11, rcx
cmp r9, 8
jb 0x140081b2c
mov rbx, rdx
mov rdi, rcx
sub rbx, r8
sub rdi, r8
mov esi, 8
mov r10, r8
sub rsi, r8
nop dword [rax]
mov rcx, qword [rbx + r10]
add rax, 8
xor rcx, qword [r10]
mov qword [r10 + rdi], rcx
lea r10, [r10 + 8]
lea rcx, [rsi + r10]
cmp rcx, r9
jbe 0x140081b10
mov rbx, r9
sub rbx, rax
cmp rax, r9
jae 0x140081c7b
mov qword [rsp + 0x10], rbp
cmp rbx, 8
jb 0x140081c55
lea r10, [r9 - 1]
lea rcx, [r8 - 1]
add r10, r11
add rcx, r9
lea rdi, [rax + r11]
lea rbp, [rax + r8]
cmp rdi, rcx
ja 0x140081b6e
cmp r10, rbp
jae 0x140081c55
lea rcx, [rdx - 1]
add rcx, r9
lea rsi, [rax + rdx]
cmp rdi, rcx
ja 0x140081b87
cmp r10, rsi
jae 0x140081c55
mov r10, rdx
sub r10, r8
cmp rbx, 0x40
jb 0x140081c16
mov rdi, rbx
mov rsi, r9
and edi, 0x3f
sub rsi, rdi
lea rcx, [rbp + 0x10]
mov rbp, r11
sub rbp, r8
nop dword [rax]
movdqu xmm0, xmmword [rcx - 0x10]
add rax, 0x40
movdqu xmm1, xmmword [rcx + r10 - 0x10]
movdqu xmm2, xmmword [rcx]
lea rcx, [rcx + 0x40]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rcx + r10 - 0x40]
movdqu xmmword [rcx + rbp - 0x50], xmm1
xorps xmm2, xmm0
movdqu xmm0, xmmword [rcx - 0x30]
movdqu xmm1, xmmword [rcx + r10 - 0x30]
movdqu xmmword [rcx + rbp - 0x40], xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rcx - 0x20]
movdqu xmm2, xmmword [rcx + r10 - 0x20]
movdqu xmmword [rcx + rbp - 0x30], xmm1
xorps xmm2, xmm0
movdqu xmmword [rcx + rbp - 0x20], xmm2
cmp rax, rsi
jb 0x140081bb0
cmp rdi, 8
jb 0x140081c50
and ebx, 7
mov rdi, r9
sub rdi, rbx
mov rbx, r11
lea rcx, [rax + r8]
sub rbx, r8
nop dword [rax]
movq xmm1, qword [rcx + r10]
add rax, 8
movq xmm0, qword [rcx]
lea rcx, [rcx + 8]
xorps xmm1, xmm0
movq qword [rbx + rcx - 8], xmm1
cmp rax, rdi
jb 0x140081c30
cmp rax, r9
jae 0x140081c76
sub rdx, r8
lea rcx, [rax + r8]
sub r11, r8
sub r9, rax
movzx eax, byte [rcx + rdx]
xor al, byte [rcx]
mov byte [r11 + rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x140081c62
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
ret
Function at 0x14008b140
Capabilities:
Convert ip address from string

Disassembly:
push rsi
push r12
push r14
sub rsp, 0x60
mov rax, qword [0x140160140]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r12, r8
mov r14, rdx
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rdx + rsi], 0
jne 0x14008b166
test byte [rcx + 0x280], 0x20
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r15
je 0x14008b2a3
xor ebp, ebp
lea rbx, [rcx + 0x1c0]
mov edi, ebp
mov r15d, ebp
mov r11, rbx
test rbx, rbx
je 0x14008b2f1
nop word [rax + rax]
movzx ecx, byte [r11]
and ecx, 0x1f
sub ecx, 2
je 0x14008b1d2
sub ecx, 4
je 0x14008b1ca
cmp ecx, 1
jne 0x14008b1e8
mov edi, ecx
jmp 0x14008b1e8
mov r15d, 1
jmp 0x14008b1e8
mov r8, rsi
mov rdx, r14
mov rcx, r11
call fcn.14008a1c0
test eax, eax
je 0x14008b2f6
mov r11, qword [r11 + 0x18]
test r11, r11
jne 0x14008b1b0
test edi, edi
je 0x14008b271
mov edx, 0x3a
mov rcx, r14
call fcn.1400cc634
lea r8, [rsp + 0x20]
mov rdx, r14
test rax, rax
jne 0x14008b221
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
mov ecx, 4
jmp 0x14008b231
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
mov ecx, reloc.WS2_32.dll_recv
cmp eax, 1
cmove rbp, rcx
test rbp, rbp
je 0x14008b271
mov rdi, rbx
movzx eax, byte [rdi]
and al, 0x1f
cmp al, 7
jne 0x14008b268
cmp qword [rdi + 8], rbp
jne 0x14008b268
mov rcx, qword [rdi + 0x10]
lea rdx, [rsp + 0x20]
mov r8, rbp
call fcn.1400f9a90
test eax, eax
je 0x14008b2f6
mov rdi, qword [rdi + 0x18]
test rdi, rdi
jne 0x14008b240
test r15d, r15d
je 0x14008b2f1
movzx eax, byte [rbx]
and al, 0x1f
cmp al, 6
jne 0x14008b298
cmp qword [rbx + 8], rsi
jne 0x14008b298
mov rcx, qword [rbx + 0x10]
mov r8, rsi
mov rdx, r14
call fcn.1400f9a90
test eax, eax
je 0x14008b2f6
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x14008b276
jmp 0x14008b2f1
lea r11, [rcx + 0xe0]
test r11, r11
je 0x14008b2f1
mov ebx, 0x455
mov edi, 3
nop dword [rax]
cmp qword [r11 + 8], rdi
jne 0x14008b2e8
mov rax, qword [r11 + 0x10]
cmp bx, word [rax]
jne 0x14008b2e8
cmp dil, byte [rax + 2]
jne 0x14008b2e8
lea rcx, [r11 + 0x18]
mov r8, rsi
mov rdx, r14
call fcn.14008a1c0
test eax, eax
je 0x14008b2f6
mov r11, qword [r11 + 0x30]
test r11, r11
jne 0x14008b2c0
or dword [r12], 4
mov r15, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400c86e0
add rsp, 0x60
pop r14
pop r12
pop rsi
ret
Function at 0x1400932e0
Capabilities:
Encode data using base64

Disassembly:
mov r9, rcx
test rcx, rcx
je case.0x14009330f.6
mov r8, qword [rcx]
test r8, r8
je case.0x14009330f.6
mov eax, dword [r8]
add eax, 0xfffffffd
cmp eax, 0x10
ja case.0x14009330f.6
lea r10, [0x140000000]
cdqe
mov ecx, dword [r10 + rax*4 + 0x93354]
add rcx, r10
jmp rcx
mov rcx, qword [r9 + 8]
jmp fcn.1400b1210
mov rcx, qword [r9 + 8]
jmp fcn.1400b34b0
mov rcx, qword [r9 + 8]
jmp fcn.1400b4e70
mov rcx, qword [r9 + 8]
jmp fcn.1400b5f70
mov rcx, qword [r9 + 8]
jmp fcn.1400b6d50
movzx r8d, byte [r8 + 4]
mov rcx, qword [r9 + 8]
jmp fcn.1400b78f0
mov eax, 0xffffaf00
ret

Function at 0x140093ae0
Capabilities:
Hash data with md5

Disassembly:
mov r8, rcx
test rcx, rcx
je case.0x140093b19.6
mov rax, qword [rcx]
test rax, rax
je case.0x140093b19.6
mov eax, dword [rax]
add eax, 0xfffffffd
cmp eax, 0x10
ja case.0x140093b19.6
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x93ba8]
add rcx, rdx
jmp rcx
mov rcx, qword [r8 + 8]
jmp fcn.1400b1340
mov rcx, qword [r8 + 8]
jmp fcn.1400b35c0
mov rcx, qword [r8 + 8]
jmp fcn.1400b35c0
mov rcx, qword [r8 + 8]
mov edx, 1
jmp fcn.1400b60c0
mov rcx, qword [r8 + 8]
xor edx, edx
jmp fcn.1400b60c0
mov rcx, qword [r8 + 8]
mov edx, 1
jmp fcn.1400b6ed0
mov rcx, qword [r8 + 8]
xor edx, edx
jmp fcn.1400b6ed0
mov rcx, qword [r8 + 8]
mov edx, 1
jmp fcn.1400b7a30
mov rcx, qword [r8 + 8]
mov edx, 2
jmp fcn.1400b7a30
mov rcx, qword [r8 + 8]
mov edx, 3
jmp fcn.1400b7a30
mov rcx, qword [r8 + 8]
mov edx, 4
jmp fcn.1400b7a30
mov eax, 0xffffaf00
ret

Function at 0x140095d60
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9, rdx
mov r11, rcx
test r8, r8
je 0x140095d89
sub r11, rdx
movzx edx, byte [r11 + r9]
movzx ecx, byte [r9]
lea r9, [r9 + 1]
xor ecx, edx
or r10d, ecx
sub r8, 1
jne 0x140095d71
mov eax, r10d
movzx ecx, r10w
shr eax, 0x10
or eax, ecx
ret
Function at 0x140095da0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r13
push r14
push r15
xor eax, eax
mov rbp, r8
sub rbp, qword [rsp + 0x48]
mov r15, r9
mov rsi, r8
mov r12, rdx
mov r13, rcx
mov r14d, eax
test r8, r8
je 0x140095f08
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rdi
nop
movzx edi, byte [r14 + r13]
movzx ebx, byte [r14 + r12]
mov r10, qword [0x1403ec5f8]
xor ebx, edi
mov r9, qword [0x1403ec5f8]
xor r10, r14
mov rcx, qword [0x1403ec5f8]
xor r9, rbp
mov rdx, r9
xor rdx, r10
sub r10, r9
shr rdx, 0x3f
xor rdx, rcx
mov rcx, qword [0x1403ec5f8]
mov r11, qword [0x1403ec5f8]
mov r8, rdx
shr r8, 1
neg rdx
neg r8
or r8, rdx
shr r8, 0x3f
neg r8
xor rcx, r8
and r8, r9
not rcx
and r10, rcx
or r10, r8
shr r10, 0x3f
xor r11, r10
mov r10, qword [0x1403ec5f8]
mov r9, qword [0x1403ec5f8]
xor r10, r14
mov rcx, qword [0x1403ec5f8]
xor r9, r15
mov rdx, r9
inc r14
xor rdx, r10
sub r10, r9
shr rdx, 0x3f
xor rdx, rcx
mov rcx, qword [0x1403ec5f8]
mov r8, rdx
neg rdx
shr r8, 1
neg r8
or r8, rdx
mov rdx, r11
shr r8, 0x3f
neg r11
neg r8
shr rdx, 1
xor rcx, r8
shr r11, 0x3f
and r8, r9
not rcx
and r10, rcx
neg rdx
mov rcx, qword [0x1403ec5f8]
or r10, r8
shr rdx, 0x3f
shr r10, 0x3f
or edx, r11d
xor rcx, r10
neg edx
mov r8, rcx
neg rcx
shr r8, 1
neg r8
shr rcx, 0x3f
shr r8, 0x3f
or r8d, ecx
dec r8d
and r8d, edx
and r8d, ebx
or eax, r8d
cmp r14, rsi
jb 0x140095de0
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret