joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016140
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x1400cc400]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rsi, rcx
xor r12d, r12d
mov dword [rbp - 0x2d], r12d
mov qword [rbp - 0x21], r12
mov qword [rbp + 7], r12
lea rax, str.Window
mov qword [rbp - 0x39], rax
mov r15d, 0xffffffff
mov edx, r15d
mov r9b, 0x57
lea r8, [0x1400a8055]
lea r13, [0x1400a7a10]
nop dword [rax]
cmp r9b, 0x23
jne 0x1400161c3
cmp byte [r8], r9b
jne 0x1400161c3
cmp byte [r8 + 1], r9b
cmove edx, r15d
movzx ecx, dl
movzx eax, r9b
xor rcx, rax
shr edx, 8
xor edx, dword [r13 + rcx*4]
movzx r9d, byte [r8]
inc r8
test r9b, r9b
jne 0x1400161b0
not edx
mov dword [rbp - 0x31], edx
lea rax, [0x1400245c0]
mov qword [rbp - 0x29], rax
lea rax, [0x1400247f0]
mov qword [rbp - 0x19], rax
lea rax, [0x140024650]
mov qword [rbp - 0x11], rax
lea rax, [0x1400244c0]
mov qword [rbp - 9], rax
lea rax, [0x140024830]
mov qword [rbp - 1], rax
lea rdx, [rbp - 0x39]
lea rcx, [rsi + 0x2fd0]
call fcn.140025180
mov rax, qword [0x1400cd9e0]
test rax, rax
je 0x14001623f
inc dword [rax + 0x3b0]
mov rdx, qword [0x1400cd9f0]
mov ecx, 0x138
call qword [section..data]
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x49]
mov qword [rbp + 0x17], rcx
mov qword [rbp + 0x1f], rax
test rax, rax
je 0x140016270
mov rcx, rax
call fcn.140002fa0
jmp 0x140016273
mov rax, r12
mov qword [rbp - 0x41], rax
mov dword [rax], 0x11111111
mov dword [rax + 0x68], r12d
mov byte [rax + 0x92], 1
lea rcx, [rsi + 0x1d38]
lea rdx, [rbp - 0x41]
call fcn.140024f20
mov rcx, qword [rsi + 0x1d40]
mov rax, qword [rcx]
mov qword [rsi + 0x1628], rax
mov rdi, qword [rcx]
lea rbx, [rsi + 0x1630]
mov r8d, dword [rbx + 4]
mov ecx, dword [rbx]
cmp ecx, r8d
jne 0x1400162e6
inc ecx
test r8d, r8d
je 0x1400162d2
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x1400162d7
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.140025580
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov qword [rax + rcx*8], rdi
inc dword [rbx]
mov dword [rbp - 0x2d], r12d
mov qword [rbp + 7], r12
lea rax, str.Docking
mov qword [rbp - 0x39], rax
mov edx, r15d
mov r9b, 0x44
lea r8, [0x1400a82d9]
cmp r9b, 0x23
jne 0x140016326
cmp byte [r8], r9b
jne 0x140016326
cmp byte [r8 + 1], r9b
cmove edx, r15d
movzx ecx, dl
movzx eax, r9b
xor rcx, rax
shr edx, 8
xor edx, dword [r13 + rcx*4]
movzx r9d, byte [r8]
inc r8
test r9b, r9b
jne 0x140016313
not edx
mov dword [rbp - 0x31], edx
lea rax, [0x140011450]
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
lea rax, [0x140011b80]
mov qword [rbp - 0x19], rax
lea rax, [0x140011730]
mov qword [rbp - 0x11], rax
lea rax, [0x140011410]
mov qword [rbp - 9], rax
lea rax, [0x140011bb0]
mov qword [rbp - 1], rax
lea rdx, [rbp - 0x39]
lea rcx, [rsi + 0x2fd0]
call fcn.140025180
mov byte [rsi], 1
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14004c260
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14001c550
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x1400cd9e0]
lea rdx, [0x1400a7a10]
mov r8, rcx
mov rbx, qword [rax + 0x1b90]
add rbx, 0x108
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 9]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xa]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xb]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xc]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xd]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xe]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xf]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x14001c651
lea ecx, [r9 + 1]
test r8d, r8d
je 0x14001c63d
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x14001c642
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.1400254e0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140022df0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [0x1400cd9e0]
cmp byte [rbx + 0x2fb8], 0
jne 0x140022f41
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140022f3a
lea rdx, [0x1400a817c]
mov qword [rsp + 0x38], rdi
call fcn.140015670
mov rdi, rax
test rax, rax
je 0x140022f35
mov qword [rsp + 0x40], r14
mov rcx, rax
mov qword [rsp + 0x30], rbp
call fcn.14007ed7c
mov r14d, eax
cmp eax, 0xffffffff
je 0x140022f23
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call fcn.14007e6b8
test eax, eax
jne 0x140022f23
mov rcx, rdi
call fcn.14007ed7c
movsxd rbp, eax
cmp ebp, 0xffffffff
je 0x140022f23
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call fcn.14007e6b8
test eax, eax
jne 0x140022f23
mov r14, rbp
cmp rbp, 0xffffffffffffffff
je 0x140022f23
mov rax, qword [0x1400cd9e0]
test rax, rax
je 0x140022eb5
inc dword [rax + 0x3b0]
mov rdx, qword [0x1400cd9f0]
mov rcx, r14
call qword [section..data]
mov rbp, rax
test rax, rax
je 0x140022f23
mov r9, rdi
mov r8, r14
mov edx, 1
mov rcx, rax
call fcn.14007e2e8
mov rcx, rdi
cmp rax, r14
je 0x140022eef
call fcn.14007dc00
jmp 0x140022eff
call fcn.14007dc00
mov rdx, r14
mov rcx, rbp
call fcn.140016df0
mov rax, qword [0x1400cd9e0]
test rax, rax
je 0x140022f11
dec dword [rax + 0x3b0]
mov rdx, qword [0x1400cd9f0]
mov rcx, rbp
call qword [fcn.140001bc0]
jmp 0x140022f2b
mov rcx, rdi
call fcn.14007dc00
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov byte [rbx + 0x2fb8], 1
movss xmm0, dword [rbx + 0x2fbc]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x140022f84
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x2fbc], xmm0
jb 0x140022f84
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140022f73
call fcn.14001fa40
jmp 0x140022f7a
mov byte [rbx + 0x398], 1
mov dword [rbx + 0x2fbc], 0
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x1400465d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea r8, [0x1400adaa4]
mov edx, 0x65
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
je 0x14004664b
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test eax, eax
je 0x14004664b
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14004664b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
jne 0x14004665d
lea rdx, [0x1400adaa8]
lea rcx, [0x1400d03f0]
call fcn.140048140
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rax
call fcn.14004f720
mov rbx, qword [rsp + 0x30]
mov al, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140048080
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1400cc400]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rdx
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140048111
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x140048108
nop
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400480f3
inc rax
test ecx, ecx
jne 0x1400480e0
test edx, edx
je 0x140048134
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1400480d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14004c260
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
mov eax, dword [rsp + 0x28]
jmp 0x140048113

Function at 0x140048140
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
mov eax, 0x2058
call fcn.14004c200
sub rsp, rax
mov rax, qword [0x1400cc400]
xor rax, rsp
mov qword [rsp + 0x2040], rax
movsd xmm0, qword [str.define]
lea rcx, [rsp + 0x39]
movzx eax, byte [0x1400a79d0]
mov rbx, rdx
xor edx, edx
movsd qword [rsp + 0x30], xmm0
mov r8d, 0xfff
mov byte [rsp + 0x38], al
call fcn.1400a3cc0
lea rdi, [rsp + 0x2080]
call fcn.140001560
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x1040]
mov r9, rbx
mov qword [rsp + 0x20], 0
mov r8d, 0x1000
mov rcx, qword [rax]
call fcn.14007d420
lea r8, [rsp + 0x1040]
mov edx, 0x1008
lea rcx, [rsp + 0x30]
call fcn.14007aef0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.14004c260
add rsp, 0x2058
pop rdi
pop rbx
ret
Function at 0x140049e40
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140049e62
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x140049edc
mov rdi, r14
mov rcx, rbx
call fcn.1400487e0
test rax, rax
jle 0x140049eb4
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.1400a4120
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140049ecc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140049ed4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140049e76
sub r14, rdi
jmp 0x140049fbf
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140049ef3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140049ef5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140049f27
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400a4120
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140049fbc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140049f62
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x140049f9d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14007e2e8
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x140049fbc
cmp rbp, rax
ja 0x140049f70
test rbp, rbp
je 0x140049fbc
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14007e2e8
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret

Function at 0x14004cffc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004d046
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004d046
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004d046
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004d046
cmp dword [rcx + 0x84], 0xe
jbe 0x14004d046
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004d048
xor al, al
add rsp, 0x28
ret
Function at 0x14004d730
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2c8
mov rax, qword [0x1400cc400]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rdx, [rsp + 0xb0]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x14004d8c3
mov dword [rsp + 0x20], 0
jmp 0x14004d783
mov eax, dword [rsp + 0x20]
add eax, 4
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
movsx eax, byte [rsp + rax + 0xb0]
test eax, eax
je 0x14004d8c3
movsxd rax, dword [rsp + 0x20]
lea rax, [rsp + rax + 0xb0]
lea rdx, [0x1400af20c]
mov rcx, rax
call fcn.1400a39cc
test eax, eax
je 0x14004d7d8
movsxd rax, dword [rsp + 0x20]
lea rax, [rsp + rax + 0xb0]
lea rdx, [0x1400af234]
mov rcx, rax
call fcn.1400a39cc
test eax, eax
jne 0x14004d7da
jmp 0x14004d778
movsxd rax, dword [rsp + 0x20]
mov ecx, 1
imul rcx, rcx, 0
movzx eax, byte [rsp + rax + 0xb0]
mov byte [rsp + rcx + 0x24], al
mov eax, dword [rsp + 0x20]
inc eax
cdqe
mov ecx, 1
imul rcx, rcx, 1
movzx eax, byte [rsp + rax + 0xb0]
mov byte [rsp + rcx + 0x24], al
mov eax, 1
imul rax, rax, 2
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 3
jae 0x14004d829
jmp 0x14004d82e
call fcn.14004cd04
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x24], 0
mov r8d, 0x64
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x14004d856
xor eax, eax
jmp 0x14004d8c5
lea rcx, [rsp + 0x40]
call fcn.14008e8c0
mov dword [rsp + 0x28], eax
movsxd rax, dword [rsp + 0x28]
mov r8, rax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x2d0]
call fcn.14007d550
test eax, eax
jne 0x14004d8be
lea rdx, [rsp + 0x24]
mov rcx, qword [rsp + 0x2d8]
call fcn.14008e7f0
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x2d0]
add rcx, rax
mov rax, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x2d8]
call fcn.14008e750
mov eax, 1
jmp 0x14004d8c5
jmp 0x14004d778
xor eax, eax
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14004c260
add rsp, 0x2c8
ret

Function at 0x14004d8f0
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x150
mov rax, qword [0x1400cc400]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14004d94c
xor eax, eax
jmp 0x14004d9a9
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.PSAPI.DLL_GetProcessImageFileNameA
test eax, eax
jne 0x14004d974
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14004d9a9
mov rdx, qword [rsp + 0x160]
lea rcx, [rsp + 0x30]
call fcn.14004d730
test eax, eax
jne 0x14004d999
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14004d9a9
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14004c260
add rsp, 0x150
pop rdi
ret
Function at 0x140051420
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov byte [rsp], 0
mov eax, 1
imul rax, rax, 0
movzx ecx, byte [rsp + 0x30]
mov byte [rsp + rax + 8], cl
mov dword [rsp + 4], 1
jmp 0x14005145c
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
cmp dword [rsp + 4], 4
jge 0x1400514a9
mov eax, dword [rsp + 4]
dec eax
cdqe
movzx eax, byte [rsp + rax + 8]
shl eax, 1
movsxd rcx, dword [rsp + 4]
mov byte [rsp + rcx + 8], al
mov eax, dword [rsp + 4]
dec eax
cdqe
movzx eax, byte [rsp + rax + 8]
and eax, 0x80
test eax, eax
je 0x1400514a7
movsxd rax, dword [rsp + 4]
movzx eax, byte [rsp + rax + 8]
xor eax, 0x1b
movsxd rcx, dword [rsp + 4]
mov byte [rsp + rcx + 8], al
jmp 0x140051452
mov dword [rsp + 4], 0
jmp 0x1400514bd
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
cmp dword [rsp + 4], 4
jge 0x1400514ed
movzx eax, byte [rsp + 0x28]
mov ecx, dword [rsp + 4]
sar eax, cl
and eax, 1
test eax, eax
je 0x1400514eb
movsxd rax, dword [rsp + 4]
movzx eax, byte [rsp + rax + 8]
movzx ecx, byte [rsp]
xor ecx, eax
mov eax, ecx
mov byte [rsp], al
jmp 0x1400514b3
movzx eax, byte [rsp]
add rsp, 0x18
ret

Function at 0x140052640
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov byte [rax + 0x68], 0
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x10], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x10], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x10325476
ret
Function at 0x140055920
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
mov word [rsp + 0x18], r8w
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x1400cc400]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
cmp dword [rax + 8], 0xffffffff
je 0x140055957
mov rcx, qword [rsp + 0x50]
call fcn.140055ad0
call fcn.1400562c0
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x50]
cmp dword [rax + 8], 0xffffffff
jne 0x140055976
xor eax, eax
jmp 0x140055ab8
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x50]
add rax, 0x34
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r8d, 6
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, qword [rsp + 0x50]
movsxd rcx, dword [rcx + 8]
mov rdx, qword [0x1400d0fc0]
mov qword [rdx + rcx*8], rax
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 8]
mov rcx, qword [0x1400d0fc0]
cmp qword [rcx + rax*8], 0xffffffffffffffff
je 0x140055aa2
mov eax, 2
mov word [rsp + 0x28], ax
movzx ecx, word [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x2a], ax
mov ecx, dword [rsp + 0x58]
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 8]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x28]
mov rcx, qword [0x1400d0fc0]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x140055a64
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x140055a64
mov dword [rsp + 0x20], 1
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 8]
mov rcx, qword [0x1400d0fc0]
mov r8, qword [rcx + rax*8]
mov rax, qword [rsp + 0x50]
mov edx, dword [rax + 8]
mov rcx, qword [rsp + 0x50]
call fcn.140056330
jmp 0x140055aa2
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 8]
mov rcx, qword [0x1400d0fc0]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 8]
mov rcx, qword [0x1400d0fc0]
mov qword [rcx + rax*8], 0xffffffffffffffff
mov rax, qword [rsp + 0x50]
mov dword [rax + 8], 0xffffffff
mov rax, qword [rsp + 0x50]
add rax, 0x34
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14004c260
add rsp, 0x48
ret
Function at 0x140055c80
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
add rax, 0x34
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [0x1400d0fc0], 0
je 0x140055d54
mov rax, qword [rsp + 0x40]
cmp dword [rax + 8], 0xffffffff
je 0x140055d54
cmp dword [rsp + 0x50], 0
je 0x140055d54
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 8]
xor r9d, r9d
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [0x1400d0fc0]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jle 0x140055d26
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
jmp 0x140055d4f
cmp qword [0x1400d0fc8], 0
je 0x140055d4f
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 8]
mov edx, 0xffffffff
mov rcx, qword [0x1400d0fc8]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x140055ca5
mov rax, qword [rsp + 0x40]
add rax, 0x34
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add rsp, 0x38
ret

Function at 0x140056180
Capabilities:
Create thread

Disassembly:
mov byte [rsp + 8], cl
sub rsp, 0x28
movzx eax, byte [rsp + 0x30]
cmp eax, 0x40
jg 0x14005619b
movzx eax, byte [rsp + 0x30]
test eax, eax
jne 0x14005619f
xor eax, eax
jmp 0x140056214
movsx eax, word [0x1400d0fd8]
test eax, eax
jne 0x14005620f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x1400d0fb8], rax
movzx eax, byte [rsp + 0x30]
mov word [0x1400d0fd8], ax
xor r8d, r8d
xor edx, edx
lea rcx, [0x140056420]
call fcn.14008f968
mov qword [0x1400cc480], rax
mov edx, 0xffffffff
mov rcx, qword [0x1400d0fb8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x1400d0fb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1400d0fb8], 0
mov eax, 1
add rsp, 0x28
ret
Function at 0x140056330
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x58]
mov dword [rax + 8], ecx
movsxd rax, dword [rsp + 0x58]
mov rcx, qword [0x1400d0fd0]
mov rdx, qword [rsp + 0x50]
mov qword [rcx + rax*8], rdx
movsxd rax, dword [rsp + 0x58]
mov rcx, qword [0x1400d0fc0]
mov rdx, qword [rsp + 0x60]
mov qword [rcx + rax*8], rdx
movsxd rax, dword [rsp + 0x58]
mov r8d, 0x33
mov rcx, qword [0x1400d0fc8]
mov rdx, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_WSAEventSelect]
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov r8d, 1
mov edx, 6
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x30], 0x100000
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
mov r8d, 0x1002
mov edx, 0xffff
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x48
ret