joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003b210
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r8d, dword [rcx + 0x28]
mov rdi, rcx
mov rsi, rdx
lea ebp, [r8*8]
xor edx, edx
add rbp, qword [rcx + 0x20]
mov byte [r8 + rcx + 0x2c], 0x80
mov ecx, dword [rcx + 0x28]
mov eax, ecx
cmp ecx, 0x37
ja 0x14003b25e
mov r8d, 0x37
sub r8d, ecx
lea rcx, [rdi + 0x2d]
add rcx, rax
call sub.MSVCR120.dll_memset
jmp 0x14003b2ad
mov r8d, 0x3f
mov qword [rsp + 0x30], rbx
sub r8d, ecx
lea rcx, [rdi + 0x2d]
add rcx, rax
call sub.MSVCR120.dll_memset
lea rdx, [rdi + 0x2c]
mov r8d, 1
mov rcx, rdi
call fcn.14003aeb0
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov qword [rdi + 0x2c], rax
mov qword [rdi + 0x34], rax
mov qword [rdi + 0x3c], rax
mov qword [rdi + 0x44], rax
mov qword [rdi + 0x4c], rax
mov qword [rdi + 0x54], rax
mov qword [rdi + 0x5c], rax
mov rcx, rbp
lea rdx, [rdi + 0x2c]
mov r8d, 1
shr rcx, 0x20
mov byte [rdi + 0x6b], bpl
mov eax, ecx
mov byte [rdi + 0x67], cl
shr eax, 0x18
mov byte [rdi + 0x64], al
mov eax, ecx
shr eax, 0x10
mov byte [rdi + 0x65], al
mov eax, ecx
mov rcx, rdi
shr eax, 8
mov byte [rdi + 0x66], al
mov eax, ebp
shr eax, 0x18
mov byte [rdi + 0x68], al
mov eax, ebp
shr eax, 0x10
mov byte [rdi + 0x69], al
mov eax, ebp
shr eax, 8
mov byte [rdi + 0x6a], al
call fcn.14003aeb0
movzx eax, byte [rdi + 3]
mov byte [rsi], al
movzx eax, byte [rdi + 2]
mov byte [rsi + 1], al
mov eax, dword [rdi]
shr eax, 8
mov byte [rsi + 2], al
movzx eax, byte [rdi]
mov byte [rsi + 3], al
movzx eax, byte [rdi + 7]
mov byte [rsi + 4], al
movzx eax, byte [rdi + 6]
mov byte [rsi + 5], al
mov eax, dword [rdi + 4]
shr eax, 8
mov byte [rsi + 6], al
movzx eax, byte [rdi + 4]
mov byte [rsi + 7], al
movzx eax, byte [rdi + 0xb]
mov byte [rsi + 8], al
movzx eax, byte [rdi + 0xa]
mov byte [rsi + 9], al
mov eax, dword [rdi + 8]
shr eax, 8
mov byte [rsi + 0xa], al
movzx eax, byte [rdi + 8]
mov byte [rsi + 0xb], al
movzx eax, byte [rdi + 0xf]
mov byte [rsi + 0xc], al
movzx eax, byte [rdi + 0xe]
mov byte [rsi + 0xd], al
mov eax, dword [rdi + 0xc]
shr eax, 8
mov byte [rsi + 0xe], al
movzx eax, byte [rdi + 0xc]
mov byte [rsi + 0xf], al
movzx eax, byte [rdi + 0x13]
mov byte [rsi + 0x10], al
movzx eax, byte [rdi + 0x12]
mov byte [rsi + 0x11], al
mov eax, dword [rdi + 0x10]
shr eax, 8
mov byte [rsi + 0x12], al
movzx eax, byte [rdi + 0x10]
mov byte [rsi + 0x13], al
movzx eax, byte [rdi + 0x17]
mov byte [rsi + 0x14], al
movzx eax, byte [rdi + 0x16]
mov byte [rsi + 0x15], al
mov eax, dword [rdi + 0x14]
shr eax, 8
mov byte [rsi + 0x16], al
movzx eax, byte [rdi + 0x14]
mov byte [rsi + 0x17], al
movzx eax, byte [rdi + 0x1b]
mov rbp, qword [rsp + 0x38]
mov byte [rsi + 0x18], al
movzx eax, byte [rdi + 0x1a]
mov byte [rsi + 0x19], al
mov eax, dword [rdi + 0x18]
shr eax, 8
mov byte [rsi + 0x1a], al
movzx eax, byte [rdi + 0x18]
mov byte [rsi + 0x1b], al
movzx eax, byte [rdi + 0x1f]
mov byte [rsi + 0x1c], al
movzx eax, byte [rdi + 0x1e]
mov byte [rsi + 0x1d], al
mov eax, dword [rdi + 0x1c]
shr eax, 8
mov byte [rsi + 0x1e], al
movzx eax, byte [rdi + 0x1c]
mov byte [rsi + 0x1f], al
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003bf30
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r9, rdx
mov edx, r8d
mov r11d, r8d
shr edx, 3
xor r8d, r8d
mov r10, rcx
test edx, edx
je 0x14003bfd1
cmp edx, 4
jb 0x14003bfa7
lea eax, [rdx - 1]
lea rbx, [rcx + rax*8]
lea rax, [r9 + rax*8]
cmp rcx, rax
ja 0x14003bf66
cmp rbx, r9
jae 0x14003bfa7
mov eax, edx
mov ebx, edx
and eax, 3
sub ebx, eax
nop
movdqu xmm0, xmmword [rcx + r8*8]
movdqu xmm1, xmmword [r9 + r8*8]
lea eax, [r8 + 2]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8*8], xmm1
movdqu xmm1, xmmword [r9 + rax*8]
movdqu xmm0, xmmword [rcx + rax*8]
add r8d, 4
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
cmp r8d, ebx
jb 0x14003bf70
cmp r8d, edx
jae 0x14003bfd1
mov rbx, r9
lea rcx, [rcx + r8*8]
sub rbx, r10
sub edx, r8d
mov r8d, edx
nop dword [rax]
mov rax, qword [rbx + rcx]
lea rcx, [rcx + 8]
xor qword [rcx - 8], rax
dec r8
jne 0x14003bfc0
mov ecx, r11d
and ecx, 7
je 0x14003c0a1
mov eax, r11d
mov ebx, r11d
sub eax, ecx
sub ebx, eax
mov r8d, eax
cmp eax, r11d
jae 0x14003c078
cmp ebx, 0x20
jb 0x14003c078
mov edx, eax
lea eax, [r11 - 1]
mov qword [rsp + 0x10], rsi
mov ecx, eax
mov qword [rsp + 0x18], rdi
lea rdi, [rax + r10]
lea rax, [rdx + r10]
add rcx, r9
lea rsi, [rdx + r9]
cmp rax, rcx
ja 0x14003c027
cmp rdi, rsi
jae 0x14003c06e
and ebx, 0x1f
mov edx, r11d
lea ecx, [r8 + 0x10]
sub edx, ebx
mov eax, r8d
add r8d, 0x20
movdqu xmm0, xmmword [rax + r10]
movdqu xmm1, xmmword [rax + r9]
pxor xmm1, xmm0
movdqu xmmword [rax + r10], xmm1
movdqu xmm1, xmmword [rcx + r9]
movdqu xmm0, xmmword [rcx + r10]
pxor xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
lea ecx, [rcx + 0x20]
cmp r8d, edx
jb 0x14003c033
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
cmp r8d, r11d
jae 0x14003c0a1
mov eax, r8d
sub r9, r10
add rax, r10
sub r11d, r8d
mov edx, r11d
nop dword [rax]
movzx ecx, byte [rax + r9]
lea rax, [rax + 1]
xor byte [rax - 1], cl
dec rdx
jne 0x14003c090
pop rbx
ret
Function at 0x140041c40
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x1402581e0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbp, rcx
mov rdi, rdx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x30], 0
call sub.MSVCR120.dll_memset
xor esi, esi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
call fcn.1400abed0
mov rbx, rax
test rax, rax
jne 0x140041cab
lea rdx, str.Remote_config_init_failed_
xor ecx, ecx
call fcn.140040950
xor eax, eax
jmp 0x140041e69
mov r8, rbp
mov edx, 0x2712
mov rcx, rax
call fcn.1400abfb0
mov edx, 0x4a
mov rcx, rbx
lea r8d, [rdx - 0x49]
call fcn.1400abfb0
mov edx, 0x4e
mov rcx, rbx
lea r8d, [rdx - 0x3f]
call fcn.1400abfb0
lea r8, [rsp + 0x30]
mov edx, 0x271a
mov rcx, rbx
call fcn.1400abfb0
mov edx, 0x63
mov rcx, rbx
lea r8d, [rdx - 0x62]
call fcn.1400abfb0
mov edx, 0x79
mov rcx, rbx
lea r8d, [rdx - 0x78]
call fcn.1400abfb0
lea r8, [0x140040e40]
mov edx, 0x4e2b
mov rcx, rbx
call fcn.1400abfb0
lea r8, [rsp + 0x20]
mov edx, 0x2711
mov rcx, rbx
call fcn.1400abfb0
mov r8, qword [0x1402c7eb8]
test r8, r8
je 0x140041d66
mov edx, 0x2714
mov rcx, rbx
call fcn.1400abfb0
mov r8d, dword [0x1402cb7d0]
mov edx, 0x65
mov rcx, rbx
call fcn.1400abfb0
jmp 0x140041dd4
lea rcx, [0x14023ebc8]
call qword [sym.imp.MSVCR120.dll_getenv]
test rax, rax
je 0x140041dd4
lea rcx, [0x14023ebd8]
call qword [sym.imp.MSVCR120.dll_getenv]
test rax, rax
je 0x140041d9c
lea rcx, [0x14023ebd8]
call qword [sym.imp.MSVCR120.dll_getenv]
mov r8, rax
jmp 0x140041dc7
lea rcx, [0x14023ebe8]
call qword [sym.imp.MSVCR120.dll_getenv]
test rax, rax
je 0x140041dc0
lea rcx, [0x14023ebe8]
call qword [sym.imp.MSVCR120.dll_getenv]
mov r8, rax
jmp 0x140041dc7
lea r8, [0x1401d3072]
mov edx, 0x2714
mov rcx, rbx
call fcn.1400abfb0
mov rcx, rbx
call fcn.1400ac190
test eax, eax
je 0x140041df5
lea r8, [rsp + 0x30]
lea rdx, str.Remote_config_read_failed:__s
xor ecx, ecx
call fcn.140040950
jmp 0x140041e5e
mov r9, qword [rsp + 0x20]
test r9, r9
je 0x140041e50
cmp qword [rsp + 0x28], rsi
je 0x140041e50
test rdi, rdi
je 0x140041e28
lea rdx, str._string_
mov rcx, rdi
mov byte [rdi + 0x5c], sil
mov qword [rdi], 0xffffffffffffffff
mov dword [rdi + 8], esi
call fcn.14002bcd0
test r9, r9
jne 0x140041e40
lea r8, str.wrong_arguments
xor edx, edx
mov rcx, rdi
call fcn.14002c200
jmp 0x140041e5e
mov rdx, rdi
mov rcx, r9
call fcn.14002d7c0
mov rsi, rax
jmp 0x140041e5e
lea rdx, str.Empty_data_received_for_config
xor ecx, ecx
call fcn.140040950
mov rcx, rbx
call fcn.1400af340
mov rax, rsi
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1401bddc0
mov rbx, qword [rsp + 0x170]
add rsp, 0x140
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400423e0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x260
mov rax, qword [0x1402581e0]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor r15d, r15d
mov rsi, rdx
mov rbp, rcx
mov edi, r15d
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdx + rbx], dil
jne 0x140042410
movsxd rax, ebx
inc ebx
mov qword [rsp + 0x2a0], r14
mov byte [rax + rdx], 0xa
test ebx, ebx
jle 0x140042495
nop
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea ecx, [rbp + 1]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x40], 1
call qword [sym.imp.WS2_32.dll_select]
cmp eax, 1
jl 0x1400424c0
movsxd rdx, edi
xor r9d, r9d
mov r8d, ebx
add rdx, rsi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14004248d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1400424c0
mov eax, r15d
sub ebx, eax
add edi, eax
test ebx, ebx
jg 0x140042430
mov eax, 1
mov r14, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1401bddc0
add rsp, 0x260
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor eax, eax
jmp 0x14004249a

Function at 0x140042540
Capabilities:
Get socket status

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x1402581e0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov dword [rsp + 0x30], edx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rcx
xor ebx, ebx
lea rdx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
inc ecx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x34], ebx
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
setg bl
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1401bddc0
add rsp, 0x260
pop rbx
ret
Function at 0x140051280
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, r8
mov r10, rdx
not ecx
test r8, r8
je 0x1400512bf
lea r11, [0x1401d67c0]
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r10]
mov eax, ecx
lea r10, [r10 + 1]
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov ecx, dword [r11 + r8*4]
xor ecx, eax
dec r9
jne 0x1400512a0
not ecx
mov eax, ecx
ret
Function at 0x140059520
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x30
mov r9, rdx
mov rbx, rcx
call fcn.140054200
xor eax, eax
movups xmm0, xmmword [0x1401d6c00]
movups xmmword [rbx + 0x48], xmm0
movups xmm1, xmmword [0x1401d6c10]
movups xmmword [rbx + 0x58], xmm1
movups xmm0, xmmword [0x1401d67a8]
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x40], rax
movups xmmword [rbx + 0x68], xmm0
add rsp, 0x30
pop rbx
ret

Function at 0x140059600
Capabilities:
Hash data using sha512

Disassembly:
mov r9, rdx
jmp 0x140059610
push rbx
sub rsp, 0x30
mov rbx, rcx
call fcn.140059010
movaps xmm0, xmmword [0x1401d6c40]
xor eax, eax
movups xmmword [rbx + 0x88], xmm0
movaps xmm1, xmmword [0x1401d6c50]
movups xmmword [rbx + 0x98], xmm1
movaps xmm0, xmmword [0x1401d6c60]
movups xmmword [rbx + 0xa8], xmm0
movaps xmm1, xmmword [0x1401d6c70]
movups xmmword [rbx + 0xb8], xmm1
movups xmm0, xmmword [0x1401d6c20]
movups xmmword [rbx + 0xc8], xmm0
movups xmm1, xmmword [0x1401d6c30]
mov qword [rbx + 0xf0], rax
mov qword [rbx + 0xe8], rax
mov qword [rbx + 0x80], rax
movups xmmword [rbx + 0xd8], xmm1
add rsp, 0x30
pop rbx
ret

Function at 0x140059610
Capabilities:
Hash data using sha512

Disassembly:
mov r9, rdx
jmp 0x140059610
push rbx
sub rsp, 0x30
mov rbx, rcx
call fcn.140059010
movaps xmm0, xmmword [0x1401d6c40]
xor eax, eax
movups xmmword [rbx + 0x88], xmm0
movaps xmm1, xmmword [0x1401d6c50]
movups xmmword [rbx + 0x98], xmm1
movaps xmm0, xmmword [0x1401d6c60]
movups xmmword [rbx + 0xa8], xmm0
movaps xmm1, xmmword [0x1401d6c70]
movups xmmword [rbx + 0xb8], xmm1
movups xmm0, xmmword [0x1401d6c20]
movups xmmword [rbx + 0xc8], xmm0
movups xmm1, xmmword [0x1401d6c30]
mov qword [rbx + 0xf0], rax
mov qword [rbx + 0xe8], rax
mov qword [rbx + 0x80], rax
movups xmmword [rbx + 0xd8], xmm1
add rsp, 0x30
pop rbx
ret
Function at 0x14008c0a0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x30
mov r9, rdx
mov rbx, rcx
call fcn.14008beb0
movups xmm0, xmmword [0x1401ddbd0]
movups xmmword [rbx + 0x40], xmm0
movups xmm1, xmmword [0x1401ddbe0]
mov qword [rbx + 0x60], 0
movups xmmword [rbx + 0x50], xmm1
add rsp, 0x30
pop rbx
ret
Function at 0x14008e730
Capabilities:
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x30
mov r9, rdx
mov rbx, rcx
call fcn.14008e3c0
movaps xmm0, xmmword [0x1401de030]
movups xmmword [rbx + 0x80], xmm0
movaps xmm1, xmmword [0x1401de040]
movups xmmword [rbx + 0x90], xmm1
movaps xmm0, xmmword [0x1401de050]
movups xmmword [rbx + 0xa0], xmm0
movaps xmm1, xmmword [0x1401de060]
mov qword [rbx + 0xc0], 0
movups xmmword [rbx + 0xb0], xmm1
add rsp, 0x30
pop rbx
ret
Function at 0x1400a06c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rdi, r8
mov rbx, rcx
xor rax, qword [rdx]
lea rsi, str._jvC.E
lea rbp, [0x1401e0170]
mov qword [r8], rax
mov rax, qword [rdx + 8]
xor rax, qword [rcx + 8]
mov qword [r8 + 8], rax
mov rax, qword [rdx + 0x10]
xor rax, qword [rcx + 0x10]
mov qword [r8 + 0x10], rax
mov rax, qword [rdx + 0x18]
xor rax, qword [rcx + 0x18]
mov qword [r8 + 0x18], rax
mov rax, qword [rdx + 0x20]
xor rax, qword [rcx + 0x20]
mov qword [r8 + 0x20], rax
mov rax, qword [rdx + 0x28]
xor rax, qword [rcx + 0x28]
mov qword [r8 + 0x28], rax
mov rax, qword [rdx + 0x30]
xor rax, qword [rcx + 0x30]
mov qword [r8 + 0x30], rax
mov rax, qword [rdx + 0x38]
xor rax, qword [rcx + 0x38]
mov qword [r8 + 0x38], rax
mov rcx, rdi
call fcn.1400a0340
mov rax, qword [rsi - 0x10]
mov rcx, rbx
xor qword [rbx], rax
mov rax, qword [rsi - 8]
xor qword [rbx + 8], rax
mov rax, qword [rsi]
xor qword [rbx + 0x10], rax
mov rax, qword [rsi + 8]
xor qword [rbx + 0x18], rax
mov rax, qword [rsi + 0x10]
xor qword [rbx + 0x20], rax
mov rax, qword [rsi + 0x18]
xor qword [rbx + 0x28], rax
mov rax, qword [rsi + 0x20]
xor qword [rbx + 0x30], rax
mov rax, qword [rsi + 0x28]
xor qword [rbx + 0x38], rax
call fcn.1400a0340
mov rax, qword [rbx]
xor qword [rdi], rax
mov rax, qword [rbx + 8]
add rsi, 0x40
xor qword [rdi + 8], rax
mov rax, qword [rbx + 0x10]
xor qword [rdi + 0x10], rax
mov rax, qword [rbx + 0x18]
xor qword [rdi + 0x18], rax
mov rax, qword [rbx + 0x20]
xor qword [rdi + 0x20], rax
mov rax, qword [rbx + 0x28]
xor qword [rdi + 0x28], rax
mov rax, qword [rbx + 0x30]
xor qword [rdi + 0x30], rax
mov rax, qword [rbx + 0x38]
xor qword [rdi + 0x38], rax
cmp rsi, rbp
jl 0x1400a0745
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a9a30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r8, qword [rcx + 8]
mov rax, qword [rcx + 0x50]
mov rbx, rcx
lea rdx, [rax + r8*8]
mov byte [r8 + rbx], 0x80
mov rsi, r9
rol rdx, 0x20
mov rdi, rdx
mov rax, rdx
shl rdx, 0x10
shl rax, 0x10
shr rdi, 0x10
xor rdi, rax
movabs rax, 0xffff0000ffff
and rdi, rax
xor rdi, rdx
mov rcx, rdi
mov rax, rdi
shl rdi, 8
shr rcx, 8
shl rax, 8
xor rcx, rax
movabs rax, 0xff00ff00ff00ff
and rcx, rax
xor rcx, rdi
inc r8
mov qword [rsp + 0x30], rcx
cmp r8, 8
jae 0x1400a9ac2
mov ecx, 8
lea rdi, [r8 + rbx]
sub rcx, r8
xor eax, eax
rep stosb byte [rdi], al
mov r8d, 1
mov rdx, rbx
mov rcx, rbx
call fcn.1400a0ed0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400a3f70
xor eax, eax
lea r8, [rbx + 0x10]
nop word [rax + rax]
mov edi, dword [r8]
inc rax
lea r8, [r8 + 4]
rol edi, 0x10
mov edx, edi
mov ecx, edi
shl edi, 8
shr edx, 8
shl ecx, 8
xor edx, ecx
and edx, 0xff00ff
xor edx, edi
mov dword [rsi + rax*4 - 4], edx
cmp rax, 0x10
jb 0x1400a9af0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400ab740
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x80]
xor edx, edx
and ecx, 0x3f
mov byte [rcx + rbx], 0x80
inc ecx
cmp ecx, 0x20
jbe 0x1400ab78f
mov r8d, 0x40
sub r8d, ecx
add rcx, rbx
call sub.MSVCR120.dll_memset
lea rdx, [rbx + 0x40]
mov rcx, rbx
call fcn.1400a9c00
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
jmp 0x1400ab7a0
mov r8d, 0x20
sub r8d, ecx
add rcx, rbx
call sub.MSVCR120.dll_memset
xor eax, eax
movabs r10, 0xffff0000ffff
movabs r9, 0xff00ff00ff00ff
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov r8, qword [rbx + 0x80]
mov rcx, r8
shr rcx, 0x3d
rol rcx, 0x20
mov rdx, rcx
mov rax, rcx
shl rcx, 0x10
shr rdx, 0x10
shl rax, 0x10
xor rdx, rax
and rdx, r10
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
shl rdx, 8
shr rcx, 8
shl rax, 8
xor rcx, rax
and rcx, r9
xor rcx, rdx
mov qword [rbx + 0x30], rcx
lea rcx, [r8*8]
rol rcx, 0x20
mov rdx, rcx
mov rax, rcx
shl rcx, 0x10
shr rdx, 0x10
shl rax, 0x10
xor rdx, rax
and rdx, r10
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
shl rdx, 8
shr rcx, 8
shl rax, 8
xor rcx, rax
and rcx, r9
xor rcx, rdx
lea rdx, [rbx + 0x40]
mov qword [rbx + 0x38], rcx
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400a9c00
Function at 0x1400ab9d0
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x80]
xor edx, edx
and ecx, 0x3f
mov byte [rcx + rbx], 0x80
inc ecx
cmp ecx, 0x20
jbe 0x1400aba1f
mov r8d, 0x40
sub r8d, ecx
add rcx, rbx
call sub.MSVCR120.dll_memset
lea rdx, [rbx + 0x40]
mov rcx, rbx
call fcn.1400aa8f0
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
jmp 0x1400aba30
mov r8d, 0x20
sub r8d, ecx
add rcx, rbx
call sub.MSVCR120.dll_memset
xor eax, eax
movabs r10, 0xffff0000ffff
movabs r9, 0xff00ff00ff00ff
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov r8, qword [rbx + 0x80]
mov rcx, r8
shr rcx, 0x3d
rol rcx, 0x20
mov rdx, rcx
mov rax, rcx
shl rcx, 0x10
shr rdx, 0x10
shl rax, 0x10
xor rdx, rax
and rdx, r10
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
shl rdx, 8
shr rcx, 8
shl rax, 8
xor rcx, rax
and rcx, r9
xor rcx, rdx
mov qword [rbx + 0x30], rcx
lea rcx, [r8*8]
rol rcx, 0x20
mov rdx, rcx
mov rax, rcx
shl rcx, 0x10
shr rdx, 0x10
shl rax, 0x10
xor rdx, rax
and rdx, r10
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
shl rdx, 8
shr rcx, 8
shl rax, 8
xor rcx, rax
and rcx, r9
xor rcx, rdx
lea rdx, [rbx + 0x40]
mov qword [rbx + 0x38], rcx
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400aa8f0

Function at 0x1400abd50
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x1402581e0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400abdb1
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x1400abdab
shr ax, 8
cmp al, 2
jne 0x1400abdab
call fcn.1400bc020
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1401bddc0
add rsp, 0x1d8
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1401bddc0
add rsp, 0x1d8
ret
Function at 0x1400abfe0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov qword [rsp + 0x58], rbp
mov rsi, rcx
mov edi, r15d
mov ebx, r15d
mov qword [rsp + 0x60], r14
test edi, edi
jne 0x1400ac168
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov ebp, edx
shr ebp, 6
imul eax, ebp, 0x3e8
sub ecx, eax
imul r14d, ecx, 0x3e8
test rsi, rsi
je 0x1400ac157
lea rcx, [rsp + 0x24]
mov rdx, rsi
call fcn.1400acc70
mov edi, eax
test eax, eax
jne 0x1400ac003
mov eax, dword [rsp + 0x24]
cmp eax, 0xffffffff
je 0x1400ac161
test eax, eax
jne 0x1400ac0fc
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0x10624dd3
mul r8d
mov r9d, edx
shr r9d, 6
mov dword [rsp + 0x28], r9d
imul ecx, r9d, 0x3e8
sub r8d, ecx
sub r9d, ebp
imul eax, r8d, 0x3e8
mov dword [rsp + 0x2c], eax
mov rcx, qword [rsp + 0x28]
mov eax, 0x10624dd3
shr rcx, 0x20
sub ecx, r14d
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, r9d, 0x3e8
add edx, eax
cmp edx, 0xa
jg 0x1400ac0fc
inc ebx
cmp ebx, 2
jle 0x1400ac0ff
cmp ebx, 0xa
jge 0x1400ac0ed
lea ecx, [rbx - 1]
mov eax, 1
shl eax, cl
test eax, eax
je 0x1400ac0ff
jns 0x1400ac0f2
mov ecx, 0x2726
call qword [sym.imp.WS2_32.dll_WSASetLastError]
jmp 0x1400ac0ff
mov eax, 0x3e8
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400ac0ff
mov ebx, r15d
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400ae060
mov edi, eax
test eax, eax
jne 0x1400ac003
cmp dword [rsp + 0x20], r15d
jne 0x1400ac003
cmp dword [rsi], 0xbab1e
jne 0x1400ac003
mov rcx, qword [rsi + 0x20]
cmp qword [rcx + 0x18], r15
je 0x1400ac003
mov rdx, qword [rcx]
xor r8d, r8d
mov rbp, qword [rdx]
call fcn.1400c0910
test rbp, rbp
je 0x1400ac003
mov eax, dword [rbp + 0x10]
jmp 0x1400ac178
mov edi, 1
jmp 0x1400ac003
mov eax, 0x38
jmp 0x1400ac178
mov eax, 0x2b
mov ecx, 0x1b
cmp edi, 3
cmove eax, ecx
mov r14, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret
Function at 0x1400b4290
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r9d, dword [rcx + 0x338]
xor edi, edi
mov rbx, rdx
test r9d, r9d
mov rbp, rcx
mov ecx, dword [rcx + 0x33c]
mov edx, edi
mov r15d, 1
mov r14, r8
cmovg edx, r15d
mov esi, 0x493e0
test ecx, ecx
jle 0x1400b42db
or edx, 2
dec edx
je 0x1400b42f6
dec edx
je 0x1400b42f2
dec edx
jne 0x1400b42f9
mov esi, ecx
cmp r9d, ecx
cmovl esi, r9d
jmp 0x1400b42f9
mov esi, ecx
jmp 0x1400b42f9
mov esi, r9d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov r9d, edx
shr r9d, 6
mov dword [rsp + 0x40], r9d
imul eax, r9d, 0x3e8
sub ecx, eax
imul eax, ecx, 0x3e8
mov rcx, qword [rbp + 0x7d0]
mov dword [rsp + 0x44], eax
mov r8, qword [rsp + 0x40]
mov rax, rcx
shr rax, 0x20
shr r8, 0x20
sub ecx, r9d
sub r8d, eax
mov eax, 0x10624dd3
imul r8d
imul r8d, ecx, 0x3e8
mov rcx, 0xffffffffffffffff
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
sub r8d, edx
add esi, r8d
cmove esi, ecx
cmp dword [rbx + 0x2ac], edi
je 0x1400b437d
mov dword [r14], edi
jmp 0x1400b44ba
mov rax, qword [rbx + 0xb8]
mov qword [rbx + 0xc0], rax
nop dword [rax + rax]
cmp byte [rax + rcx + 1], dil
lea rcx, [rcx + 1]
jne 0x1400b4390
cmp byte [rax + rcx - 1], 0x2e
jne 0x1400b43a7
mov byte [rax + rcx - 1], dil
mov rcx, qword [rbx + 0xb8]
movzx eax, byte [rcx]
test al, al
je 0x1400b43d5
lea rcx, [rcx + 1]
and al, 0x80
jne 0x1400b43c6
movzx eax, byte [rcx]
test al, al
jne 0x1400b43b5
jmp 0x1400b43d5
lea rdx, str.IDN_support_not_present__cant_parse_Unicode_domains_n
mov rcx, rbp
call fcn.1400b89e0
mov rax, qword [rbx + 0xd8]
test rax, rax
je 0x1400b4453
cmp byte [rax], dil
je 0x1400b4453
lea r8, [rbx + 0xc8]
mov rcx, rbp
call fcn.1400b25f0
mov qword [rsp + 0x40], rdi
test esi, esi
js 0x1400b44ac
mov r8d, dword [rbx + 0xe8]
mov rdx, qword [rbx + 0xd8]
lea r9, [rsp + 0x40]
mov rcx, rbx
call fcn.1400b73e0
cmp eax, r15d
jne 0x1400b442a
mov dword [r14], r15d
jmp 0x1400b44b1
cmp eax, 0xfffffffe
je 0x1400b44ac
cmp qword [rsp + 0x40], rdi
jne 0x1400b44b1
mov r8, qword [rbx + 0xe0]
lea rdx, str.Couldnt_resolve_proxy__s
mov rcx, rbp
call fcn.1400b8ac0
mov edi, 5
jmp 0x1400b44b1
mov r8d, dword [rbx + 0xec]
mov qword [rsp + 0x40], rdi
mov dword [rbx + 0xe8], r8d
test esi, esi
js 0x1400b44ac
mov rdx, qword [rbx + 0xb8]
lea r9, [rsp + 0x40]
mov rcx, rbx
call fcn.1400b73e0
cmp eax, r15d
je 0x1400b4422
cmp eax, 0xfffffffe
je 0x1400b44ac
cmp qword [rsp + 0x40], rdi
jne 0x1400b44b1
mov r8, qword [rbx + 0xc0]
lea rdx, str.Couldnt_resolve_host__s
mov rcx, rbp
call fcn.1400b8ac0
mov edi, 6
jmp 0x1400b44b1
mov edi, 0x1c
mov rax, qword [rsp + 0x40]
mov qword [rbx + 0x50], rax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov eax, edi
add rsp, 0x20
pop r15
pop r14
pop rdi
ret