joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140024420
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, dword [rcx + 0x128]
xor r10b, r10b
movzx edi, r8b
mov rbx, rcx
test r9b, r9b
jne 0x140024523
mov eax, dword [rcx + 0x12c]
test eax, eax
jne 0x140024474
test dl, dl
je 0x1400244dd
call fcn.14002d230
mov rcx, rbx
call fcn.14002de40
mov ecx, eax
mov r10b, 1
mov eax, dword [rbx + 0x12c]
jmp 0x140024478
mov ecx, dword [rsp + 0x48]
cmp eax, 1
jne 0x140024496
test dil, dil
je 0x140024496
mov rcx, rbx
call fcn.14002d3d0
mov rcx, rbx
call fcn.14002de40
mov ecx, eax
jmp 0x14002449b
test r10b, r10b
je 0x1400244dd
test esi, esi
jne 0x1400244e7
cmp byte [rbx + 0x120], sil
je 0x1400244e7
mov eax, dword [rbx + 0x128]
cmp eax, 0xa
jne 0x1400244cb
mov rcx, rbx
call fcn.14002d3d0
mov rcx, rbx
call fcn.14002de40
mov ecx, eax
mov eax, dword [rbx + 0x128]
add eax, 0xfffffff4
test eax, 0xfffffffd
jne 0x1400244e7
mov rcx, rbx
call fcn.14002d3d0
mov rcx, rbx
call fcn.14002de40
mov ecx, eax
mov rdx, qword [rbx + 0x20]
cmp byte [rdx + 0x17c], 0
jne 0x140024511
mov eax, dword [rdx + 0x194]
and eax, 4
test al, al
jne 0x140024511
cmp dword [rbx + 0x12c], 2
jne 0x140024511
mov byte [rdx + 0x17c], 1
mov eax, ecx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, 1
call fcn.140029c80
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14002de40
Function at 0x140025b00
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 0x20]
mov rsi, rcx
test dword [rdi + 0x194], 0x2000
jne 0x140025b3f
mov rcx, qword [0x1402f10b8]
lea r9, str.Cannot_resume_connections_without_enabling_MHD_ALLOW_SUSPEND_RESUME__n
mov r8d, 0xaff
lea rdx, [0x1402e0e80]
call qword [0x1402f10b0]
int3
lea rcx, [rdi + 0x130]
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov byte [rsi + 0x168], 1
lea rcx, [rdi + 0x130]
mov byte [rdi + 0x17b], 1
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
cmp qword [rdi + 0x168], 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
je 0x140025bb6
mov rcx, qword [rdi + 0x170]
lea rdx, [0x1402dea14]
xor r9d, r9d
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x140025bb6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x140025bb6
lea rdx, str.Failed_to_signal_resume_via_inter_thread_communication_channel.
mov rcx, rdi
call fcn.14002fa20
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140026210
Capabilities:
Set socket configuration

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1402dd5c8]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor eax, eax
mov dword [rsp + 0x30], 0x1c
mov rdi, rcx
mov qword [r11 - 0x30], rax
mov rcx, qword [rcx + 0x158]
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov dword [rsp + 0x50], eax
cmp rcx, 0xffffffffffffffff
je 0x1400263f7
movzx eax, byte [rdi + 0x179]
test al, al
jne 0x1400263f7
lea r8, [r11 - 0x38]
lea rdx, [r11 - 0x30]
call qword [sym.imp.WS2_32.dll_accept]
xor bl, bl
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140026321
cmp dword [rsp + 0x30], 0
jle 0x140026321
lea r8, [rsp + 0x34]
mov dword [rsp + 0x34], 1
mov edx, 0x8004667e
mov rcx, rax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x1400262d4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.14002eff0
mov r8, rax
lea rdx, str.Failed_to_set_nonblocking_mode_on_incoming_connection_socket:__s_n
mov rcx, rdi
call fcn.14002fa20
jmp 0x1400262d6
mov bl, 1
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.DLL_SetHandleInformation]
test eax, eax
jne 0x1400262f9
lea rdx, str.Failed_to_set_noninheritable_mode_on_incoming_connection_socket._n
mov rcx, rdi
call fcn.14002fa20
mov r9d, dword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov byte [rsp + 0x28], bl
mov rdx, rsi
mov rcx, rdi
mov byte [rsp + 0x20], 0
call fcn.140024cd0
mov eax, 1
jmp 0x1400263f9
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
lea ecx, [rax - 0x2726]
test ecx, 0xffffffdf
je 0x1400263f7
cmp eax, 0x2733
je 0x14002635b
mov ecx, eax
call fcn.14002eff0
mov r8, rax
lea rdx, str.Error_accepting_connection:__s_n
mov rcx, rdi
call fcn.14002fa20
cmp rsi, 0xffffffffffffffff
je 0x140026390
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
je 0x140026390
mov rcx, qword [0x1402f10b8]
lea r9, [0x1402e02f8]
mov r8d, 0xc23
lea rdx, [0x1402e0800]
call qword [0x1402f10b0]
int3
cmp ebx, 0x2728
je 0x1400263a0
cmp ebx, 0x2747
jne 0x1400263f7
cmp dword [rdi + 0x180], 0
jne 0x1400263c0
lea rdx, str.Hit_process_or_system_resource_limit_at_FIRST_connection._This_is_really_bad_as_there_is_no_sane_way_to_proceed._Will_try_busy_waiting_for_system_resources_to_become_magically_available._n
mov rcx, rdi
call fcn.14002fa20
jmp 0x1400263f7
lea rcx, [rdi + 0x130]
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
lea rcx, [rdi + 0x130]
mov byte [rdi + 0x17a], 1
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov r8d, dword [rdi + 0x180]
lea rdx, str.Hit_process_or_system_resource_limit_at__u_connections__temporarily_suspending_accept__._Consider_setting_a_lower_MHD_OPTION_CONNECTION_LIMIT._n
mov rcx, rdi
call fcn.14002fa20
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401b48e0
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140026820
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push r12
push r13
push r14
sub rsp, 0x50
mov r14, rcx
mov byte [rcx + 0x17c], 0
mov rcx, qword [rcx + 0x168]
mov r13, r9
mov r12, rdx
cmp rcx, 0xffffffffffffffff
je 0x14002687d
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x14002687d
nop dword [rax + rax]
mov rcx, qword [r14 + 0x168]
lea rdx, [rsp + 0x20]
xor r9d, r9d
lea r8d, [r9 + 4]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x140026860
mov rcx, qword [r14 + 0x158]
cmp rcx, 0xffffffffffffffff
je 0x1400268ab
movzx eax, byte [r14 + 0x179]
test al, al
jne 0x1400268ab
mov rdx, r12
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x1400268ab
mov rcx, r14
call fcn.140026210
mov eax, dword [r14 + 0x194]
and eax, 4
test al, al
jne 0x14002696c
mov qword [rsp + 0x78], rbx
mov rbx, qword [r14 + 0x18]
test rbx, rbx
je 0x140026967
mov r14, qword [rsp + 0x80]
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rdi
nop dword [rax + rax]
mov r15, qword [rbx + 0x118]
mov rbp, qword [rbx + 8]
cmp r15, 0xffffffffffffffff
je 0x140026946
mov rdx, r13
mov rcx, r15
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
mov rdx, r14
mov rcx, r15
test eax, eax
setne sil
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
mov rdx, r12
mov rcx, r15
test eax, eax
setne dil
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
movzx r9d, sil
movzx r8d, dil
test eax, eax
mov rcx, rbx
setne dl
call fcn.140024420
mov rbx, rbp
test rbp, rbp
jne 0x1400268f0
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rcx, r14
call fcn.140026420
mov eax, 1
add rsp, 0x50
pop r14
pop r13
pop r12
ret
Function at 0x1400274b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push r15
sub rsp, 0x68
mov rax, qword [0x1402dd5c8]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx eax, byte [rcx + 0x178]
mov r15d, edx
mov rbx, rcx
test al, al
je 0x1400274df
xor eax, eax
jmp 0x140027693
mov eax, dword [rcx + 0x194]
and eax, 4
test al, al
jne 0x1400274f6
call fcn.140027160
jmp 0x140027693
mov rcx, qword [rcx + 0x158]
xor eax, eax
mov qword [rsp + 0x88], rbp
mov ebp, 0xffffffff
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0x60], r12
lea edi, [rax + 1]
xor r12d, r12d
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r14
mov esi, r12d
mov qword [rsp + 0x28], rax
mov r14d, ebp
mov qword [rsp + 0x30], rax
mov r13d, 0x300
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
cmp rcx, 0xffffffffffffffff
je 0x140027571
movzx eax, byte [rbx + 0x179]
test al, al
jne 0x140027571
mov qword [rsp + 0x28], rcx
mov ebp, r12d
mov dword [rsp + 0x30], r13d
mov esi, edi
mov rcx, qword [rbx + 0x168]
cmp rcx, 0xffffffffffffffff
je 0x140027592
mov eax, esi
mov r14d, esi
add rax, rax
inc esi
mov qword [rsp + rax*8 + 0x28], rcx
mov dword [rsp + rax*8 + 0x30], r13d
test dword [rbx + 0x194], 0x2000
je 0x1400275a6
mov rcx, rbx
call fcn.140025bd0
test esi, esi
je 0x14002766a
mov eax, r12d
lea rcx, [rsp + 0x28]
sub eax, r15d
mov edx, esi
neg eax
sbb r8d, r8d
call qword [sym.imp.WS2_32.dll_WSAPoll]
test eax, eax
jns 0x1400275f9
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x14002766a
mov ecx, eax
call fcn.14002eff0
mov r8, rax
lea rdx, [0x1402dfb68]
mov rcx, rbx
call fcn.14002fa20
mov edi, r12d
jmp 0x14002766a
cmp r14d, 0xffffffff
je 0x14002763d
movsxd rax, r14d
add rax, rax
movzx ecx, word [rsp + rax*8 + 0x32]
and cx, r13w
cmp r12w, cx
je 0x14002763d
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x168]
lea rdx, [rsp + 0x20]
xor r9d, r9d
lea r8d, [r9 + 4]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x140027620
movzx eax, byte [rbx + 0x178]
test al, al
jne 0x1400275f4
cmp ebp, 0xffffffff
je 0x14002766a
movsxd rcx, ebp
add rcx, rcx
movzx edx, word [rsp + rcx*8 + 0x32]
and dx, r13w
cmp r12w, dx
je 0x14002766a
mov rcx, rbx
call fcn.140026210
mov r14, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x98]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401b48e0
add rsp, 0x68
pop r15
pop rbx
ret
Function at 0x14002fdd0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
mov rsi, r9
mov ecx, 0x18
mov rdi, r8
mov rbp, rdx
call fcn.1401da214
mov rbx, rax
test rax, rax
je 0x14002fe68
mov qword [rax], rsi
mov rax, qword [rsp + 0x60]
mov qword [rbx + 8], rax
mov eax, 0xffffffff
mov qword [rbx + 0x10], rbp
cmp rdi, rax
jbe 0x14002fe39
call fcn.1401e1e4c
mov rcx, rbx
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.1401db01c
xor eax, eax
jmp 0x14002fe71
xor eax, eax
lea r8, [0x14002fd80]
mov qword [rsp + 0x28], rax
mov r9, rbx
mov edx, edi
mov dword [rsp + 0x20], eax
xor ecx, ecx
call fcn.1401ec70c
mov qword [r14], rax
cmp rax, 0xffffffffffffffff
jne 0x14002fe6c
mov rcx, rbx
call fcn.1401db01c
xor eax, eax
jmp 0x14002fe71
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140059710
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov rdx, rcx
mov r9d, 0x40
xor ecx, ecx
mov r8d, 0x3000
jmp qword [sym.imp.KERNEL32.DLL_VirtualAlloc]

Function at 0x140059760
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 0x20
call qword [sym.imp.KERNEL32.DLL_VirtualProtect]
add rsp, 0x28
ret

Function at 0x1400599b0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x238
mov rax, qword [0x1402dd5c8]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov r8d, 0x200
lea rdx, [rsp + 0x20]
lea rcx, str._PROGRAMFILES_NVIDIA_CorporationNVSMI_nvml.dll
call qword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
lea rdx, [0x1402e7cd8]
lea rcx, [rsp + 0x20]
call fcn.14001fbc0
cmp eax, 0xffffffff
jne 0x140059a0f
lea rdx, [0x1402e7cd8]
lea rcx, str.nvml.dll
call fcn.14001fbc0
cmp eax, 0xffffffff
je 0x140059a2e
lea r8, [0x1402e7ce8]
lea rdx, str.nvmlInit_v2
lea rcx, [0x1402e7cd8]
call fcn.14001fc80
cmp eax, 0xffffffff
jne 0x140059a48
xor al, al
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1401b48e0
add rsp, 0x238
ret
lea r8, [0x1402e7d40]
lea rdx, str.nvmlShutdown
lea rcx, [0x1402e7cd8]
call fcn.14001fc80
lea r8, [0x1402e7d48]
lea rdx, str.nvmlDeviceGetHandleByIndex_v2
lea rcx, [0x1402e7cd8]
call fcn.14001fc80
lea r8, [0x1402e7d50]
lea rdx, str.nvmlDeviceGetTemperature
lea rcx, [0x1402e7cd8]
call fcn.14001fc80
lea r8, [0x1402e7d58]
lea rdx, str.nvmlDeviceGetPowerUsage
lea rcx, [0x1402e7cd8]
call fcn.14001fc80
lea r8, [0x1402e7d60]
lea rdx, str.nvmlDeviceGetFanSpeed
lea rcx, [0x1402e7cd8]
call fcn.14001fc80
lea r8, [0x1402e7d68]
lea rdx, str.nvmlDeviceGetClockInfo
lea rcx, [0x1402e7cd8]
call fcn.14001fc80
lea r8, [0x1402e7d70]
lea rdx, str.nvmlSystemGetNVMLVersion
lea rcx, [0x1402e7cd8]
call fcn.14001fc80
lea r8, [0x1402e7d78]
lea rdx, str.nvmlDeviceGetCount_v2
lea rcx, [0x1402e7cd8]
call fcn.14001fc80
lea r8, [0x1402e7d80]
lea rdx, str.nvmlDeviceGetPciInfo_v2
lea rcx, [0x1402e7cd8]
call fcn.14001fc80
call qword [0x1402e7ce8]
mov r8, qword [0x1402e7d70]
test eax, eax
sete al
mov byte [0x1402e7cd0], al
test r8, r8
je 0x140059b65
mov edx, 0x50
lea rcx, [0x1402e7cf0]
call r8
movzx eax, byte [0x1402e7cd0]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1401b48e0
add rsp, 0x238
ret
Function at 0x140059e20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x1402dd5c8]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov eax, dword [rcx]
lea rdi, [rcx + 0x3c]
mov dword [rbp - 0x79], eax
lea rdx, [rbp - 0x39]
mov eax, dword [rcx + 4]
mov rbx, rcx
mov dword [rbp - 0x75], eax
xor r8d, r8d
mov eax, dword [rcx + 8]
mov dword [rbp - 0x71], eax
mov eax, dword [rcx + 0xc]
mov dword [rbp - 0x6d], eax
mov eax, dword [rcx + 0x10]
mov dword [rbp - 0x69], eax
mov eax, dword [rcx + 0x14]
mov dword [rbp - 0x65], eax
mov eax, dword [rcx + 0x18]
mov dword [rbp - 0x61], eax
mov eax, dword [rcx + 0x1c]
mov dword [rbp - 0x5d], eax
mov eax, dword [rcx + 0x20]
mov dword [rbp - 0x59], eax
mov eax, dword [rcx + 0x24]
mov dword [rbp - 0x55], eax
mov eax, dword [rcx + 0x28]
mov dword [rbp - 0x51], eax
mov eax, dword [rcx + 0x2c]
mov dword [rbp - 0x4d], eax
mov eax, dword [rcx + 0x30]
mov dword [rbp - 0x49], eax
mov eax, dword [rcx + 0x34]
mov dword [rbp - 0x45], eax
mov eax, dword [rcx + 0x38]
lea rcx, [rbp - 0x79]
mov dword [rbp - 0x41], eax
mov eax, dword [rdi]
mov dword [rbp - 0x3d], eax
call fcn.14005a020
mov r8d, 1
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.14005a020
mov r8d, 2
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.14005a020
mov r8d, 3
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.14005a020
mov r8d, 4
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.14005a020
mov r8d, 5
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.14005a020
mov r8d, 6
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.14005a020
mov r8d, 7
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.14005a020
mov r8d, 8
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.14005a020
mov r8d, 9
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x39]
call fcn.14005a020
lea rax, [rbp - 0x3d]
mov edx, reloc.WS2_32.dll_recv
cmp rbx, rax
ja 0x140059f7e
xor ecx, ecx
lea rax, [rbp - 0x79]
cmp rdi, rax
jae 0x140059fc7
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rbp - 0x69]
pxor xmm0, xmmword [rbp - 0x79]
movdqu xmmword [rbx], xmm0
movdqu xmm0, xmmword [rbx + 0x10]
pxor xmm1, xmm0
movdqu xmmword [rbx + 0x10], xmm1
movdqu xmm0, xmmword [rbx + 0x20]
movdqu xmm1, xmmword [rbp - 0x59]
pxor xmm1, xmm0
movdqu xmmword [rbx + 0x20], xmm1
movdqu xmm0, xmmword [rbx + 0x30]
movdqu xmm1, xmmword [rbp - 0x49]
pxor xmm1, xmm0
movdqu xmmword [rbx + 0x30], xmm1
mov rcx, rdx
cmp rcx, rdx
jae 0x140059ff0
lea r8, [rbp - 0x79]
sub r8, rbx
lea rax, [rbx + rcx*4]
sub rdx, rcx
nop word [rax + rax]
mov ecx, dword [r8 + rax]
xor dword [rax], ecx
lea rax, [rax + 4]
sub rdx, 1
jne 0x140059fe0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1401b48e0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14005c3e0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x1402dd5c8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov dword [rsp + 0x20], 0x6a09e667
mov rbx, rcx
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x50], rax
lea r8, [r8*8]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov qword [rsp + 0x3c], 0x5be0cd19
call fcn.14005c4a0
mov r9b, 1
lea rcx, [rsp + 0x20]
mov r8b, 0x81
mov rdx, rbx
call fcn.14005c180
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1401b48e0
add rsp, 0xb0
pop rbx
ret
Function at 0x14006e0e0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
pshufd xmm0, xmmword [rdx], 0x55
lea rdi, [0x140216060]
mov r11, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov rbx, rdx
mov r9d, eax
movdqu xmm5, xmmword [r11]
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
pxor xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
ror eax, 8
or r8d, ecx
xor eax, 2
mov ecx, r8d
ror ecx, 8
xor ecx, 2
movd xmm0, r8d
movd xmm2, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqu xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r9d, eax
movdqu xmm5, xmmword [rbx]
mov eax, edx
shr rax, 8
movzx ecx, al
pshufd xmm0, xmm1, 0xff
shl r9d, 8
pslldq xmm5, 4
movzx eax, byte [rcx + rdi]
movdqa xmm4, xmm5
pxor xmm4, xmmword [rbx]
or r9d, eax
movzx eax, dl
shl r9d, 8
pslldq xmm5, 4
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov rdi, qword [rsp + 0x10]
or r8d, ecx
mov eax, r8d
mov ecx, r9d
ror eax, 8
ror ecx, 8
movd xmm0, r8d
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, eax
pxor xmm0, xmm4
movd xmm2, ecx
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pshufd xmm1, xmm3, 0xaa
pxor xmm0, xmm5
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
mov rbx, qword [rsp + 8]
ret

Function at 0x140074030
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rdi, [rcx + 0x28]
mov rbx, rdx
mov rcx, rdi
xor edx, edx
mov r8d, 0x80
call fcn.1401d2d90
test rbx, rbx
je 0x140074089
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x140074060
test rax, rax
je 0x140074089
mov r8d, 0x7f
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1401da0b0
mov edx, 0x7f
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.WS2_32.dll_gethostname]
Function at 0x140077f10
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rbx, rcx
mov rdi, r8
mov ecx, 0x18
mov rsi, rdx
call qword [fcn.1401da214]
mov r14, rax
test rax, rax
jne 0x14001d1eb
mov eax, 0xfffff027
jmp 0x14001d274
mov qword [rax + 8], rdi
lea r8, [0x14001d0c0]
xor edi, edi
mov qword [rax], rsi
mov qword [rsp + 0x28], rdi
mov r9, r14
xor edx, edx
mov dword [rsp + 0x20], 4
xor ecx, ecx
call fcn.1401ec70c
test rax, rax
jne 0x14001d262
call fcn.1401e1e4c
mov esi, dword [rax]
call fcn.1401e1e4c
mov rcx, r14
mov ebx, dword [rax]
call qword [fcn.1401db01c]
call fcn.1401e1e4c
mov dword [rax], ebx
test esi, esi
je 0x14001d272
cmp esi, 0xb
je 0x14001d25b
cmp esi, 0xd
je 0x14001d254
cmp esi, 0x16
setne dil
lea eax, [rdi - 0xfe7]
jmp 0x14001d274
mov eax, 0xfffff004
jmp 0x14001d274
mov eax, 0xfffff008
jmp 0x14001d274
mov qword [rbx], rax
mov rcx, rax
mov qword [r14 + 0x10], rax
call qword [sym.imp.KERNEL32.DLL_ResumeThread]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
mov r8, rcx
add rcx, 0x20
jmp 0x14001d1b0

Function at 0x140089950
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x48
test ecx, ecx
jle 0x140089a34
mov qword [rsp + 0x40], rbx
movsxd rbx, ecx
cmp ecx, 0x64
jle 0x1400899c4
imul rax, rbx, 0xfffffffffffffff6
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x58], rax
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.DLL_CreateWaitableTimerW]
xor r9d, r9d
lea rdx, [rsp + 0x58]
mov rbx, rax
xor r8d, r8d
xor eax, eax
mov rcx, rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_SetWaitableTimer]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rcx, [rsp + 0x68]
movaps xmmword [rsp + 0x30], xmm6
call qword [sym.imp.KERNEL32.DLL_QueryPerformanceFrequency]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
movss xmm6, dword [0x14021a0a0]
call qword [sym.imp.KERNEL32.DLL_SwitchToThread]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
mov rax, qword [rsp + 0x58]
xorps xmm1, xmm1
sub rax, qword [rsp + 0x60]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [rsp + 0x68]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
mulss xmm1, xmm6
mulss xmm1, xmm6
cvttss2si rax, xmm1
cmp rax, rbx
jl 0x1400899e7
movaps xmm6, xmmword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret
Function at 0x1400bc800
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
mov eax, 0x20
call fcn.1401b4b30
sub rsp, rax
mov rax, qword [rcx + 8]
lea rsi, [r9 + 1]
mov rbx, rdx
mov rdx, qword [rdx + 8]
mov r9, qword [rax + 0xc0]
test byte [r9 + 0x60], 1
je 0x1400bc889
lea rax, [rsi + r8]
cmp rax, rdx
ja 0x1400bc88e
add qword [rbx + 0x20], r8
sub rdx, r8
add qword [rbx + 0x28], r8
sub qword [rbx + 0x10], r8
mov qword [rbx + 8], rdx
mov rax, qword [rbx + 0x20]
mov rcx, qword [rcx + 0x430]
mov qword [rsp + 0x40], rdi
movzx edi, byte [rax + rdx - 1]
call fcn.1400c1000
mov rcx, rax
call fcn.1400ddb90
mov r8, qword [rbx + 8]
and eax, 0x200000
je 0x1400bc89b
sub r8, rdi
mov eax, 1
dec r8
jmp 0x1400bc956
cmp rsi, rdx
jbe 0x1400bc84c
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
lea rcx, [rdi + rsi]
mov qword [rsp + 0x38], rbp
mov ebp, 0x100
mov r9, r8
sub r9, rcx
mov rax, r8
xor r9, rcx
xor rax, rcx
or r9, rax
xor r9, r8
shr r9, 0x3f
dec r9
cmp r8, rbp
cmovb rbp, r8
xor r10d, r10d
test rbp, rbp
je 0x1400bc92d
mov r11, qword [rbx + 0x20]
mov rsi, rdi
shr rsi, 0x3f
dec r11
add r11, r8
nop word [rax + rax]
mov rax, r10
lea r11, [r11 - 1]
shr rax, 0x3f
mov rcx, rdi
sub rcx, r10
inc r10
shr rcx, 0x3f
xor cl, al
xor al, sil
or cl, al
movzx eax, byte [r11 + 1]
dec cl
movzx edx, cl
mov rcx, rdi
xor rcx, rax
and rdx, rcx
not rdx
and r9, rdx
cmp r10, rbp
jb 0x1400bc8f0
mov rbp, qword [rsp + 0x38]
lea rax, [rdi + 1]
not r9
movzx ecx, r9b
dec rcx
shr rcx, 0x3f
neg rcx
and rax, rcx
sub r8, rax
mov eax, ecx
and eax, 1
not ecx
or eax, ecx
mov rdi, qword [rsp + 0x40]
mov qword [rbx + 8], r8
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret