joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18378
Capabilities:
Allocate or change rwx memory
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r13
push r14
sub rsp, 0x90
and qword [rax - 0x60], 0
mov rdi, rcx
mov rcx, qword [rcx + 8]
lea rdx, [rax - 0x70]
xor esi, esi
xor bpl, bpl
xor bl, bl
mov qword [rax - 0x58], rsi
call qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
mov r13d, 0xc0000000
and eax, r13d
cmp eax, r13d
je 0x18593
mov rdi, qword [rdi]
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rax, rdi
jne 0x183d8
mov bl, 1
jmp 0x18402
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
and eax, r13d
cmp eax, r13d
je 0x18588
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rdi, qword [0x00022824]
and qword [rsp + 0x30], rsi
and dword [rsp + 0xb0], esi
mov r9d, 8
lea rax, [rsp + 0xb0]
or r14, 0xffffffffffffffff
lea edx, [r9 + 0x12]
lea r8, [rsp + 0x30]
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
test eax, eax
js 0x1845b
lea rcx, [rsp + 0x50]
test rcx, rcx
je 0x1845b
cmp qword [rsp + 0x30], rsi
setne byte [rsp + 0x50]
mov rsi, qword [rsp + 0x50]
and eax, r13d
cmp eax, r13d
je 0x1856e
test rsi, rsi
jne 0x1856e
mov esi, 0x1000
lea rax, [rdi + 0xfff]
mov r13d, 0x40
and rax, 0xfffffffffffff000
lea r9, [rsp + 0x58]
lea rdx, [rsp + 0x48]
add rax, rsi
xor r8d, r8d
mov rcx, r14
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x58], rax
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x18544
and qword [rsp + 0xb0], 0
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0xb0]
xor r8d, r8d
mov rcx, r14
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x30], 0x1f1000
mov dword [rsp + 0x20], esi
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x18544
mov rcx, qword [rsp + 0x48]
lea rdx, [0x00022100]
mov r8, rdi
call fcn.0001f770
mov rcx, qword [rsp + 0xb0]
mov edi, 0x1f0800
lea rdx, [0x00022ef0]
mov r8, rdi
call fcn.0001f770
mov r9, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
mov r8d, 0x12349876
mov qword [rsp + 0x20], rdi
call fcn.0001822c
mov bpl, al
test bl, bl
jne 0x1855e
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bpl
jmp 0x18595
test bl, bl
jne 0x18588
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor al, al
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rdi
ret
Function at 0x185b8
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rbp, rcx
xor edx, edx
xor ecx, ecx
xor ebx, ebx
call fcn.00019c50
lea r9, [rsp + 0x68]
lea ecx, [rbx + 5]
xor r8d, r8d
xor edx, edx
mov r13, rax
mov dword [rsp + 0x68], ebx
mov r12, rbx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov edi, eax
cmp eax, 0xc0000004
jne 0x1867a
mov ecx, dword [rsp + 0x68]
call fcn.00017d34
mov rsi, rax
cmp rax, rbx
je 0x1869b
mov r8d, dword [rsp + 0x68]
lea r9, [rsp + 0x68]
lea ecx, [rbx + 5]
mov rdx, rax
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, ebx
mov edi, eax
jl 0x1865e
mov rcx, rsi
cmp qword [rcx + 0x50], rbp
jne 0x18643
cmp dword [rcx + 4], ebx
ja 0x1864e
cmp dword [rcx], ebx
je 0x18659
mov eax, dword [rcx]
add rcx, rax
jmp 0x18638
mov r12, qword [rcx + 0x130]
mov edi, ebx
jmp 0x1865e
mov edi, 0xc0000225
mov edx, 0x4d784b5f
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp edi, ebx
jl 0x1869b
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], r12
cmp edi, ebx
jl 0x1869b
mov rdx, qword [r13 + 0x10]
lea r8, [0x00022ef0]
lea rcx, [rsp + 0x20]
mov r9d, 0x1f0800
call fcn.00018378
mov bl, al
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov al, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret

Function at 0x186bc
Capabilities:
Enumerate processes via ntquerysysteminformation
Find process by pid
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rbp, r8
lea r9, [rax + 0x20]
lea edi, [rbx + 5]
xor r8d, r8d
xor edx, edx
mov ecx, edi
mov dword [rax + 0x20], ebx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
je 0x186fa
xor al, al
jmp 0x1879f
mov ecx, dword [rsp + 0x58]
call fcn.00017d34
mov rsi, rax
cmp rax, rbx
je 0x186f3
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov rdx, rax
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, ebx
jl 0x1878f
mov rdi, rsi
mov rcx, qword [rdi + 0x50]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, ebx
jl 0x1876f
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessImageFileName]
cmp rax, rbx
je 0x18764
lea rcx, [0x00020d20]
mov r8d, 0xa
mov rdx, rax
call qword [sym.imp.ntoskrnl.exe__strnicmp]
cmp eax, ebx
je 0x1877a
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dword [rdi], ebx
je 0x1878f
mov eax, dword [rdi]
add rdi, rax
jmp 0x18727
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov r11, qword [rdi + 0x50]
mov bl, 1
mov qword [rbp], r11
mov edx, 0x4d784b5f
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, bl
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1a3fc
Capabilities:
Complete processing asynchronous io request

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor ecx, ecx
xor edx, edx
call fcn.00019c50
test rax, rax
je 0x1a450
cmp qword [rax + 0x28], 0
je 0x1a450
mov rcx, qword [rbx + 0xb8]
lea rax, [rcx - 0x48]
test rax, rax
je 0x1a450
inc byte [rbx + 0x43]
lea rax, [rcx + 0x48]
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0xb8], rax
call fcn.00019c50
mov rdx, rbx
mov rcx, qword [rax + 0x28]
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
jmp 0x1a467
xor edx, edx
mov rcx, rbx
mov dword [rbx + 0x30], 0xc00000bb
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, 0xc00000bb
add rsp, 0x20
pop rbx
ret

Function at 0x1a708
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rax, qword [rdx + 0xb8]
mov rbp, qword [rdx + 0x18]
mov rdi, rdx
mov r12d, dword [rax + 0x20]
mov r13, rcx
xor edx, edx
xor ecx, ecx
call fcn.00019c50
mov rdx, qword [rdi + 0xb8]
mov r8d, 0x38
lea rbx, [rdx - 0x48]
mov rsi, rax
mov rcx, rbx
call fcn.0001f770
mov byte [rbx + 3], 0
test rsi, rsi
je 0x1a771
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp eax, dword [rsi + 0xf40]
je 0x1a7c4
test rbp, rbp
je 0x1a7c4
cmp r12d, 0x1c
jbe 0x1a7c4
cmp byte [rbp + 5], 0x11
jne 0x1a7c4
lea rcx, [rbp + 8]
lea rdx, [0x00020ed0]
mov r8d, 0x11
call qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp rax, 0x11
jne 0x1a7c4
mov byte [rsp + 0x30], 0
lea r8, [0x0001a6ac]
xor r9d, r9d
mov rdx, rdi
mov rcx, r13
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x20], 1
call qword [sym.imp.ntoskrnl.exe_IoSetCompletionRoutineEx]
test rsi, rsi
je 0x1a7dd
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x1a7dd
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
jmp 0x1a7f2
mov ebx, 0xc00000bb
xor edx, edx
mov rcx, rdi
mov dword [rdi + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x1b264
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbp, rcx
xor edx, edx
xor ecx, ecx
call fcn.00019c50
mov rdi, qword [rsi + 0xb8]
mov rbx, rax
test rdi, rdi
jne 0x1b2b0
mov edi, 0xc00000bb
xor edx, edx
mov rcx, rsi
mov dword [rsi + 0x30], edi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
jmp 0x1b470
movzx ecx, byte [rdi]
test ecx, ecx
je 0x1b465
sub ecx, 0xe
je 0x1b2de
sub ecx, 1
je 0x1b303
cmp ecx, 3
jne 0x1b458
mov rdx, rsi
mov rcx, rbp
call fcn.0001a814
jmp 0x1b458
mov rax, cr8
test al, al
jne 0x1b2f6
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call sub.TDI.SYS_TdiMapUserRequest
jmp 0x1b2fb
mov eax, 0xc0000002
test eax, eax
js 0x1b458
movzx ecx, byte [rdi + 1]
sub ecx, 1
je 0x1b3f8
sub ecx, 2
je 0x1b3eb
sub ecx, 4
je 0x1b34c
cmp ecx, 4
jne 0x1b458
mov rbx, qword [rsi + 0xb8]
xor edx, edx
xor ecx, ecx
call fcn.00019c50
mov rdx, qword [rbx + 0x30]
lea r8, [rbx + 8]
mov rcx, rax
call fcn.0001b0b0
jmp 0x1b458
cmp byte [rbx + 0xf6e], 0
je 0x1b458
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsGetProcessImageFileName]
mov r11, rax
test rax, rax
je 0x1b3db
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r11
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
mov rcx, r11
call fcn.0001b4d4
mov rdi, rax
test rax, rax
je 0x1b3db
movzx eax, byte [rax]
xor r8d, r8d
lea rcx, [rdi + 1]
jmp 0x1b3ae
imul r8d, r8d, 0x83
add r8d, eax
movzx eax, byte [rcx]
inc rcx
test eax, eax
jne 0x1b39e
lea rdx, [rbx + 0x40]
mov rcx, rbx
call fcn.0001b48c
mov edx, 0x4d784b5f
mov rcx, rdi
test al, al
je 0x1b3d5
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x1b458
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rdx, rsi
mov rcx, rbp
call fcn.0001ab14
jmp 0x1b470
mov rdx, rsi
mov rcx, rbp
call fcn.0001b57c
jmp 0x1b458
mov rdi, qword [rsi + 0xb8]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x48]
mov rcx, qword [rdi + 8]
and qword [rsp + 0x48], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
jne 0x1b448
xor edx, edx
xor ecx, ecx
call fcn.00019c50
mov r8, qword [rsp + 0x48]
mov rdx, qword [rdi + 0x30]
mov rcx, rax
call fcn.0001a5ac
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1b458
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdx, rsi
mov rcx, rbp
call fcn.0001a3fc
jmp 0x1b470
mov rdx, rsi
mov rcx, rbp
call fcn.0001a708
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1dd34
Capabilities:
Check os version
Create device object

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x1a0
mov rax, qword [0x00022ec0]
xor rax, rsp
mov qword [rsp + 0x190], rax
and qword [rsp + 0x40], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
mov rdi, rcx
mov ebx, 0x114
lea rcx, [rsp + 0x70]
mov r8, rbx
xor edx, edx
call fcn.0001fc70
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], ebx
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
cmp dword [rsp + 0x74], 6
jbe 0x1decb
cmp qword [0x006182a8], 0
jne 0x1decb
lea rdx, [0x00020f10]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x58]
mov edx, 0x80
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
mov ebx, eax
test eax, eax
jns 0x1ddf2
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1ddeb
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
jmp 0x1decd
mov rdx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
xor r8d, r8d
mov r9d, dword [rdx + 0x48]
mov qword [rsp + 0x30], rax
mov eax, dword [rdx + 0x34]
lea edx, [r8 + 0x20]
mov rcx, rdi
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov edi, eax
test eax, eax
jns 0x1de3e
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1de37
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
jmp 0x1decd
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStack]
mov rsi, rax
test rax, rax
jne 0x1de68
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
and qword [rsp + 0x40], rsi
jmp 0x1de27
mov rax, qword [rsp + 0x40]
xor edx, edx
mov rbx, qword [rax + 0x40]
lea r8d, [rdx + 0x20]
mov rcx, rbx
call fcn.0001fc70
mov r11, qword [rsp + 0x40]
mov qword [rbx + 0x18], r11
mov rax, qword [rsp + 0x48]
mov qword [rbx], rax
mov rax, qword [rsp + 0x50]
mov qword [rbx + 0x10], rsi
mov qword [rbx + 8], rax
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rax + 0x30]
and ecx, 0x14
or dword [rdx + 0x30], ecx
mov rax, qword [rsp + 0x40]
btr dword [rax + 0x30], 7
mov rax, qword [rsp + 0x40]
mov qword [0x006182a8], rax
jmp 0x1de37
xor eax, eax
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.0001f710
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x8f3ffd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
btr bx, 0x12
movsx rbx, di
bts bx, di
mov qword [rsp + 0x10], rsi
xor bl, r15b
sbb sil, r15b
and si, 0x1e3a
push rdi
test esi, 0x343462dc
sub rsp, 0x20
mov rsi, r8
shr edi, cl
bt bx, 0x7e
mov rdi, rdx
sbb edx, 0xb873f82
not dx
mov rbx, rcx
nop
cmp dword [rbx + 0x44], 0
movzx edx, r9w
movsx rdx, si
mov rdx, rdi
jmp 0x8f4058
jne 0x8f4094
mov r8d, dword [rbx + 0xc]
cmc
mov rcx, qword [rbx + 0x30]
lahf
sbb ah, 9
movsx rax, ax
mov rax, rdi
sub r8d, dword [rbx + 0x40]
cmp r15d, ebp
sub rax, rcx
cmp rax, r8
jmp 0x8f4084
jbe 0x8f4094
lea rdx, [r8 + rcx]
movzx ecx, bx
not rcx
mov r8, rsi
movzx ecx, r11w
movsx rcx, r9w
mov rcx, rbx
jmp 0x8f40a7
call fcn.008f20e3
test eax, eax
jne 0x8f413a
mov eax, dword [rbx + 0xc]
cmp dh, 0x7e
cmp dword [rbx + 0x40], eax
jmp 0x8f40c2
jb 0x8f40d8
mov dword [rbx + 0x44], eax
movzx edx, di
movzx dx, bpl
jmp 0x8f40d8
mov rdx, rdi
xchg ch, cl
mov rcx, rbx
jmp 0x8f40e5
call fcn.008f3e62
cmp qword [rbx + 0x30], rdi
jmp 0x8f40f3
jae 0x8f4115
cmp qword [rbx + 0x20], rsi
jmp 0x8f4102
jae 0x8f4115
cmp dword [rbx + 0x5c], 0x112
jb 0x8f4044
cmp dword [rbx + 0x5c], 0x112
jmp 0x8f4121
jbe 0x8f4131
mov dword [rbx + 0x5c], 0x112
sal sil, cl
sub eax, eax
movsxd rsi, eax
xadd sil, dil
mov rbx, qword [rsp + 0x30]
rcr di, 0xe5
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
movsx di, r14b
setne dil
not rdi
pop rdi
jmp 0x8f415e
ret

Function at 0x8f59e8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
test dil, cl
mov qword [rsp + 0x10], rdi
add r10d, 0xbd43961
sub edi, edi
movzx ebx, r8b
xchg r11d, r8d
movsx r10, bx
movzx r9, bp
mov r11, rcx
inc r9w
xchg r9w, r10w
movzx r10, dx
mov r8, rdi
nop
movzx r10d, dx
movzx r9d, byte [r11]
movzx r10d, byte [rdx]
jmp 0x8f5a31
inc r11
jmp 0x8f5a39
inc rdx
clc
cmp dil, r9b
test bl, bl
jmp 0x8f5a47
je 0x8f5a68
mov ecx, r8d
mov eax, 0x25266eec
cmc
rol eax, cl
stc
add al, r8b
xor r9b, al
jmp 0x8f5a64
inc r8
cmc
test r9b, r9b
jmp 0x8f5a70
je 0x8f5a7f
cmp r9b, r10b
je 0x8f5a24
cmp r9b, r10b
jmp 0x8f5a87
jae 0x8f5aab
or eax, 0xffffffff
movsx rdi, r15w
not dil
cmovs bx, sp
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
jmp 0x8f5aaa
ret
mov rbx, qword [rsp + 8]
cwde
seta dil
nop
bswap ax
mov eax, edi
jmp 0x8f5ac4
mov rdi, qword [rsp + 0x10]
jmp 0x8f5ace
ret
Function at 0x14000af10
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov qword [rcx], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], bpl
mov dword [rsp + 0x20], 1
lea rsi, [rdx + 0x10]
mov rdx, qword [rsi]
call fcn.140014060
lea r15d, [rbp - 6]
mov r14, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14000af6f
mov r14, qword [rdi]
mov rdi, r14
mov r13, qword [rsi]
add r13, rdi
cmp r14, r13
je 0x14000b071
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop word [rax + rax]
shl ebp, 8
movzx eax, byte [r14]
add ebp, eax
add r15d, 8
js 0x14000b016
movsxd r12, ebp
movsxd rdi, r15d
lea ecx, [r15 + 6]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 2
mov esi, edx
imul eax, edx, 0xfffffffa
add r15d, eax
nop dword [rax + rax]
mov rax, r12
mov rcx, rdi
sar rax, cl
and eax, 0x3f
movzx r9d, byte [rax + r8]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x14000affd
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x14000aff2
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000b00c
mov rcx, rbx
call fcn.140016c80
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
sub rdi, 6
sub rsi, 1
jne 0x14000afc0
inc r14
cmp r14, r13
jne 0x14000af90
cmp r15d, 0xfffffffa
jle 0x14000b071
lea ecx, [r15 + 8]
shl ebp, 8
movsxd rdx, ebp
sar rdx, cl
and edx, 0x3f
movzx r9d, byte [rdx + r8]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x14000b069
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x14000b05e
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000b071
mov rcx, rbx
call fcn.140016c80
mov rcx, qword [rbx + 0x10]
test cl, 3
je 0x14000b0b9
nop word [rax + rax]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x14000b0a5
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x14000b09d
mov rax, qword [rbx]
mov word [rax + rcx], 0x3d
jmp 0x14000b0b0
mov r9b, 0x3d
mov rcx, rbx
call fcn.140016c80
mov rcx, qword [rbx + 0x10]
test cl, 3
jne 0x14000b080
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000b240
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x14006e060]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x34], r8d
nop dword [rax + rax]
lea rax, [rsp + 0x30]
xor r9d, r9d
lea ecx, [rdi + 1]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x14000b2ae
call fcn.140034bb0
cmp dword [rax], 4
je 0x14000b280
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140027820
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
Function at 0x14000ca00
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x14006e060]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdx, qword [rcx + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rcx + 8]
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x40], 1
lea rax, [rsp + 0x30]
xor r9d, r9d
lea ecx, [rdi + 1]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x14000ca6f
call fcn.140034bb0
cmp dword [rax], 4
je 0x14000ca40
test rbx, rbx
setg al
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140027820
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret

Function at 0x14000cac0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call qword [rax + ioctlsocket]
test al, al
je 0x14000cb10
cmp rbx, 0x7fffffff
ja 0x14000cb10
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_recv]
cdqe
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rax, 0xffffffffffffffff
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000cb30
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
je 0x14000cb80
cmp rbx, 0x7fffffff
ja 0x14000cb80
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_send]
cdqe
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rax, 0xffffffffffffffff
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000cba0
Capabilities:
Resolve dns

Disassembly:
push rbx
push rsi
sub rsp, 0x4f8
mov rax, qword [0x14006e060]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rcx, qword [rcx + 8]
mov rbx, r8
mov rsi, rdx
mov dword [rsp + 0x40], 0x80
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x14000cc8b
movzx eax, word [rsp + 0x50]
mov qword [rsp + 0x4f0], rdi
mov edi, dword [rsp + 0x40]
cmp ax, 2
je 0x14000cc03
cmp ax, 0x17
jne 0x14000cc13
movzx ecx, word [rsp + 0x52]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rbx], eax
xor edx, edx
lea rcx, [rsp + 0xd0]
mov r8d, 0x401
call fcn.14002a040
xor eax, eax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
lea r8, [rsp + 0xd0]
mov r9d, 0x401
mov qword [rsp + 0x20], rax
mov edx, edi
lea rcx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov rdi, qword [rsp + 0x4f0]
test eax, eax
jne 0x14000cc8b
lea rax, [rsp + 0xd0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14000cc71
lea rdx, [rsp + 0xd0]
mov rcx, rsi
call fcn.140004940
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.140027820
add rsp, 0x4f8
pop rsi
pop rbx
ret
Function at 0x140012fc0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140012fe2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14001305c
mov rdi, r14
mov rcx, rbx
call fcn.140004790
test rax, rax
jle 0x140013034
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.140029990
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14001304c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140013054
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140012ff6
sub r14, rdi
jmp 0x140013149
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140013073
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140013075
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400130aa
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140029990
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140013146
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x1400130e5
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x140013121
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140035398
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x14001315f
cmp rbp, rax
ja 0x1400130f1
mov r8, rdi
test rdi, rdi
je 0x140013146
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140035398
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x140013149