joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140136ae0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rdi, r8
mov qword [rsp + 0x38], 0
mov r8, rdx
mov dword [rsp + 0x40], 0
mov rbx, r9
mov qword [rsp + 0x48], 0
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x38]
mov r9d, 0x20019
call fcn.1400a5930
test eax, eax
jne 0x140136b8f
mov rdx, rdi
mov dword [rsp + 0x60], 4
mov rdi, qword [rsp + 0x38]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov rcx, rdi
mov qword [rsp + 0x20], rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140136b70
cmp dword [rsp + 0x30], 4
mov ecx, reloc.WS2_32.dll_listen
cmovne eax, ecx
test eax, eax
sete bl
test rdi, rdi
je 0x140136b81
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140136b9f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rdi
ret

Function at 0x140136bb0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
xor eax, eax
mov dword [rsp + 0x28], 0xf003f
mov rdi, r8
mov qword [rsp + 0x40], rax
mov r8, rdx
mov dword [rsp + 0x48], eax
mov rdx, 0xffffffff80000001
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x40]
mov ebx, r9d
xor sil, sil
call fcn.1400a5100
test eax, eax
jne 0x140136c5f
mov rdx, rdi
mov dword [rsp + 0x28], 4
mov rdi, qword [rsp + 0x40]
lea rax, [rsp + 0x70]
mov rcx, rdi
mov dword [rsp + 0x70], ebx
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx ebx, sil
mov ecx, 1
test eax, eax
cmove ebx, ecx
test rdi, rdi
je 0x140136c49
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140136c6f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x78]
movzx eax, sil
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140136c90
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0x1070
call fcn.1401afbb0
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x1090], rbx
mov rax, qword [0x14047b0a0]
xor rax, rsp
mov qword [rsp + 0x1060], rax
mov rsi, r9
mov rbx, r8
xor dil, dil
xor ebp, ebp
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x48], rbp
mov r9d, 0x20019
mov r8, rdx
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x38]
call fcn.1400a5930
test eax, eax
jne 0x140136dae
xor edx, edx
mov r8d, 0x1000
lea rcx, [rsp + 0x60]
call fcn.1402dd440
mov dword [rsp + 0x30], 0xffe
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rbx
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140136d9b
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 1
ja 0x140136d9b
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140136d6d
test al, 1
jne 0x140136d9b
shr rax, 1
cmp word [rsp + rax*2 + 0x5e], bp
je 0x140136d72
jmp 0x140136d9b
mov word [rsp + 0x60], bp
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140136d80
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.14007ece0
mov dil, 1
test rbx, rbx
je 0x140136db3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rbp
jmp 0x140136db3
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x140136dc1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, dil
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.1401aed20
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1070
pop rdi
pop rsi
pop rbp
ret

Function at 0x140136df0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rsi
sub rsp, 0x60
xor eax, eax
mov dword [rsp + 0x28], 0xf003f
mov rsi, r8
mov qword [rsp + 0x40], rax
mov r8, rdx
mov dword [rsp + 0x48], eax
mov rdx, 0xffffffff80000001
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x40]
mov rbx, r9
call fcn.1400a5100
test eax, eax
jne 0x140136ea9
cmp qword [rbx + 0x18], 8
jb 0x140136e3a
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140136e44
lea eax, [rbx + 0xd]
jmp 0x140136e83
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140136e50
mov rcx, qword [rsp + 0x40]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
cmp qword [rsp + 0x40], 0
je 0x140136e9b
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rsi
ret
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140136eb9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x70]
xor al, al
add rsp, 0x60
pop rsi
ret
Function at 0x140137040
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, 1
mov edx, ebx
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, rdi
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
mov edx, ebx
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1401376f0
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rsi, rcx
xor edi, edi
test rdx, rdx
je 0x14013770c
mov dword [rdx], edi
mov r15, rdi
mov r14, rdi
mov qword [rsp + 0x98], rdi
mov r12, rdi
mov qword [rsp + 0xa0], rdi
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ebx, eax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], Ordinal_133
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
mov qword [rsp + 0xa8], rax
cmp rax, 0xffffffffffffffff
je 0x1401377c4
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor edx, edx
mov r8d, 0x1000002
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
mov qword [rsp + 0x98], rax
test rax, rax
je 0x1401377c4
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
mov qword [rsp + 0xa0], rax
test rax, rax
cmovne r15, rax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
test r15, r15
je 0x140137884
mov esi, edi
mov dword [rsp + 0x44], edi
mov edx, 1
lea r8d, [rdx + 0xf]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x140137851
mov rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x40], eax
test eax, eax
je 0x140137851
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140137851
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x140137851
movzx ebx, word [rax]
cmp ebx, dword [rsp + 0x40]
ja 0x140137848
mov dword [rsp + 0x40], ebx
add ebx, 3
and ebx, 0xfffffffc
mov dword [rsp + 0x40], ebx
cmp dword [rax + 0x28], 0xfeef04bd
je 0x140137857
mov esi, reloc.WS2_32.dll_listen
mov dword [rsp + 0x44], esi
mov ebx, edi
mov dword [rsp + 0x40], ebx
jmp 0x140137889
mov esi, reloc.WS2_32.dll_listen
test r12, r12
je 0x140137897
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test r14, r14
je 0x1401378a5
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r13, 0xffffffffffffffff
je 0x1401378b4
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x1401378c7
lea edi, [rbx*2 + 4]
mov eax, edi
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401378e0
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 0x10], edx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r13, r9
mov r12d, r8d
mov r15, rcx
xor edi, edi
xor bl, bl
mov esi, edi
mov qword [rsp + 0x48], rdi
mov r14d, edi
mov qword [rsp + 0x50], rdi
cmp r8d, 2
jae 0x14013792d
lea ecx, [rdi + 0x7a]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x140137aae
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [rsp + 0x98], eax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], Ordinal_133
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
je 0x1401379c8
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor edx, edx
mov r8d, 0x1000002
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1401379c8
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
mov qword [rsp + 0x50], rax
test rax, rax
cmovne rdi, rax
mov ecx, dword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
test rdi, rdi
je 0x140137a80
mov edx, 1
lea r8d, [rdx + 0xf]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140137a7e
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rax
test rax, rax
je 0x140137a7e
movzx edi, word [rax]
mov dword [rsp + 0x98], edi
mov rdx, r12
lea ecx, [rdi + rdi]
add rcx, 4
cmp rcx, r12
jbe 0x140137a38
shr rdx, 1
lea edi, [rdx - 4]
mov dword [rsp + 0x98], edi
mov r12b, 1
jmp 0x140137a3b
xor r12b, r12b
mov eax, edi
mov ebx, eax
mov r8d, eax
mov rdx, r9
mov rcx, r13
call fcn.1402dcfd0
mov dword [rbx + r13], 0x58324546
test r12b, r12b
je 0x140137a5f
mov word [r13], di
mov bl, 1
mov byte [rsp + 0x40], bl
jmp 0x140137a80
xor bl, bl
test r14, r14
je 0x140137a8e
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test rsi, rsi
je 0x140137a9c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r15, 0xffffffffffffffff
je 0x140137aab
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140139430
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rax, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x140139474
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140139460
ret
Function at 0x14014ed20
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, qword [rdi + 0x10]
cmp rax, rcx
je 0x14014ed5b
cmp rbx, qword [rdi + 0x120]
je 0x14014ed5b
test rbx, rbx
je 0x14014ed5b
call qword [sym.imp.USER32.dll_SetFocus]
mov rsi, qword [rdi + 0x120]
cmp rbx, rsi
je 0x14014eea9
mov qword [rsp + 0xa8], rbp
xor ebp, ebp
movaps xmmword [rsp + 0x80], xmm6
xorps xmm6, xmm6
test rsi, rsi
je 0x14014ee16
mov eax, ebp
mov qword [rsp + 0xa0], rbp
mov ecx, eax
mov dword [rsp + 0x50], ebp
shr rcx, 0x20
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x40], 3
mov word [rsp + 0x5c], bp
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x70], ebp
cmp ecx, 1
jne 0x14014edd4
mov rax, qword [rsi + 0x30]
mov rcx, qword [rax + 0x148]
mov qword [rsp + 0x54], rcx
jmp 0x14014edd9
mov qword [rsp + 0x54], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x50], eax
lea rdx, [rsp + 0x40]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x1a0]
mov rdx, qword [rdi + 0x120]
xor r9d, r9d
mov rcx, rdi
mov qword [rdi + 0x120], rbp
mov qword [rsp + 0x20], rbp
lea r8d, [r9 + 0x25]
call fcn.14014f2e0
test rbx, rbx
je 0x14014ee99
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
cmp rax, rdi
jne 0x14014ee99
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + Ordinal_41]
test al, al
je 0x14014ee99
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + VarUI4FromDisp]
test al, al
je 0x14014ee99
xor r9d, r9d
movss dword [rsp + 0x30], xmm6
mov rax, rbp
mov qword [rdi + 0x120], rbx
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0xa0], rbp
lea edx, [r9 + 2]
mov word [rsp + 0x20], bp
call fcn.140152dd0
mov rdx, qword [rdi + 0x120]
test rdx, rdx
je 0x14014ee99
xor r9d, r9d
mov qword [rsp + 0x20], rbp
mov rcx, rdi
lea r8d, [r9 + 0x24]
call fcn.14014f2e0
mov rbp, qword [rsp + 0xa8]
movaps xmm6, xmmword [rsp + 0x80]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140152760
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [rcx + 0xbf], 0
jne 0x14015277d
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x14015277d
mov rdx, rcx
mov rcx, rax
jmp fcn.14014ed20
ret
Function at 0x140152dd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x60
movzx eax, word [rsp + 0x90]
xor r10d, r10d
movss xmm0, dword [rsp + 0xa0]
mov rbx, rcx
mov qword [r11 - 0x40], rcx
mov dword [r11 - 0x38], r10d
mov word [rsp + 0x3c], ax
mov rax, qword [r11 + 0x30]
test eax, eax
mov dword [rsp + 0x20], edx
mov rcx, rax
mov qword [r11 - 0x28], r8
sete r10b
mov qword [r11 - 0x20], r9
shr rcx, 0x20
movss dword [rsp + 0x50], xmm0
cmp r10d, ecx
jne 0x140152e35
mov rax, qword [rbx + 0x30]
mov rcx, qword [rax + 0x148]
mov qword [r11 - 0x34], rcx
jmp 0x140152e3a
mov qword [rsp + 0x34], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x30], eax
lea rdx, [rsp + 0x20]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x1a0]
add rsp, 0x60
pop rbx
ret
Function at 0x140162d40
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140162e01
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x140162df1
mov rax, qword [rbx + 0x10]
mov ecx, 2
lea rsi, [rax + rax]
lea rdx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x140162df1
mov rcx, rax
mov qword [rsp + 0x30], rbp
call qword [sym.imp.KERNEL32.dll_GlobalLock]
cmp qword [rbx + 0x18], 8
mov rbp, rax
jb 0x140162dab
mov rbx, qword [rbx]
mov r8, rsi
mov rdx, rbx
mov rcx, rbp
call fcn.1402dcfd0
xor eax, eax
mov rcx, rdi
mov word [rsi + rbp], ax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_CloseClipboard]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
ret
Function at 0x14016efd0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x38]
lea rcx, [rbx + 0xc0]
sub rax, qword [rcx]
xorps xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rbx + 0xc8]
cvtsi2sd xmm1, rax
mulsd xmm1, qword [0x1404155b8]
divsd xmm1, xmm0
addsd xmm1, qword [rbx + 0x30]
movsd qword [rbx + 0x30], xmm1
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
mov rcx, qword [rbx + 0x78]
mov edi, eax
test rcx, rcx
je 0x14016f0a7
mov eax, dword [rbx + 0x1c]
mov qword [rsp + 0x40], rsi
mov esi, dword [rbx + 0x20]
cmp esi, eax
jle 0x14016f050
cmp edi, esi
jge 0x14016f056
cmp esi, eax
jge 0x14016f080
cmp edi, esi
jg 0x14016f080
mov dword [rsp + 0x30], esi
lea rdx, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, rbx
call fcn.14016f0c0
mov dword [rbx + 0x24], esi
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
cmp edi, dword [rbx + 0x24]
je 0x14016f094
mov dword [rsp + 0x30], edi
lea rdx, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rsi, qword [rsp + 0x40]
mov dword [rbx + 0x24], edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov dword [rbx + 0x24], edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140171470
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r10d, r8d
mov r9, rdx
test rdx, rdx
jne 0x140171486
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rbx
lea rbx, [0x1404010c0]
not ecx
cmp r10d, 8
jb 0x140171578
mov r11, r10
shr r11, 3
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r10d, 0xfffffff8
mov edx, dword [rbx + rax*4]
xor edx, ecx
movzx ecx, byte [r9 + 1]
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 2]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 3]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 4]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 5]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 6]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 7]
add r9, 8
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, edx
sub r11, 1
jne 0x1401714b0
test r10d, r10d
je 0x1401715a0
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov ecx, dword [rbx + r8*4]
xor ecx, eax
add r10d, 0xffffffff
jne 0x140171580
mov rbx, qword [rsp]
not ecx
mov eax, ecx
add rsp, 8
ret

Function at 0x140171ec0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov r10, r8
mov rdi, r9
imul r10d, edx
mov rsi, rdx
cmp byte [r9], 0
mov r11, rcx
je 0x140171f1a
mov rdx, rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x48]
mov r8d, r10d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140171f06
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
xor edx, edx
div rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov edx, dword [r9 + 0x2c]
mov ecx, dword [r9 + 0x28]
sub ecx, edx
mov qword [rsp + 0x40], rbx
lea eax, [rdx + r10]
cmp eax, dword [r9 + 0x28]
cmovbe ecx, r10d
add rdx, qword [r9 + 0x20]
mov ebx, ecx
mov r8d, ecx
mov rcx, r11
call fcn.1402dcfd0
add dword [rdi + 0x2c], ebx
mov eax, ebx
mov rbx, qword [rsp + 0x40]
xor edx, edx
div rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140171f60
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
sub rsp, 0x38
cmp byte [rcx], 0
mov r14, rdx
mov qword [rsp + 0x58], rbp
mov rbx, rcx
mov qword [rsp + 0x30], rdi
mov edi, 1
je 0x140171fb0
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x60]
mov r8d, edi
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140171faa
mov byte [rbx + 0x10], dil
mov ebp, dword [rsp + 0x60]
jmp 0x140171fe7
mov qword [rsp + 0x68], rsi
mov esi, dword [rcx + 0x2c]
mov ecx, dword [rcx + 0x28]
lea eax, [rsi + 1]
cmp eax, ecx
jbe 0x140171fc6
mov edi, ecx
sub edi, esi
mov rdx, rsi
mov r8d, edi
add rdx, qword [rbx + 0x20]
lea rcx, [rsp + 0x50]
mov ebp, edi
call fcn.1402dcfd0
lea eax, [rsi + rdi]
mov rsi, qword [rsp + 0x68]
mov dword [rbx + 0x2c], eax
mov rdi, qword [rsp + 0x30]
cmp ebp, 1
mov rbp, qword [rsp + 0x58]
jne 0x140172008
movzx eax, byte [rsp + 0x50]
mov dword [r14], eax
xor eax, eax
add rsp, 0x38
pop r14
pop rbx
ret
cmp byte [rbx], 0
je 0x140171ffe
cmp byte [rbx + 0x10], 0
je 0x140171ffe
mov eax, 0xffffffff
add rsp, 0x38
pop r14
pop rbx
ret
Function at 0x140172f00
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x140173111
cmp dword [rcx + 0x1c], 0
je 0x140173111
cmp qword [rcx + 0x80], 0
je 0x140172f2f
call fcn.1401734b0
lea r9, [rsp + 0x50]
mov rcx, rdi
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
call fcn.140172c40
test eax, eax
je 0x140172f56
mov eax, 0xffffff99
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, reloc.SHLWAPI.dll_IUnknown_QueryService
mov qword [rsp + 0x48], rbx
call fcn.1402e51dc
mov rbx, rax
test rax, rax
jne 0x140172f7c
lea eax, [rbx - 0x68]
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0x4000
mov qword [rsp + 0x20], rbp
call fcn.1402e51dc
mov ecx, dword [rsp + 0x40]
xor ebp, ebp
mov dword [rbx + 0x68], ecx
mov ecx, dword [rsp + 0x50]
mov dword [rbx + 0x6c], ecx
mov qword [rbx], rax
mov dword [rbx + 0x70], ebp
test rax, rax
jne 0x140172fc2
mov rcx, rbx
call fcn.1402e51e4
mov rbx, qword [rsp + 0x48]
lea eax, [rbp - 0x68]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov dword [rbx + 0x64], ebp
mov eax, dword [rdi + 0x40]
mov ecx, dword [rdi + 0x38]
mov dword [rbx + 0x78], eax
mov dword [rbx + 0x74], ebp
mov eax, dword [rdi + 0x38]
mov dword [rbx + 0x90], eax
mov rax, qword [rdi]
mov qword [rbx + 0x88], rax
mov eax, dword [rdi + 0x10]
mov dword [rbx + 0x94], eax
mov dword [rbx + 0x24], ebp
test ecx, ecx
je 0x140173014
lea rcx, [rbx + 8]
mov qword [rbx + 0x38], rbp
mov qword [rbx + 0x40], rbp
mov qword [rbx + 0x48], rbp
call fcn.140171830
test eax, eax
jne 0x140173014
mov dword [rbx + 0x64], 1
mov eax, dword [rdi + 0x44]
mov dword [rbx + 0x7c], eax
mov eax, dword [rdi + 0x48]
mov dword [rbx + 0x80], eax
movzx eax, byte [rdi + 0x34]
and al, 1
mov byte [rbx + 0x98], al
mov eax, dword [rdi + 0x34]
shr eax, 3
test al, 1
je 0x14017303f
movzx eax, byte [rdi + 0x3d]
jmp 0x140173043
movzx eax, byte [rdi + 0x43]
mov byte [rbx + 0xac], al
movzx eax, byte [rbx + 0x98]
neg al
sbb ecx, ecx
and ecx, 0xc
mov dword [rbx + 0xa8], ecx
mov dword [rbx + 0x9c], 0x12345678
mov dword [rbx + 0xa0], 0x23456789
mov dword [rbx + 0xa4], 0x34567890
test rsi, rsi
je 0x1401730e5
lea r8, [0x1404010c0]
movzx eax, byte [rsi]
test al, al
je 0x1401730e5
mov edx, dword [rbx + 0x9c]
xor rax, rdx
movzx ecx, al
shr edx, 8
mov eax, dword [r8 + rcx*4]
mov ecx, dword [rbx + 0xa4]
xor eax, edx
mov dword [rbx + 0x9c], eax
movzx eax, al
add eax, dword [rbx + 0xa0]
imul edx, eax, 0x8088405
movzx eax, cl
shr ecx, 8
inc edx
mov dword [rbx + 0xa0], edx
shr rdx, 0x18
xor rax, rdx
mov eax, dword [r8 + rax*4]
xor eax, ecx
mov dword [rbx + 0xa4], eax
add rsi, 1
jne 0x140173087
mov ecx, dword [rdi + 0x7c]
mov eax, dword [rsp + 0x58]
mov dword [rbx + 0x10], ebp
add eax, 0x1e
mov rbp, qword [rsp + 0x20]
add ecx, eax
mov dword [rbx + 0x60], ecx
xor eax, eax
mov qword [rdi + 0x80], rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
mov eax, 0xffffff9a
add rsp, 0x28
pop rdi
pop rsi
ret