joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140161a30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140396de8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [0x14039dea0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
mov rcx, qword [rax + 0x690]
mov rcx, qword [rcx + 0x20]
mov rdx, qword [rcx + 0x4e0]
mov rcx, qword [rax + 0x18]
call fcn.140161d10
mov qword [rsp + 0x20], rbx
mov rcx, qword [rbx + 8]
test byte [rcx + 7], 2
cmove rax, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
pcmpeqd xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0xffffffffffffffff
lea rcx, [rsp + 0x20]
call fcn.140161be0
test al, al
je 0x140161bbc
lea rbx, str.0x_.8x:
lea r14, [rsp + 0x20]
lea r15, [0x1402d5199]
lea r12, [0x1402f826e]
nop dword [rax]
mov r8d, dword [rsp + 0x38]
mov rcx, rdi
mov rdx, rbx
call fcn.140024010
mov r13, qword [rsp + 0x48]
test r13, r13
js 0x140161b30
add r13, qword [rsp + 0x50]
jg 0x140161b44
jmp 0x140161ba0
mov rcx, r14
call fcn.14017e430
mov r13, qword [rsp + 0x48]
add r13, qword [rsp + 0x50]
jle 0x140161ba0
xor ebp, ebp
jmp 0x140161b60
mov rcx, rdi
call fcn.140024180
inc rbp
cmp r13, rbp
je 0x140161ba0
cmp qword [rsp + 0x48], 0
jns 0x140161b70
mov rcx, r14
call fcn.14017e430
mov rax, rbp
shr rax, 3
add rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
movzx eax, byte [rcx + rax + 0xb]
mov ecx, ebp
and ecx, 7
bt eax, ecx
mov rdx, r15
jae 0x140161b50
mov rdx, r12
jmp 0x140161b50
mov rcx, r14
call fcn.140161be0
test al, al
je 0x140161bbc
mov rcx, rdi
mov rdx, rsi
call fcn.140024180
jmp 0x140161b00
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14025dfe0
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401637e0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, r8
mov r8, rdx
mov rsi, rcx
mov rbx, qword [rsp + 0xd8]
mov ecx, dword [rsp + 0xe0]
mov rdx, qword [0x140396de8]
xor rdx, rsp
mov qword [rsp + 0x60], rdx
mov edx, dword [0x14039dea0]
mov r10, qword gs:[0x58]
mov rdx, qword [r10 + rdx*8]
mov rdx, qword [rdx + 8]
mov r15, qword [rdx + 0x18]
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], r9
lea rcx, [rsp + 0x58]
mov rdx, r15
mov r9, rax
call fcn.1401635b0
mov rdx, qword [rsp + 0x58]
mov rcx, r15
call fcn.1401637d0
mov rdi, rax
lea rax, [rbx + 2]
mov qword [rsp + 0x48], rax
lea r8, [rbx*2 + 4]
lea rcx, [rsp + 0x50]
mov edx, 0x59
mov r9d, 1
call fcn.140172d20
mov rdx, qword [rsp + 0x50]
mov rcx, r15
call fcn.1400f2340
mov r14, rax
mov rcx, r15
call fcn.1400f8be0
test rbx, rbx
jle 0x1401638ec
mov r15, rax
mov rbp, qword [rsp + 0xe8]
xor r13d, r13d
mov r12, rbx
nop word [rax + rax]
mov rax, qword [rbp + 0x10]
mov r8, qword [rax + r13]
add r8, r8
mov qword [r15 + 8], r8
mov rcx, qword [r14 + 8]
lea rdx, [rcx + r13]
add rdx, 0x17
dec rcx
call fcn.1400ef910
add r13, 8
dec r12
jne 0x1401638c0
mov r15, qword [rsp + 0xf0]
mov rax, qword [r15 + 8]
mov rcx, qword [rax + 0x3f]
call fcn.14011e900
mov rcx, qword [r14 + 8]
mov r8, qword [rax + 8]
lea rdx, [rcx + rbx*8]
add rdx, 0x1f
dec rcx
call fcn.1400ef910
mov rcx, qword [r14 + 8]
mov r8, qword [r15 + 8]
lea rdx, [rcx + rbx*8]
add rdx, 0x17
dec rcx
call fcn.1400ef910
mov rcx, r14
mov rdx, qword [rsp + 0x48]
mov r8, rdi
call fcn.140162870
mov rdx, qword [rdi + 8]
lea rcx, [rdx - 1]
mov r8, qword [r14 + 8]
add rdx, 0x17
call fcn.14017b7a0
mov rax, qword [rdi + 8]
mov qword [rsi], rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14025dfe0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14016f3b0
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
movaps xmm6, xmm1
mov rsi, rcx
mov rax, qword [0x140396de8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x14039dea0]
mov rcx, qword gs:[0x58]
mov r14, qword [rcx + rax*8]
mov rdi, qword [r14 + 8]
call fcn.14016f380
mov rbx, rax
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0x38]
mov edx, 0x3d
mov r8d, reloc.WS2_32.dll_recv
mov r9d, 1
call fcn.140149a80
mov rax, qword [rsp + 0x38]
mov qword [rbx + 8], rax
movsd qword [rax + 7], xmm6
mov rdx, qword [rbx + 8]
mov rcx, qword [rdi + 0x18]
call fcn.14016f4c0
mov rbx, rax
mov r8d, 0x430
add r8, qword [rdi + 0x690]
mov rdx, qword [r14 + 8]
lea r14, [rsp + 0x38]
mov rcx, r14
call fcn.140130020
mov rax, qword [rbx]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov r8, rdi
call qword [rax + 0x2d8]
lea rax, [0x1402f60f0]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x50]
call fcn.14009c4b0
mov rcx, r14
call fcn.14010f660
mov rax, qword [rsp + 0x30]
mov qword [rbx + 8], rax
mov qword [rsi], rax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14025dfe0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14016fa50
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
jle 0x14016fa68
mov eax, edx
and eax, 3
cmp rdx, 4
jae 0x14016fa6f
xor r8d, r8d
jmp 0x14016faf9
xor eax, eax
jmp 0x14016fb28
and rdx, 0xfffffffffffffffc
xor r8d, r8d
nop word cs:[rax + rax]
movzx r9d, byte [rcx]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, byte [rcx + 1]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
movzx r9d, byte [rcx + 2]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, byte [rcx + 3]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
add rcx, 4
add rdx, 0xfffffffffffffffc
jne 0x14016fa80
test rax, rax
je 0x14016fb24
xor edx, edx
movzx r9d, byte [rcx + rdx]
add r9d, r8d
mov r10d, r9d
shl r10d, 0xa
add r10d, r9d
mov r8d, r10d
shr r8d, 6
xor r8d, r10d
inc rdx
cmp rax, rdx
jne 0x14016fb00
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
and eax, 0x3fffffff
cmp eax, 1
adc eax, 0
ret

Function at 0x14016fb50
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
jle 0x14016fb68
mov eax, edx
and eax, 3
cmp rdx, 4
jae 0x14016fb6f
xor r8d, r8d
jmp 0x14016fbf9
xor eax, eax
jmp 0x14016fc28
and rdx, 0xfffffffffffffffc
xor r8d, r8d
nop word cs:[rax + rax]
movzx r9d, word [rcx]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, word [rcx + 2]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
movzx r9d, word [rcx + 4]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, word [rcx + 6]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
add rcx, 8
add rdx, 0xfffffffffffffffc
jne 0x14016fb80
test rax, rax
je 0x14016fc24
xor edx, edx
movzx r9d, word [rcx + rdx*2]
add r9d, r8d
mov r10d, r9d
shl r10d, 0xa
add r10d, r9d
mov r8d, r10d
shr r8d, 6
xor r8d, r10d
inc rdx
cmp rax, rdx
jne 0x14016fc00
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
and eax, 0x3fffffff
cmp eax, 1
adc eax, 0
ret
Function at 0x1401709c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
movdqa xmmword [rsp + 0x80], xmm11
movdqa xmmword [rsp + 0x70], xmm10
movdqa xmmword [rsp + 0x60], xmm9
movdqa xmmword [rsp + 0x50], xmm8
movdqa xmmword [rsp + 0x40], xmm7
movdqa xmmword [rsp + 0x30], xmm6
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140396de8]
xor rax, rsp
mov qword [rsp + 0x28], rax
test r8, r8
jle 0x140170c33
xor eax, eax
cmp rdi, 4
jae 0x140170a31
mov r8b, 1
xor ecx, ecx
mov rdx, rdi
jmp 0x140170b90
mov rcx, rdi
and rcx, 0xfffffffffffffffc
movq xmm1, rdi
movdqa xmm2, xmmword [0x1403007a0]
pxor xmm0, xmm0
xor edx, edx
movdqa xmm3, xmmword [0x1402f6a20]
movdqa xmm4, xmmword [0x1403007b0]
movdqa xmm5, xmmword [0x1403007c0]
movdqa xmm6, xmmword [0x1403007d0]
movdqa xmm7, xmmword [0x1403007e0]
movdqa xmm8, xmm2
nop dword [rax + rax]
movdqa xmm10, xmm8
movdqa xmm8, xmm2
movq xmm11, qword [rbx + rdx*4]
movq xmm9, qword [rbx + rdx*4 + 8]
movdqa xmm2, xmm11
pxor xmm2, xmm3
pcmpgtd xmm2, xmm4
packssdw xmm2, xmm2
packsswb xmm2, xmm2
pandn xmm2, xmm8
movdqa xmm8, xmm9
pxor xmm8, xmm3
pcmpgtd xmm8, xmm4
packssdw xmm8, xmm8
packsswb xmm8, xmm8
pandn xmm8, xmm10
paddd xmm11, xmm5
paddd xmm9, xmm5
pxor xmm11, xmm3
movdqa xmm10, xmm6
pcmpgtd xmm10, xmm11
pshufd xmm10, xmm10, 0xd4
pand xmm10, xmm7
paddq xmm1, xmm10
pxor xmm9, xmm3
movdqa xmm10, xmm6
pcmpgtd xmm10, xmm9
pshufd xmm9, xmm10, 0xd4
pand xmm9, xmm7
paddq xmm0, xmm9
add rdx, 4
cmp rcx, rdx
jne 0x140170a80
movdqa xmm3, xmmword [0x1403007a0]
pcmpeqb xmm2, xmm3
pcmpeqd xmm4, xmm4
pxor xmm2, xmm4
punpcklbw xmm2, xmm2
pshuflw xmm2, xmm2, 0x60
pshufd xmm2, xmm2, 0x50
pcmpeqb xmm8, xmm3
pxor xmm8, xmm4
punpcklbw xmm3, xmm8
pshuflw xmm3, xmm3, 0x60
pshufd xmm3, xmm3, 0x50
por xmm3, xmm2
movmskpd edx, xmm3
test edx, edx
sete r8b
paddq xmm0, xmm1
pshufd xmm1, xmm0, 0xee
paddq xmm1, xmm0
movq rdx, xmm1
cmp rcx, rdi
je 0x140170bbd
nop word cs:[rax + rax]
mov r10d, dword [rbx + rcx*4]
cmp r10d, 0x100
movzx r8d, r8b
cmovae r8d, eax
add r10d, 0xffff0000
cmp r10d, 0x100000
adc rdx, 0
inc rcx
cmp rdi, rcx
jne 0x140170b90
test r8b, 1
jne 0x140170c33
lea rcx, [rsp + 0x20]
mov r8d, r9d
call fcn.140170570
mov rcx, qword [rsp + 0x20]
call fcn.1400efd10
mov r14, rax
test rdi, rdi
jle 0x140170c43
xor r15d, r15d
xor r12d, r12d
jmp 0x140170c0a
mov rax, qword [r14 + 8]
mov word [rax + r12*2 + 0xf], cx
mov eax, 1
add r12, rax
inc r15
cmp rdi, r15
je 0x140170c43
mov ecx, dword [rbx + r15*4]
lea eax, [rcx - 0x10000]
cmp eax, 0xfffff
ja 0x140170bf0
mov rax, qword [r14 + 8]
lea rdx, [rax + r12*2]
add rdx, 0xf
call fcn.140024d10
mov eax, 2
jmp 0x140170bff
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
call fcn.140170c90
jmp 0x140170c4a
mov rax, qword [r14 + 8]
mov qword [rsi], rax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14025dfe0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm9, xmmword [rsp + 0x60]
movaps xmm10, xmmword [rsp + 0x70]
movaps xmm11, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1401806a0
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140396de8]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov qword [rcx], rdx
mov rax, qword [rdx + 0x18]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], r8
lea rdi, [rcx + 0x18]
mov rcx, qword [rdx + 0x18]
xorps xmm0, xmm0
movups xmmword [rsi + 0x18], xmm0
mov qword [rsi + 0x28], 0
mov qword [rsi + 0x30], rcx
mov qword [rsi + 0x20], 2
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
sub rdx, rax
cmp rdx, 0x10
jge 0x14018070a
mov edx, reloc.WS2_32.dll_recv
call fcn.1401c6570
jmp 0x140180716
lea rdx, [rax + 0x10]
mov qword [rcx], rdx
add qword [rcx + 0x10], 0x10
mov qword [rsi + 0x28], rax
lea rcx, [rsp + 0x20]
mov edx, 2
xor r8d, r8d
call fcn.14014d390
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rsp + 0x20]
call fcn.1400f9eb0
mov qword [rsi + 0x38], rax
mov rax, qword [rbx + 0x18]
xorps xmm0, xmm0
movups xmmword [rsi + 0x40], xmm0
mov qword [rsi + 0x50], 0
mov qword [rsi + 0x58], rax
mov eax, dword [0x14039dea0]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
mov rax, qword [rbx + 8]
mov rax, qword [rax + 0x18]
movups xmmword [rsi + 0x60], xmm0
mov qword [rsi + 0x70], 0
mov qword [rsi + 0x78], rax
mov rax, qword [rbx + 8]
mov rax, qword [rax + 0x18]
movups xmmword [rsi + 0x80], xmm0
mov qword [rsi + 0x90], 0
mov qword [rsi + 0x98], rax
mov rax, qword [rbx + 8]
mov rax, qword [rax + 0x18]
movups xmmword [rsi + 0xa0], xmm0
mov qword [rsi + 0xb0], 0
mov qword [rsi + 0xb8], rax
mov rax, qword [rbx + 8]
mov rax, qword [rax + 0x18]
movups xmmword [rsi + 0xc0], xmm0
mov qword [rsi + 0xd0], 0
mov qword [rsi + 0xd8], rax
mov rax, qword [rbx + 8]
mov rax, qword [rax + 0x18]
movups xmmword [rsi + 0xe0], xmm0
mov qword [rsi + 0xf0], 0
mov qword [rsi + 0xf8], rax
movups xmmword [rsi + 0x100], xmm0
mov edx, 2
mov rcx, rdi
call fcn.1400f9f60
mov rdi, qword [0x140394c80]
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x18]
call fcn.140128610
mov qword [rax + 8], rdi
mov qword [rax], 0
mov rcx, qword [rsi + 0x28]
mov qword [rcx], rax
mov rdi, qword [0x140394c80]
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x18]
call fcn.140128610
mov qword [rax + 8], rdi
mov qword [rax], 0
mov rcx, qword [rsi + 0x28]
mov qword [rcx + 8], rax
mov rcx, qword [rsi + 0x38]
mov rdx, qword [0x140399af0]
xor r8d, r8d
call fcn.14014d620
mov rcx, qword [rsi + 0x38]
mov rdx, qword [0x140399af0]
xor r8d, r8d
call fcn.14014d620
mov qword [rsi + 0x100], 2
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14025dfe0
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x14018d290
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140396de8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 0x18
call fcn.14025e260
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rsi
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
lea r8, [0x14018d1c0]
xor esi, esi
xor ecx, ecx
mov edx, 0x100000
mov r9, rax
call fcn.14027d0f0
lea rcx, [rax + 1]
cmp rcx, 1
ja 0x14018d301
call fcn.140270958
mov esi, dword [rax]
jmp 0x14018d30a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14025dfe0
mov eax, esi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x14018d330
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rdi, rcx
mov rax, qword [0x140396de8]
xor rax, rsp
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14018d375
mov esi, eax
mov ecx, eax
mov rdx, rdi
call fcn.14018d3b0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14025dfe0
mov eax, esi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rax, str..._.._runtime_vm_os_thread_win.cc
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.TlsAlloc_failed__d
lea rcx, [rsp + 0x20]
mov r8d, eax
call fcn.140023950
int3

Function at 0x14018d540
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140396de8]
xor rax, rsp
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14018d570
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14025dfe0
nop
add rsp, 0x38
ret
lea rax, str..._.._runtime_vm_os_thread_win.cc
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0xe2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.TlsSetValue_failed__d
lea rcx, [rsp + 0x20]
mov r8d, eax
call fcn.140023950
int3
Function at 0x140190930
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xf0
movaps xmmword [rsp + 0xe0], xmm6
mov r14, r9
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140396de8]
xor rax, rsp
mov qword [rsp + 0xd8], rax
mov byte [r8 + 8], 0
mov qword [rcx + 0x30], r8
mov eax, dword [0x14039dea0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x18]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x40]
mov qword [rdi + 0x20], rax
lea r15, [rsp + 0x30]
mov rcx, r15
call fcn.14019f8f0
mov rcx, qword [rdi + 0x30]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + 0x128]
mov dword [rsp + 0xa6], 0
mov byte [rsp + 0xaa], 0
mov dword [rsp + 0xac], 0
mov byte [rsp + 0xb0], 0
mov dword [rsp + 0xb2], 0
mov byte [rsp + 0xb6], 0
mov qword [rsp + 0xb8], 0
mov byte [rsp + 0xc0], 0
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x90], xmm6
mov qword [rsp + 0x9d], 0
mov qword [rsp + 0xc8], WSAGetLastError
mov dword [rsp + 0xd0], 0xffffffff
mov rax, qword [r14]
lea r8, [rsp + 0x60]
mov rcx, r14
mov rdx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 0x30]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + 0x30]
mov rcx, qword [rdi + 0x30]
mov rax, qword [rcx]
call qword [rax + 0xc8]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x140190ab9
lea r14, [rsp + 0x60]
nop dword [rax + rax]
lea rcx, [rax - 1]
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rdx + rax*8 - 8]
mov rax, qword [rcx]
mov rdx, rdi
mov r8, r14
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [rsp + 0x40]
test rax, rax
jne 0x140190a90
cmp byte [rdi + 0x39], 0
je 0x140190ad1
mov rcx, 0xffffffffffffffff
lea rdx, str.RegExp_too_big
xor eax, eax
jmp 0x140190aee
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.1401a15a0
mov rcx, qword [rsp + 0x28]
call fcn.140190b30
mov rcx, qword [rdi + 8]
xor edx, edx
mov qword [rsi], rdx
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.14025dfe0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140191be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r15, qword [rsp + 0xb0]
cmp qword [r15], 0
je 0x140191cc3
mov rsi, r9
mov r12, r8
mov r14, rdx
mov rax, qword [rcx]
cmp dword [r9 + 0x70], 0
sete byte [rsp + 0x20]
xor r13d, r13d
mov rdx, r15
mov r8, r14
xor r9d, r9d
call qword [rax + 0x20]
cmp byte [r15 + 0x28], 0
jne 0x140191cc6
movzx eax, byte [r14 + 0x38]
test al, al
mov ecx, 0xffff
mov edx, 0xff
cmove edx, ecx
mov qword [r15 + 0x20], 0
mov r9, qword [r15]
xor r13d, r13d
test r9, r9
jle 0x140191cc6
xor ecx, ecx
test al, al
sete cl
lea r8d, [rcx*8 + 8]
lea r10, [r15 + 0xa]
mov r11d, 1
mov qword [rsp + 0x30], r9
mov rax, r9
xor edi, edi
xor ebp, ebp
xor ebx, ebx
movzx r9d, word [r10 - 2]
test r9b, r9b
movzx edi, dil
cmovne edi, r11d
and r9d, edx
mov ecx, r13d
shl r9d, cl
or ebp, r9d
mov dword [r15 + 0x20], ebp
movzx r9d, word [r10]
and r9d, edx
shl r9d, cl
or ebx, r9d
mov dword [r15 + 0x24], ebx
add r13d, r8d
add r10, 6
dec rax
jne 0x140191c80
test dil, 1
jne 0x140191cda
xor r13d, r13d
mov eax, r13d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r13, qword [r14 + 0x30]
mov rcx, qword [rsp + 0x30]
cmp qword [rsi + 0x28], rcx
je 0x140191d13
movzx r9d, byte [rsp + 0xa0]
xor r9b, 1
mov r8, qword [r12 + 0x10]
mov rdx, qword [rsi]
mov rax, qword [r13]
mov qword [rsp + 0x20], rcx
mov rcx, r13
call qword [rax + 0x100]
mov rcx, qword [r15]
cmp rcx, 2
je 0x140191d37
cmp rcx, 1
jne 0x140191d44
cmp byte [r14 + 0x38], 0
mov eax, 0xffff
mov ecx, 0xff
cmove ecx, eax
and ebp, ecx
cmp ebp, ecx
jmp 0x140191d47
cmp byte [r14 + 0x38], 0
je 0x140191d44
cmp bp, 0xffff
jmp 0x140191d47
cmp ebp, 0xffffffff
setne al
movzx ecx, byte [rsp + 0xb8]
test cl, cl
je 0x140191d74
mov r10, qword [r13]
mov rcx, r13
mov edx, ebx
test al, al
je 0x140191d91
mov r8d, ebp
mov r9, qword [rsp + 0xa8]
call qword [r10 + 0x48]
jmp 0x140191da9
mov r9, qword [rsi + 0x10]
mov r10, qword [r13]
mov rcx, r13
mov edx, ebx
test al, al
je 0x140191d9f
mov r8d, ebp
call qword [r10 + 0x88]
jmp 0x140191da9
mov r8, qword [rsp + 0xa8]
call qword [r10 + 0x40]
jmp 0x140191da9
mov r8, r9
call qword [r10 + 0x80]
mov r13b, 1
jmp 0x140191cc6
Function at 0x140192ef0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x140396de8]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x50], 0
movzx eax, byte [rsp + 0xd0]
setne bpl
or bpl, al
mov rax, qword [rcx + 0x48]
mov r12, qword [rax]
mov rax, qword [rax + 0x10]
mov rcx, qword [rax]
mov rax, qword [rcx]
mov byte [rsp + 0x20], bpl
call qword [rax + 0x20]
cmp r12, 2
jl 0x1401930a0
lea r13, [rsp + 0x50]
lea rax, [rsi + rsi*2]
lea rax, [rax*2 + 0xc]
mov qword [rsp + 0x28], rax
mov r15d, 1
jmp 0x140192f96
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
movups xmm2, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x20], xmm2
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx], xmm0
inc r15
cmp r15, r12
je 0x1401930a0
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
mov dword [rsp + 0x3e], 0
mov byte [rsp + 0x42], 0
mov dword [rsp + 0x44], 0
mov byte [rsp + 0x48], 0
mov dword [rsp + 0x4a], 0
mov byte [rsp + 0x4e], 0
mov byte [r13 + 8], 0
mov qword [r13], 0
mov rax, qword [r14 + 0x48]
mov rax, qword [rax + 0x10]
mov rcx, r15
shl rcx, 4
mov rcx, qword [rax + rcx]
mov rax, qword [rcx]
mov byte [rsp + 0x20], bpl
lea rdx, [rsp + 0x30]
mov r8, rdi
mov r9, rsi
call qword [rax + 0x20]
cmp byte [rsp + 0x58], 0
jne 0x140192f8a
cmp byte [rbx + 0x28], 0
jne 0x140192f70
mov rax, qword [rsp + 0x28]
mov rcx, rsi
cmp qword [rbx], rsi
jg 0x14019306e
jmp 0x140192f8a
mov byte [rbx + rax], 0
mov r11d, r10d
and r11d, r9d
mov r9d, r8d
and r9d, r11d
mov word [rsp + rax + 0x2e], r9w
xor r8d, edx
not r8d
and r8d, r11d
mov word [rbx + rax - 4], r8w
and r8d, edx
mov word [rbx + rax - 2], r8w
inc rcx
add rax, 6
cmp rcx, qword [rbx]
jge 0x140192f8a
movzx r9d, word [rbx + rax - 4]
movzx edx, word [rbx + rax - 2]
movzx r10d, word [rsp + rax + 0x2c]
movzx r8d, word [rsp + rax + 0x2e]
cmp r9w, r10w
jne 0x140193030
cmp dx, r8w
jne 0x140193030
cmp byte [rsp + rax + 0x30], 0
mov r8d, edx
mov r11d, r9d
jne 0x140193037
jmp 0x140193030
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14025dfe0
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401a5480
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
call fcn.1401a5310
mov rax, qword [rsi + 0x60]
cmp rax, 1
je 0x1401a54d1
test rax, rax
jne 0x1401a54dd
mov eax, dword [0x140399d40]
mov ecx, dword [0x14039dea0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x10]
jg 0x1401a5583
mov rsi, qword [0x140399d38]
jmp 0x1401a5576
mov rax, qword [rsi + 0x70]
mov rsi, qword [rax]
jmp 0x1401a5576
mov rdx, qword [rsi]
mov ecx, 0x20
call fcn.14010f5a0
mov rdi, rax
mov eax, dword [0x14039dea0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x18]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], rax
cmp qword [rsi + 0x60], 0
jle 0x1401a555b
xor ebx, ebx
nop word cs:[rax + rax]
mov r14, qword [rsi + 0x70]
mov rdx, qword [rdi]
inc rdx
mov rcx, rdi
call fcn.1400f9f60
mov rax, qword [r14 + rbx*8]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 0x10]
mov qword [rdx + rcx*8 - 8], rax
inc rbx
cmp rbx, qword [rsi + 0x60]
jl 0x1401a5530
mov rdx, qword [rsi]
mov ecx, 0x20
call fcn.14010f5a0
mov rsi, rax
mov rcx, rax
mov rdx, rdi
call fcn.1401a21a0
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140399d40]
call fcn.14025e468
cmp dword [0x140399d40], 0xffffffff
jne 0x1401a54c5
mov ecx, 8
call fcn.14025e260
lea rcx, [0x1403181a0]
mov qword [rax], rcx
mov qword [0x140399d38], rax
lea rcx, [0x140399d40]
call fcn.14025e408
jmp 0x1401a54c5