joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c4150
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0xc8
lea rax, [rsp + 0x2c]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x94]
lea rcx, [0x140333b80]
mov rdi, rax
mov rsi, rcx
mov ecx, Ordinal_35
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x94]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov eax, 2
imul rax, rax, 0x10
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx + rax]
test eax, eax
je 0x1400c41be
mov dword [rsp + 0x30], 1
jmp 0x1400c41c6
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x1400c4231
mov dword [rsp + 0x24], 0
jmp 0x1400c41ef
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x11
jge 0x1400c4231
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx + rax*2]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, Ordinal_60
idiv ecx
mov eax, edx
add eax, 0x35
mov ecx, dword [rsp + 0x48]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x38]
mov word [rdx + rcx*2], ax
jmp 0x1400c41e5
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400c4269
call fcn.1400c0710
mov ecx, 8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rax, [rsp + 0x2d]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x78]
lea rcx, [0x1403332b8]
mov rdi, rax
mov rsi, rcx
mov ecx, Ordinal_30
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov eax, 2
imul rax, rax, 0xd
mov rcx, qword [rsp + 0x40]
movzx eax, word [rcx + rax]
test eax, eax
je 0x1400c42c7
mov dword [rsp + 0x34], 1
jmp 0x1400c42cf
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
movzx eax, al
test eax, eax
je 0x1400c433a
mov dword [rsp + 0x28], 0
jmp 0x1400c42f8
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xe
jge 0x1400c433a
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
movzx eax, word [rcx + rax*2]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x28]
cdq
mov ecx, Ordinal_60
idiv ecx
mov eax, edx
add eax, 0x35
mov ecx, dword [rsp + 0x4c]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov word [rdx + rcx*2], ax
jmp 0x1400c42ee
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400c4372
call fcn.1400c0710
mov ecx, 8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
add rsp, 0xc8
pop rdi
pop rsi
ret
Function at 0x1400cca60
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x1400cca81
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400ccaae
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400ccab0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400ccb09
test ecx, ecx
jle 0x1400ccae9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400ccb09
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400ccb09
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
int3
jg 0x1405e572b
dec ch
adc eax, 0x35ff8a9f
or ebp, dword [rbp - 0x588cd541]
xor eax, 0x2abfad0b
jae 0x1405e56d9
Function at 0x1400ccb30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400ccb61
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x1400ccb78
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400ccb9b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400ccb9d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400ccbd9
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400ccc6e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400ccc14
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1400ccc4e
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1400ccc6e
cmp rbx, rax
ja 0x1400ccc20
test rbx, rbx
je 0x1400ccc6e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
xchg edx, eax
xchg ebx, eax
mov es, r15d
sbb edi, edi
Function at 0x1400cd0b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400cd0d4
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400cd117
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x1400cd117
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x1400cd248
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400cd15a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400cd185
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x1400cd24d
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400cd1fa
sub eax, 1
je 0x1400cd1fa
cmp eax, 2
jne 0x1400cd248
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x1400cd24d
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x1400cd22b
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400cd248
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400cd24d
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x1400d07b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400d0879
cmp byte [rcx + 0x71], 0
je 0x1400d0879
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x1400d086c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400d0828
sub eax, 1
je 0x1400d082c
cmp eax, 2
jne 0x1400d086c
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x1400d085a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400d086c
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x1400d4d70
Capabilities:
Interact with driver via ioctl

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x60
xor ecx, ecx
lea rdi, [rsp + 0x68]
cmp byte [0x140de7f9b], cl
lea rax, [r11 + 8]
mov qword [r11 - 0x30], rcx
lea r8, [r11 - 0x28]
mov qword [r11 + 8], rcx
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov rbx, qword [rdi]
mov qword [rdi], rcx
mov dword [rsp + 0x44], ecx
mov qword [r11 - 0x38], rcx
mov qword [r11 - 0x18], rax
mov eax, dword [0x140de803c]
mov dword [rsp + 0x28], ecx
mov qword [r11 - 0x20], rdx
mov edx, 0x2224a8
mov qword [r11 - 0x10], 8
mov qword [r11 - 0x48], rcx
mov rcx, qword [0x140de8068]
mov dword [rsp + 0x40], eax
jne 0x1400d4de6
mov edx, 0x17fe810
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rdi], rbx
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x1400d4fe0
Capabilities:
Interact with driver via ioctl

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x60
xor ecx, ecx
lea rdi, [rsp + 0x68]
cmp byte [0x140de7f9b], cl
lea rax, [r11 + 8]
mov qword [r11 - 0x30], rcx
lea r8, [r11 - 0x28]
mov dword [rsp + 0x70], ecx
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov rbx, qword [rdi]
mov qword [rdi], rcx
mov dword [rsp + 0x44], ecx
mov qword [r11 - 0x38], rcx
mov qword [r11 - 0x18], rax
mov eax, dword [0x140de803c]
mov dword [rsp + 0x28], ecx
mov qword [r11 - 0x20], rdx
mov edx, 0x2224a8
mov qword [r11 - 0x10], 4
mov qword [r11 - 0x48], rcx
mov rcx, qword [0x140de8068]
mov dword [rsp + 0x40], eax
jne 0x1400d5056
mov edx, 0x17fe810
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rdi], rbx
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400d5690
Capabilities:
Interact with driver via ioctl

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x60
xor ecx, ecx
mov dword [rsp + 0x70], 0
cmp byte [0x140de7f9b], cl
lea rdi, [rsp + 0x68]
mov rbx, qword [rdi]
lea rax, [r11 + 8]
mov qword [rdi], rcx
lea r8, [r11 - 0x28]
mov qword [r11 - 0x30], rcx
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x44], ecx
mov qword [r11 - 0x38], rcx
mov qword [r11 - 0x18], rax
mov eax, dword [0x140de803c]
mov dword [rsp + 0x28], ecx
mov qword [r11 - 0x20], rdx
mov edx, 0x2224a8
mov qword [r11 - 0x10], 4
mov qword [r11 - 0x48], rcx
mov rcx, qword [0x140de8068]
mov dword [rsp + 0x40], eax
jne 0x1400d570a
mov edx, 0x17fe810
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rdi], rbx
movss xmm0, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x1400d5790
Capabilities:
Interact with driver via ioctl

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x60
xor ecx, ecx
mov byte [rsp + 0x70], 0
cmp byte [0x140de7f9b], cl
lea rdi, [rsp + 0x68]
mov rbx, qword [rdi]
lea rax, [r11 + 8]
mov qword [rdi], rcx
lea r8, [r11 - 0x28]
mov qword [r11 - 0x30], rcx
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x44], ecx
mov qword [r11 - 0x38], rcx
mov qword [r11 - 0x18], rax
mov eax, dword [0x140de803c]
mov dword [rsp + 0x28], ecx
mov qword [r11 - 0x20], rdx
mov edx, 0x2224a8
mov qword [r11 - 0x10], 1
mov qword [r11 - 0x48], rcx
mov rcx, qword [0x140de8068]
mov dword [rsp + 0x40], eax
jne 0x1400d5807
mov edx, 0x17fe810
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rdi], rbx
movzx eax, byte [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x1400d5ee0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.140283e88
mov qword [rax], rbx
mov qword [rsp + 0x40], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400e3af0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x1400d5f3d
mov rax, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1400e8d10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x22], 0
je 0x1400e8e2d
movdqa xmm3, xmmword [0x140333fb0]
lea rdx, [rcx + 8]
movdqa xmm4, xmmword [0x140334100]
mov r8d, 0x2beb
nop dword [rax]
nop dword [rax + rax]
movd xmm1, dword [rdx - 8]
lea rax, [r8 - 0x2beb]
xorps xmm0, xmm0
lea rdx, [rdx + 0x10]
punpcklwd xmm1, xmm0
movq xmm2, rax
punpckldq xmm1, xmm0
lea rax, [r8 - 5]
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rax
pshuflw xmm1, xmm0, 0xd8
lea rax, [r8 - 3]
movd dword [rdx - 0x18], xmm1
xorps xmm0, xmm0
movd xmm1, dword [rdx - 0x14]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rax
pshuflw xmm1, xmm0, 0xd8
lea rax, [r8 - 1]
movd dword [rdx - 0x14], xmm1
xorps xmm0, xmm0
movd xmm1, dword [rdx - 0x10]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rax
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r8
movd dword [rdx - 0x10], xmm1
add r8, 8
movd xmm1, dword [rdx - 0xc]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
lea rax, [r8 - 0x2beb]
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rdx - 0xc], xmm1
cmp rax, 0x10
jb 0x1400e8d40
mov byte [rcx + 0x22], 0
ret
Function at 0x1400e9fe0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
test rcx, rcx
je 0x1400ea183
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400ea183
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400ea183
mov edx, 0x20b
cmp word [rax + rcx + 0x18], dx
jne 0x1400ea183
mov qword [rbx], rcx
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
mov qword [rsp + 0x40], rdi
mov qword [rbx + 8], rcx
xor edi, edi
mov qword [rsp + 0x48], r14
lea rax, [rcx + 0x18]
mov qword [rbx + 0x18], rax
lea rdx, [rcx + 4]
mov qword [rbx + 0x10], rdx
lea rax, [rcx + 0x88]
mov qword [rbx + 0x20], rax
lea r14, [rcx + 0x18]
lea rax, [rcx + 0x90]
mov qword [rbx + 0x28], rax
lea rax, [rcx + 0x98]
mov qword [rbx + 0x30], rax
lea rax, [rcx + 0xa0]
mov qword [rbx + 0x38], rax
lea rax, [rcx + 0xa8]
mov qword [rbx + 0x40], rax
lea rax, [rcx + 0xb0]
mov qword [rbx + 0x48], rax
lea rax, [rcx + 0xb8]
mov qword [rbx + 0x50], rax
lea rax, [rcx + 0xc0]
mov qword [rbx + 0x58], rax
lea rax, [rcx + 0xc8]
mov qword [rbx + 0x60], rax
lea rax, [rcx + 0xd0]
mov qword [rbx + 0x68], rax
lea rax, [rcx + 0xd8]
mov qword [rbx + 0x70], rax
lea rax, [rcx + 0xe0]
mov qword [rbx + 0x78], rax
lea rax, [rcx + 0xe8]
mov qword [rbx + 0x80], rax
lea rax, [rcx + 0xf0]
mov qword [rbx + 0x88], rax
lea rax, [rcx + 0xf8]
mov qword [rbx + 0x90], rax
lea rax, [rcx + 0x100]
mov qword [rbx + 0x98], rax
movzx eax, word [rcx + 0x14]
add r14, rax
cmp di, word [rdx + 2]
jae 0x1400ea171
mov qword [rsp + 0x38], rsi
nop dword [rax]
mov rdx, qword [rbx + 0xa8]
movsxd rax, edi
lea rcx, [rax + rax*4]
lea rax, [r14 + rcx*8]
mov qword [rsp + 0x30], rax
cmp rdx, qword [rbx + 0xb0]
je 0x1400ea14d
mov qword [rdx], rax
add qword [rbx + 0xa8], 8
jmp 0x1400ea15e
lea r8, [rsp + 0x30]
lea rcx, [rbx + 0xa0]
call fcn.1400e3f40
mov rax, qword [rbx + 0x10]
inc edi
movzx ecx, word [rax + 2]
cmp edi, ecx
jl 0x1400ea120
mov rsi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x48]
mov al, 1
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1400ea7c0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], 0
lea rdx, [rsp + 0x50]
call fcn.1400e9fe0
mov r14, qword [rbp - 0x10]
test al, al
je 0x1400ea920
mov dword [rbp + 0x4a], 0x747865
mov word [rbp + 0x48], 0x742e
mov byte [rbp + 0x4e], 0
mov rbx, r14
mov rdi, qword [rbp - 8]
cmp r14, rdi
je 0x1400ea853
nop dword [rax]
nop word [rax + rax]
mov r12, qword [rbx]
mov r8d, 8
lea rdx, [rbp + 0x48]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x1400ea856
add rbx, 8
cmp rbx, rdi
jne 0x1400ea830
xor r12d, r12d
mov word [rbp + 0x55], 0x61
mov dword [rbp + 0x50], 0x6164722e
mov byte [rbp + 0x54], reloc.WS2_32.dll_WSACleanup
mov byte [rbp + 0x57], 0
mov rbx, r14
cmp r14, rdi
je 0x1400ea8a3
nop dword [rax]
nop word [rax + rax]
mov rsi, qword [rbx]
mov r8d, 8
lea rdx, [rbp + 0x50]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x1400ea8a5
add rbx, 8
cmp rbx, rdi
jne 0x1400ea880
xor esi, esi
mov dword [rbp + 0x4a], 0x617461
mov word [rbp + 0x48], 0x642e
mov byte [rbp + 0x4e], 0
mov rbx, r14
cmp r14, rdi
je 0x1400ea8e3
nop
mov r15, qword [rbx]
mov r8d, 8
lea rdx, [rbp + 0x48]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x1400ea8e6
add rbx, 8
cmp rbx, rdi
jne 0x1400ea8c0
xor r15d, r15d
test r12, r12
je 0x1400ea920
cmp r12, rsi
jae 0x1400ea920
cmp rsi, r15
jae 0x1400ea920
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
mov eax, dword [rsi + 0xc]
mov rcx, qword [rsp + 0x48]
div ecx
test edx, edx
jne 0x1400ea920
xor edx, edx
mov eax, dword [r15 + 0xc]
div ecx
test edx, edx
jne 0x1400ea920
mov bl, 1
jmp 0x1400ea922
xor bl, bl
test r14, r14
je 0x1400ea962
mov rdx, qword [rbp]
sub rdx, r14
and rdx, 0xfffffffffffffff8
mov rax, r14
cmp rdx, 0x1000
jb 0x1400ea95a
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400ea95a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.140284104
movzx eax, bl
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret

Function at 0x1400f3ae0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, Ordinal_41
call fcn.1402844a0
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x140106070
Capabilities:
Encode data using xor

Disassembly:
mov eax, Ordinal_60
call fcn.1402844a0
sub rsp, rax
mov r10, rdx
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
add rdx, 0xf
lea rax, [r8 + 0xf]
mov r11, rcx
cmp r10, rax
ja 0x1401060c3
xor ecx, ecx
cmp rdx, r8
jb 0x1401060c3
sub r8, r10
lea rax, [rcx + r10]
mov edx, reloc.WS2_32.dll_recv
sub rdx, rcx
nop
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1401060b0
jmp 0x1401060d6
movdqu xmm1, xmmword [r10]
movdqu xmm0, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [r10], xmm1
mov rcx, qword [r11 + 8]
lea r8, [rsp + 0x40]
mov r9, r10
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rdx, r10
call fcn.1400eb650
test eax, eax
je 0x140106107
cmp dword [rsp + 0x40], 0x10
jne 0x140106107
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret

Function at 0x1401062b0
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x140106338
test r8, r8
je 0x140106338
mov rax, qword [rcx + 0x18]
cmp r8, rax
mov r9, rax
cmovb r9, r8
test r9, r9
je 0x1401062f6
add rcx, 0x20
mov r11, rdx
sub r11, r10
nop
movzx eax, byte [r11 + rcx - 0x20]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x1401062e0
mov rax, qword [r10 + 0x18]
cmp r8, rax
jbe 0x140106338
sub r8, rax
cmp r8, 0x10
jbe 0x14010630c
mov r8d, reloc.WS2_32.dll_recv
jmp 0x140106311
test r8, r8
je 0x140106338
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x18]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x40], al
inc rcx
cmp rcx, r8
jb 0x140106320
ret

Function at 0x140108290
Capabilities:
Get thread local storage value

Disassembly:
mov eax, Ordinal_41
call fcn.1402844a0
sub rsp, rax
lea rcx, [0x140de70c8]
add rsp, 0x28
jmp fcn.1400f3940