joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479831
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
aesimc xmm11, xmmword [rdx + 0xc0]
aesimc xmm12, xmmword [rdx + 0xd0]
movaps xmm13, xmmword [rdx]
movaps xmm14, xmmword [rdx + 0xe0]
movaps xmmword [rcx], xmm13
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movdqa xmmword [rcx + 0xc0], xmm11
movdqa xmmword [rcx + 0xd0], xmm12
movaps xmmword [rcx + 0xe0], xmm14
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x4a130e
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
lea rcx, [rsp + 0x27]
mov byte [rcx], 0
mov edx, 1
call fcn.0042f019
test eax, eax
jne 0x4a1380
mov al, byte [rsp + 0x27]
mov rcx, qword [rsi + 0x10]
mov qword [rdi + 0x30], rcx
movups xmm0, xmmword [rsi]
movups xmmword [rdi + 0x20], xmm0
mov qword [rdi], rcx
mov qword [rdi + 0x10], 0
mov byte [rdi + 0x38], al
mov word [rdi + 0x39], 0x7764
mov byte [rdi + 0x3b], 0x73
mov byte [rdi + 0x3c], bl
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [0x005d9410]
lea rbx, [rsp + 0x30]
mov qword [rbx], rax
mov rcx, qword [rbx]
movabs rax, 0x39b9be7e01f400ef
mov qword [rbx], rax
mov rdx, qword [rbx]
call fcn.00478246
xorps xmm0, xmm0
movaps xmmword [rbx], xmm0
mov cl, 1
xor edx, edx
lea r8, [0x005dbdc0]
movzx r10d, byte [rdx + r8]
mov r9, rdx
or r9, 1
movzx r9d, byte [r9 + r8]
mov r11, rdx
or r11, 2
movzx r11d, byte [r11 + r8]
mov rbx, rdx
or rbx, 3
movzx ebx, byte [rbx + r8]
mov r14, rdx
or r14, 4
movzx r14d, byte [r14 + r8]
mov r15, rdx
or r15, 5
movzx r15d, byte [r15 + r8]
mov r12, rdx
or r12, 6
mov r13, rdx
or r13, 7
movzx r12d, byte [r12 + r8]
movzx r13d, byte [r13 + r8]
shl r13, 0x38
shl r12, 0x30
or r12, r13
shl r15, 0x28
shl r14, 0x20
shl rbx, 0x18
shl r11, 0x10
shl r9, 8
or r9, r10
or r9, r11
or r9, rbx
or r9, r14
or r9, r15
or r9, r12
xor r9, qword [rax + rdx]
mov qword [rsp + rdx + 0x30], r9
mov edx, 8
test cl, 1
mov ecx, 0
jne 0x4a13b8
mov ecx, 0x1d7eb2f5
xor ecx, dword [rax + 0x10]
lea rbx, [rsp + 0x30]
mov dword [rbx + 0x10], ecx
mov al, byte [rax + 0x14]
xor al, 0xc5
mov byte [rbx + 0x14], al
mov ecx, 0x15
call fcn.005162fd
lea r15, [rsp + 0x60]
mov qword [r15], rax
mov qword [r15 + 8], rdx
movaps xmm0, xmmword [rbx]
movups xmmword [rdx], xmm0
mov rax, qword [rbx + 0xd]
mov qword [rdx + 0xd], rax
mov qword [r15 + 0x10], 0x15
lea rax, [rsp + 0x90]
mov qword [rax], r15
lea rcx, [0x0044e529]
mov qword [rax + 8], rcx
lea rcx, [rsp + 0x28]
mov qword [rax + 0x10], rcx
lea rcx, [0x004dd60f]
mov qword [rax + 0x18], rcx
lea rcx, str.combase.dll
mov qword [rbx + 0x10], rcx
mov ecx, 2
mov qword [rbx + 0x18], rcx
mov qword [rbx], 0
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rcx
lea r14, [rsp + 0x78]
mov rcx, r14
mov rdx, rbx
call fcn.004179e0
mov rcx, r14
call fcn.004554b3
mov qword [rdi], rax
mov byte [rdi + 0x3c], 0xc
mov rcx, qword [r15]
mov rdx, qword [r15 + 8]
call fcn.004c9843
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.004c9843
jmp 0x4a136d
Function at 0x4c2bb3
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rcx + 0x10]
cmp rdx, rax
jae 0x4c2c2a
mov rbx, rax
not rbx
and rbx, rdx
mov r14, rdx
not r14
and r14, rax
mov rdi, r14
sub rdi, rbx
mov rax, qword [rsi]
sub rax, rdx
cmp rax, rdi
jb 0x4c2c38
mov rax, qword [rsi + 8]
cmp rdi, 2
jb 0x4c2c19
mov ecx, 1
mov r8, rcx
xor r8, 1
and ecx, 1
lea rcx, [r8 + rcx*2]
mov byte [rax + rdx], 0
inc rdx
cmp rcx, rdi
jb 0x4c2bfd
jmp 0x4c2c1e
cmp r14, rbx
je 0x4c2c27
add rax, rdx
mov byte [rax], 0
inc rdx
mov rax, rdx
mov qword [rsi + 0x10], rax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, rsi
mov r8, rdi
call fcn.004c2a2c
mov rdx, qword [rsi + 0x10]
jmp 0x4c2bee
Function at 0x4c8131
Capabilities:
List udp connections and listeners

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov edi, edx
mov rsi, rcx
xor r13d, r13d
lea rbx, [rsp + 0x34]
mov dword [rbx], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 1
xor ecx, ecx
mov rdx, rbx
xor r8d, r8d
mov r9d, edi
call sub.iphlpapi.dll_GetExtendedUdpTable
mov r14d, 1
mov ebp, 0x65
cmp eax, 0x7a
jne 0x4c81ec
mov ecx, dword [rsp + 0x34]
call fcn.004c7fd3
mov r12, rax
mov r15, rdx
test r13, r13
je 0x4c81a3
mov rcx, qword [0x00677420]
xor edx, edx
mov r8, r14
call fcn.005ab9d4
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
mov rcx, r15
mov rdx, rbx
xor r8d, r8d
mov r9d, edi
call sub.iphlpapi.dll_GetExtendedUdpTable
mov r14, r15
mov r13, r12
dec ebp
jne 0x4c8179
mov byte [rsi + 8], 7
mov qword [rsi], 1
test r12, r12
je 0x4c8227
mov rcx, qword [0x00677420]
xor edx, edx
mov r8, r15
jmp 0x4c8222
test eax, eax
jne 0x4c8203
mov qword [rsi + 8], r13
mov qword [rsi + 0x10], r14
xor eax, eax
mov qword [rsi + 0x18], rax
mov qword [rsi], rax
jmp 0x4c8227
mov byte [rsi + 8], 9
mov dword [rsi + 0xc], eax
mov qword [rsi], 1
test r13, r13
je 0x4c8227
mov rcx, qword [0x00677420]
xor edx, edx
mov r8, r14
call fcn.005ab9d4
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x4c82b9
Capabilities:
List tcp connections and listeners

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov edi, edx
mov rsi, rcx
xor r13d, r13d
lea rbx, [rsp + 0x34]
mov dword [rbx], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 5
xor ecx, ecx
mov rdx, rbx
xor r8d, r8d
mov r9d, edi
call sub.iphlpapi.dll_GetExtendedTcpTable
mov r14d, 1
mov ebp, 0x65
cmp eax, 0x7a
jne 0x4c8374
mov ecx, dword [rsp + 0x34]
call fcn.004c7fd3
mov r12, rax
mov r15, rdx
test r13, r13
je 0x4c832b
mov rcx, qword [0x00677420]
xor edx, edx
mov r8, r14
call fcn.005ab9d4
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 5
mov rcx, r15
mov rdx, rbx
xor r8d, r8d
mov r9d, edi
call sub.iphlpapi.dll_GetExtendedTcpTable
mov r14, r15
mov r13, r12
dec ebp
jne 0x4c8301
mov byte [rsi + 8], 7
mov qword [rsi], 1
test r12, r12
je 0x4c83af
mov rcx, qword [0x00677420]
xor edx, edx
mov r8, r15
jmp 0x4c83aa
test eax, eax
jne 0x4c838b
mov qword [rsi + 8], r13
mov qword [rsi + 0x10], r14
xor eax, eax
mov qword [rsi + 0x18], rax
mov qword [rsi], rax
jmp 0x4c83af
mov byte [rsi + 8], 8
mov dword [rsi + 0xc], eax
mov qword [rsi], 1
test r13, r13
je 0x4c83af
mov rcx, qword [0x00677420]
xor edx, edx
mov r8, r14
call fcn.005ab9d4
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x4ca2f0
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call sub.KERNEL32.dll_GetModuleHandleA
test rax, rax
je 0x4ca348
mov rsi, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x4ca348
mov rbx, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rsi
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x4ca348
mov rsi, rax
mov r15d, 1
jmp 0x4ca3cf
lea rcx, str.ntdll.dll
call sub.KERNEL32.dll_GetModuleHandleA
test rax, rax
je 0x4ca43b
mov rdi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x4ca43b
mov rbx, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x4ca43b
mov rsi, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x4ca43b
mov rdi, rax
lea rcx, [rsp + 0x20]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
jne 0x4ca43b
mov rbx, qword [rsp + 0x20]
xor r15d, r15d
mov ecx, 0x20
mov edx, 8
call fcn.00414fe0
test rax, rax
je 0x4ca475
mov r14, rax
mov qword [rax], r15
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
xor eax, eax
lock cmpxchg qword [0x006772d0], r14
je 0x4ca42c
mov rsi, rax
cmp qword [r14], 0
jne 0x4ca418
mov rcx, qword [r14 + 8]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [0x00677420]
xor edx, edx
mov r8, r14
call fcn.005ab9d4
mov r14, rsi
mov rax, r14
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_
lea rcx, [rsp + 0x20]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 1
xor eax, eax
mov qword [rcx], rax
lea rdx, str.combase.dll
mov qword [rcx + 0x20], rdx
mov qword [rcx + 0x28], rax
lea rdx, str.registry_src_octopus.retort.com_8754fae0eb2f08f1_indiscriminately_0.9.10_src_thread_parker_windows_mod.rs
call fcn.00426330
ud2
mov ecx, 0x20
mov edx, 8
call fcn.00417bf0
ud2
Function at 0x4cf86a
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1b8
lea rbp, [rsp + 0x80]
and rsp, 0xffffffffffffff80
mov rsi, rdx
mov rdi, rcx
movabs r12, 0x800000000000000
mov rax, qword [rdx + 0x20]
mov qword [rsp + 0x68], rax
mov al, byte [rdx + 0x28]
mov byte [rsp + 0x67], al
lea rcx, [rsp + 0x80]
call fcn.004cefee
mov qword [rsp + 0x78], rsi
mov rax, qword [rsi + 0x58]
mov qword [rsp + 0x70], rax
movabs rax, 0x7465646279746573
movabs rcx, 0x6c7967656e657261
movabs rdx, 0xded7d4e2d7dedfc6
movabs r8, 0xa60c596fc19fead0
movabs r9, 0xe414a674f0de7325
mov ebx, 1
lock xadd qword [0x006772e8], rbx
mov r10, rbx
xor r10, rax
lea r11, [r10 + rcx]
mov r14, r10
rol r14, 0x10
xor r14, r11
lea rsi, [r14 + rdx]
rol r14, 0x15
xor r14, rsi
add r10, r8
mov r13, r10
xor r13, r9
rol r10, 0x20
mov r15, rsi
and r15, rbx
mov r11, r14
xor r11, r12
add rbx, r13
add rbx, rsi
add r15, r15
rol r13, 0xd
sub rbx, r15
mov rsi, rbx
and rsi, r13
add r13, rbx
add rsi, rsi
sub r13, rsi
rol rbx, 0x20
add r10, r11
shrd r11, r14, 0x30
xor r11, r10
add rbx, r11
rol r11, 0x15
xor r11, rbx
add r10, r13
rol r13, 0x11
xor r13, r10
rol r10, 0x20
xor rbx, r12
movzx esi, r10b
add rsi, rsi
add rbx, r13
rol r13, 0xd
xor r13, rbx
rol rbx, 0x20
add r10, r11
sub r10, rsi
lea rsi, [r10 + 0xff]
rol r11, 0x10
xor r11, rsi
add rbx, r11
rol r11, 0x15
lea r14, [r10 + r13]
add r14, 0xff
rol r13, 0x11
xor r13, r14
rol r14, 0x20
xor r11, rbx
add rbx, r13
rol r13, 0xd
xor r13, rbx
rol rbx, 0x20
add r14, r11
rol r11, 0x10
xor r11, r14
add rbx, r11
rol r11, 0x15
mov rsi, rbx
and rsi, r11
add rsi, rsi
mov r10, rbx
sub r10, rsi
add r14, r13
rol r13, 0x11
mov rsi, r13
and rsi, r14
add r13, r14
add rsi, rsi
rol r14, 0x20
sub r13, rsi
add rbx, r13
rol r13, 0xd
add r10, r11
xor r13, rbx
rol rbx, 0x20
add r14, r10
rol r10, 0x10
mov r11, r10
and r11, r14
add r10, r14
add r11, r11
sub r10, r11
mov r11, r10
and r11, rbx
xor rbx, r10
lea r11, [rbx + r11*2]
rol r10, 0x15
mov rsi, r11
and rsi, r10
add r10, r11
add r14, r13
rol r13, 0x11
add rsi, rsi
xor r13, r14
rol r14, 0x20
sub r10, rsi
xor r14, r10
mov r10, r11
and r10, r13
add r13, r11
add r10, r10
sub r13, r10
xor r13, r14
je 0x4cf8f6
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rbx + 0x60]
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x110], xmm1
movups xmmword [rdi + 0x100], xmm0
mov rax, qword [rsp + 0x68]
mov qword [rdi + 0x120], rax
mov al, byte [rsp + 0x67]
mov byte [rdi + 0x128], al
lea rdx, [rsp + 0x80]
mov r8d, 0x100
mov rcx, rdi
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x130], rax
mov qword [rdi + 0x138], r13
mov qword [rdi + 0x140], rsi
mov r8, qword [rbx + 0x48]
test r8, r8
je 0x4cfb08
cmp qword [rbx + 0x40], 0
je 0x4cfb08
mov rcx, qword [0x00677420]
xor edx, edx
call fcn.005ab9d4
nop
lea rsp, [rbp + 0x138]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x4d0658
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x005b7248]
test ecx, ecx
je 0x4d0726
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x4d0689
mov rdi, rax
cmp qword [rax], 0
jne 0x4d0718
mov ecx, dword [0x005b7248]
test ecx, ecx
je 0x4d0739
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x4d0707
mov rdi, rax
test rax, rax
jne 0x4d06ed
mov ecx, 0x18
mov edx, 8
call fcn.00414fe0
test rax, rax
je 0x4d075c
mov rdi, rax
mov qword [rax], 0
lea rax, [0x005b7230]
mov qword [rdi + 0x10], rax
mov ecx, dword [0x005b7248]
test ecx, ecx
je 0x4d074c
dec ecx
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
test rsi, rsi
je 0x4d070b
mov rax, qword [rsi]
mov qword [rsi], 0
test rax, rax
je 0x4d070d
mov rax, qword [rsi + 8]
jmp 0x4d070d
xor edi, edi
jmp 0x4d071c
xor eax, eax
mov qword [rdi], 1
mov qword [rdi + 8], rax
add rdi, 8
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x005b7230]
call fcn.0053fad0
mov ecx, eax
jmp 0x4d0671
lea rcx, [0x005b7230]
call fcn.0053fad0
mov ecx, eax
jmp 0x4d0699
lea rcx, [0x005b7230]
call fcn.0053fad0
mov ecx, eax
jmp 0x4d06e5
mov ecx, 0x18
mov edx, 8
call fcn.00417bf0
ud2
Function at 0x4d217c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x005b7108]
test ecx, ecx
je 0x4d228d
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x4d21af
cmp qword [rax], 0
je 0x4d21af
add rax, 8
jmp 0x4d2286
mov ecx, dword [0x005b7108]
test ecx, ecx
je 0x4d22a0
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x4d2284
mov rdi, rax
test rax, rax
jne 0x4d221b
mov ecx, 0x28
mov edx, 8
call fcn.00414fe0
test rax, rax
je 0x4d22c6
mov rdi, rax
mov qword [rax], 0
lea rax, [0x005b70f0]
mov qword [rdi + 0x20], rax
mov ecx, dword [0x005b7108]
test ecx, ecx
je 0x4d22b3
dec ecx
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
test rsi, rsi
je 0x4d224e
cmp qword [rsi], 0
mov qword [rsi], 0
je 0x4d224e
mov r9, qword [rsi + 8]
mov r8b, byte [rsi + 0x10]
mov dl, byte [rsi + 0x11]
movzx eax, word [rsi + 0x16]
mov word [rsp + 0x24], ax
mov eax, dword [rsi + 0x12]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsi + 0x18]
jmp 0x4d2258
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
mov qword [rdi], 1
lea rax, [rdi + 8]
mov qword [rdi + 8], r9
mov byte [rdi + 0x10], r8b
mov byte [rdi + 0x11], dl
mov edx, dword [rsp + 0x20]
mov dword [rdi + 0x12], edx
movzx edx, word [rsp + 0x24]
mov word [rdi + 0x16], dx
mov qword [rdi + 0x18], rcx
jmp 0x4d2286
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x005b70f0]
call fcn.0053fad0
mov ecx, eax
jmp 0x4d2195
lea rcx, [0x005b70f0]
call fcn.0053fad0
mov ecx, eax
jmp 0x4d21bf
lea rcx, [0x005b70f0]
call fcn.0053fad0
mov ecx, eax
jmp 0x4d2213
mov ecx, 0x28
mov edx, 8
call fcn.00417bf0
ud2
Function at 0x4d2f74
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rax, rdx
mov rsi, rcx
lea rdx, [rcx + 0x10]
mov r8, rcx
not r8
and r8, rdx
mov rcx, rdx
not rcx
and rcx, rsi
sub r8, rcx
cmp r8, 0x10
mov ecx, 0x10
cmovb rcx, r8
test rcx, rcx
je 0x4d2fc2
xor r8d, r8d
mov r9b, byte [rax + r8]
xor byte [rsi + r8], r9b
lea r9, [r8 + 1]
mov r8, r9
cmp rcx, r9
jne 0x4d2fae
mov rax, qword [0x00631390]
test byte [rax + 3], 1
je 0x4d2fe5
mov eax, dword [rax + 4]
and eax, 2
je 0x4d2fe5
mov rcx, rsi
add rsp, 0x58
pop rdi
pop rsi
jmp 0x59a6b0
mov rdx, qword [rsi + 0x10]
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
bswap rax
bswap rcx
mov r8, qword [rsi + 0x18]
lea rdi, [rsp + 0x38]
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov rcx, rdi
call fcn.004d344d
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
lea rax, [rsp + 0x48]
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov cl, 1
xor edx, edx
mov r8, qword [rax]
add rax, 8
bswap r8
mov qword [rsp + rdx*8 + 0x28], r8
mov edx, 1
test cl, 1
mov ecx, 0
jne 0x4d3025
movups xmm0, xmmword [rsp + 0x28]
movaps xmmword [rsi], xmm0
add rsp, 0x58
pop rdi
pop rsi
ret
movdqu xmm0, xmmword [rcx]
movdqa xmm5, xmmword [0x00630480]
movdqu xmm2, xmmword [rdx]
movdqu xmm4, xmmword [rdx + 0x20]
pshufb xmm0, xmm5
movdqa xmm1, xmm0
pshufd xmm3, xmm0, 0x4e
pxor xmm3, xmm0
pclmulqdq xmm0, xmm2, 0
pclmulqdq xmm1, xmm2, 0x11
pclmulqdq xmm3, xmm4, 0
pxor xmm3, xmm0
pxor xmm3, xmm1
movdqa xmm4, xmm3
psrldq xmm3, 8
pslldq xmm4, 8
pxor xmm1, xmm3
pxor xmm0, xmm4
movdqa xmm4, xmm0
movdqa xmm3, xmm0
psllq xmm0, 5
pxor xmm3, xmm0
psllq xmm0, 1
pxor xmm0, xmm3
psllq xmm0, 0x39
movdqa xmm3, xmm0
pslldq xmm0, 8
psrldq xmm3, 8
pxor xmm0, xmm4
pxor xmm1, xmm3
movdqa xmm4, xmm0
psrlq xmm0, 1
pxor xmm1, xmm4
pxor xmm4, xmm0
psrlq xmm0, 5
pxor xmm0, xmm4
psrlq xmm0, 1
pxor xmm0, xmm1
pshufb xmm0, xmm5
movdqu xmmword [rcx], xmm0
ret
Function at 0x4d3052
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rbx, r9
mov r14, r8
mov rdi, rdx
mov rsi, rcx
movaps xmm0, xmmword [r8 + 0x110]
lea rax, [rsp + 0x30]
movups xmmword [rax], xmm0
mov cl, 1
xor edx, edx
mov r8, qword [rax]
add rax, 8
bswap r8
mov qword [rsp + rdx*8 + 0x20], r8
mov edx, 1
test cl, 1
mov ecx, 0
jne 0x4d307d
lea r15, [rsp + 0x20]
movups xmm0, xmmword [r15]
movups xmmword [r15], xmm0
mov rcx, r14
mov rdx, r15
call fcn.004d2f74
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rbx]
movaps xmmword [r15], xmm0
mov rax, qword [0x00631390]
mov eax, dword [rax + 4]
xor ecx, ecx
bt eax, 9
setae cl
or rcx, 2
bt eax, 0x19
mov eax, 1
cmovae rax, rcx
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov r8, rdi
cmp rax, 1
je 0x4d3106
cmp eax, 2
jne 0x4d310d
call fcn.005909a0
jmp 0x4d3112
call fcn.0058ef40
jmp 0x4d3112
call fcn.005b2950
movups xmm0, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x20], xmm0
movaps xmm0, xmmword [rsp + 0x50]
lea rax, [rsp + 0x40]
movaps xmmword [rax - 0x10], xmm0
lea rcx, [rsp + 0x30]
mov rdx, rcx
not rdx
and rdx, rax
not rax
and rax, rcx
sub rdx, rax
cmp rdx, 0x10
mov eax, 0x10
cmovb rax, rdx
test rax, rax
je 0x4d3169
xor ecx, ecx
mov dl, byte [rsp + rcx + 0x20]
xor byte [rsp + rcx + 0x30], dl
lea rdx, [rcx + 1]
mov rcx, rdx
cmp rax, rdx
jne 0x4d3155
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x4d77fe
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
movaps xmmword [rsp + 0x240], xmm6
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdx
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x4d7a19
mov rbp, qword [rsp + 0x2c0]
test rbp, rbp
je 0x4d79bc
mov rbx, rcx
xorps xmm6, xmm6
lea r15, [rsp + 0x40]
xor edi, edi
mov r13, qword [rsp + 0x28]
cmp rbp, r13
cmovb r13, rbp
mov rsi, r9
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmm2, xmmword [rbx + 0x20]
movups xmm3, xmmword [rbx + 0x30]
lea rax, [rsp + 0xc0]
movups xmmword [rax + 0x30], xmm3
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
xor eax, eax
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rbx
mov qword [rsp + 0x110], rax
mov rcx, r15
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
call fcn.004d7bf3
movabs rax, 0x100000000
cmp rdi, rax
je 0x4d79d8
mov eax, edi
bswap eax
mov dword [rsp + 0x168], eax
mov r8d, 4
mov rcx, r15
lea r12, [rsp + 0x168]
mov rdx, r12
call fcn.004d7bf3
mov r8d, 0xd8
mov rcx, r12
mov r14, r15
mov rdx, r15
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x120]
mov rdx, r12
call fcn.004d7f87
mov rax, qword [rsp + 0x160]
mov rcx, qword [rax + 0x40]
cmp rcx, 0x41
jae 0x4d7a06
lea r9, [rsi + r13]
mov rax, rbp
not rax
and rax, r13
not r13
and rbp, r13
sub rbp, rax
mov rax, rsi
not rax
and rax, r9
mov rdx, r9
not rdx
and rdx, rsi
sub rax, rdx
cmp rax, rcx
cmovae rax, rcx
test rax, rax
je 0x4d79ad
test rsi, rsi
je 0x4d79ad
xor ecx, ecx
mov dl, byte [rsp + rcx + 0x120]
xor byte [rsi + rcx], dl
lea rdx, [rcx + 1]
mov rcx, rdx
cmp rax, rdx
jne 0x4d7997
inc rdi
test rbp, rbp
mov r15, r14
jne 0x4d7853
movaps xmm6, xmmword [rsp + 0x240]
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.registry_src_octopus.retort.com_8754fae0eb2f08f1_worm_0.17.8_src_rsa_padding.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x0062cc63]
lea r9, [0x005e20c0]
lea r8, [rsp + 0x168]
mov edx, 0x2b
call fcn.0041f970
ud2
lea r8, str.registry_src_octopus.retort.com_8754fae0eb2f08f1_worm_0.17.8_src_digest.rs
mov edx, 0x40
call fcn.004292f0
ud2
lea rax, str.chunk_size_must_be_non_zero
lea rcx, [rsp + 0x168]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 1
xor eax, eax
mov qword [rcx], rax
lea rdx, str.combase.dll
mov qword [rcx + 0x20], rdx
mov qword [rcx + 0x28], rax
lea rdx, str.registry_src_octopus.retort.com_8754fae0eb2f08f1_worm_0.17.8_src_rsa_padding.rs
call fcn.00426330
ud2
Function at 0x4e15d5
Capabilities:
Set socket configuration

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rax, r8
mov rdi, rdx
mov rsi, rcx
mov ecx, 0x3e8
mul rcx
seto r14b
jno 0x4e1632
lea r9, [rsp + 0x30]
mov dword [r9], 0xffffffff
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 0xffff
mov r8d, 0x1006
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x4e1719
mov eax, 0xffffffff
jmp 0x4e16ec
mov ebp, r9d
mov rbx, rax
mov r15d, r9d
imul rcx, r15, 0x431bde83
shr rcx, 0x32
mov eax, 0xffffffff
add rcx, rbx
jb 0x4e1680
imul edx, ebp, 0x68c26139
ror edx, 6
xor r8d, r8d
cmp edx, 0x10c7
setae r8b
add rcx, r8
jb 0x4e1680
mov eax, 0xffffffff
cmp rcx, rax
cmovb rax, rcx
test rax, rax
je 0x4e173a
lea r9, [rsp + 0x30]
mov dword [r9], eax
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 0xffff
mov r8d, 0x1006
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x4e1719
mov eax, 0xffffffff
test r14b, r14b
jne 0x4e16ec
imul rcx, r15, 0x431bde83
shr rcx, 0x32
add rbx, rcx
jb 0x4e16ec
imul ecx, ebp, 0x68c26139
ror ecx, 6
xor edx, edx
cmp ecx, 0x10c7
setae dl
add rbx, rdx
jb 0x4e16ec
mov eax, 0xffffffff
cmp rbx, rax
cmovb rax, rbx
test rax, rax
je 0x4e173a
lea r9, [rsp + 0x34]
mov dword [r9], eax
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 0xffff
mov r8d, 0x1005
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x4e1719
mov byte [rsi], 0x20
jmp 0x4e172d
call fcn.005abbd4
shl rax, 0x20
or rax, 2
mov byte [rsi], 0
mov qword [rsi + 8], rax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, str.cannot_set_a_0_duration_timeout
jmp 0x4e1726