joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18008ffe0
Capabilities:
Enumerate pe sections

Disassembly:
mov r9, rcx
test rdx, rdx
je 0x1800901ac
cmp r8d, 0x20
jne 0x1800901ac
test rcx, rcx
je 0x1800901ac
movzx eax, byte [rdx + 6]
movabs r10, 0xffc0fffffff
movzx r8d, byte [rdx + 7]
movzx ecx, byte [rdx + 0xf]
shl rcx, 8
shl r8, 8
or r8, rax
movzx eax, byte [rdx + 5]
shl r8, 8
or r8, rax
movzx eax, byte [rdx + 4]
shl r8, 8
or r8, rax
movzx eax, byte [rdx + 3]
shl r8, 8
or r8, rax
movzx eax, byte [rdx + 2]
shl r8, 8
or r8, rax
movzx eax, byte [rdx + 1]
shl r8, 8
or r8, rax
movzx eax, byte [rdx]
shl r8, 8
or r8, rax
movzx eax, byte [rdx + 0xe]
or rcx, rax
movzx eax, byte [rdx + 0xd]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 0xc]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 0xb]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 0xa]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 9]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 8]
shl rcx, 8
or rcx, rax
mov rax, r8
and rax, r10
shr r8, 0x2c
mov qword [r9], rax
mov rax, rcx
shr rcx, 0x18
shl rax, 0x14
or r8, rax
movabs rax, 0xfffffc0ffff
and r8, rax
movabs rax, 0xffffffc0f
and rcx, rax
mov qword [r9 + 8], r8
mov qword [r9 + 0x10], rcx
xor r8d, r8d
mov qword [r9 + 0x18], r8
mov qword [r9 + 0x20], r8
mov qword [r9 + 0x28], r8
movzx eax, byte [rdx + 0x16]
movzx ecx, byte [rdx + 0x17]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 0x15]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 0x14]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 0x13]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 0x12]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 0x11]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 0x10]
shl rcx, 8
or rcx, rax
mov qword [r9 + 0x30], rcx
movzx eax, byte [rdx + 0x1e]
movzx ecx, byte [rdx + 0x1f]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 0x1d]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 0x1c]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 0x1b]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 0x1a]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 0x19]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 0x18]
shl rcx, 8
or rcx, rax
mov qword [r9 + 0x40], r8
mov qword [r9 + 0x38], rcx
xor eax, eax
mov byte [r9 + 0x58], r8b
ret
mov eax, 0xffffff53
ret
Function at 0x180091710
Capabilities:
Terminate thread

Disassembly:
push rdi
sub rsp, 0x20
mov rax, qword [0x1802f8428]
mov edi, ecx
test rax, rax
je 0x180091732
cmp dword [rax + 0xc], edi
je 0x18009173d
mov rax, qword [rax + 0x48]
test rax, rax
jne 0x180091724
mov eax, 0xfffffffe
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
mov edx, 0x2710
mov rbx, qword [rax + 0x10]
mov rcx, rbx
mov dword [rax + 8], 1
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x18009176a
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
Function at 0x180093260
Capabilities:
Get socket status

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x480
mov rax, qword [0x1800f3188]
xor rax, rsp
mov qword [rsp + 0x460], rax
cmp dword [0x1802f7160], 0
mov esi, r8d
mov ebp, edx
mov r14, rcx
jne 0x1800932bf
lea rcx, str.ws2_32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1800cb470]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802f7158], rax
mov dword [0x1802f7160], 1
jmp 0x1800932c6
mov rax, qword [0x1802f7158]
test rax, rax
je 0x1800932da
mov r8d, esi
mov edx, ebp
mov rcx, r14
call rax
jmp 0x180093473
mov qword [rsp + 0x4b8], rbx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x478], rdi
xor ebx, ebx
mov qword [rsp + 0x470], r15
mov dword [rsp + 0x40], r8d
mov r15d, 0x300
mov dword [rsp + 0x250], edx
test ebp, ebp
je 0x1800933c4
mov r9, r14
mov rdi, rbp
nop dword [rax]
mov eax, dword [r9]
cmp ebx, eax
movzx r11d, word [r9 + 8]
cmovae eax, ebx
mov ebx, eax
test r15w, r11w
je 0x18009336e
xor ecx, ecx
test r8d, r8d
je 0x18009334e
mov r10, qword [r9]
nop
cmp qword [rsp + rcx*8 + 0x48], r10
je 0x18009334e
inc ecx
cmp ecx, r8d
jb 0x180093340
cmp ecx, r8d
jne 0x18009336e
cmp r8d, 0x40
jae 0x18009336e
mov rax, qword [r9]
mov qword [rsp + rcx*8 + 0x48], rax
mov r8d, dword [rsp + 0x40]
inc r8d
mov dword [rsp + 0x40], r8d
test r11b, 0x10
je 0x1800933b6
xor eax, eax
test edx, edx
je 0x180093390
mov r10, qword [r9]
nop dword [rax]
cmp qword [rsp + rax*8 + 0x258], r10
je 0x180093390
inc eax
cmp eax, edx
jb 0x180093380
cmp eax, edx
jne 0x1800933b6
cmp edx, 0x40
jae 0x1800933b6
mov ecx, eax
mov rax, qword [r9]
mov qword [rsp + rcx*8 + 0x258], rax
mov edx, dword [rsp + 0x250]
inc edx
mov dword [rsp + 0x250], edx
add r9, 0x10
sub rdi, 1
jne 0x180093320
mov eax, 0x10624dd3
lea ecx, [rbx + 1]
imul esi
xor r9d, r9d
lea r8, [rsp + 0x250]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3e8
mov dword [rsp + 0x30], edx
lea rdx, [rsp + 0x40]
sub esi, eax
imul eax, esi, 0x3e8
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
mov esi, eax
test eax, eax
jle 0x180093459
test ebp, ebp
je 0x180093459
lea rbx, [r14 + 0xa]
mov rdi, rbp
nop
mov rcx, qword [rbx - 0xa]
lea rdx, [rsp + 0x40]
call fcn.1800a1ab5
test eax, eax
je 0x180093436
or word [rbx], r15w
mov rcx, qword [rbx - 0xa]
lea rdx, [rsp + 0x250]
call fcn.1800a1ab5
test eax, eax
je 0x18009344f
or word [rbx], 0x10
add rbx, 0x10
sub rdi, 1
jne 0x180093420
mov r15, qword [rsp + 0x470]
mov eax, esi
mov rdi, qword [rsp + 0x478]
mov rbx, qword [rsp + 0x4b8]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1800a1bf0
add rsp, 0x480
pop r14
pop rsi
pop rbp
ret
Function at 0x180095860
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x60
xorps xmm0, xmm0
mov qword [rsp + 0x20], 0
movups xmmword [rsp + 0x28], xmm0
or dword [rsp + 0x28], 2
mov rax, rdx
mov dword [rsp + 0x2c], ecx
mov rsi, r9
movzx r14d, r8w
mov dword [rsp + 0x30], 1
mov edi, ecx
lea r9, [rsp + 0x20]
mov rcx, rax
lea r8, [rsp + 0x28]
xor edx, edx
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
test eax, eax
je 0x1800958d0
test eax, eax
jle 0x180095947
neg ebx
jmp 0x180095947
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x70], rbp
mov rbp, rdx
test rdx, rdx
je 0x180095925
cmp dword [rdx + 4], edi
je 0x1800958f7
mov rdx, qword [rdx + 0x28]
mov qword [rsp + 0x20], rdx
test rdx, rdx
jne 0x1800958e2
jmp 0x18009591c
mov r8, qword [rdx + 0x10]
mov eax, dword [rsp + 0x90]
cmp rax, r8
jae 0x18009590e
mov ebx, 0xfffffff4
jmp 0x18009591c
mov rdx, qword [rdx + 0x20]
mov rcx, rsi
call fcn.1800a2a90
xor ebx, ebx
mov rcx, rbp

Function at 0x180095960
Capabilities:
Set socket configuration

Disassembly:
push rdi
sub rsp, 0x30
mov dword [rsp + 0x40], 0x50001
mov edi, edx
test ecx, ecx
jns 0x18009597c
xor eax, eax
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x48], rbx
lea r9, [rsp + 0x40]
movsxd rbx, ecx
mov edx, 0xffff
mov rcx, rbx
mov dword [rsp + 0x20], 4
mov r8d, pe_nt_image_headers64
call qword [sym.imp.WS2_32.dll_setsockopt]
xor eax, eax
lea r8, [rsp + 0x50]
test edi, edi
mov edx, 0x8004667e
mov rcx, rbx
setne al
mov dword [rsp + 0x50], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rbx, qword [rsp + 0x48]
cmp eax, 0xffffffff
jne 0x180095a43
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
neg eax
cmp eax, 0xffffd8cd
jne 0x1800959e9
mov ecx, 0xfffffff5
mov eax, ecx
add rsp, 0x30
pop rdi
ret
cmp eax, 0xffffd8cb
je 0x1800959dc
cmp eax, 0xffffd8ba
jne 0x180095a04
mov ecx, 0xffffff94
mov eax, ecx
add rsp, 0x30
pop rdi
ret
cmp eax, 0xffffd8b8
jne 0x180095a18
mov ecx, 0xffffff8f
mov eax, ecx
add rsp, 0x30
pop rdi
ret
cmp eax, 0xffffd8b7
jne 0x180095a2c
mov ecx, 0xffffff82
mov eax, ecx
add rsp, 0x30
pop rdi
ret
cdq
mov ecx, 0xfffffff5
xor eax, edx
sub eax, edx
neg eax
cmove eax, ecx
mov ecx, eax
add rsp, 0x30
pop rdi
ret
xor ecx, ecx
mov eax, ecx
add rsp, 0x30
pop rdi
ret

Function at 0x180095de0
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
mov dword [rsp + 0x20], 1
mov rdi, rcx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x180095e1f
call qword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov ecx, dword [rsp + 0x28]
xor eax, eax
mov dword [rdi], ecx
mov ecx, dword [rsp + 0x30]
mov dword [rbx], ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180095e70
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
movsxd rcx, ecx
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180095eb9
call qword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
cmp eax, 0xffffff18
jne 0x180095ead
mov eax, 0xfffffff5
add rsp, 0x30
pop rbx
ret
cmp eax, 0xffffff93
cmove eax, ebx
add rsp, 0x30
pop rbx
ret
mov eax, dword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret

Function at 0x180095ed0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
xor eax, eax
mov dword [rsp + 0x48], eax
test rdx, rdx
je 0x180095f20
test r8d, r8d
je 0x180095f20
movsxd rcx, ecx
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
Function at 0x180098020
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
jne 0x18009802b
mov eax, 1
ret
xor eax, eax
mov qword [rcx + 0x48], rax
mov qword [rcx], rax
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx + 8], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x10], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x18], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x20], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x28], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x30], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x38], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x40], rax
xor eax, eax
ret
Function at 0x18009d370
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
mov r14d, r9d
mov rcx, qword [rcx + 0xa8]
mov r15, r8
movsxd r12, edx
test rcx, rcx
jne 0x18009d4cb
lea rcx, [r14 + 0x14]
call fcn.1800a411c
mov qword [rbx + 0xa8], rax
test rax, rax
jne 0x18009d3c8
call fcn.1800a41dc
mov eax, dword [rax]
neg eax
jmp 0x18009d51d
mov qword [rsp + 0x40], rsi
nop dword [rax]
call fcn.1800a4480
mov edi, eax
test al, al
je 0x18009d3d0
mov rcx, qword [rbx + 0xa8]
lea edx, [r14 + 8]
mov dword [rcx + 4], 0
mov rcx, qword [rbx + 0xa8]
mov dword [rcx], edx
mov rsi, qword [rbx + 0xa8]
mov byte [rsi + 8], dil
movzx eax, byte [rbx + 4]
mov byte [rsi + 9], al
mov eax, dword [rbx + 4]
lea rcx, [rax + rax*8]
add rcx, r12
lea rax, [0x1800f3160]
movzx eax, byte [rcx + rax]
mov ecx, r14d
mov byte [rsi + 0xa], al
call qword [sym.imp.WS2_32.dll_htonl]
mov byte [rsi + 0xf], 0
mov dword [rsi + 0xb], eax
mov rax, qword [rbx + 0xa8]
movzx ecx, byte [rax + 9]
mov byte [rsi + 0xf], cl
mov rax, qword [rbx + 0xa8]
xor cl, byte [rax + 0xa]
mov byte [rsi + 0xf], cl
mov rax, qword [rbx + 0xa8]
xor cl, byte [rax + 0xb]
mov byte [rsi + 0xf], cl
mov rax, qword [rbx + 0xa8]
xor cl, byte [rax + 0xc]
mov byte [rsi + 0xf], cl
mov rax, qword [rbx + 0xa8]
xor cl, byte [rax + 0xd]
mov byte [rsi + 0xf], cl
mov rax, qword [rbx + 0xa8]
xor cl, byte [rax + 0xe]
mov byte [rsi + 0xf], cl
test r14d, r14d
je 0x18009d493
lea rcx, [rsi + 0x10]
mov r8, r14
mov rdx, r15
call fcn.1800a2a90
mov rcx, qword [rbx + 0xa8]
mov eax, 1
mov rsi, qword [rsp + 0x40]
cmp dword [rcx], eax
jbe 0x18009d4cb
nop dword [rax + rax]
mov rcx, qword [rbx + 0xa8]
mov edx, eax
inc eax
xor byte [rdx + rcx + 8], dil
mov rcx, qword [rbx + 0xa8]
cmp eax, dword [rcx]
jb 0x18009d4b0
mov eax, dword [rcx + 4]
lea rdx, [rcx + 8]
mov r8d, dword [rcx]
add rdx, rax
mov r9, qword [rbx + 0x10]
sub r8d, eax
mov rcx, r9
call qword [r9 + 0x48]
mov edi, eax
test eax, eax
jle 0x18009d51b
mov rcx, qword [rbx + 0xa8]
add dword [rcx + 4], eax
mov rcx, qword [rbx + 0xa8]
mov edi, dword [rcx]
cmp dword [rcx + 4], edi
jb 0x18009d516
call fcn.1800a4108
mov qword [rbx + 0xa8], 0
jmp 0x18009d51b
mov edi, 0xfffffff5
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1800a1490
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x1800f3188]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rax, r8
mov rbx, rdx
mov r8, rdx
mov rdi, rcx
mov edx, 0x20
mov rcx, rax
call fcn.180097300
and byte [rbx + 0x1f], 0x3f
lea rcx, [rsp + 0x20]
and byte [rbx], 0xf8
mov rdx, rbx
or byte [rbx + 0x1f], 0x40
call fcn.180099280
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1800991e0
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800a1bf0
mov rbx, qword [rsp + 0xf8]
add rsp, 0xd0
pop rdi
ret
Function at 0x1800a1650
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
movsxd r11, r9d
mov r10, r8
mov rbx, rdx
test r9d, r9d
jle 0x1800a16c8
sub rbx, r8
inc byte [rcx + 0x100]
lea r10, [r10 + 1]
movzx r9d, byte [rcx + 0x100]
movzx eax, byte [r9 + rcx]
add byte [rcx + 0x101], al
movzx r8d, byte [rcx + 0x101]
movzx edx, byte [r9 + rcx]
movzx eax, byte [r8 + rcx]
mov byte [r9 + rcx], al
mov byte [r8 + rcx], dl
movzx eax, byte [rcx + 0x101]
movzx edx, byte [rcx + 0x100]
movzx edx, byte [rdx + rcx]
add dl, byte [rax + rcx]
movzx eax, dl
movzx edx, byte [rax + rcx]
xor dl, byte [rbx + r10 - 1]
mov byte [r10 - 1], dl
sub r11, 1
jne 0x1800a1666
mov rbx, qword [rsp + 8]
ret

Function at 0x1800a16d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor r10d, r10d
mov edi, r8d
mov eax, r10d
mov rsi, rdx
mov r11, rcx
mov r9, rcx
nop dword [rax]
nop word [rax + rax]
mov byte [r9], al
lea r9, [r9 + 1]
inc eax
cmp eax, 0x100
jl 0x1800a1700
mov word [rcx + 0x100], r10w
xor bl, bl
mov r9, r11
nop dword [rax]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
mov eax, r10d
movzx ecx, r8b
cdq
inc r10d
idiv edi
movsxd rax, edx
add cl, byte [rax + rsi]
add bl, cl
movzx ecx, bl
movzx eax, byte [rcx + r11]
mov byte [r9 - 1], al
mov byte [rcx + r11], r8b
cmp r10d, 0x100
jl 0x1800a1720
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x1800a1770
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rsp + 0x48]
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1800a17bf
mov rcx, qword [rsp + 0x48]
mov r8, rbx
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x48]
xor edx, edx
test eax, eax
jne 0x1800a17ca
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 1
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x140011230
Capabilities:
Terminate process

Disassembly:
jmp 0x140013840
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112cb
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014b90
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014bb0
xor al, al
jmp 0x140014c31
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014bc3
xor al, al
jmp 0x140014c31
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014bed
xor al, al
jmp 0x140014c31
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014c01
xor al, al
jmp 0x140014c31
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014c13
xor al, al
jmp 0x140014c31
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014c2f
xor al, al
jmp 0x140014c31
mov al, 1
add rsp, 0x38
ret
Function at 0x140004370
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140004393
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x14]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140004380
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x1400043a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x1400043d4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1400043c0
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140004409
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.1400096f0
nop
cmp byte [rbx + 0xa], 0
je 0x140004433
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 9
jb 0x140004420
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140004468
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1400096f0
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000b440
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400044bc
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400044b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400044b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cef0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400044fc
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400044f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400044f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cef0
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004510
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140004544
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x140004530
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140004579
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.1400096f0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140004587
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000c410
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400045fc
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400045f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400045f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cef0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140004610
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140004644
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x140004630
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140004679
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.1400096f0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140004687
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14000c410
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400046fc
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400046f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400046f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cef0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140004710
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140004738
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x14]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x140004720
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x1400052c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x1400052f4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1400052e0
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140005329
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.1400096f0
nop
cmp byte [rbx + 0xb], 0
je 0x140005353
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xa
jb 0x140005340
mov byte [rbx + 0xb], 0
lea rax, [rbx + 0xa]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140005388
mov r8d, 0xa
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1400096f0
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.14000b440
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400053dc
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400053d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400053d6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cef0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14000541c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005417
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005417
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007cef0
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret