joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14048e100
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14048e14c
mov eax, r8d
xor eax, 0xb2ffd56b
add eax, dword [0x14067c4b0]
cmp edx, eax
jne 0x14048e17c
movzx eax, byte [0x14067ac24]
cmp al, 0x6a
je 0x14048e144
mov cl, 0x4d
nop dword [rax + rax]
mov al, 0xd
lock cmpxchg byte [0x14067ac24], cl
je 0x14048e1e8
cmp al, 0x6a
jne 0x14048e130
lea rax, [0x14067ac20]
ret
test edx, edx
je 0x14048e1ac
movzx eax, byte [0x14067adb0]
cmp al, 0xd7
je 0x14048e174
mov cl, 0xd9
nop dword [rax]
mov al, 0x2f
lock cmpxchg byte [0x14067adb0], cl
je 0x14048e2a1
cmp al, 0xd7
jne 0x14048e160
lea rax, [0x14067ada0]
ret
movzx eax, byte [0x14067b626]
cmp al, 0xf0
je 0x14048e1a4
mov cl, 0xa1
nop dword [rax]
mov al, 0xd8
lock cmpxchg byte [0x14067b626], cl
je 0x14048e22a
cmp al, 0xf0
jne 0x14048e190
lea rax, [0x14067b620]
ret
movzx eax, byte [0x14067ad73]
cmp al, 0xe4
je 0x14048e1e0
mov cl, 0x5b
nop dword [rax]
mov al, 0xcc
lock cmpxchg byte [0x14067ad73], cl
je 0x14048e301
mov edx, r8d
xor dl, 0x22
add dl, byte [0x14067c4b4]
cmp al, dl
jne 0x14048e1c0
lea rax, [0x14067ad70]
ret
xor edx, edx
lea rax, [0x14067ac20]
lea rcx, [0x14055c0f0]
nop dword [rax + rax]
movsxd r8, edx
movzx edx, byte [r8 + rcx]
xor byte [r8 + rax], dl
lea edx, [r8 + r8]
sub edx, r8d
inc edx
cmp edx, 4
jl 0x14048e200
mov al, 0x6a
xchg byte [0x14067ac24], al
lea rax, [0x14067ac20]
ret
xor eax, eax
lea rcx, [0x14067b620]
lea rdx, [0x14055ca60]
nop word [rax + rax]
xor r9d, r9d
sub r9b, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
xor r11d, r11d
sub r11b, r10b
mov r10d, r9d
xor r10b, r11b
and r11b, r9b
add r11b, r11b
add r11b, r10b
neg r11b
mov byte [rax + rcx], r11b
lea r9d, [rax + 1]
cmp r9d, 5
jg 0x14048e277
inc rax
jmp 0x14048e240
mov eax, r8d
not al
xor r8b, 0x29
and al, 0xd6
or r8b, al
not r8b
or r8b, al
add r8b, byte [0x14067c4b4]
xchg byte [0x14067b626], r8b
lea rax, [0x14067b620]
ret
xor eax, eax
lea rcx, [0x14067ada0]
lea rdx, [0x14055c270]
mov r9d, r8d
xor r9d, 0xb2ffd56a
nop dword [rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
add byte [rax + rcx], r10b
mov r10d, dword [0x14067c4b0]
mov r11d, r9d
xor r11d, r10d
and r10d, r9d
lea r10d, [r11 + r10*2]
add eax, r10d
cmp eax, 0x10
jl 0x14048e2c0
xor r8b, 0x2f
add r8b, byte [0x14067c4b4]
xchg byte [0x14067adb0], r8b
lea rax, [0x14067ada0]
ret
xor eax, eax
lea rcx, [0x14067ad70]
lea rdx, [0x14055c240]
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 2
jg 0x14048e338
inc rax
jmp 0x14048e320
xor r8b, 0x22
add r8b, byte [0x14067c4b4]
xchg byte [0x14067ad73], r8b
lea rax, [0x14067ad70]
ret

Function at 0x14048e8e0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
movzx r10d, byte [rcx + 0x12]
mov rax, rdx
not rax
mov r11, r10
not r11
mov rsi, rdx
and rsi, r11
mov edi, r10d
and edi, eax
or rdi, rsi
mov rbx, rdi
not rbx
xor rdi, rax
and rbx, rdx
or rbx, rdi
not rbx
xor r11, rdx
xor rax, r10
or rax, rsi
not rax
or rax, r11
not rax
or rax, rbx
movabs rdx, 0x100000001b3
imul rdx, rax
mov qword [r8], rdx
add rcx, 0x13
mov qword [r9], rcx
pop rbx
pop rdi
pop rsi
ret
Function at 0x14048f6d0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14048f799
mov eax, r8d
xor eax, 0xc28b559d
mov ecx, r8d
not ecx
and ecx, r8d
xor ecx, eax
add ecx, dword [0x14067c4b0]
cmp edx, ecx
jne 0x14048f802
movzx eax, byte [0x14067ac69]
nop word cs:[rax + rax]
cmp al, 0x69
je 0x14048f791
movzx ecx, byte [0x14067c4b4]
mov edx, r8d
xor dl, 0x53
mov r9d, r8d
xor r9b, 0xac
mov eax, ecx
xor al, r9b
xor r9b, dl
and r9b, cl
xor r9b, dl
and al, cl
add al, al
add al, r9b
mov edx, r8d
xor dl, 0xd1
add dl, cl
lock cmpxchg byte [0x14067ac69], dl
jne 0x14048f710
xor edx, edx
lea rax, [0x14067ac60]
lea rcx, [0x14055c130]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
not edx
and edx, 0x7ffffffe
or edx, r8d
not edx
lea edx, [r8 + rdx*2]
cmp edx, 9
jl 0x14048f760
mov al, 0x69
xchg byte [0x14067ac69], al
lea rax, [0x14067ac60]
ret
test edx, edx
je 0x14048f828
movzx eax, byte [0x14067b1d1]
cmp al, 0x64
je 0x14048f7fa
nop dword [rax]
movzx eax, byte [0x14067c4b4]
mov ecx, r8d
xor cl, al
xor cl, 0xb9
mov edx, r8d
xor dl, 0x46
mov r9d, r8d
xor r9b, 0xc3
add r9b, al
not al
and al, dl
or al, cl
not al
add al, al
add al, cl
lock cmpxchg byte [0x14067b1d1], r9b
je 0x14048f89f
mov ecx, r8d
xor cl, 0x54
add cl, byte [0x14067c4b4]
cmp al, cl
jne 0x14048f7b0
lea rax, [0x14067b1c0]
ret
movzx eax, byte [0x14067aed1]
cmp al, 0x5b
je 0x14048f820
mov cl, 0x96
nop
mov al, 0x11
lock cmpxchg byte [0x14067aed1], cl
je 0x14048f85c
cmp al, 0x5b
jne 0x14048f810
lea rax, [0x14067aec0]
ret
movzx eax, byte [0x14067ac94]
cmp al, 0x82
je 0x14048f854
mov cl, 0xc4
nop word cs:[rax + rax]
mov al, 0x90
lock cmpxchg byte [0x14067ac94], cl
je 0x14048f8e8
cmp al, 0x82
jne 0x14048f840
lea rax, [0x14067ac90]
ret
xor edx, edx
lea rax, [0x14067aec0]
lea rcx, [0x14055c380]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x11
jl 0x14048f870
mov al, 0x5b
xchg byte [0x14067aed1], al
lea rax, [0x14067aec0]
ret
xor eax, eax
lea rcx, [0x14067b1c0]
lea rdx, [0x14055c660]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x14048f8d8
inc rax
jmp 0x14048f8b0
mov al, 0x64
xchg byte [0x14067b1d1], al
lea rax, [0x14067b1c0]
ret
xor eax, eax
lea rcx, [0x14067ac90]
lea rdx, [0x14055c160]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x14048f918
inc rax
jmp 0x14048f900
mov al, 0x82
xchg byte [0x14067ac94], al
lea rax, [0x14067ac90]
ret
Function at 0x14048f9a0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14048f9dc
test edx, edx
je 0x14048fa18
movzx eax, byte [0x14067b09d]
cmp al, 0x3c
je 0x14048f9d4
mov cl, 0x49
nop word [rax + rax]
mov al, 0xd1
lock cmpxchg byte [0x14067b09d], cl
je 0x14048fa7c
cmp al, 0x3c
jne 0x14048f9c0
lea rax, [0x14067b090]
ret
test edx, edx
je 0x14048fa4c
movzx eax, byte [0x14067b68d]
cmp al, 0xc3
je 0x14048fa10
mov cl, 0x4e
nop dword [rax]
mov al, 0x36
lock cmpxchg byte [0x14067b68d], cl
je 0x14048fac8
mov edx, r8d
xor dl, 0xe3
add dl, byte [0x14067c4b4]
cmp al, dl
jne 0x14048f9f0
lea rax, [0x14067b680]
ret
movzx eax, byte [0x14067b197]
cmp al, 0x3f
je 0x14048fa44
mov cl, 0x49
nop word cs:[rax + rax]
mov al, 0x68
lock cmpxchg byte [0x14067b197], cl
je 0x14048fb08
cmp al, 0x3f
jne 0x14048fa30
lea rax, [0x14067b190]
ret
movzx eax, byte [0x14067ad4a]
cmp al, 0xd8
je 0x14048fa74
mov cl, 0x79
nop dword [rax]
mov al, 0x9e
lock cmpxchg byte [0x14067ad4a], cl
je 0x14048fb7b
cmp al, 0xd8
jne 0x14048fa60
lea rax, [0x14067ad40]
ret
xor eax, eax
lea rcx, [0x14067b090]
lea rdx, [0x14055c530]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14048fab8
inc rax
jmp 0x14048fa90
mov al, 0x3c
xchg byte [0x14067b09d], al
lea rax, [0x14067b090]
ret
xor eax, eax
lea rcx, [0x14067b680]
lea rdx, [0x14055cac0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14048fb51
inc rax
jmp 0x14048fae0
xor eax, eax
lea rcx, [0x14067b190]
lea rdx, [0x14055c630]
mov r9d, r8d
xor r9d, 0x580d484
nop word cs:[rax + rax]
movzx r10d, byte [rax + rdx]
add byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x14067c4b0]
add r11d, r9d
cmp r10d, r11d
jge 0x14048fb61
inc rax
jmp 0x14048fb30
mov al, 0xc3
xchg byte [0x14067b68d], al
lea rax, [0x14067b680]
ret
xor r8b, 0x67
add r8b, byte [0x14067c4b4]
xchg byte [0x14067b197], r8b
lea rax, [0x14067b190]
ret
xor edx, edx
lea rax, [0x14067ad40]
lea rcx, [0x14055c210]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xa
jl 0x14048fb90
mov al, 0xd8
xchg byte [0x14067ad4a], al
lea rax, [0x14067ad40]
ret
Function at 0x14049c1a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
test ecx, ecx
je 0x14049c1d9
test edx, edx
je 0x14049c209
movzx eax, byte [0x14067d242]
cmp al, 0xbc
je 0x14049c2b7
mov cl, 0x31
nop word [rax + rax]
mov al, 0xc8
lock cmpxchg byte [0x14067d242], cl
je 0x14049c279
cmp al, 0xbc
jne 0x14049c1c0
jmp 0x14049c2b7
test edx, edx
je 0x14049c249
movzx eax, byte [0x14067cf8f]
cmp al, 0x9c
je 0x14049c330
mov cl, 0xe
nop
mov al, 0xa
lock cmpxchg byte [0x14067cf8f], cl
je 0x14049c2c0
cmp al, 0x9c
jne 0x14049c1f0
jmp 0x14049c330
movzx eax, byte [0x14067cf4d]
movzx ecx, byte [0x14067e778]
add cl, 0x9c
cmp al, cl
je 0x14049c341
mov cl, 0x4e
nop word cs:[rax + rax]
mov al, 0xf0
lock cmpxchg byte [0x14067cf4d], cl
je 0x14049c2e8
cmp al, 0x2b
jne 0x14049c230
jmp 0x14049c341
movzx eax, byte [0x14067d0ab]
cmp al, 0xea
je 0x14049c3b5
mov cl, 0x8a
nop word [rax + rax]
mov al, 0xd5
lock cmpxchg byte [0x14067d0ab], cl
je 0x14049c34a
cmp al, 0xea
jne 0x14049c260
jmp 0x14049c3b5
xor edx, edx
lea rax, [0x14067d240]
lea rcx, [0x14055d0f0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 2
jl 0x14049c290
mov al, 0xbc
xchg byte [0x14067d242], al
lea rax, [0x14067d240]
pop rbx
ret
xor eax, eax
lea rcx, [0x14067cf80]
lea rdx, [0x14055ce80]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x14049c328
inc rax
jmp 0x14049c2d0
xor eax, eax
lea rcx, [0x14067cf40]
lea rdx, [0x14055ce40]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14049c339
inc rax
jmp 0x14049c300
mov al, 0x9c
xchg byte [0x14067cf8f], al
lea rax, [0x14067cf80]
pop rbx
ret
mov al, 0x2b
xchg byte [0x14067cf4d], al
lea rax, [0x14067cf40]
pop rbx
ret
xor edx, edx
lea rax, [0x14067d090]
lea rcx, [0x14055cf70]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
not r10b
mov r11d, r10d
xor r11b, r9b
not r9b
mov ebx, r8d
and bl, r9b
or bl, r11b
not bl
xor r9b, r10b
and r9b, r8b
or r9b, bl
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 0x7ffffffe
and r8d, edx
xor edx, 1
lea edx, [rdx + r8*2]
cmp edx, 0x1b
jl 0x14049c360
mov al, 0xea
xchg byte [0x14067d0ab], al
lea rax, [0x14067d090]
pop rbx
ret
Function at 0x1404aa1f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov eax, dword [0x140680e54]
mov r8d, eax
xor r8d, 0xb70b5091
mov r9d, eax
and r9d, 0x370b5091
add r9d, r9d
xor eax, r8d
xor eax, 0x4814a122
and eax, r9d
xor eax, r8d
and r9d, r8d
lea eax, [rax + r9*2]
cmp ecx, eax
jne 0x1404aa259
test edx, edx
je 0x1404aa289
movzx eax, byte [0x140680abb]
cmp al, 0xac
je 0x1404aa3ce
mov cl, 0x80
nop dword [rax]
mov al, 0xc7
lock cmpxchg byte [0x140680abb], cl
je 0x1404aa2e9
cmp al, 0xac
jne 0x1404aa240
jmp 0x1404aa3ce
test edx, edx
je 0x1404aa2b9
movzx eax, byte [0x140680b05]
cmp al, 0x1b
je 0x1404aa3ba
mov cl, 0x62
nop
mov al, 0xcc
lock cmpxchg byte [0x140680b05], cl
je 0x1404aa32c
cmp al, 0x1b
jne 0x1404aa270
jmp 0x1404aa3ba
movzx eax, byte [0x140680afc]
cmp al, 5
je 0x1404aa41e
mov cl, 0xd9
nop word [rax + rax]
mov al, 0xa4
lock cmpxchg byte [0x140680afc], cl
je 0x1404aa3da
cmp al, 5
jne 0x1404aa2a0
jmp 0x1404aa41e
movzx eax, byte [0x140680b1b]
cmp al, 0x90
je 0x1404aa480
mov cl, 0x22
nop word [rax + rax]
mov al, 0xb4
lock cmpxchg byte [0x140680b1b], cl
je 0x1404aa427
cmp al, 0x90
jne 0x1404aa2d0
jmp 0x1404aa480
xor eax, eax
lea rcx, [0x140680aa0]
lea rdx, [0x14055dd00]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x1a
jg 0x1404aa3c6
inc rax
jmp 0x1404aa300
xor r8d, r8d
lea rax, [0x140680b00]
lea rcx, [0x14055dd60]
mov edx, 0xb70b5096
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rax]
movzx r10d, byte [r8 + rcx]
mov r11d, r10d
not r11b
mov ebx, r11d
xor bl, r9b
and bl, r11b
or bl, r9b
not bl
mov esi, r11d
xor sil, r10b
and sil, r9b
xor sil, r10b
and sil, r11b
or sil, bl
mov byte [r8 + rax], sil
add r8d, 0xca685e8d
mov r9d, r8d
xor r9d, 0x3597a174
and r8d, 0x3597a174
lea r8d, [r9 + r8*2]
mov r9d, dword [0x140680e54]
add r9d, edx
cmp r8d, r9d
jl 0x1404aa350
mov al, 0x1b
xchg byte [0x140680b05], al
lea rax, [0x140680b00]
jmp 0x1404aa487
mov al, 0xac
xchg byte [0x140680abb], al
lea rax, [0x140680aa0]
jmp 0x1404aa487
xor edx, edx
lea rax, [0x140680ae0]
lea rcx, [0x14055dd40]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x1c
jl 0x1404aa3f0
movzx eax, byte [0x140680e50]
add al, 0x87
xchg byte [0x140680afc], al
lea rax, [0x140680ae0]
jmp 0x1404aa487
xor r8d, r8d
lea rax, [0x140680b10]
lea rcx, [0x14055dd70]
mov edx, 0xb70b5092
nop dword [rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
add byte [r8 + rax], r9b
mov r9d, dword [0x140680e54]
add r9d, edx
mov r10d, r9d
not r10d
mov r11d, r10d
xor r11d, r9d
and r11d, r8d
xor r11d, r9d
xor r10d, r8d
and r10d, r8d
lea r8d, [r11 + r10*2]
cmp r8d, 0xb
jl 0x1404aa440
mov al, 0x90
xchg byte [0x140680b1b], al
lea rax, [0x140680b10]
pop rbx
pop rsi
ret
Function at 0x10000124c
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.100001180
add rsp, 0x28
jmp 0x100001270
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [section..data], rdi
jne 0x10000169f
mov eax, dword [0x100003014]
cmp eax, 1
je 0x1000016bf
mov eax, dword [0x100003014]
cmp eax, ebx
jne 0x1000016d6
mov dword [0x100003014], 1
lea r13, [0x100002168]
lea rdi, [0x100002150]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x10000131c
cmp eax, ebx
jne 0x10000131c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x100001311
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1000012fa
cmp eax, ebx
jne 0x1000016cc
mov eax, dword [0x100003014]
cmp eax, 1
jne 0x10000134c
lea rdx, [0x100002148]
lea rcx, [0x100002138]
call fcn.10017a000
mov dword [0x100003014], 2
cmp r12d, ebx
jne 0x10000135b
mov rax, rbx
xchg qword [section..data], rax
cmp qword [0x1000035d8], rbx
jne 0x1000016e5
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
je 0x10000170e
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [rcx], 0x20
jbe 0x1000013ab
cmp word [rcx], 0x22
je 0x100001741
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x100001390
cmp word [rcx], bx
je 0x1000013b4
cmp edx, ebx
jne 0x100001396
cmp word [rcx], bx
je 0x1000013ca
cmp word [rcx], 0x20
ja 0x1000013ca
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1000013b4
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x100000000]
call fcn.100001400
nop
jmp 0x100001715
cmp rax, rdi
jne 0x1000016af
mov r12d, 1
jmp 0x1000012ba
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000012a9
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x100001324
mov eax, 0xff
jmp 0x100001780
mov dword [0x1000036e4], 1
jmp 0x100001324
lea rcx, [0x1000035d8]
call fcn.1000018fc
cmp eax, ebx
je 0x100001368
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x1000035d8]
nop
jmp 0x100001368
mov eax, 0xff
jmp 0x100001780
mov dword [0x1000036e0], eax
cmp dword [0x100003008], ebx
jne 0x10000172b
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1000036e4], ebx
jne 0x10000173f
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1000036e0]
jmp 0x100001780
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
jmp 0x1000013a0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
Function at 0x1400081e0
Capabilities:
Hash data using crc32b

Disassembly:
xor r9d, r9d
lea r10, [0x1400b56f0]
nop word [rax + rax]
xor eax, eax
test r9b, 1
je 0x1400081fc
bts eax, 7
mov ecx, r9d
shr ecx, 1
test cl, 1
je 0x14000820a
bts eax, 6
shr ecx, 1
test cl, 1
je 0x140008215
bts eax, 5
shr ecx, 1
test cl, 1
je 0x140008220
bts eax, 4
shr ecx, 1
test cl, 1
je 0x14000822b
bts eax, 3
shr ecx, 1
test cl, 1
je 0x140008236
bts eax, 2
shr ecx, 1
test cl, 1
je 0x140008241
bts eax, 1
test cl, 2
je 0x14000824a
bts eax, 0
shl eax, 0x18
lea ecx, [rax + rax]
mov edx, ecx
xor edx, 0x4c11db7
test eax, eax
cmovns edx, ecx
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov r8d, eax
xor r8d, 0x4c11db7
test edx, edx
cmovns r8d, eax
xor ecx, ecx
lea edx, [rcx + 0x1e]
test r8b, 1
je 0x1400082e1
lea eax, [rdx + 1]
bts ecx, eax
sar r8d, 1
test r8b, 1
je 0x1400082ed
bts ecx, edx
sar r8d, 1
sub edx, 2
cmp edx, 0xfffffffe
jg 0x1400082d5
mov dword [r10], ecx
inc r9d
add r10, 4
cmp r9d, 0x100
jl 0x1400081f0
mov dword [0x1400b56e0], 1
ret
Function at 0x14000b150
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp dword [r8 + 0x38], 1
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov rbp, rcx
je 0x14000b17f
xor eax, eax
jmp 0x14000b337
mov ecx, dword [r9 + 0x10]
mov qword [rsp + 0x30], rsi
call qword [sym.imp.WS2_32.dll_ntohl]
mov esi, eax
lea rax, [rsi - 1]
cmp rax, 0xfe
ja 0x14000b2f8
mov ecx, dword [rdi + 0x1c]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0xa4]
jne 0x14000b2f8
mov ecx, dword [rdi + 0x20]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0x9c]
jne 0x14000b2f8
mov ecx, dword [rdi + 0x24]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0xa0]
jne 0x14000b2f8
mov eax, dword [rbx + 0x1c]
cmp dword [rdi + 0x28], eax
jne 0x14000b2f8
mov edx, 1
mov r8b, 0xff
mov rcx, rbx
call fcn.14000b350
cmp rsi, qword [rbx + 0x48]
jae 0x14000b205
mov qword [rbx + 0x48], rsi
movzx ecx, word [rdi + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rbx + 0x18], ax
movzx eax, byte [rdi + 6]
mov byte [rbx + 0x21], al
movzx eax, byte [rdi + 7]
mov byte [rbx + 0x20], al
mov ecx, dword [rdi + 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, 0x240
mov esi, 0x1000
cmp eax, ecx
jb 0x14000b23f
cmp eax, esi
mov ecx, eax
cmova ecx, esi
cmp ecx, dword [rbx + 0xd0]
jae 0x14000b24d
mov dword [rbx + 0xd0], ecx
mov ecx, dword [rdi + 0xc]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, esi
jb 0x14000b266
mov ecx, 0x10000
mov esi, eax
cmp eax, ecx
cmova esi, ecx
cmp esi, dword [rbx + 0xd4]
jae 0x14000b274
mov dword [rbx + 0xd4], esi
mov ecx, dword [rdi + 0x14]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbx + 0x50], eax
mov ecx, dword [rdi + 0x18]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbx + 0x54], eax
mov rcx, rbx
mov dword [rbp + 0x24], 1
test r14, r14
je 0x14000b2c0
call fcn.140008850
mov dword [rbx + 0x38], 5
mov dword [r14], 1
mov qword [r14 + 8], rbx
mov eax, dword [rbx + 0x1c8]
mov dword [r14 + 0x14], eax
xor eax, eax
jmp 0x14000b332
xor edi, edi
cmp dword [rbx + 0x38], 1
sete dil
add edi, 3
call fcn.140008880
cmp dword [rbx + 0x140], 0
mov dword [rbx + 0x38], edi
jne 0x14000b2f4
lea rcx, [rbp + 0x48]
mov rdx, rbx
call fcn.140008000
mov dword [rbx + 0x140], 1
xor eax, eax
jmp 0x14000b332
xor edi, edi
mov rcx, rbx
mov dword [rbx + 0x1c8], edi
call fcn.140008880
mov dword [rbx + 0x38], 9
cmp dword [rbx + 0x140], edi
jne 0x14000b32d
lea rcx, [rbp + 0x48]
mov rdx, rbx
call fcn.140008000
mov dword [rbx + 0x140], 1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000c210
Capabilities:
Resolve dns

Disassembly:
push rbx
push r14
sub rsp, 0x58
mov rax, qword [0x1400b25b8]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, rcx
mov rbx, rdx
mov rcx, rdx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x14000c255
cmp word [rax + 0x10], 2
jne 0x14000c255
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov eax, dword [rcx]
mov dword [r14], eax
xor eax, eax
jmp 0x14000c309
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x50], rsi
xor esi, esi
mov qword [rsp + 0x48], rdi
mov ebp, esi
mov qword [rsp + 0x40], r15
mov edi, esi
mov dword [rsp + 0x28], 0
lea r15d, [rsi + 0x2e]
nop
lea rdx, [rbx + 1]
mov qword [rsp + 0x20], rdx
cmp byte [rbx], 0x30
je 0x14000c2c3
mov r8d, 0xa
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
cmp eax, 0xff
ja 0x14000c2eb
mov rdx, qword [rsp + 0x20]
cmp rdx, rbx
je 0x14000c2eb
mov rcx, rdx
sub rcx, rbx
cmp rcx, 3
jg 0x14000c2eb
mov byte [rsp + rdi + 0x28], al
movsx eax, byte [rdx]
cmp ebp, 3
mov ecx, esi
cmovl ecx, r15d
cmp eax, ecx
jne 0x14000c2eb
inc ebp
lea rbx, [rdx + 1]
inc rdi
cmp rdi, 4
jl 0x14000c280
mov eax, dword [rsp + 0x28]
mov dword [r14], eax
jmp 0x14000c2f0
mov esi, 0xffffffff
mov r15, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14007c610
add rsp, 0x58
pop r14
pop rbx
ret

Function at 0x14000c330
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x1400b25b8]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ecx, 0x101
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14000c399
movzx eax, word [rsp + 0x20]
cmp al, 1
jne 0x14000c393
shr ax, 8
cmp al, 1
jne 0x14000c393
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14007c610
add rsp, 0x1d8
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14007c610
add rsp, 0x1d8
ret

Function at 0x14000c490
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400b25b8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x28]
lea r8, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x14000c4d8
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14007c610
add rsp, 0x40
pop rbx
ret
mov eax, dword [rsp + 0x2c]
movzx ecx, word [rsp + 0x2a]
mov dword [rbx], eax
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rbx + 4], ax
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14007c610
add rsp, 0x40
pop rbx
ret