joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002f341
Capabilities:
Read file on windows

Disassembly:
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
push rax
lea rax, [0x1800a7cbf]
call rax
call fcn.18002e41d
test al, al
je 0x18004c4fd
movss xmm7, dword [0x1800b6da0]
push rbp
lea rbp, [0x18003e7ba]
push rbp
ret
xor sil, sil
mov rdx, qword [rbp - 0x21]
jmp 0x18006f0de
cmp ecx, r8d
jg 0x1800303f0
test ecx, ecx
js 0x1800303f0
push rbp
lea rbp, [0x18007adc0]
jmp rbp
pop rdi
pop rdi
cmp qword [rax + 0x18], 0x10
jb 0x180059e34
mov rax, qword [rax]
push rbp
call fcn.180059e32
pop rcx
sub rsp, 0x60
mov rax, qword [0x1800c1010]
xor rax, rsp
mov qword [rsp + 0x58], rax
push rbp
call fcn.1800a4804
pop rsi
test eax, eax
js 0x180074747
xor r10d, r10d
mov dword [rsp + 0x28], r10d
push rcx
lea rcx, [0x180061650]
push rcx
ret
xor cl, cl
movzx ebp, cl
movups xmm0, xmmword [r14 + 0x80]
push rdi
lea rdi, [0x180087970]
call rdi
cmp eax, edi
mov esi, edi
cmovg esi, eax
push rdx
lea rdx, [0x18002c099]
call rdx
pop rdx
int3
movss xmm7, dword [0x1800b6db0]
movss xmm8, dword [0x1800b6db4]
push rbx
lea rbx, [0x180005e4c]
jmp rbx
mov byte [rbp - 0x39], 0
test sil, sil
push rbp
lea rbp, [0x1800aec63]
call rbp
movss xmm8, dword [rdx]
movaps xmmword [rsp], xmm9
movss xmm9, dword [r8 + 4]
movzx r8d, word [rcx + 0x48]
push rdx
lea rdx, [0x1800675bb]
jmp rdx
cmp r8, r12
jne 0x1800230b2
mov rcx, rax
push rbp
lea rbp, [0x18006190d]
jmp rbp
mov eax, 8
jmp 0x18004595f
cmp rdx, 0x10
jb 0x18008dd5f
push rbp
lea rbp, [0x18002b8e9]
call rbp
pop rcx
test ecx, ecx
je 0x180063f21
push rax
lea rax, [0x18008a993]
call rax
pop rdx
pop rdx
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
jmp 0x180091554
mov dword [rsp + 0x28], r8d
jmp 0x1800996da
mov qword [rbp - 0x29], 0
mov qword [rbp - 0x21], 0xf
jmp 0x18004daa1
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x180015322
push rdi
lea rdi, [0x180050d48]
jmp rdi
mov r10d, r8d
mov eax, r10d
lea ecx, [rsi + rax]
jmp 0x18002a509

Function at 0x180036b8a
Capabilities:
Hash data with crc32

Disassembly:
pop rbx
pop rbx
call fcn.180021f27
mov byte [rbp + 0x9c], al
mov dl, 0x61
lea rcx, [rbp + 0x90]
push rsi
lea rsi, [0x18004a339]
call rsi

Function at 0x1800499f8
Capabilities:
Hash data with crc32

Disassembly:
pop rdi
pop rdi
cmp byte [rdx + 0x1c41], 0
je 0x180044837
cmp dword [rdx + 0x1c58], 0
push rdi
call fcn.18006f948
pop rdx
mov byte [rbp + 0xdb1], r8b
mov r8d, r10d
jmp 0x180093fda
xor al, cl
mov byte [rbp + 0xd9a], r13b
movd ecx, xmm1
mov byte [rbp + 0xda1], al
push rbx
call fcn.180040fbb
pop rcx
mov dil, 0x28
movzx esi, r9b
push rdx
call fcn.18006fe0d
pop rdi
pop rdi
lea rcx, [rbp + 0x10]
shl rax, 0x20
xor rax, qword [rbp + 0x20]
xor rax, qword [rbp + 0x10]
push rdi
lea rdi, [0x180066791]
push rdi
ret

Function at 0x180058c06
Capabilities:
Hash data with crc32

Disassembly:
pop rcx
pop rcx
jne 0x18009bf4e
movss xmm0, dword [rcx + 0x24]
maxss xmm0, dword [rcx + 0x34]
jmp 0x18009db34
subss xmm0, dword [rcx + 0x60]
mov byte [rdx + 0x1c41], r9b
movss dword [rsp + 0x2c], xmm0
movss dword [rsp + 0x24], xmm0
jmp 0x18000172c
Function at 0x180064721
Capabilities:
Read .ini file

Disassembly:
pop rax
pop rax
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rbp + 0xf98], xmm1
mov dl, 0x58
push rsi
call fcn.180041cea
xor r8d, r8d
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push rbp
call fcn.1800a99c0
pop rbp
jb 0x180090e22
mov r8, qword [rcx - 8]
add rdx, 0x27
jmp 0x1800a7575
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
push rdx
lea rdx, [0x180090e18]
jmp rdx

Function at 0x18006f105
Capabilities:
Read file on windows

Disassembly:
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
push rax
lea rax, [0x1800a7cbf]
call rax
call fcn.18002e41d
test al, al
je 0x18004c4fd
movss xmm7, dword [0x1800b6da0]
push rbp
lea rbp, [0x18003e7ba]
push rbp
ret
xor sil, sil
mov rdx, qword [rbp - 0x21]
jmp 0x18006f0de
cmp ecx, r8d
jg 0x1800303f0
test ecx, ecx
js 0x1800303f0
push rbp
lea rbp, [0x18007adc0]
jmp rbp
pop rdi
pop rdi
cmp qword [rax + 0x18], 0x10
jb 0x180059e34
mov rax, qword [rax]
push rbp
call fcn.180059e32
pop rcx
sub rsp, 0x60
mov rax, qword [0x1800c1010]
xor rax, rsp
mov qword [rsp + 0x58], rax
push rbp
call fcn.1800a4804
pop rsi
test eax, eax
js 0x180074747
xor r10d, r10d
mov dword [rsp + 0x28], r10d
push rcx
lea rcx, [0x180061650]
push rcx
ret
xor cl, cl
movzx ebp, cl
movups xmm0, xmmword [r14 + 0x80]
push rdi
lea rdi, [0x180087970]
call rdi
cmp eax, edi
mov esi, edi
cmovg esi, eax
push rdx
lea rdx, [0x18002c099]
call rdx
pop rdx
int3
movss xmm7, dword [0x1800b6db0]
movss xmm8, dword [0x1800b6db4]
push rbx
lea rbx, [0x180005e4c]
jmp rbx
mov byte [rbp - 0x39], 0
test sil, sil
push rbp
lea rbp, [0x1800aec63]
call rbp
movss xmm8, dword [rdx]
movaps xmmword [rsp], xmm9
movss xmm9, dword [r8 + 4]
movzx r8d, word [rcx + 0x48]
push rdx
lea rdx, [0x1800675bb]
jmp rdx
cmp r8, r12
jne 0x1800230b2
mov rcx, rax
push rbp
lea rbp, [0x18006190d]
jmp rbp
mov eax, 8
jmp 0x18004595f
cmp rdx, 0x10
jb 0x18008dd5f
push rbp
lea rbp, [0x18002b8e9]
call rbp
pop rcx
test ecx, ecx
je 0x180063f21
push rax
lea rax, [0x18008a993]
call rax
pop rdx
pop rdx
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
jmp 0x180091554
mov dword [rsp + 0x28], r8d
jmp 0x1800996da
mov qword [rbp - 0x29], 0
mov qword [rbp - 0x21], 0xf
jmp 0x18004daa1
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x180015322
push rdi
lea rdi, [0x180050d48]
jmp rdi
mov r10d, r8d
mov eax, r10d
lea ecx, [rsi + rax]
jmp 0x18002a509

Function at 0x18006f948
Capabilities:
Hash data with crc32

Disassembly:
pop rdi
pop rdi
jne 0x180044837
cmp dword [rdx + 0x1cb8], 0
jmp 0x18007f933
jne 0x180044837
cmp dword [rdx + 0x1c48], 0
push rbx
lea rbx, [0x18002c6e1]
jmp rbx

Function at 0x18007c167
Capabilities:
Read .ini file

Disassembly:
pop rbp
pop rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push rax
call fcn.180011ce6
pop rax
jmp 0x1800339fb
Function at 0x18007ea30
Capabilities:
Read .ini file

Disassembly:
pop rdi
pop rdi
mov dword [rsp + 0x5c], r15d
mov dword [rsp + 0x58], r12d
jne 0x1800879a2
add r11d, r15d
push rax
lea rax, [0x18007ba63]
call rax
pop rdi
movdqa xmm2, xmmword [0x1800b88d0]
movdqu xmmword [rbp - 0x29], xmm2
movdqa xmm3, xmmword [0x1800b87f0]
push rcx
lea rcx, [0x18003dd9d]
call rcx
pop rax
movzx eax, word [r14]
add rcx, rax
add rcx, qword [r13 + 0x30]
call fcn.180095164
push rax
lea rax, [0x18003ec60]
jmp rax
inc r9d
push rbx
call fcn.18005fe7d

Function at 0x18008a032
Capabilities:
Read file on windows

Disassembly:
pop rdi
pop rdi
addss xmm0, xmm11
movss dword [r15 + r12 + 0x14], xmm0
movzx eax, word [r14 - 2]
push rdx
call fcn.1800a943d
pop rcx
lea rcx, [rbp]
call fcn.180021f27
mov dl, 0x6c
push rsi
lea rsi, [0x18000c484]
call rsi
pop rdx
pop rdx
je 0x18001c06c
call qword [0x1800b0638]
push rdi
lea rdi, [0x18001c06b]
push rdi
ret
xor r12d, r12d
jmp 0x18006f0b6
add rbx, 8
cmp rbx, rdi
jmp 0x180027f59
jb 0x18008a026
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
push rdx
call fcn.180035604
pop rdx
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push rbx
lea rbx, [0x1800a0889]
jmp rbx
mov eax, dword [rbp - 0x21]
mov dword [rbp + 7], eax
mov ebx, dword [rdi + 0x98]
jmp 0x18005cb10
mov eax, ebx
bts eax, 0xa
push rdx
lea rdx, [0x1800a84b4]
call rdx
mov word [rbx + 0x1c29], 0
mov dword [rbx + 0x1c2c], r12d
mov dword [rbx + 0x1bd0], r12d
cmp byte [rbx + 0x1c41], r12b
push rbx
lea rbx, [0x18004d7d4]
call rbx
mov rax, qword [rbx]
test rax, rax
push rdx
call 0x180001fe0
pop rbp
pop rbp
lea rcx, [rbp + 0x4d0]
call fcn.180021f27
mov dl, 0x42
push rsi
lea rsi, [0x18009a7ce]
call rsi
cmp byte [rbx + 0x1c2a], 0
je 0x18000a5fd
jmp 0x18009b9c1
movsxd rcx, eax
mov rax, qword [rbx + 0x1bb0]
push rcx
call fcn.18002d16b
pop rdi
test rdi, rdi
jne 0x180036c4b
movdqa xmm1, xmmword [0x1800b7e60]
push rdi
lea rdi, [0x18005a6c1]
jmp rdi
mov eax, dword [rbx + 0x1c1c]
jmp 0x18009754b

Function at 0x18008ba9f
Capabilities:
Read .ini file

Disassembly:
pop rdi
pop rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push rbp
lea rbp, [0x1800140e5]
call rbp
pop rdx
mov qword [rbx + 0x18], rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, rbx
mov rbx, qword [rsp + 0x50]
push rax
lea rax, [0x18001cfc6]
call rax
lea rcx, [rbp + 0x8a8]
call fcn.180021f27
push rcx
call fcn.180023d9b
pop rsi
mov edx, r8d
call fcn.1800a55c3
movsxd rdx, dword [rbx]
push rbp
call fcn.1800760e9
pop rdi
pop rdi
cmovs r10d, r9d
movsxd rdx, r10d
push rdi
lea rdi, [0x18000de8f]
call rdi
movsd xmm0, qword [r8]
lea r10, [r9 + 0x128]
movss xmm7, dword [0x1800b8a40]
lea r11, [r9 + 0x42c]
push rcx
lea rcx, [0x18001da0e]
push rcx
ret
Function at 0x18008d800
Capabilities:
Create thread

Disassembly:
pop rdi
pop rdi
call fcn.180021f27
mov byte [rbp + 0xb17], al
push rbx
lea rbx, [0x180067d0d]
call rbx
pop rbp
pop rbp
cmp ecx, r8d
jne 0x18009a048
inc ecx
test r8d, r8d
jmp 0x1800aa56a
nop
mov rax, qword [0x1800c2b50]
push rsi
lea rsi, [0x1800268a4]
call rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
je 0x1800ab590
mov eax, r8d
cdq
sub eax, edx
push rbx
lea rbx, [0x1800364e2]
jmp rbx
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push rbx
lea rbx, [0x180090e2d]
call rbx
pop rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::_Lockit::constructor_int____ptr64]
jmp 0x1800a4318

Function at 0x18009bf4c
Capabilities:
Hash data with crc32

Disassembly:
add rsp, 0x38
jmp fcn.180010f6c
mov rbx, qword [0x1800c2208]
movss xmm1, dword [rbx + 0x1554]
lea rcx, [rbx + 0x1af8]
push rbx
lea rbx, [0x180041ae3]
call rbx
pop rsi
movaps xmm0, xmmword [rsi]
lea rax, [rdx - 0x10000]
movaps xmmword [rsp + 0x50], xmm0
push rbp
lea rbp, [0x18003b2f6]
call rbp
pop rcx
pop rcx
cmp dword [rdx + 0x1c4c], 3
jne 0x180044837
movss xmm0, dword [rcx + 0x60]
xorps xmm0, xmmword [0x1800b8a50]
push rdx
lea rdx, [0x18006ea7a]
call rdx
pop rdx
je 0x180093d7f
cmp byte [rax + 0x7f], 0
je 0x180093d7f
mov rdx, rax
push rdx
lea rdx, [0x180032cf5]
push rdx
ret

Function at 0x1800ab509
Capabilities:
Read clipboard data

Disassembly:
pop rdi
pop rdi
mov qword [rsp + 0x38], rsi
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rsi, rax
test rax, rax
push rbp
lea rbp, [0x18004ee4a]
jmp rbp

Function at 0x1800adb1d
Capabilities:
Terminate process

Disassembly:
pop rbx
pop rbx
lea rax, [rbp - 0x10]
cmove rax, r12
mov qword [rbp - 0x60], rax
mov rax, qword [0x1800c21a8]
push rsi
call fcn.18006be25
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x140001000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
call fcn.1400a6120
xor r10d, r10d
test eax, eax
js 0x14000122f
mov ecx, dword [rbx + 0xf0]
lea eax, [rcx*4]
movsxd r9, eax
test eax, eax
jle 0x14000108c
lea rdx, [rbx + 8]
lea rdx, [rdx + r9*4]
lea r8, [rbx + 8]
mov ecx, dword [r8 - 8]
add r10, 4
mov eax, dword [rdx - 8]
sub r9, 4
mov dword [r8 - 8], eax
mov eax, dword [rdx - 4]
mov dword [rdx - 8], ecx
mov ecx, dword [r8 - 4]
mov dword [r8 - 4], eax
mov eax, dword [rdx]
mov dword [rdx - 4], ecx
mov ecx, dword [r8]
mov dword [r8], eax
lea r8, [r8 + 0x10]
mov eax, dword [rdx + 4]
mov dword [rdx], ecx
lea rdx, [rdx - 0x10]
mov ecx, dword [r8 - 0xc]
mov dword [r8 - 0xc], eax
mov dword [rdx + 0x14], ecx
cmp r10, r9
jl 0x14000103d
mov ecx, dword [rbx + 0xf0]
mov r11d, 1
cmp ecx, r11d
jle 0x14000122d
lea r10, [rbx + 2]
lea rdi, [0x140000000]
lea r10, [r10 + 0x10]
inc r11d
mov r8d, dword [r10 - 2]
mov eax, r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0xae8e0]
movzx eax, byte [r10 - 1]
mov r9d, dword [rdi + rdx*4 + 0xaece0]
movzx ecx, byte [rdi + rax*4 + 0xae8e0]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0xaf4e0]
movzx ecx, byte [rdi + rax*4 + 0xae8e0]
movzx eax, byte [r10]
xor r9d, dword [rdi + rcx*4 + 0xaf8e0]
movzx ecx, byte [rdi + rax*4 + 0xae8e0]
xor r9d, dword [rdi + rcx*4 + 0xaf0e0]
mov dword [r10 - 2], r9d
mov r9d, dword [r10 + 2]
mov eax, r9d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0xae8e0]
movzx eax, byte [r10 + 3]
mov r8d, dword [rdi + rdx*4 + 0xaece0]
movzx ecx, byte [rdi + rax*4 + 0xae8e0]
movzx eax, byte [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0xaf4e0]
movzx ecx, byte [rdi + rax*4 + 0xae8e0]
movzx eax, r9b
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0xaf0e0]
movzx ecx, byte [rdi + rax*4 + 0xae8e0]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0xaf8e0]
movzx edx, byte [rdi + rax*4 + 0xae8e0]
movzx eax, byte [r10 + 7]
mov dword [r10 + 2], r8d
mov r8d, dword [rdi + rdx*4 + 0xaece0]
movzx ecx, byte [rdi + rax*4 + 0xae8e0]
movzx eax, byte [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0xaf4e0]
movzx ecx, byte [rdi + rax*4 + 0xae8e0]
movzx eax, r9b
mov r9d, dword [r10 + 0xa]
xor r8d, dword [rdi + rcx*4 + 0xaf0e0]
movzx ecx, byte [rdi + rax*4 + 0xae8e0]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0xaf8e0]
movzx edx, byte [rdi + rax*4 + 0xae8e0]
movzx eax, byte [r10 + 0xb]
mov dword [r10 + 6], r8d
mov r8d, dword [rdi + rdx*4 + 0xaece0]
movzx ecx, byte [rdi + rax*4 + 0xae8e0]
movzx eax, byte [r10 + 0xc]
xor r8d, dword [rdi + rcx*4 + 0xaf4e0]
movzx ecx, byte [rdi + rax*4 + 0xae8e0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0xaf0e0]
movzx ecx, byte [rdi + rax*4 + 0xae8e0]
xor r8d, dword [rdi + rcx*4 + 0xaf8e0]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x1400010a6
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400053e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x10], rdx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdi, rdx
and dword [rbp - 0x30], 0
lea rdx, [rbp - 0x28]
call fcn.1400a9f54
mov rcx, rdi
call fcn.14000f95c
mov dword [rbp - 0x30], 1
mov edx, 0x20
mov rcx, rdi
call fcn.140015618
xor esi, esi
mov word [rbp - 0x15], 0x3433
mov word [rbp - 0x18], 0x3130
mov word [rbp - 0xa], 0x6665
mov word [rbp - 0x13], 0x3635
mov word [rbp - 0xd], 0x6362
mov word [rbp - 0x10], 0x3938
mov byte [rbp - 0xb], 0x64
mov byte [rbp - 0x16], 0x32
mov byte [rbp - 8], 0
mov byte [rbp - 0x11], 0x37
mov byte [rbp - 0xe], 0x61
movzx ebx, byte [rbp + rsi - 0x28]
mov eax, ebx
shr rax, 4
mov dl, byte [rbp + rax - 0x18]
mov rcx, rdi
call fcn.140013810
and ebx, 0xf
mov dl, byte [rbp + rbx - 0x18]
mov rcx, rdi
call fcn.140013810
inc rsi
cmp rsi, 0x10
jl 0x14000542d
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x1400062c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
lea rsi, [rcx + 0x50]
mov word [rbp - 0x39], 0x3130
movups xmm0, xmmword [rsi]
mov rdi, rdx
mov rbx, rcx
movups xmm1, xmmword [rsi + 0x10]
mov word [rbp - 0x2a], 0x66
movups xmmword [rbp + 0x37], xmm0
mov dword [rbp - 0x36], 0x36353433
movups xmmword [rbp + 0x47], xmm1
mov dword [rbp - 0x2f], 0x64636261
mov byte [rbp - 0x2b], 0x65
mov word [rbp - 0x32], 0x3837
mov byte [rbp - 0x37], 0x32
mov byte [rbp - 0x30], 0x39
call fcn.14000d5f8
xor ecx, ecx
lea r8, [rbp + 0x37]
sub r8, rbx
lea r9d, [rcx + 8]
mov edx, dword [rsi]
lea rcx, [rcx + 8]
mov eax, edx
shr rax, 0x1c
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x21], al
mov eax, edx
shr rax, 0x18
and eax, 0xf
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x20], al
mov eax, edx
shr rax, 0x14
and eax, 0xf
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x1f], al
mov eax, edx
shr rax, 0x10
and eax, 0xf
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x1e], al
mov eax, edx
shr rax, 0xc
and eax, 0xf
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x1d], al
mov eax, edx
shr rax, 8
and eax, 0xf
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x1c], al
mov eax, edx
shr rax, 4
and edx, 0xf
and eax, 0xf
mov al, byte [rbp + rax - 0x39]
mov byte [rbp + rcx - 0x1b], al
mov al, byte [rbp + rdx - 0x39]
mov byte [rbp + rcx - 0x1a], al
mov eax, dword [r8 + rsi - 0x50]
mov dword [rsi], eax
lea rsi, [rsi + 4]
sub r9, 1
jne 0x14000633a
mov byte [rbp + rcx - 0x19], r9b
lea rdx, [rbp - 0x19]
mov rcx, rdi
call fcn.14000f8d4
lea r11, [rsp + 0xb0]
mov rax, rdi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400076dc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rcx, [rbp - 0x10]
mov word [rbp - 0xa], 0x642e
mov word [rbp - 0xd], 0x3372
mov word [rbp - 0x10], 0x7355
mov word [rbp - 7], WSASetLastError
mov byte [rbp - 0xe], 0x65
mov byte [rbp - 0xb], 0x32
mov byte [rbp - 8], WSAGetLastError
call fcn.140008014
add rsp, 0x30
pop rbp
ret

Function at 0x14000774c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov esi, r9d
mov r14, r8
mov r15d, edx
mov r12, rcx
xor ebx, ebx
call fcn.1400aa274
mov rdi, rax
test rax, rax
je 0x1400077f8
lea rdx, [rbp - 0x20]
mov word [rbp - 0x11], 0x6c69
mov rcx, rax
mov dword [rbp - 0xe], 0x736567
mov dword [rbp - 0x1f], 0x73756a64
mov dword [rbp - 0x16], 0x6972506e
mov dword [rbp - 0x1a], 0x656b6f54
mov byte [rbp - 0x12], 0x76
mov byte [rbp - 0xf], 0x65
mov byte [rbp - 0x1b], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x20], 0x41
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400077f0
mov rax, qword [rbp + 0x48]
mov r9d, esi
mov qword [rsp + 0x28], rax
mov r8, r14
mov rax, qword [rbp + 0x40]
mov edx, r15d
mov rcx, r12
mov qword [rsp + 0x20], rax
call r10
mov ebx, eax
mov rcx, rdi
call fcn.1400aa6c4
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140007818
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov edi, r9d
mov esi, r8d
mov r14, rdx
mov r15, rcx
call fcn.1400aa274
mov rbx, rax
test rax, rax
je 0x1400078c6
lea rdx, [rbp - 0x20]
mov word [rbp - 9], 0x614e
mov rcx, rax
mov word [rbp - 6], 0x4165
mov dword [rbp - 0x14], 0x63634174
mov word [rbp - 0xe], 0x5773
mov byte [rbp - 4], 0
mov dword [rbp - 0x20], 0x6c697542
mov dword [rbp - 0x1a], 0x696c7078
mov byte [rbp - 7], WSASetLastError
mov word [rbp - 0xb], 0x6874
mov byte [rbp - 0xc], 0x69
mov word [rbp - 0x10], 0x7365
mov word [rbp - 0x16], 0x6963
mov word [rbp - 0x1c], 0x4564
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400078be
mov ecx, dword [rbp + 0x40]
mov r9d, edi
mov dword [rsp + 0x20], ecx
mov r8d, esi
mov rcx, r15
mov rdx, r14
call rax
mov rcx, rbx
call fcn.1400aa6c4
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400078e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rdi, rcx
call fcn.14000d7d8
mov rbx, rax
test rax, rax
je 0x140007943
lea rdx, [rbp - 0x10]
mov word [rbp - 8], 0x466d
mov rcx, rax
mov dword [rbp - 0x10], 0x61546f43
mov dword [rbp - 6], 0x656572
mov word [rbp - 0xb], 0x4d6b
mov byte [rbp - 9], 0x65
mov byte [rbp - 0xc], reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000793b
mov rcx, rdi
call rax
mov rcx, rbx
call fcn.1400aa6c4
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret

Function at 0x140007954
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rdi, r9
mov word [rbp - 0x10], 0x7243
mov rsi, r8
mov word [rbp - 6], 0x7365
mov r14, rdx
mov dword [rbp - 0xd], 0x50657461
mov r15, rcx
mov word [rbp - 9], 0x6f72
xor ebx, ebx
mov word [rbp - 3], 0x41
mov byte [rbp - 0xe], 0x65
mov byte [rbp - 4], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 7], 0x63
call fcn.14000769c
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x140007a05
mov rax, qword [rbp + 0x68]
mov r9, rdi
mov qword [rsp + 0x48], rax
mov r8, rsi
mov rax, qword [rbp + 0x60]
mov rdx, r14
mov qword [rsp + 0x40], rax
mov rcx, r15
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x50]
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 0x48]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x40]
mov dword [rsp + 0x20], eax
call r10
mov ebx, eax
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140007a24
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov edi, edx
mov word [rbp - 0x11], 0x5332
mov esi, ecx
mov dword [rbp - 0xb], 0x746f68
or rbx, 0xffffffffffffffff
mov dword [rbp - 0x20], 0x61657243
mov dword [rbp - 0x1c], 0x6f546574
mov dword [rbp - 0x16], 0x706c6568
mov word [rbp - 0x18], 0x6c6f
mov dword [rbp - 0xf], 0x7370616e
mov byte [rbp - 0x12], 0x33
call fcn.14000769c
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007a96
mov edx, edi
mov ecx, esi
call rax
mov rbx, rax
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret