joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140055c3c
Capabilities:
Set socket configuration

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x140093028]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor ebp, ebp
mov rsi, r9
mov r14, rdx
mov rdi, rcx
mov ebx, ebp
cmp rcx, 0xffffffffffffffff
je 0x140055d3c
test r8b, r8b
je 0x140055cad
mov al, byte [rdx]
test al, 8
je 0x140055cad
or al, 8
mov dword [rsp + 0x60], ebp
mov byte [rdx], al
lea r9, [rsp + 0x60]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea rcx, [rsp + 0x30]
setne dl
call fcn.140055b8c
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, rsi
mov ebx, eax
setne dl
call fcn.140055b8c
test ebx, ebx
je 0x140055d3c
mov edx, 0x2733
lea rcx, [rsp + 0x48]
call fcn.14006344c
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.140053704
test al, al
jne 0x140055d09
mov edx, 0x4d5
lea rcx, [rsp + 0x30]
call fcn.14006344c
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140053704
test al, al
je 0x140055d3c
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], ebp
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [r14], 0xfc
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, rsi
mov ebx, eax
setne dl
call fcn.140055b8c
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140069020
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140055d58
Capabilities:
Send data
Send data on socket

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140093028]
xor rax, rsp
mov qword [rsp + 0x60], rax
and qword [r11 - 0x48], 0
lea r9, [r11 - 0x20]
and qword [r11 - 0x50], 0
and dword [rsp + 0x20], 0
mov rbx, qword [rsp + 0xa0]
and dword [rsp + 0x58], 0
call qword [sym.imp.WS2_32.dll_WSASend]
mov dl, 1
mov rcx, rbx
mov edi, eax
call fcn.140055b8c
cmp qword [rbx + 0x10], 1
movabs r9, 0x4800144005b3
je 0x140055dbd
mov ecx, dword [rbx]
mov r8d, ecx
jmp 0x140055ded
mov rcx, qword [rbx + 8]
mov rax, r9
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul ecx, ecx, 0x3e8
add ecx, r8d
cmp ecx, 0x40
jne 0x140055df9
mov edx, 0x2746
jmp 0x140055e3b
cmp qword [rbx + 0x10], 1
jne 0x140055e2d
mov rcx, qword [rbx + 8]
mov rax, r9
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x140055e43
mov edx, 0x274d
mov rcx, rbx
call fcn.1400633c0
test edi, edi
je 0x140055e4c
or eax, 0xffffffff
jmp 0x140055e67
and qword [rsp + 0x50], 0
xorps xmm0, xmm0
mov eax, dword [rsp + 0x58]
movups xmmword [rbx], xmm0
movsd xmm0, qword [rsp + 0x50]
movsd qword [rbx + 0x10], xmm0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140069020
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
ret
Function at 0x140061f70
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x200
mov rax, qword [0x140093028]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov bl, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x140095318], eax
inc eax
cmp eax, 1
jne 0x140061fc1
lea ecx, [rax + 1]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x14009531c], eax
test bl, bl
je 0x14006204e
xor ebx, ebx
lock xadd dword [0x14009531c], ebx
test ebx, ebx
je 0x14006204e
and dword [rsp + 0x3c], 0
lea rsi, str.Xb_b_
movabs rcx, 0x4d54ee85da812030
add rcx, qword [0x140093510]
cmp rcx, 1
jbe 0x14006200b
mov rax, qword [str.Xb_b_]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x14006200d
mov al, 1
lea rcx, str.C:Users_ntoskrnlDesktopSDK_boost_asio_182_0_boost_asiodetail_throw_error.hpp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x48], rax
lea rcx, str.throw_on_error
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x30], 0x30
mov dword [rsp + 0x34], 5
test al, 1
jne 0x140062076
mov rax, rdi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.140069020
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.140054178
int3

Function at 0x140062850
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x140093028]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbp, rcx
mov rdi, r9
mov rcx, qword [rcx + 8]
mov rsi, rdx
cmp rcx, 0xffffffffffffffff
jne 0x14006288d
mov edx, 0x2719
mov rcx, r9
call fcn.1400633c0
jmp 0x1400628bc
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 1
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov edx, eax
mov rcx, rdi
shr edx, 0x1f
mov ebx, eax
call fcn.140055b8c
test ebx, ebx
js 0x1400628bc
or byte [rbp + 0x10], 2
movups xmm0, xmmword [rdi]
mov rax, rsi
movups xmmword [rsi], xmm0
movsd xmm1, qword [rdi + 0x10]
movsd qword [rsi + 0x10], xmm1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140069020
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140064b0c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x140093028]
xor rax, rsp
mov qword [rbp + 0x47], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
and qword [rbp - 0x49], 0
mov rbx, qword [rcx + 0x18]
xor eax, eax
lock xadd dword [rbx + 0x30], eax
test eax, eax
jne 0x140064b59
mov rcx, rbx
call fcn.1400552e4
jmp 0x140064c11
and dword [rbp + 0x27], 0
lea rcx, [rbp + 0x2f]
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrCreate_void____ptr64_]
xor edx, edx
lea r8d, [rdx + 0x50]
lea rcx, [rbp - 0x29]
call sub.VCRUNTIME140.dll_memset
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x41], xmm0
mov qword [rbp - 0x31], rax
mov rax, rbx
lea rdx, [rbx + 0x28]
neg rax
sbb rcx, rcx
and rcx, rdx
mov qword [rbp - 0x41], rcx
lea rax, [rbp - 0x29]
mov qword [rbp - 0x39], rax
mov ecx, dword [0x140095324]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rbp - 0x31], rax
lea rdx, [rbp - 0x41]
mov ecx, dword [0x140095324]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea r9, [rbp - 0x59]
lea r8, [rbp - 0x29]
mov rcx, rbx
call fcn.1400553fc
test rax, rax
jne 0x140064bc1
mov rdx, qword [rbp - 0x31]
mov ecx, dword [0x140095324]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea rbx, [rbp - 0x29]
mov edi, 0xa
mov rcx, qword [rbx]
test rcx, rcx
je 0x140064bfd
call fcn.1400699b0
add rbx, 8
sub rdi, 1
jne 0x140064bf0
lea rcx, [rbp + 0x2f]
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrDestroy_void____ptr64_]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140069020
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140065eb8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rbx, r8
mov rsi, rdx
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x140065edd
mov rdx, qword [r8]
movabs rbp, 0xcbf29ce484222325
xor ecx, ecx
cmp qword [r8 + 0x10], rcx
jbe 0x140065f0d
movzx eax, byte [rcx + rdx]
xor rbp, rax
movabs r8, 0x100000001b3
imul rbp, r8
inc rcx
cmp rcx, qword [rbx + 0x10]
jb 0x140065eef
mov r9, rbp
mov r8, rbx
lea rdx, [rsp + 0x30]
call fcn.140067664
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x140065f33
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x1400660ff
movabs rax, 0x492492492492492
cmp qword [0x140095100], rax
jne 0x140065f54
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [0x1400950f8]
mov qword [rsp + 0x20], rax
and qword [rsp + 0x28], 0
mov ecx, 0x38
call fcn.140069794
mov rdi, rax
mov qword [rsp + 0x28], rax
mov rdx, rbx
lea rcx, [rax + 0x10]
call fcn.14004e164
mov ecx, dword [rbx + 0x20]
mov dword [rdi + 0x30], ecx
mov r9, qword [0x140095100]
lea rcx, [r9 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x140065fa4
cvtsi2ss xmm0, rcx
jmp 0x140065fb9
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rbx, qword [0x140095128]
xorps xmm2, xmm2
test rbx, rbx
js 0x140065fcf
cvtsi2ss xmm2, rbx
jmp 0x140065fe7
mov rcx, rbx
shr rcx, 1
mov rax, rbx
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm1, xmm0
divss xmm1, xmm2
movss xmm3, dword [0x1400950f0]
comiss xmm1, xmm3
seta al
test al, al
je 0x140066089
divss xmm0, xmm3
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
xor ecx, ecx
movss xmm1, dword [0x140086ecc]
comiss xmm0, xmm1
jb 0x140066032
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140066032
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x140066060
cmp rbx, 0x200
jae 0x14006605d
shl rbx, 3
cmp rbx, rcx
jae 0x140066060
mov rbx, rcx
mov rdx, rbx
call fcn.1400664fc
mov r9, rbp
lea r8, [rdi + 0x10]
lea rdx, [rsp + 0x30]
call fcn.140067664
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x30], xmm0
mov r9, qword [0x140095100]
and qword [rsp + 0x28], 0
mov rdx, qword [rsp + 0x30]
mov r8, qword [rdx + 8]
inc r9
mov qword [0x140095100], r9
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [r8], rdi
mov qword [rdx + 8], rdi
mov rcx, qword [0x140095108]
mov rax, qword [0x140095120]
and rax, rbp
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [0x1400950f8]
jne 0x1400660d7
mov qword [rcx + rax*8], rdi
jmp 0x1400660e9
cmp r9, rdx
jne 0x1400660e2
mov qword [rcx + rax*8], rdi
jmp 0x1400660ee
cmp qword [rcx + rax*8 + 8], r8
jne 0x1400660ee
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
lea rcx, [rsp + 0x20]
call fcn.140066118
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400664fc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rdx, rax
jbe 0x14006653b
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rbp, qword [0x1400950f8]
lea rax, [rdx - 1]
or rax, 1
mov ebx, 1
bsr rcx, rax
mov r8, rbp
inc ecx
shl rbx, cl
lea rcx, [0x140095108]
lea rdx, [rbx + rbx]
call fcn.1400629f4
lea r8, [rbx - 1]
mov qword [0x140095128], rbx
mov rbx, qword [0x1400950f8]
mov qword [0x140095120], r8
mov rbx, qword [rbx]
mov rdi, rbx
cmp rbx, rbp
je 0x1400666f5
mov rdi, qword [rdi]
lea r15, [rbx + 0x10]
cmp qword [r15 + 0x18], 0x10
mov rdx, r15
jb 0x1400665a7
mov rdx, qword [r15]
xor ecx, ecx
movabs r14, 0xcbf29ce484222325
cmp qword [r15 + 0x10], rcx
jbe 0x1400665d7
movzx eax, byte [rcx + rdx]
movabs r9, 0x100000001b3
xor r14, rax
inc rcx
imul r14, r9
cmp rcx, qword [r15 + 0x10]
jb 0x1400665b9
mov r12, qword [0x140095108]
and r14, r8
add r14, r14
cmp qword [r12 + r14*8], rbp
jne 0x1400665f8
mov qword [r12 + r14*8], rbx
mov qword [r12 + r14*8 + 8], rbx
jmp 0x1400666e1
mov rsi, qword [r12 + r14*8 + 8]
lea rdx, [rsi + 0x10]
cmp qword [rdx + 0x18], 0x10
mov rax, qword [rdx + 0x10]
jb 0x14006660f
mov rdx, qword [rdx]
cmp qword [r15 + 0x18], 0x10
mov rcx, r15
jb 0x14006661c
mov rcx, qword [r15]
cmp qword [r15 + 0x10], rax
jne 0x14006665a
mov r8, qword [r15 + 0x10]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14006665a
mov r8, qword [rsi]
cmp r8, rbx
je 0x1400665ee
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
jmp 0x1400665ee
cmp qword [r12 + r14*8], rsi
je 0x1400666bc
mov rsi, qword [rsi + 8]
lea rdx, [rsi + 0x10]
cmp qword [rdx + 0x18], 0x10
mov rax, qword [rdx + 0x10]
jb 0x140066676
mov rdx, qword [rdx]
cmp qword [r15 + 0x18], 0x10
mov rcx, r15
jb 0x140066683
mov rcx, qword [r15]
cmp qword [r15 + 0x10], rax
jne 0x14006665a
mov r8, qword [r15 + 0x10]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14006665a
mov r8, qword [rsi]
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
jmp 0x1400666e1
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rsi
mov rax, qword [rsi + 8]
mov qword [rax], rbx
mov qword [rsi + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12 + r14*8], rbx
mov rbx, rdi
cmp rdi, rbp
je 0x1400666f5
mov r8, qword [0x140095120]
jmp 0x140066593
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call fcn.1400667c4
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140067120
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140067184
lea r8, [r9 + 8]
mov r11d, 0x7fffffff
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
and edx, r11d
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140067144
mov ecx, dword [r9]
jmp 0x14006725d
cmp ecx, 0x4e0
jb 0x14006725d
lea r10, [r9 + 0x9c4]
mov esi, 0xe3
mov edi, dword [r10]
mov r11d, 0x7fffffff
mov eax, edi
mov edi, dword [r10 + 4]
mov edx, edi
lea r10, [r10 + 4]
xor edx, eax
and edx, r11d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rsi, 1
jne 0x1400671a5
lea r10, [r9 + 0xd50]
mov esi, 0x18c
mov edi, dword [r10]
mov eax, edi
mov edi, dword [r10 + 4]
mov edx, edi
lea r10, [r10 + 4]
xor edx, eax
and edx, r11d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rsi, 1
jne 0x1400671ed
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
and edx, r11d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov rsi, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret
Function at 0x14006734c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rdi, r8
mov rsi, rdx
mov r10, rcx
cmp rdx, r8
je 0x1400674f0
mov r14, qword [rcx + 0x18]
lea rax, [rcx + 8]
mov r12, qword [rdx + 8]
lea rcx, [rdx + 0x10]
cmp qword [rcx + 0x18], 0x10
mov r13, qword [rax]
mov r9, qword [rcx + 0x10]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], rdx
jb 0x1400673a7
mov rcx, qword [rcx]
xor r8d, r8d
movabs rdx, 0xcbf29ce484222325
movabs r11, 0x100000001b3
test r9, r9
je 0x1400673d7
movzx eax, byte [r8 + rcx]
inc r8
xor rdx, rax
imul rdx, r11
cmp r8, r9
jb 0x1400673c3
mov r15, qword [r10 + 0x30]
lea rcx, [rbp - 0x20]
and r15, rdx
add r15, r15
mov rbx, qword [r14 + r15*8]
mov rax, qword [r14 + r15*8 + 8]
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x48], rax
call fcn.14006750c
mov rax, qword [rbp + 0x48]
cmp rsi, rax
je 0x14006742c
mov rcx, qword [rbp - 0x10]
cmp rcx, rdi
je 0x1400674a6
cmp rcx, rax
lea rcx, [rbp - 0x20]
sete bl
call fcn.14006750c
mov rax, qword [rbp + 0x48]
test bl, bl
je 0x140067404
mov rbx, qword [rbp + 0x50]
cmp rbx, rsi
jne 0x140067438
mov qword [r14 + r15*8], r13
mov r12, r13
mov qword [r14 + r15*8 + 8], r12
mov rcx, qword [rbp - 0x10]
cmp rcx, rdi
je 0x1400674e5
mov r12, qword [rbp + 0x40]
lea rdx, [rcx + 0x10]
cmp qword [rdx + 0x18], 0x10
mov r10, qword [rdx + 0x10]
jb 0x140067460
mov rdx, qword [rdx]
xor r9d, r9d
movabs r8, 0xcbf29ce484222325
test r10, r10
je 0x140067494
movabs rcx, 0x100000001b3
movzx eax, byte [r9 + rdx]
inc r9
xor r8, rax
imul r8, rcx
cmp r9, r10
jb 0x14006747c
mov rcx, qword [rbp - 0x10]
mov rsi, qword [r12 + 0x30]
and rsi, r8
add rsi, rsi
mov r15, qword [r14 + rsi*8 + 8]
jmp 0x1400674b7
cmp qword [rbp + 0x50], rsi
jne 0x1400674e5
mov qword [r14 + r15*8], rcx
jmp 0x1400674e5
cmp rcx, rdi
je 0x1400674e1
cmp rcx, r15
lea rcx, [rbp - 0x20]
sete bl
call fcn.14006750c
mov rcx, qword [rbp - 0x10]
test bl, bl
je 0x1400674b2
mov qword [r14 + rsi*8], r13
mov qword [r14 + rsi*8 + 8], r13
cmp rcx, rdi
je 0x1400674e5
jmp 0x14006744e
mov qword [r14 + rsi*8], rcx
mov rax, qword [rbp - 0x18]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov rbx, qword [rsp + 0x98]
mov rax, rdi
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140068b70
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140068b9c
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x140068b97
mov rax, qword [rcx]
xor edx, edx
call rax
nop
and qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140068be2
mov ecx, dword [0x140095324]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140068bd5
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140068bd5
xor edx, edx
xor eax, eax
cmp qword [rcx + rax*8], 0
je 0x140068bed
inc edx
inc rax
cmp rax, 2
jl 0x140068bc3
mov rcx, rbx
call fcn.1400699b0
and qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov al, byte [rbx + 0x48]
mov byte [rbx], al
movsxd rax, edx
mov qword [rcx + rax*8], rbx
jmp 0x140068bdd

Function at 0x140069dd0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140069e1a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140069e1a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140069e1a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140069e1a
cmp dword [rcx + 0x84], 0xe
jbe 0x140069e1a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140069e1c
xor al, al
add rsp, 0x28
ret
Function at 0x140013810
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov ebx, 0xffffffff
mov r9, rdx
mov eax, ebx
mov r8, rcx
test rdx, rdx
je 0x14001386d
lea r11, [0x140035fd0]
nop
movzx r10d, byte [r8]
lea r8, [r8 + 1]
dec r9
cmp r10b, 0x23
jne 0x140013853
cmp r9, 2
jb 0x140013853
cmp byte [r8], r10b
jne 0x140013853
cmp byte [r8 + 1], r10b
cmove eax, ebx
movzx edx, al
xor rdx, r10
shr eax, 8
xor eax, dword [r11 + rdx*4]
test r9, r9
jne 0x140013830
not eax
mov rbx, qword [rsp + 8]
ret
movzx r9d, byte [rcx]
inc r8
test r9b, r9b
je 0x1400138af
lea r11, [0x140035fd0]
cmp r9b, 0x23
jne 0x140013892
cmp byte [r8], r9b
jne 0x140013892
cmp byte [r8 + 1], r9b
cmove eax, ebx
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140013880
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x140014f90
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push r15
sub rsp, 0x20
mov rbx, qword [0x140048c00]
xor r15d, r15d
mov rbp, rcx
mov dword [rbx + 0x5bfc], r15d
test rcx, rcx
je 0x14001508c
mov qword [rsp + 0x48], rsi
lea rcx, [rbx + 0x5c00]
mov qword [rsp + 0x50], rdi
xor edx, edx
mov qword [rsp + 0x58], r14
mov dword [rbx + 0x5bfc], r15d
call fcn.140015e00
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x40], r15b
lea rcx, [rbx + 0x5c00]
call fcn.140015d20
mov esi, r15d
cmp dword [rbx + 0x5c10], r15d
jle 0x140015029
mov edi, r15d
nop
mov r9, qword [rbx + 0x5c18]
lea r8, [rbx + 0x5c00]
add r9, rdi
mov rcx, rbx
mov rdx, r9
call qword [r9 + 0x38]
inc esi
add rdi, 0x48
cmp esi, dword [rbx + 0x5c10]
jl 0x140015000
mov eax, dword [rbx + 0x5c00]
lea rdi, [0x140048bf8]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x5c08]
cmove ecx, r15d
test rax, rax
movsxd rsi, ecx
mov rcx, rbp
cmovne rdi, rax
call fcn.1400138c0
mov r14, qword [rsp + 0x58]
mov rbx, rax
test rax, rax
je 0x140015082
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop rbp
pop rbx
ret
Function at 0x1400190b0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.140018ad0
test al, al
je 0x1400190d3
call fcn.140018c30
call fcn.140018580
call fcn.140018290
call fcn.1400187a0
jmp 0x1400190de
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x14001a6f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x110
mov rax, qword [0x140048010]
xor rax, rsp
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x30]
call fcn.14001a930
mov rcx, rax
call fcn.14001f810
lea rcx, [rsp + 0xf8]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x31]
call fcn.14001a9d0
mov rcx, rax
call fcn.14001f7f0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x100]
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [rsp + 0xf0]
mov ecx, eax
call fcn.1400326b8
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x32]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x32]
call fcn.14001a9d0
mov rcx, rax
call fcn.14001f7f0
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x100]
xor r8d, r8d
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x38]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x34], 0
jmp 0x14001a888
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x34], eax
jae 0x14001a8c7
mov rax, qword [rsp + 0x40]
add rax, 8
mov r9, rax
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0xa8]
lea rcx, [0x140048cc8]
call fcn.140023f80
mov rax, qword [rsp + 0x40]
add rax, 0x14
mov qword [rsp + 0x40], rax
jmp 0x14001a87e
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.140031e7c
cmp qword [rsp + 0x50], 0
jne 0x14001a8f1
mov qword [rsp + 0x80], 0
jmp 0x14001a907
mov qword [rsp + 0x38], 0x8123
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.140031c10
add rsp, 0x110
pop rdi
ret