joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008d40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140008d64
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140008d9b
mov rax, qword [rcx + 0x58]
movsxd rcx, dword [rax]
add rcx, rdx
cmp rdx, rcx
jae 0x140008d9b
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x140008ec4
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140008dde
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140008e09
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140008ec9
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140008e7e
sub eax, 1
je 0x140008e7e
cmp eax, 2
jne 0x140008ec4
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140008ec9
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x140008eaf
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140008ec4
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov eax, edi
jne 0x140008ec9
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x1400091f0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400092b9
cmp byte [rcx + 0x71], 0
je 0x1400092b9
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x1400092ac
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140009268
sub eax, 1
je 0x14000926c
cmp eax, 2
jne 0x1400092ac
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x14000929a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400092ac
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret
Function at 0x14000bee0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
mov eax, 0x13b0
call fcn.1400a2e50
sub rsp, rax
mov rsi, rcx
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x24], eax
mov r8d, eax
shr r8d, 0x1e
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x24], eax
inc rdx
cmp rdx, 0x270
jb 0x14000bf10
mov rbx, qword [0x14022a740]
sub rbx, qword [0x14022a738]
sar rbx, 5
dec ebx
mov dword [rsp + 0x20], 0x270
cmp ebx, 0xffffffff
jne 0x14000bf62
lea rcx, [rsp + 0x20]
call fcn.14003deb0
mov edx, eax
jmp 0x14000bfb3
mov qword [rsp + 0x13c0], rdi
lea edi, [rbx + 1]
nop dword [rax]
xor r8d, r8d
xor eax, eax
test ebx, ebx
je 0x14000bf8b
lea rcx, [rsp + 0x20]
call fcn.14003deb0
mov r8d, eax
mov eax, 0xffffffff
xor edx, edx
div edi
mov ecx, eax
mov r9d, edx
xor edx, edx
mov eax, r8d
div edi
cmp eax, ecx
jb 0x14000bfa4
cmp r9d, ebx
jne 0x14000bf70
xor edx, edx
mov eax, r8d
div edi
mov rdi, qword [rsp + 0x13c0]
movsxd rdx, edx
mov rcx, rsi
shl rdx, 5
add rdx, qword [0x14022a738]
call fcn.14000a3c0
mov rbx, qword [rsp + 0x13c8]
mov rax, rsi
add rsp, 0x13b0
pop rsi
ret
Function at 0x14000c0a0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov r8d, 0x104
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14000c2d1
mov r8d, 0x104
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x14000c2d1
movabs rax, 0x53bc5cd7375bc474
mov qword [rsp + 0x2c8], rbx
mov qword [rbp + 0x1c0], rax
lea rdx, [rsp + 0x30]
mov rax, qword [rbp + 0x1c0]
lea rcx, [rbp + 0xa0]
mov qword [rsp + 0x30], rax
movabs rbx, 0x539c30b2537ba75b
mov qword [rsp + 0x2d0], rdi
movabs rdi, 0xae7fad3f0b7fcd08
mov qword [rbp + 0x1c0], rdi
mov rax, qword [rbp + 0x1c0]
mov qword [rsp + 0x38], rax
mov qword [rbp + 0x1c0], rbx
mov rax, qword [rbp + 0x1c0]
mov qword [rsp + 0x60], rax
mov qword [rbp + 0x1c0], rdi
mov rax, qword [rbp + 0x1c0]
movdqa xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x68], rax
pxor xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
movabs rax, 0x53d065fc7345997b
lea rdx, [rsp + 0x40]
mov qword [rbp + 0x1c0], rax
lea rcx, [rbp + 0xa0]
mov rax, qword [rbp + 0x1c0]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x1c0], rdi
mov rax, qword [rbp + 0x1c0]
mov qword [rsp + 0x48], rax
mov qword [rbp + 0x1c0], rbx
mov rax, qword [rbp + 0x1c0]
mov qword [rsp + 0x70], rax
mov qword [rbp + 0x1c0], rdi
mov rax, qword [rbp + 0x1c0]
movdqa xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x78], rax
pxor xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_lstrcatA]
movabs rax, 0x53ff55c20016c818
lea rdx, [rbp - 0x70]
mov qword [rbp + 0x1c0], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rbp + 0x1c0]
mov r8d, 0x104
mov qword [rsp + 0x50], rax
mov qword [rbp + 0x1c0], rdi
mov rax, qword [rbp + 0x1c0]
mov qword [rsp + 0x58], rax
mov qword [rbp + 0x1c0], rbx
mov rax, qword [rbp + 0x1c0]
mov qword [rbp - 0x80], rax
mov qword [rbp + 0x1c0], rdi
mov rax, qword [rbp + 0x1c0]
movdqa xmm0, xmmword [rsp + 0x50]
mov qword [rbp - 0x78], rax
pxor xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rdi, qword [rsp + 0x2d0]
mov rbx, qword [rsp + 0x2c8]
test eax, eax
je 0x14000c2d1
xor eax, eax
lea r9, [rbp + 0xa0]
mov dword [rsp + 0x28], eax
lea r8, [rbp - 0x70]
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x14000c2d1
mov eax, 1
add rsp, 0x2b0
pop rbp
ret
xor eax, eax
add rsp, 0x2b0
pop rbp
ret
Function at 0x140017e30
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x1130
call fcn.1400a2e50
sub rsp, rax
mov r14, rcx
lea r8, [rsp + 0x1158]
lea rcx, [rsp + 0x130]
mov edx, 0x1000
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140017ee7
mov ebp, dword [rsp + 0x1158]
xor ebx, ebx
shr ebp, 2
test ebp, ebp
je 0x140017ee7
lea rsi, [rsp + 0x130]
nop word [rax + rax]
mov r8d, dword [rsi]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140017edd
mov r9d, 0x104
lea r8, [rsp + 0x20]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
test eax, eax
je 0x140017ed4
mov rdx, r14
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
je 0x140017f01
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
add rsi, 4
cmp ebx, ebp
jb 0x140017e90
xor al, al
lea r11, [rsp + 0x1130]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140017ee9
Function at 0x14001bea0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
mov eax, 0x1130
call fcn.1400a2e50
sub rsp, rax
mov r14, rdx
lea r8, [rsp + 0x1150]
mov edx, 0x1000
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x14001bf57
mov ebp, dword [rsp + 0x1150]
xor ebx, ebx
shr ebp, 2
test ebp, ebp
je 0x14001bf57
lea rsi, [rsp + 0x130]
nop word [rax + rax]
mov r8d, dword [rsi]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14001bf4d
mov r9d, 0x104
lea r8, [rsp + 0x20]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
test eax, eax
je 0x14001bf44
mov rdx, r14
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbscmp]
test eax, eax
je 0x14001bf71
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
add rsi, 4
cmp ebx, ebp
jb 0x14001bf00
xor al, al
lea r11, [rsp + 0x1130]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x14001bf59

Function at 0x14002ea20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push r14
sub rsp, 0x38
mov rbp, qword [r8 + 8]
xor r14d, r14d
mov rax, r8
mov qword [rsp + 0x78], r14
mov rbx, rdx
mov dword [rsp + 0x60], r14d
lea r8, [rsp + 0x78]
mov dword [rsp + 0x70], r14d
mov rcx, 0xffffffff80000002
mov esi, r14d
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14002eb3c
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002eb3c
mov ecx, dword [rsp + 0x60]
mov qword [rsp + 0x30], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, qword [rsp + 0x78]
lea r9, [rsp + 0x70]
mov rdi, rax
xor r8d, r8d
lea rax, [rsp + 0x60]
mov rdx, rbp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r8d, r14d
cmp dword [rdi], r14d
jbe 0x14002eb2b
mov ecx, r14d
cmp dword [rdi + 0x10], ecx
jbe 0x14002eb23
mov eax, r8d
lea rdx, [rax + rax*8]
lea r9, [rdx*4]
nop dword [rax]
mov eax, ecx
lea rdx, [rax + rax*4]
lea rdx, [r9 + rdx*4]
cmp byte [rdx + rdi + 0x14], 3
jne 0x14002eb1c
test rbx, rbx
je 0x14002eb1a
mov rax, qword [rdx + rdi + 0x18]
mov qword [rbx + 8], rax
mov eax, dword [rdx + rdi + 0x20]
mov qword [rbx], rax
add rbx, 0x10
inc esi
inc ecx
cmp ecx, dword [rdi + 0x10]
jb 0x14002eaf0
inc r8d
cmp r8d, dword [rdi]
jb 0x14002ead6
mov rdi, qword [rsp + 0x30]
mov eax, esi
add rsp, 0x38
pop r14
pop rsi
pop rbp
pop rbx
ret
xor eax, eax
add rsp, 0x38
pop r14
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400305f0
Capabilities:
Execute command

Disassembly:
sub rsp, 0x88
mov rdx, qword [rcx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rdx
cmp rax, 0x2d
jb 0x1400306bc
cmp qword [rcx + 0x18], 0x10
jb 0x14003061c
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], reloc.WLDAP32.dll_Ordinal_45
lea r9, str.netsh_advfirewall_firewall_delete_rule_name_
lea rcx, [rsp + 0x60]
call fcn.14003b940
nop
mov r8d, 1
lea rdx, [0x1400cc63c]
lea rcx, [rsp + 0x60]
call fcn.140038d90
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x60]
call fcn.140007de0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400cd1bc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rsp + 0x40]
call fcn.140007de0
add rsp, 0x88
ret
call fcn.140007550
int3

Function at 0x1400306d0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x190
mov rbx, rcx
xor edx, edx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rsp + 0x60], 0x130
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400307fb
xor ebp, ebp
lea rax, [rsp + 0x8c]
mov r8, rbx
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140030733
inc rax
test ecx, ecx
jne 0x140030720
test edx, edx
jne 0x1400307e5
mov r8d, dword [rsp + 0x68]
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400307e5
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x1b8], rax
lea rdx, [0x140229140]
lea rcx, [rsp + 0x40]
call fcn.14000a3c0
mov rdi, rax
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x1400307b0
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140007e60
nop
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140011cb0
mov ecx, reloc.WLDAP32.dll_Ordinal_50
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14000bbb0
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140030710
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x190
pop rdi
pop rsi
pop rbp
ret
Function at 0x140030820
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
xor eax, eax
mov dword [rax], Ordinal_46
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400308b7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400308b7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400308b2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140030890
cmp r8d, 0xcded1a85
je 0x1400308bc
test r9d, r9d
jne 0x140030870
mov rax, qword [rax]
jmp 0x140030840
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, reloc.WS2_32.dll_listen
add rax, r10
mov rbx, qword [rsp + 0x10]
pop rdi
jmp rax
Function at 0x1400388b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1400388e4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1400388d0
ret

Function at 0x140039eb0
Capabilities:
Get system firmware table

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, 0xe0
call fcn.1400a2458
mov rbx, rax
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], al
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbx + 0x20], al
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbx + 0x40], al
mov qword [rbx + 0x60], rax
mov qword [rbx + 0x70], rax
mov qword [rbx + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rbx + 0x60], al
mov qword [rbx + 0x80], rax
mov qword [rbx + 0x90], rax
mov qword [rbx + 0x98], reloc.WS2_32.dll_ntohs
mov byte [rbx + 0x80], al
mov qword [rbx + 0xa0], rax
mov qword [rbx + 0xb0], rax
mov qword [rbx + 0xb8], reloc.WS2_32.dll_ntohs
mov byte [rbx + 0xa0], al
mov qword [rbx + 0xc0], rax
mov qword [rbx + 0xd0], rax
mov qword [rbx + 0xd8], reloc.WS2_32.dll_ntohs
mov byte [rbx + 0xc0], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x52534d42
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
nop
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14003c7c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.1400a2458
mov qword [rax], rbx
mov qword [rsp + 0x40], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14003f050]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x14003c81a
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x14003deb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14003df11
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x14003ded0
mov ecx, dword [r10]
jmp 0x14003dffa
cmp ecx, 0x4e0
jb 0x14003dffa
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14003df30
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14003df80
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140047a30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140047a53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x39]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140047a40
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x140047a60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov r9, r8
mov rbx, rdx
mov rdi, rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140047aa4
mov eax, esi
nop dword [rax]
nop word [rax + rax]
lea edx, [rax - 0x39]
xor byte [rax + r8], dl
inc rax
cmp rax, 6
jb 0x140047a90
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x20], rsi
movdqa xmm0, xmmword [0x1400ce690]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x140047ad9
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140007e60
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140047ae7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.14003be90
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x20]
call fcn.140007de0
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140047b40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov r9, r8
mov rbx, rdx
mov rdi, rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140047b84
mov eax, esi
nop dword [rax]
nop word [rax + rax]
lea edx, [rax - 0x39]
xor byte [rax + r8], dl
inc rax
cmp rax, 9
jb 0x140047b70
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x20], rsi
movdqa xmm0, xmmword [0x1400ce690]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x140047bb9
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140007e60
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140047bc7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.14003be90
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x20]
call fcn.140007de0
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140047c20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140047c48
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x39]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x140047c30
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x140047c50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov r9, r8
mov rbx, rdx
mov rdi, rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140047c94
mov eax, esi
nop dword [rax]
nop word [rax + rax]
lea edx, [rax - 0x39]
xor byte [rax + r8], dl
inc rax
cmp rax, 0xb
jb 0x140047c80
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x20], rsi
movdqa xmm0, xmmword [0x1400ce690]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x140047cc9
mov r8d, listen
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140007e60
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140047cd7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.14003be90
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x20]
call fcn.140007de0
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret