joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f7780
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1400f7942
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1400eded0
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1400f7907
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rbx
jne 0x1400f7873
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1400f78f6
mov rax, qword [r11 + 8]
mov r9d, dword [rcx + 0x10]
cmp r9d, dword [rax + 0x10]
jne 0x1400f78b0
mov r10, qword [rax]
cmp r10, rcx
je 0x1400f78aa
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1400f78f6
mov r8, rax
cmp r10, rax
je 0x1400f78d2
nop dword [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r9d, dword [rax + 0x10]
je 0x1400f791c
cmp r10, rax
jne 0x1400f78c0
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x1400f7820
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1400f78f6
lea rcx, [0x140179608]
call fcn.14011f30c
int3
Function at 0x1400f7e60
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1400f8040
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x14019f5c8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x14019f5d8]
lea rdx, [rdi + rdi]
call fcn.1400eded0
mov rcx, qword [0x14019f5c8]
lea r9, [rdi - 1]
mov qword [0x14019f5f0], r9
mov qword [0x14019f5f8], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1400f8035
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x14]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x15]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x16]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x17]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x14019f5d8]
mov r10, qword [r11]
cmp r10, rbx
jne 0x1400f7f7b
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1400f7ff6
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x1400f7fb8
mov r10, qword [rax]
cmp r10, rcx
je 0x1400f7fb2
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1400f7ff6
mov r8, rax
cmp r10, rax
je 0x1400f7fd2
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x1400f800a
cmp r10, rax
jne 0x1400f7fc0
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
je 0x1400f8030
mov r9, qword [0x14019f5f0]
jmp 0x1400f7f00
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1400f7ff6
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x140179608]
call fcn.14011f30c
int3
Function at 0x1400f84b0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1400f8690
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x14019f6d8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x14019f6e8]
lea rdx, [rdi + rdi]
call fcn.1400eded0
mov rcx, qword [0x14019f6d8]
lea r9, [rdi - 1]
mov qword [0x14019f700], r9
mov qword [0x14019f708], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1400f8685
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x14]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x15]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x16]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x17]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x14019f6e8]
mov r10, qword [r11]
cmp r10, rbx
jne 0x1400f85cb
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1400f8646
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x1400f8608
mov r10, qword [rax]
cmp r10, rcx
je 0x1400f8602
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1400f8646
mov r8, rax
cmp r10, rax
je 0x1400f8622
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x1400f865a
cmp r10, rax
jne 0x1400f8610
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
je 0x1400f8680
mov r9, qword [0x14019f700]
jmp 0x1400f8550
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1400f8646
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x140179608]
call fcn.14011f30c
int3
Function at 0x1400f8890
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x14019f610]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x14019f638]
js 0x1400f66b4
cvtsi2ss xmm0, rcx
jmp 0x1400f66c9
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x14019f600]
call fcn.14015153c
movss xmm1, dword [0x14017b69c]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1400f66fb
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1400f66fb
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1400f672d
cmp rbx, 0x200
jae 0x1400f672a
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x1400f672d
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400f8890
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1400f8a50
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x14019f608]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x14019f618]
lea rdx, [rdi + rdi]
call fcn.1400eded0
mov rcx, qword [0x14019f608]
lea r9, [rdi - 1]
mov qword [0x14019f630], r9
mov qword [0x14019f638], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1400f8a45
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x14019f618]
mov r10, qword [r11]
cmp r10, rbx
jne 0x1400f8982
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1400f8a06
mov rax, qword [r11 + 8]
mov r9d, dword [rcx + 0x10]
cmp r9d, dword [rax + 0x10]
jne 0x1400f89bf
mov r10, qword [rax]
cmp r10, rcx
je 0x1400f89b9
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1400f8a06
mov r8, rax
cmp r10, rax
je 0x1400f89e2
nop word [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r9d, dword [rax + 0x10]
je 0x1400f8a1a
cmp r10, rax
jne 0x1400f89d0
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
je 0x1400f8a40
mov r9, qword [0x14019f630]
jmp 0x1400f8930
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1400f8a06
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x140179608]
call fcn.14011f30c
int3
Function at 0x1400fd560
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x60
mov rbx, qword [0x14019f860]
movabs r12, 0xcbf29ce484222325
mov rdi, qword [0x14019f858]
mov rbp, rbx
sub rbp, rdi
movabs r15, 0x100000001b3
sar rbp, 2
movabs r13, 0x27ab1c1f1d4547b8
cmp rdi, rbx
je 0x1400fd6db
nop word [rax + rax]
mov ecx, dword [rdi]
lea rdx, [rsp + 0x20]
call fcn.140049330
mov r9, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400fd5d9
mov r9, qword [rax]
mov rsi, r12
nop dword [rax]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
lea eax, [r8 + 0x20]
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
movsx rax, cl
xor rsi, rax
imul rsi, r15
test r8b, r8b
jne 0x1400fd5e0
lea rcx, [rsp + 0x20]
call fcn.140009900
cmp rsi, r13
jne 0x1400fd622
add rdi, 4
cmp rdi, rbx
jne 0x1400fd5c0
cmp rdi, rbx
je 0x1400fd6db
mov qword [rsp + 0x90], r14
lea r14, [rdi + 4]
cmp r14, rbx
je 0x1400fd6b0
nop dword [rax]
mov ecx, dword [r14]
lea rdx, [rsp + 0x40]
call fcn.140049330
mov r9, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400fd65a
mov r9, qword [rax]
mov rsi, r12
nop dword [rax]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
lea eax, [r8 + 0x20]
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
movsx rax, cl
xor rsi, rax
imul rsi, r15
test r8b, r8b
jne 0x1400fd660
lea rcx, [rsp + 0x40]
call fcn.140009900
cmp rsi, r13
jne 0x1400fd6a2
mov eax, dword [r14]
mov dword [rdi], eax
add rdi, 4
add r14, 4
cmp r14, rbx
jne 0x1400fd640
cmp rdi, rbx
je 0x1400fd6d3
mov rsi, qword [0x14019f860]
mov rdx, rbx
sub rsi, rbx
mov rcx, rdi
mov r8, rsi
call fcn.1401238b0
lea rcx, [rsi + rdi]
mov qword [0x14019f860], rcx
mov r14, qword [rsp + 0x90]
mov rcx, qword [0x14019f860]
lea r11, [rsp + 0x60]
sub rcx, qword [0x14019f858]
mov rbx, qword [r11 + 0x38]
sar rcx, 2
sub rbp, rcx
mov rax, rbp
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140103c50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140103cb1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140103c70
mov ecx, dword [r10]
jmp 0x140103d9a
cmp ecx, 0x4e0
jb 0x140103d9a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140103cd0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140103d20
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14010bfa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r8, rdx
mov r9, rcx
mov eax, dword [rdx]
mov dword [rcx], eax
movzx eax, byte [rdx + 4]
mov byte [rcx + 4], al
movsd xmm0, qword [rdx + 8]
movsd qword [rcx + 8], xmm0
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x18], eax
movsd xmm0, qword [rdx + 0x1c]
movsd qword [rcx + 0x1c], xmm0
mov eax, dword [rdx + 0x24]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x28]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 0x2c]
mov dword [rcx + 0x2c], eax
mov eax, dword [rdx + 0x30]
mov dword [rcx + 0x30], eax
mov eax, dword [rdx + 0x34]
mov dword [rcx + 0x34], eax
mov eax, dword [rdx + 0x38]
mov dword [rcx + 0x38], eax
mov eax, dword [rdx + 0x3c]
mov dword [rcx + 0x3c], eax
mov eax, dword [rdx + 0x40]
mov dword [rcx + 0x40], eax
mov rax, qword [rdx + 0x48]
mov qword [rcx + 0x48], rax
mov rax, qword [rdx + 0x50]
mov qword [rcx + 0x50], rax
mov rax, qword [rdx + 0x58]
mov qword [rcx + 0x58], rax
mov rax, qword [rdx + 0x60]
mov qword [rcx + 0x60], rax
mov rax, qword [rdx + 0x68]
mov qword [rcx + 0x68], rax
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, byte [rdx + 0x7c]
mov byte [rcx + 0x7c], al
mov eax, dword [rdx + 0x80]
mov dword [rcx + 0x80], eax
movzx eax, byte [rdx + 0x84]
mov byte [rcx + 0x84], al
mov eax, dword [rdx + 0x88]
mov dword [rcx + 0x88], eax
movups xmm0, xmmword [rdx + 0x8c]
movups xmmword [rcx + 0x8c], xmm0
mov eax, dword [rdx + 0x9c]
mov dword [rcx + 0x9c], eax
mov rdx, qword [rdx + 0xb0]
xor r10d, r10d
mov qword [r8 + 0xb0], r10
mov rcx, qword [r8 + 0xa8]
mov qword [r8 + 0xa8], r10
mov rax, qword [r8 + 0xa0]
mov qword [r8 + 0xa0], r10
mov qword [r9 + 0xa0], rax
mov qword [r9 + 0xa8], rcx
mov qword [r9 + 0xb0], rdx
mov rax, qword [r8 + 0xb8]
mov qword [r9 + 0xb8], rax
mov rax, qword [r8 + 0xc0]
mov qword [r9 + 0xc0], rax
mov qword [r9 + 0xc8], r10
mov qword [r9 + 0xd8], r10
mov qword [r9 + 0xe0], r10
movups xmm0, xmmword [r8 + 0xc8]
movups xmmword [r9 + 0xc8], xmm0
movups xmm1, xmmword [r8 + 0xd8]
movups xmmword [r9 + 0xd8], xmm1
mov qword [r8 + 0xd8], r10
mov qword [r8 + 0xe0], socket
mov byte [r8 + 0xc8], r10b
mov rax, r9
ret
Function at 0x14011da80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x48
movss xmm3, dword [0x14017b498]
lea rcx, [rsp + 0x30]
xorps xmm0, xmm0
mov eax, r9d
shr eax, 0x10
xorps xmm2, xmm2
movzx eax, al
xorps xmm1, xmm1
mov r10, r8
mov r11, rdx
mov r8, qword [0x14019e140]
cvtsi2ss xmm2, rax
mov eax, r9d
shr eax, 8
movzx eax, al
cvtsi2ss xmm1, rax
movzx eax, r9b
shr r9d, 0x18
cvtsi2ss xmm0, rax
mov eax, r9d
divss xmm2, xmm3
divss xmm0, xmm3
divss xmm1, xmm3
movss dword [rsp + 0x38], xmm0
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss dword [rsp + 0x30], xmm2
movss dword [rsp + 0x34], xmm1
divss xmm0, xmm3
mulss xmm0, dword [r8 + 0x1558]
movss dword [rsp + 0x3c], xmm0
call fcn.14001ca50
movss xmm0, dword [rsp + 0x78]
lea rcx, [r8 + 0x1d20]
mov r9d, eax
mov dword [rsp + 0x78], recv
mov r8, r10
movss dword [rsp + 0x70], xmm0
mov rdx, r11
add rsp, 0x48
jmp fcn.1400361b0

Function at 0x14011db40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x48
movss xmm3, dword [0x14017b498]
lea rcx, [rsp + 0x30]
xorps xmm0, xmm0
mov eax, r9d
shr eax, 0x10
xorps xmm2, xmm2
movzx eax, al
xorps xmm1, xmm1
mov r10, r8
mov r11, rdx
mov r8, qword [0x14019e140]
cvtsi2ss xmm2, rax
mov eax, r9d
shr eax, 8
movzx eax, al
cvtsi2ss xmm1, rax
movzx eax, r9b
shr r9d, 0x18
cvtsi2ss xmm0, rax
mov eax, r9d
divss xmm2, xmm3
divss xmm0, xmm3
divss xmm1, xmm3
movss dword [rsp + 0x38], xmm0
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss dword [rsp + 0x30], xmm2
movss dword [rsp + 0x34], xmm1
divss xmm0, xmm3
mulss xmm0, dword [r8 + 0x1558]
movss dword [rsp + 0x3c], xmm0
call fcn.14001ca50
movss xmm0, dword [rsp + 0x78]
lea rcx, [r8 + 0x1d20]
mov r9d, eax
mov dword [rsp + 0x78], 9
mov r8, r10
movss dword [rsp + 0x70], xmm0
mov rdx, r11
add rsp, 0x48
jmp fcn.1400361b0

Function at 0x14011f0f0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3f
syscall
ret

Function at 0x14011f0fb
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x26
syscall
ret

Function at 0x14011f106
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3a
syscall
ret

Function at 0x14013a764
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14013a590
Function at 0x140003f4c
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.140003b5c
add rsp, 0x28
jmp 0x140003f70
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x14001d938], rdi
jne 0x140008848
mov eax, dword [0x14001d930]
cmp eax, 1
je 0x140008868
mov eax, dword [0x14001d930]
cmp eax, ebx
jne 0x14000887f
mov dword [0x14001d930], 1
lea r13, [0x140014218]
lea rdi, [0x140014200]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x14000401c
cmp eax, ebx
jne 0x14000401c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x140004011
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x140003ffa
cmp eax, ebx
jne 0x140008875
mov eax, dword [0x14001d930]
cmp eax, 1
jne 0x14000404c
lea rdx, [0x1400141f8]
lea rcx, [0x1400141c0]
call fcn.140151000
mov dword [0x14001d930], 2
cmp r12d, ebx
jne 0x14000405b
mov rax, rbx
xchg qword [0x14001d938], rax
cmp qword [0x14001d950], rbx
jne 0x14000888e
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
je 0x1400088b7
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
jbe 0x14000409f
cmp word [rcx], 0x22
je 0x140008912
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140004084
cmp word [rcx], bx
jne 0x1400088c1
cmp word [rcx], bx
jne 0x1400088ce
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400040e8
nop
jmp 0x1400088e6
cmp rax, rdi
jne 0x140008858
mov r12d, 1
jmp 0x140003fba
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140003fa9
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x140004024
mov eax, 0xff
jmp 0x140008951
mov dword [0x14001db2c], 1
jmp 0x140004024
lea rcx, [0x14001d950]
call fcn.140011e1c
cmp eax, ebx
je 0x140004068
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x14001d950]
nop
jmp 0x140004068
mov eax, 0xff
jmp 0x140008951
cmp edx, ebx
je 0x1400040a8
jmp 0x14000408a
cmp word [rcx], 0x20
ja 0x1400040b1
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400040a8
mov dword [0x14001db28], eax
cmp dword [0x14001d30c], ebx
jne 0x1400088fc
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14001db2c], ebx
jne 0x140008910
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14001db28]
jmp 0x140008951
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
jmp 0x140004094
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
Function at 0x140001b0c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b56
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b56
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b56
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b56
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b56
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b58
xor al, al
add rsp, 0x28
ret