joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a1570
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x140241cc0]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rdi, qword [rbp + 0x1f0]
mov qword [rbp - 0x80], rdi
mov r12, qword [rbp + 0x1f8]
xor r13d, r13d
mov dword [rsp + 0x40], r13d
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
lea r8d, [r13 + 8]
lea rdx, [rbp - 0x70]
mov rcx, r12
call fcn.1400a2a20
nop
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi], r13
mov qword [rdi + 8], r13
mov qword [rdi + 0x10], r13
mov dword [rsp + 0x40], 1
mov r14d, r13d
mov dword [rbp - 0x78], 0x100
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x78]
lea r8, [rbp - 0x60]
xor edx, edx
mov rsi, qword [rbp - 0x70]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ecx, eax
cmp eax, 0x103
je 0x1400a1727
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
lea rdx, str.Cannot_enumerate_subkeys
nop word [rax + rax]
mov rax, r13
cmp byte [r12 + 0x240], 1
cmove rax, r12
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
lea rdx, [rsp + 0x60]
call fcn.1400a0dc0
mov r15d, dword [rbp - 0x78]
mov qword [rsp + 0x50], r15
lea rbx, [rbp - 0x60]
lea rbx, [rbx + r15*2]
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp - 0x60]
call fcn.140141380
cmp rax, rbx
jne 0x1400a16e1
mov rax, qword [rdi + 8]
cmp rax, qword [rdi + 0x10]
je 0x1400a16d1
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], r13
mov r8d, r15d
lea rdx, [rbp - 0x60]
mov rcx, rax
call fcn.140025740
add qword [rdi + 8], 0x20
jmp 0x1400a16e1
lea r9, [rsp + 0x48]
mov rdx, rax
mov rcx, rdi
call fcn.1400a23e0
inc r14d
mov dword [rbp - 0x78], 0x100
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x78]
lea r8, [rbp - 0x60]
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ecx, eax
cmp eax, 0x103
lea rdx, str.Cannot_enumerate_subkeys
jne 0x1400a1650
cmp byte [rbp - 0x68], 0
cmove rsi, r13
test rsi, rsi
je 0x1400a1749
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1400a1749
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140144310
mov rbx, qword [rsp + 0x300]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a1a80
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x280
mov rax, qword [0x140241cc0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
mov qword [rsp + 0x60], rcx
mov rbx, rdx
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x200
xor esi, esi
call fcn.14019b380
mov rcx, qword [rbx]
lea rax, [rsp + 0x60]
mov r9d, 0x200
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x70]
mov dword [rsp + 0x60], 0x200
lea edx, [rsi + 3]
call qword [sym.imp.ntdll.dll_NtQueryKey]
lea rcx, str.Cannot_query_kernel_mode_registry_key_path
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rcx
lea rdx, [rsp + 0x40]
mov ecx, eax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
call fcn.1400a0dc0
mov r8d, dword [rsp + 0x70]
lea rdx, [rsp + 0x74]
xorps xmm0, xmm0
shr r8, 1
movups xmmword [rdi], xmm0
mov rcx, rdi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
call fcn.140025740
mov rax, rdi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140144310
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400a1b70
Capabilities:
Delete registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov dword [rsp + 0x10], edx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x2d0
mov rax, qword [0x140241cc0]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov rdi, rcx
xorps xmm0, xmm0
movups xmmword [r11 - 0x48], xmm0
mov r8d, ntohs
lea rdx, [r11 - 0x48]
call fcn.1400a2a20
nop
mov rax, qword [rsp + 0x290]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
mov byte [rsp + 0x280], 0
lea rcx, [rsp + 0x40]
call fcn.1400a1d20
nop
lea rcx, [rsp + 0x40]
call fcn.1400582c0
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x2a0]
call fcn.1400a1a80
nop
xor esi, esi
mov qword [rsp + 0x288], rsi
lea rax, [rsp + 0x2a0]
cmp qword [rsp + 0x2b8], 7
cmova rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x2b0]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x288]
call fcn.1400a1940
nop
movzx ebx, byte [rdi + 0x240]
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
lea rcx, str.Cannot_delete_registry_key
mov qword [rsp + 0x20], rcx
cmp bl, 1
cmovne rdi, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
lea rdx, [rsp + 0x20]
mov ecx, eax
call fcn.1400a0dc0
nop
mov rcx, qword [rsp + 0x288]
test rcx, rcx
je 0x1400a1ca8
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [rsp + 0x288], rsi
lea rcx, [rsp + 0x2a0]
call fcn.140025f00
nop
mov rcx, qword [rsp + 0x290]
cmp byte [rsp + 0x298], 0
cmove rcx, rsi
mov qword [rsp + 0x290], rcx
test rcx, rcx
je 0x1400a1cf2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1400a1cf2
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.140144310
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400a1d20
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov rax, qword [0x140241cc0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, qword [rsp + 0x70]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov r8d, ntohs
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400a2a20
nop
movzx ebx, byte [rdi + 0x240]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
lea rcx, str.Cannot_delete_registry_key_tree
mov qword [rsp + 0x20], rcx
xor esi, esi
cmp bl, 1
cmovne rdi, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
lea rdx, [rsp + 0x20]
mov ecx, eax
call fcn.1400a0dc0
nop
mov rcx, qword [rsp + 0x40]
cmp byte [rsp + 0x48], sil
cmove rcx, rsi
mov qword [rsp + 0x40], rcx
test rcx, rcx
je 0x1400a1dd8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1400a1dd8
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140144310
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400a1e00
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x140241cc0]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rbx, qword [rbp + 0x220]
mov r14, qword [rbp + 0x228]
mov r15, qword [rbp + 0x230]
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
movsx rax, byte [rbx + 0x240]
add rax, 1
je 0x1400a1fa3
cmp rax, 1
je 0x1400a1ef2
mov rax, qword [rbx]
mov qword [rbp - 0x70], rax
lea rdx, [rbx + 8]
lea rcx, [rbp - 0x68]
call fcn.1400585e0
mov ecx, dword [rbx + 0x238]
mov eax, dword [rbx + 0x23c]
mov dword [rbp + 0x1cc], eax
or ecx, 6
mov dword [rbp + 0x1c8], ecx
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x30]
call fcn.1400a1780
mov rdi, qword [rax]
mov qword [rbp - 0x80], rdi
mov qword [rax], r12
mov sil, 1
mov byte [rbp - 0x78], sil
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400a1edf
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1400a1edf
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x30], r12
lea rcx, [rbp + 0x1a0]
call fcn.140058700
jmp 0x1400a1f00
mov rdi, qword [rbx]
mov qword [rbp - 0x80], rdi
xor sil, sil
mov byte [rbp - 0x78], sil
lea rax, str.Cannot_write_key_value
mov qword [rsp + 0x38], rax
mov rax, r12
cmp byte [rbx + 0x240], 1
cmove rax, rbx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], r15
mov r9d, 4
xor r8d, r8d
mov rdx, qword [r14]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movups xmm0, xmmword [rsp + 0x38]
movaps xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [r14]
movaps xmmword [rsp + 0x70], xmm1
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.1400a0dc0
nop
test sil, sil
cmove rdi, r12
test rdi, rdi
je 0x1400a1f82
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1400a1f82
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.140144310
add rsp, 0x2e0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400a2530
int3
Function at 0x1400a58d0
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x70
mov rax, qword [0x140241cc0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
mov qword [rsp + 0x58], rcx
mov rax, rdx
mov qword [r11 - 0x20], rdx
mov ecx, 0x10000
call fcn.140144de0
mov rdi, rax
mov qword [rsp + 0x60], rax
mov r8d, 0x8000
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, eax
lea eax, [rcx - 1]
cmp eax, 0x7fff
ja 0x1400a597f
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov r8d, ecx
mov rdx, rdi
mov rcx, rbx
call fcn.140025740
nop
mov rcx, rdi
call fcn.140144330
mov rax, rbx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140144310
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
lea rax, str.Unable_to_retrieve_environment_variable__
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x2d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x20]
mov edx, eax
lea rcx, [rsp + 0x38]
call fcn.140063260
lea rdx, [0x14023da00]
lea rcx, [rsp + 0x38]
call fcn.14015a550
int3
Function at 0x1400a7b00
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rcx
xor ecx, ecx
mov rax, qword [rsp + 8]
mov qword [rax + 0x28], rcx
mov qword [rax + 0x30], rcx
mov qword [rax + 0x38], rcx
mov qword [rax + 0x40], rcx
mov qword [rax + 0x48], rcx
mov qword [rax + 0x50], rcx
mov qword [rax + 0x58], rcx
mov qword [rax + 0x60], rcx
mov qword [rax + 0x68], rcx
mov qword [rax + 0x70], rcx
mov qword [rax + 0x78], rcx
mov qword [rax + 0x80], rcx
mov qword [rax + 0x88], rcx
mov qword [rax + 0x90], rcx
mov qword [rax + 0x98], rcx
mov qword [rax + 0xa0], rcx
mov qword [rax + 0xa8], rcx
mov qword [rax + 0xb0], rcx
mov qword [rax + 0xb8], rcx
mov qword [rax + 0xc0], rcx
mov qword [rax + 0xc8], rcx
mov qword [rax + 0xd0], rcx
mov qword [rax + 0xd8], rcx
mov qword [rax + 0xe0], rcx
mov qword [rax + 0xe8], rcx
mov qword [rax + 0xf0], rcx
mov qword [rax + 0xf8], rcx
mov qword [rax + 0x100], rcx
mov qword [rax + 0x108], rcx
mov qword [rax + 0x110], rcx
mov qword [rax + 0x118], rcx
mov qword [rax + 0x120], rcx
mov qword [rax], rcx
mov dword [rax + 8], 0x6a09e667
mov dword [rax + 0xc], 0xbb67ae85
mov dword [rax + 0x10], 0x3c6ef372
mov dword [rax + 0x14], 0xa54ff53a
mov dword [rax + 0x18], 0x510e527f
mov dword [rax + 0x1c], 0x9b05688c
mov dword [rax + 0x20], 0x1f83d9ab
mov dword [rax + 0x24], 0x5be0cd19
ret
Function at 0x1400b1d30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r11d, r11d
mov rbx, r8
bts edx, 8
nop
mov r8d, edx
shr edx, 1
and r8d, 1
neg r8d
shr r8, 4
movzx r10d, word [rcx + rdx*2]
and r8d, 0x7f
shr r10, 4
xor r10, r8
add r11d, dword [rbx + r10*4]
cmp edx, 2
jae 0x1400b1d40
mov rbx, qword [rsp + 8]
mov eax, r11d
ret

Function at 0x1400b1d80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor ebx, ebx
mov r10d, 0x100
or edx, r10d
mov r11d, r8d
mov rdi, rcx
nop dword [rax + rax]
add r11d, r11d
mov r8d, edx
shr r8d, 8
mov ecx, edx
shr ecx, 7
mov eax, r10d
and ecx, 1
and eax, r11d
neg ecx
add eax, r10d
shr rcx, 4
add r8d, eax
and ecx, 0x7f
add edx, edx
movzx r8d, word [rdi + r8*2]
shr r8, 4
xor r8, rcx
mov ecx, edx
xor ecx, r11d
not ecx
and r10d, ecx
add ebx, dword [r9 + r8*4]
cmp edx, 0x10000
jb 0x1400b1da0
mov rdi, qword [rsp + 0x10]
mov eax, ebx
mov rbx, qword [rsp + 8]
ret

Function at 0x1400b33f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xcc], 0
mov rbp, rcx
jne 0x1400b341d
call fcn.1400afd00
mov rcx, rbp
call fcn.1400afa20
mov ecx, dword [rbp + 0xc4]
lea r8, [rbp + 0x2570]
mov eax, dword [rbp + 0x48]
lea r9, [rbp + 0x820]
dec eax
mov dword [rbp + 0xec], 0x40
mov ebx, 1
mov dword [rbp + 0xb174], eax
mov edx, ebx
mov dword [rbp + 0x6d70], eax
shl edx, cl
lea rcx, [rbp + 0x6d70]
call fcn.1400b19f0
mov ecx, dword [rbp + 0xc4]
lea r8, [rbp + 0x2970]
shl ebx, cl
lea r9, [rbp + 0x820]
mov edx, ebx
lea rcx, [rbp + 0xb174]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1400b19f0

Function at 0x1400b3a90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov rbx, r9
mov rdi, r8
mov ebp, edx
mov rsi, rcx
xor r11d, r11d
mov r10d, r11d
lea rdi, [rdi + 8]
shr r10d, 1
mov r9d, r11d
shr r9d, 2
mov ecx, r10d
and ecx, 1
add r11d, 2
neg ecx
shr rcx, 4
and ecx, 0x7f
lea eax, [r9 + 2]
movzx edx, word [rsi + rax*2]
movzx eax, word [rsi + 2]
shr rax, 4
shr rdx, 4
xor rdx, rcx
mov ecx, r9d
neg ecx
shr rcx, 4
and ecx, 0x7f
mov r8d, dword [rbx + rdx*4]
xor rcx, rax
lea eax, [r10 + 4]
movzx edx, word [rsi + rax*2]
mov eax, edx
xor rdx, 0x7f0
add r8d, dword [rbx + rcx*4]
add r8d, ebp
shr rax, 4
shr rdx, 4
mov ecx, dword [rbx + rax*4]
add ecx, r8d
mov dword [rdi - 8], ecx
mov ecx, dword [rbx + rdx*4]
add ecx, r8d
mov dword [rdi - 4], ecx
cmp r11d, 8
jb 0x1400b3ab2
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x1400b6630
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
xor eax, eax
mov qword [rcx + 0x480], 0xffffffffffffffff
mov qword [rcx], rax
mov qword [rcx + 0x40], rax
mov byte [rcx + 0x23], al
mov qword [rcx + 0x48], rax
mov qword [rcx + 0x28], rax
call fcn.1400b6dd0
lea r8, [rcx + 0x78]
nop dword [rax]
mov edx, eax
lea r8, [r8 + 4]
and edx, 1
mov ecx, eax
shr ecx, 1
neg edx
and edx, 0xedb88320
inc eax
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [r8 - 4], ecx
cmp eax, 0x100
jb 0x1400b6660
add rsp, 0x28
ret

Function at 0x1400b8a50
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x40]
mov r9, r8
mov r8, rdx
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call fcn.140178e50
mov rcx, rax
mov qword [rbx], rax
call fcn.1400b8960
add rsp, 0x30
pop rbx
ret

Function at 0x1400b8a90
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, r9
lea rax, [rsp + 0x40]
mov r9, r8
mov qword [rsp + 0x28], rax
mov r8, rdx
mov dword [rsp + 0x20], 4
mov rbx, rcx
xor edx, edx
xor ecx, ecx
call fcn.140178e50
mov rcx, rax
mov qword [rbx], rax
mov rdi, rax
call fcn.1400b8960
mov ebx, eax
test rdi, rdi
je 0x1400b8b0c
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1400b8b0a
call fcn.1400b8900
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400c43d0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x20
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1400c44c2
mov rcx, rbx
call fcn.1400df380
test al, al
jne 0x1400c44c2
mov qword [rsp + 0x38], rsi
xor esi, esi
mov qword [rsp + 0x40], rdi
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp byte [rbx + rdi], sil
jne 0x1400c4410
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.1400f2880
test rax, rax
je 0x1400c4455
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.1400f2880
mov rsi, rax
test rax, rax
je 0x1400c4455
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x1400c448b
nop word [rax + rax]
movzx ecx, byte [rbx]
call fcn.1400eef30
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x1400c4470
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400da590
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x28
lea rcx, [0x1401be678]
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x1400da5b9
add rsp, 0x28
pop rdi
pop rbp
ret
mov qword [rsp + 0x48], rbx
lea rdx, str.LoadLibraryExA
mov rcx, rdi
mov qword [rsp + 0x58], r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x40]
lea rdx, [0x1401be698]
mov rcx, rbx
mov r14, rax
call fcn.140182b4c
test rax, rax
je 0x1400da61c
mov rcx, rbx
test r14, r14
je 0x1400da60e
xor edx, edx
mov rax, r14
lea r8d, [rdx + 8]
call qword [case.0x1400cd6b1.0]
mov rbp, rax
jmp 0x1400da73a
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
jmp 0x1400da73a
test r14, r14
je 0x1400da652
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400da652
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
mov rax, r14
call qword [case.0x1400cd6b1.0]
mov rbp, rax
jmp 0x1400da73a
xor edx, edx
mov qword [rsp + 0x20], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x1400da735
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x50], rsi
mov rdx, rdi
nop dword [rax + rax]
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x1400da680
lea ecx, [rax + 1]
mov rax, qword [section..data]
add rcx, rdx
call qword [case.0x1400cd6b1.0]
mov rsi, rax
test rax, rax
je 0x1400da720
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1400da720
mov rax, rdi
nop word [rax + rax]
cmp byte [rsi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x1400da6c0
mov ecx, 0x5c
mov word [rax + rsi], cx
inc rdi
cmp byte [rsi + rdi], bpl
jne 0x1400da6d4
mov rcx, rsi
sub rcx, rbx
add rcx, rdi
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x1400da6f0
mov rcx, rsi
test r14, r14
je 0x1400da717
xor edx, edx
mov rax, r14
lea r8d, [rdx + 8]
call qword [case.0x1400cd6b1.0]
jmp 0x1400da71d
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rax, qword [fcn.140167c30]
mov rcx, rsi
call qword [case.0x1400cd6b1.0]
mov rsi, qword [rsp + 0x50]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x58]
mov rax, rbp
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rbp
ret
Function at 0x1400da750
Capabilities:
Initialize winsock library

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x1e8
mov rax, qword [0x140241cc0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
test byte [rsp + 0x1f0], 2
je 0x1400da7bf
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400da7a2
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x1400da79c
shr ax, 8
cmp al, 2
je 0x1400da7bf
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140144310
add rsp, 0x1e8
ret
call fcn.140107fa0
test eax, eax
jne 0x1400da838
lea rcx, str.iphlpapi.dll
call fcn.1400da590
mov qword [0x14024a228], rax
test rax, rax
je 0x1400da805
lea rdx, [0x1401be668]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14024a220]
test rax, rax
cmovne rcx, rax
mov qword [0x14024a220], rcx
xor edx, edx
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.140107af0
test al, al
lea rcx, [0x14024db00]
setne byte [0x14024dafc]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140144310
add rsp, 0x1e8
ret
Function at 0x1400f0fc0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rsi
sub rsp, 0x1c0
mov rax, qword [0x140241cc0]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbx, qword [rcx + 0x10]
mov rax, rcx
mov rsi, rdx
mov r9, qword [rbx + 0x98]
cmp r9, 0xffffffffffffffff
je 0x1400f111b
mov rax, qword [rdx + 0x18]
mov rcx, qword [rax + 0x3d8]
test dword [rcx + 0x8c], 0x800
jne 0x1400f111b
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x80
lea r8, [rsp + 0x20]
mov rcx, r9
lea rdx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1400f10ab
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, eax
mov ebx, eax
call fcn.1400b9b40
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.1400d5c60
mov eax, 2
jmp 0x1400f111d
mov edx, dword [rsp + 0x20]
lea r9, [rbx + 0x100]
lea r8, [rbx + 0xce]
lea rcx, [rsp + 0x30]
call fcn.1400d8cc0
test al, al
jne 0x1400f111b
mov qword [rsp + 0x1e0], rdi
call fcn.140169964
mov ebx, dword [rax]
call fcn.140169964
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.1400b9b40
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.1400d5c60
mov rdi, qword [rsp + 0x1e0]
mov eax, 2
jmp 0x1400f111d
xor eax, eax
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.140144310
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1c0
pop rsi
ret