joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c110
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xd0
mov rax, qword [0x14009e010]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rax, r8
mov rbx, rdx
mov r14, rcx
mov qword [rbp - 0x79], rdx
mov rsi, qword [rbp + 0x7f]
xor r15d, r15d
mov dword [rsp + 0x20], r15d
mov rdx, qword [rcx]
mov rcx, qword [rdx + 0x28]
cmp rcx, 0xffffffffffffffff
jne 0x14001c16e
mov edx, 0x2749
mov rcx, rbx
call fcn.14001bb50
jmp 0x14001c2a0
xor r9d, r9d
mov r8d, 0x4000
mov rdx, rax
call qword [sym.imp.WS2_32.dll_recv]
movsxd rdi, eax
test eax, eax
jle 0x14001c192
mov qword [rsi], rdi
mov byte [rbx], r15b
jmp 0x14001c2a0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rbp - 0x39], r15
movdqa xmm0, xmmword [0x1400937d0]
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x39], 0
mov dword [rbp - 0x41], eax
xor r8d, r8d
lea rdx, [0x140091948]
lea rcx, [rbp - 0x39]
call fcn.140001f50
nop
mov dl, 1
mov byte [rbp - 0x11], dl
mov r8d, dword [rbp - 0x41]
mov dword [rbp - 9], r8d
movups xmm0, xmmword [rbp - 0x39]
movups xmmword [rbp - 1], xmm0
movups xmm1, xmmword [rbp - 0x29]
movups xmmword [rbp + 0xf], xmm1
mov dword [rsp + 0x20], 0x18
mov rax, qword [r14]
mov rcx, qword [rax + 0x28]
cmp rcx, 0xffffffffffffffff
je 0x14001c20f
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, qword [r14]
mov qword [rax + 0x28], 0xffffffffffffffff
mov r8d, dword [rbp - 9]
movzx edx, byte [rbp - 0x11]
mov qword [rsi], r15
test edi, edi
jne 0x14001c224
mov byte [rbp - 0x41], dil
mov edi, 0x1a
mov byte [rbx], 0
jmp 0x14001c271
mov byte [rbp - 0x71], dl
test dl, dl
je 0x14001c240
mov dword [rbp - 0x69], r8d
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x61]
call fcn.140003290
movzx edx, byte [rbp - 0x71]
mov edi, 0x1c
mov byte [rbx], dl
test dl, dl
je 0x14001c271
mov eax, dword [rbp - 0x69]
mov dword [rbx + 8], eax
movups xmm0, xmmword [rbp - 0x61]
movups xmmword [rbx + 0x10], xmm0
movups xmm1, xmmword [rbp - 0x51]
movups xmmword [rbx + 0x20], xmm1
mov qword [rbp - 0x51], r15
mov qword [rbp - 0x49], send
mov byte [rbp - 0x61], 0
or edi, 1
test dil, 4
je 0x14001c287
and edi, 0xfffffffb
lea rcx, [rbp - 0x71]
call fcn.140013d60
nop
test dil, 2
je 0x14001c297
lea rcx, [rbp - 0x41]
call fcn.140013d60
nop
lea rcx, [rbp - 0x11]
call fcn.140013d60
mov rax, rbx
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1400530b0
mov rbx, qword [rsp + 0x118]
add rsp, 0xd0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140022750
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x860
mov rax, qword [0x14009e010]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rsi, r9
mov rbx, r8
mov rdi, rcx
mov qword [rsp + 0x38], rcx
xor ebp, ebp
mov qword [rsp + 0x38], rbp
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x50]
call fcn.140057a80
mov dword [rsp + 0x30], 0x800
mov dword [rsp + 0x40], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9d, [rbp + 1]
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400227e1
mov qword [rdi], rbp
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
jmp 0x140022858
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x14002282e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi], rbp
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
jmp 0x140022858
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, dword [rsp + 0x30]
mov qword [rdi], rbp
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140004a70
mov rax, rdi
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1400530b0
mov rbx, qword [rsp + 0x888]
add rsp, 0x860
pop rdi
pop rsi
pop rbp
ret
Function at 0x140022f40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14009e010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
mov ecx, 0xf75db66e
call fcn.1400024e0
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rsi + 1]
mov rcx, rbx
call rax
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400230f6
mov qword [rsp + 0x50], rsi
mov ecx, 0xc309a0d
call fcn.1400024e0
lea rdx, [rsp + 0x50]
mov rcx, rdi
call rax
test eax, eax
je 0x1400230e7
mov ecx, 0x700da41
call fcn.1400024e0
lea r9d, [rsi + 4]
mov r8d, 0x3000
mov rdx, qword [rsp + 0x50]
xor ecx, ecx
call rax
mov rbx, rax
test rax, rax
je 0x1400230f6
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x50]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140023029
mov ecx, 0x6bcbc4b2
call fcn.1400024e0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call rax
jmp 0x1400230e7
mov ecx, 0x8285aca5
call fcn.1400024e0
mov rcx, rdi
call rax
mov dword [rsp + 0x4c], esi
mov ecx, 0xd30e846a
call fcn.1400024e0
mov r8d, 6
lea r9, [rsp + 0x4c]
xor edx, edx
mov rcx, rbx
call rax
test rax, rax
jne 0x14002307b
mov ecx, 0x6bcbc4b2
call fcn.1400024e0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call rax
xor eax, eax
jmp 0x1400230fc
mov ecx, dword [rax + 0x18]
add rcx, rbx
mov rdx, rcx
mov qword [rsp + 0x40], rcx
movabs r8, 0x6c616e416f747541
lea rax, [rcx + 0xa0]
cmp rdx, rax
jae 0x1400230cc
cmp qword [rdx], r8
jne 0x1400230c2
mov ecx, 0x6bcbc4b2
call fcn.1400024e0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call rax
mov eax, 1
jmp 0x1400230fc
inc rdx
mov qword [rsp + 0x40], rdx
jmp 0x140023093
mov ecx, 0x6bcbc4b2
call fcn.1400024e0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call rax
xor eax, eax
jmp 0x1400230fc
mov ecx, 0x8285aca5
call fcn.1400024e0
mov rcx, rdi
call rax
xor eax, eax
jmp 0x1400230fc
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400530b0
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x140025460
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
lea r11, [0x140092200]
mov r9, rdx
not ecx
cmp r8, 4
jb 0x1400254d9
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
add r9, 4
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x140025480
test r8, r8
je 0x1400254fd
nop
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x1400254e0
not ecx
mov eax, ecx
ret
Function at 0x14002b440
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x4f]
sub rsp, 0x98
mov rbx, rcx
lea rcx, [0x140093300]
jmp 0x1408963e8
Function at 0x14006433c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140064168
Function at 0x140351103
Capabilities:
Get common file path
Get number of processors
Packed with generic packer
Set registry value

Disassembly:
jne 0x1405df96e
int3
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x28]
call fcn.14072bdb8

Function at 0x140357ab3
Capabilities:
Authenticate hmac

Disassembly:
jle 0x1405cd918
lea r13, [r13*2 - 0x32776bd3]
mov r8, qword [rsp + r8 - 0x7046d431]
call fcn.14043a62a

Function at 0x140365279
Capabilities:
Get geographical location

Disassembly:
pushfq
add qword [rsp + 8], 0xffffffffbfb7960a
mov qword [rsp + 8], 0x13258b2c
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.1407aaab6

Function at 0x14036529b
Capabilities:
Get geographical location

Disassembly:
push rcx
mov qword [rsp + 0x10], 0x2277b2c0
lea rsp, [rsp + 0x10]
call fcn.14083af6d

Function at 0x1403652c2
Capabilities:
Get geographical location

Disassembly:
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov r10, qword [rsp + 0x48]
jle 0x14006b1a3
and r9, r10
mov r10, qword [rsp + 0x20]
call fcn.1403d5e30
cld
xchg esp, eax
int3

Function at 0x1403679d0
Capabilities:
Get number of processors

Disassembly:
mov qword [rsp + 0x20], 0xfffffffff130c4c0
mov r12, qword [rsp + 0x18]
jbe 0x1403fcf71

Function at 0x1403d51f8
Capabilities:
Get local ipv4 addresses

Disassembly:
pushfq
cmp word [rsp + 0x10], 0x8395
setle byte [rsp + 0x10]
add qword [rsp + 0x40], 0xfffffffffff2eff5
call fcn.140719bec

Function at 0x1403d5218
Capabilities:
Get local ipv4 addresses

Disassembly:
call fcn.1404896e5
neg r15
setg r15b
test r15d, 0x5b16bc85
mov r15, qword [rsp + 0x10]
je 0x1406da807
jg 0x1405a17d0
mov r10, qword [rsp + 0x10]
movzx r11, word [rsp + 0x28]
jne 0x14043ab3e
ja 0x1403d5213
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x30]
call fcn.1407e53ea
call 0x1403d5218
xor dword [rbp + 0x25398e9c], 0xffffffd5
mov eax, esi
mov ebp, 0x786c6ade
cmp ebx, ebp
cmovae ecx, dword [rax - 0x7fd949c7]
invalid

Function at 0x1403e353f
Capabilities:
Delete registry key
Packed with generic packer

Disassembly:
je fcn.1405d6bd4
push qword [rsp + 0x50]
popfq
lea rsp, [rsp + 0x60]
ret

Function at 0x1403f9603
Capabilities:
Packed with generic packer

Disassembly:
jne fcn.1406a4a91
js 0x1404c59e8
and qword [rsp + 0x48], 0xffffffffdc800190
push qword [rsp + 0x78]
popfq
lea rsp, [rsp + 0x98]
ret
push r15
pushfq
cmp rbp, 0x5098568b
push rbx
xchg qword [rsp + 0x20], rax
push rdi
movabs rdi, 0x39209f019abe4e90
push rcx

Function at 0x1403fcef1
Capabilities:
Encode data using base64
Get number of processors

Disassembly:
push r10
mov qword [rsp + 8], 0x6033bbc0
lea rsp, [rsp + 8]
call fcn.14083af6d

Function at 0x1403fcf06
Capabilities:
Encode data using base64
Get number of processors

Disassembly:
cmp dword [rsp + rsi + 0x38], 0xf2167e8d
mov rbp, qword [rsp + rsi*4 + 0x68]
call fcn.140532e84
Function at 0x1403fcf77
Capabilities:
Get number of processors

Disassembly:
movabs r11, 0x9b860bae0da1b936
push rsi
and r11w, 0x4486
call fcn.1405ad750
cdq
jmp 0x15bc1d5be
mov rsi, qword [rsi]
ja 0x140511071
call fcn.1403ebcf2
push r14
jg 0x1403f657f
mov rbp, qword [rsp + 0x28]
movabs r14, 0xe0a0e4b25b0ac73c
xor r14d, 0xc104d60d
push rsi
jae 0x1403d15a0

Function at 0x1403fcf85
Capabilities:
Get number of processors

Disassembly:
not rdx
mov rdx, qword [rsp + 0x30]
setbe dl
mov rdx, qword [rsp + 0x40]
jae 0x140632816
seta r13b
add dword [rsp + 0x30], 0x7e055a12
shl r13, 0xbd
mov r13, qword [rsp + r13*8 + 0x28]
call fcn.140540cc1
call fcn.140578fb5
xor ebx, 0xb9b3fd2a
add qword [rsp + 8], 0xffffffffbfc2d48d
lea rbx, [rbx + rbx*8 - 0x795342e3]
lea rdx, [rdx + 0x15827930]
and bx, bx

Function at 0x14040165c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
pushfq
call fcn.1406bf36d
movabs al, byte [0x39b4b67fc6bfadf4]
xor al, 0xcf
sub byte [rdi], cl
invalid

Function at 0x140401910
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + 0x28], 0x65bb93
mov rbp, qword [rsp + 0x20]
push r10
movzx ebp, byte [rsp + 0x2a]
cmp r14b, bpl
lea r14, [rbp*2 - 0x22464473]
movabs r10, 0x4092a226ae139e82
mov rbp, qword [rsp + rbp - 0x59]
mov rbp, qword [rbp + r14 + 0x22464361]
cmova r14w, r10w
and r14d, dword [rsp + 0x2b]
mov qword [rsp + 0x30], r14
jae 0x140637dbd

Function at 0x140404638
Capabilities:
Packed with generic packer

Disassembly:
not dword [rdi - 0x132f478]
sbb eax, 0xda32e6c9
out 0x37, eax
int1
xor al, al
sub al, 0x2a
int 0x11
test eax, 0xcd749e7f
invalid
mov r12, qword [rsp + 0x28]
jo 0x140477c25
neg r12d
call fcn.14053a376
sub eax, 0x1dcd7ba9
jrcxz 0x1404045f3
nop
pop rdi
pop rbx
in eax, dx
pop rsi
sbb bl, al
push 0x72192798
cwde
xchg esi, eax
jg 0x1404046df
cli
invalid
sbb dword [rdx + rsi*8 - 0x448e981e], edx
invalid
sub dword [rcx - 0x59], ebp
ror ebp, cl
or dh, byte [rdx]
insb byte [rdi], dx
jp 0x140404681
fild dword [rdi + rdx - 0x68]
invalid

Function at 0x14041224e
Capabilities:
Set socket configuration

Disassembly:
mov r14, r8
movsx ebx, r14b
push r8
not r14d
lea rsi, [r14 + riz - 0x7774d4c6]
call fcn.1403b7fc4

Function at 0x14041a204
Capabilities:
Packed with generic packer

Disassembly:
mov rax, r14
mov rax, qword [rsp + rax - 0x1887317]
mov rax, qword [rax]
test r9b, 0x85
seta r14b
cmp r9w, 0xd927
mov qword [rsp + 0x18], r9
push rdi
jae 0x1403b4678
lea rax, [rax + r14 - 0x11d37a70]
mov rdi, qword [rsp + r14*8 - 0xc4397e0]
add qword [rsp + 0x18], 0xfffffffffffae9f1
neg edi
xchg qword [rsp + 0x48], rax
mov rdi, qword [rsp + r14 - 0x1887300]
call fcn.14059bd38

Function at 0x14042b79c
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp + 8], 0xffffffffffa70acf
shl bl, cl
lea rbp, [rbp + 0x7a808210]
shr dword [rsp + 0x18], 0x35
or rbx, qword [rsp + 0x18]
setno byte [rsp + 0x18]
jb 0x1403e5d0c
mov ebx, dword [rsp + 0x1b]
xchg qword [rsp + rbx*2 - 0x3cc523d0], rbp
mov rbx, qword [rsp + 0x10]
jge 0x1405c3e55
call fcn.1406456dc
shl r15, 0x6a
not r15w
shl r15, 0x9a
jae 0x14055ba09
Function at 0x14043ab10
Capabilities:
Authenticate hmac
Get local ipv4 addresses

Disassembly:
mov qword [rsp + 0x18], rbp
push 0xffffffff919f8f8a
pushfq

Function at 0x14043b24d
Capabilities:
Packed with generic packer

Disassembly:
shl cl, cl
and cl, cl
shr rcx, 0xc
mov rcx, qword [rsp + 0x10]
mov rcx, qword [rcx]
jb 0x140655100
jle 0x140003afb
adc byte [rbx - 0x77], cl
cmp esi, dword [rdi + 0x4d7a8916]
xor r8, r8
jae 0x1404208bd
je fcn.1405a17c7
call 0x14067f12d

Function at 0x14043b9cf
Capabilities:
Get local ipv4 addresses

Disassembly:
mov ecx, 0x734ecd1b
or al, 0xcd
push rsp
pop rsp
xlatb
xor dh, ch
movsd dword [rdi], dword [rsi]
xor ebp, esi
mov dword [rdx], esi
jbe 0x14043b9d6
xor dword [rsi], edx
int 0xe1
sbb dl, dl
xor al, dl
cmp ah, byte [rcx + rcx + 0x166d3292]
invalid
lea rdi, [rdi + 1]
push r15
movabs r15, 0x75286214481f93ac
mov qword [rsp + 0x28], rdi
mov edi, 0x481f93ac
adc al, 0x62
sub byte [rbp + 0x48], dh
mov dword [rsp + 0x28], edi
shr r15, 0x2a
test r15, 0x7fb9b981
jbe 0x1406ec816
and r15, 0xffffffffae1b14bd
jg 0x14071885d
test byte [rbx + 0x175ff8c1], dl
cmp ch, bl
pop rdi
cmc
jp 0x14043b99b
invalid

Function at 0x14043d624
Capabilities:
Encode data using xor

Disassembly:
sub ebx, ebx
mov qword [rsp + rbx + 0x30], rbx

Function at 0x140460112
Capabilities:
Packed with generic packer

Disassembly:
add r9b, r9b
jbe 0x140493f4b
Function at 0x140473a3b
Capabilities:
Packed with generic packer

Disassembly:
neg qword [rsp + r11 - 0x4807eff]
shl qword [rsp + r11 - 0x4807eff], 0xdc
mov r11, qword [rsp + r11 - 0x4807ee7]
jb 0x1403fc5d7
sti
sar eax, 0x41
lodsd eax, dword [rsi]
or eax, 0xbe0a02fb
invalid
setae byte [rsp + 0x48]
jns fcn.14046b2d4
cmp word [rsp + 0x48], 0xb52f
sets byte [rsp + 0x48]
shl word [rsp + 0x48], 0xd
xor word [rsp + 0x48], 0xf82d
push qword [rsp + 0x58]
popfq
lea rsp, [rsp + 0x68]
ret
jbe 0x140473a46
add byte [rax - 0x77], cl
push rsp
and al, 0x10
mov qword [rsp + 0x10], rdx
push r14
movabs r14, 0xf817b480b606ea1a
shl r14, 0xce
add qword [rsp + 8], 0xe4622
movabs rdx, 0x6ab23a17ab185813
and r14w, dx
push rcx
invalid
movabs rcx, 0x7606a19c21baba0f
jge 0x1405b7dfe
int 0x26
mov esp, 0x73afd5ab
push rdx
cmp eax, 0xac69910e
sub dword [rdx - 0x2e], 0x59
sbb dword [rsi - 0x38], esi
loopne fcn.140473a36
pop rsi
mov edx, 0x447575d4
add al, 0xec
test qword [rcx], rax
jne 0x140473a38
cmpsb byte [rsi], byte [rdi]
movsb byte [rdi], byte [rsi]
mov bh, 0x26
enter 0x2452, 0xffffffffffffff94
xchg ecx, edi
test eax, 0xe7c6ae5a
adc dl, byte [rbx + 0x41d4ed9a]
mov bh, byte [rax]
shl dword [rdi - 0x3fa7ad97], cl
cdq
jae 0x140473a68
invalid
test word [rsp + rcx*2 + 0x18], cx
movzx cx, cl
mov rcx, qword [rsp + rcx + 0x30]
lea rsp, [rsp + 0x10]
ret 8
add dword [rsi + 0x48], edx
mov esi, 0x9a1e82be
popfq
stc
sub eax, 0x33669cf3
mul byte [rsi + 0xb]
test byte [rax + 2], 0xf6
push rsi
movabs rsi, 0xf32df99d9a1e82be
pushfq
xor si, si
or si, si
add sil, sil
test si, si
mov qword [rsp + 0x40], rax
and al, 0x40
lea rsi, [rsi + riz - 0x5dde47ff]
call fcn.1405dfdff
pop rdi
push rbp
movabs rbp, 0xaaa3ed8c99222b1f
pushfq
shl bp, 0x88
lea rbp, [rbp + rbp + 0x1a9ae29a]
call fcn.1404d1235
jge 0x1405a9441
fidivr dword [rcx]
mov eax, dword [rbx + 0x39265e07]
js 0x1405a94dc
cmp eax, 0x407730c6
ffree st(6)
invalid
loope 0x1405a945e
and al, 0xc6
int1
ret 0xd132
mov rdx, qword [rsp + 0x10]
mov rdx, qword [rdx]
mov qword [rsp + 0x10], rcx
js 0x1405a9443
or ecx, 0x390774bb
add ecx, r14d
jns 0x14057b753
jb fcn.140721bac
lea rdx, [rdx - 0x71e4a2c1]
and rcx, 0xffffffffb482d8ab
jb 0x140498ff0
setno r14b
add r14b, 0x86
bswap r14
xchg qword [rsp + 0x20], rdx
mov r14, qword [rsp + 8]
test qword [rsp + 0x10], 0xffffffffb30c48b1
call fcn.14049e61c
sub r11b, 0xa9
jno 0x1403f2481
mov r13, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0x2f3cc98c
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.1407aaab6

Function at 0x140489926
Capabilities:
Get local ipv4 addresses

Disassembly:
or rbp, rbp
xor bp, 0xca98
or dil, 0xbd
or bp, 0x5025
add qword [rsp + 8], 0x30f07e
push r10

Function at 0x14048994f
Capabilities:
Get local ipv4 addresses

Disassembly:
ja 0x1406d23c0
pop rsi
test dword [rsi - 9], 0xa9c10dae
movabs dword [0xf719a1039c9f3a65], eax
xor al, 0xea
ret 0xd662
movabs r15, 0xf12ed2022d1cd290
or r15b, 0x99
mov r15, qword [rsp + 0x20]
jle 0x1404b89af
js 0x140424adb

Function at 0x14048d602
Capabilities:
Set socket configuration

Disassembly:
push r9
mov qword [rsp + 8], 0x32d8e7e1
lea rsp, [rsp + 8]
call fcn.14074d835
Function at 0x140493b28
Capabilities:
Set socket configuration

Disassembly:
and bl, r9b
neg byte [rsp + 0x78]
mov r9, qword [rsp + 0x38]
add qword [rsp + 0x50], 0x23f461
not word [rsp + 0x28]
not ebx
or ebx, dword [rsp + 0x7b]
xor qword [rsp + 0x78], 0x580e9320
bswap ebx
xor dword [rsp + 0x78], 0xfa291f09
neg word [rsp + 0x78]
movzx bx, byte [rsp + 0x7a]
mov rbx, qword [rsp + 0x68]
shr bp, 0x6a
and byte [rsp + 0x28], 0x3d
test qword [rsp + 0x28], 0xffffffffac207407
mov rbp, qword [rsp + 0x40]
lea rsp, [rsp + 0x50]
ret 8
not word [rsp + 0x20]
setns byte [rsp + 0x20]
je fcn.14041224e
setno byte [rsp + 0x20]
je 0x1403ce4b4
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x38]
ret 8
Function at 0x1404b824e
Capabilities:
Packed with generic packer

Disassembly:
je 0x1405bd412
and cl, 0x90
shr cl, 0xea
push rbx
mov qword [rsp + 0x28], rbx
js 0x1403ee06b
jns 0x1404062f9
out 0x87, eax
add dword [rcx], ebx
or byte [rax], al
sbb dword [rax + rcx], esp
sbb dword [rdi + rax], edx
sbb dword [rsi + rax], esi
add byte [rcx], bl
xor dl, byte [0xe4d6d0ef]
mov r12, qword [rsp + r12 - 0x20f077cd]
invalid
invalid
jl 0x1404b82ac
jo 0x1404b828a
leave
jns 0x1404e50fa
mov ecx, 0x45e8000a
pop qword [rax + rax]
neg qword [rsp + 0x70]
test byte [rsp + 0x70], 0x96
not qword [rsp + 0x70]
push qword [rsp + 0x78]
popfq
lea rsp, [rsp + 0x80]
ret
call fcn.1404fa24c
mov dl, 0xa4
popfq
rcr byte [rbp - 0x10], cl
mov ebx, 0xe731980e
invalid

Function at 0x1404cc844
Capabilities:
Get common file path
Get number of processors
Packed with generic packer
Set registry value

Disassembly:
jle 0x1405df96e
call fcn.140351103

Function at 0x1404d4735
Capabilities:
Set registry value

Disassembly:
call fcn.1406d3643
mov qword [rsp + rsi + 0x38], rbx
mov r11, rsi
test r11w, 0xef0f
push r15
jge 0x14062996b
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x48]
call fcn.14074d835

Function at 0x1404ddcd1
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp], 0x11e056
cmp r10d, 0xfd34acbf
movabs rax, 0x61348cb28e3cd794
jge 0x14061c7d7

Function at 0x1404ed5c5
Capabilities:
Get common file path
Get number of processors
Packed with generic packer
Set registry value

Disassembly:
add rsi, qword [rsp + 8]
lea r9, [r9 + rsi + 0x1d1c2404]
cmp byte [rsp + 8], r9b
setns byte [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rsi, qword [rsi]
test dword [rsp + 8], r9d
jbe 0x140656a75
test byte [rsp + 0xf], r9b
setge byte [rsp + 8]
jg 0x140419931
test qword [rsp + 0x38], 0x3e16c402
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x48]
ret
xor qword [rsp + rsi*8 - 0x88f0], rsi
xor sil, 0xb2
xor rsi, 0x623f560d
shl word [rsp + rsi - 0x623f4762], 0x2d
mov rsi, qword [rsp + rsi - 0x623f477a]
or dword [rsp + 0x38], 0x93bf5839
and byte [rsp + 0x38], 0x84
jno 0x140548c83
movzx rsi, si
jge 0x1405df9a1

Function at 0x1404f80c7
Capabilities:
Set registry value

Disassembly:
xchg esi, eax
test al, 0x2f
and ah, byte [rsi]
cmpsd dword [rsi], dword [rdi]
leave
and dword [rdi], ebx
push rax
pop rbp
lahf
push rbx
add al, 0xfc
movabs eax, dword [0xf534a1145aec11c8]
fbstp tbyte [rbx + 0x610918e]
mov bl, 0x83
fidivr word [rax]
xor esp, dword [rdx + 0x75]
or al, 0xbc
mov cl, 0x60
xchg esi, eax
fcom dword [rcx]
iretd
mov rbx, qword [rsp + 0x20]
push rsi
pushfq
movabs rsi, 0x2f22e1b32a29230d
shl si, 0x1f
js 0x14044d236
shl sil, 0xbe
lea rbx, [rbx + 1]
jne 0x1407020f0
add si, 0xc417
xor esi, esi
and sil, 0x30
push r11
push rbx
jle 0x1406bcd61
test al, 0x9b
jge 0x1404f80fc
int1
jb 0x1404f80b9
jb 0x1404f8090
sub ch, byte [rdi - 0x59]
int 0x85
push 0x44
invalid

Function at 0x14052ffaa
Capabilities:
Get common file path
Set registry value

Disassembly:
lea rbx, [rbx + rbx*4 - 0x73cd73e4]
jg 0x1405561d8
sub bx, 0xaa3d
add bl, bl
jle 0x140705def