joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff674a39200
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x13d0
call fcn.7ff674cf3860
sub rsp, rax
mov rax, qword [0x7ff675045040]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
mov dword [rsp + 0x24], ebx
call fcn.7ff674aa9928
mov edx, eax
mov dword [rsp + 0x13b4], 0xffffffff
mov dword [rsp + 0x34], eax
lea eax, [rbx + 1]
nop word [rax + rax]
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
mov dword [rsp + rax*4 + 0x34], edx
inc rax
cmp rax, 0x270
jb 0x7ff674a39260
mov dword [rsp + 0x30], 0x270
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0xf
mov byte [rdi], bl
mov dword [rsp + 0x24], 1
mov esi, 4
lea rbp, [0x7ff675008c40]
movzx ebx, byte [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.7ff674a39340
mov eax, eax
shl rax, 4
shr rax, 0x20
cdqe
movzx r9d, byte [rax + rbp]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x7ff674a392fa
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x7ff674a392ef
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x7ff674a3930b
movzx r8d, bl
mov edx, 1
mov rcx, rdi
call fcn.7ff6749e5570
sub rsi, 1
jne 0x7ff674a392b3
mov rax, rdi
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.7ff674a3df50
lea r11, [rsp + 0x13d0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x7ff674a39340
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x7ff674a393a1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x7ff674a39360
mov ecx, dword [r9]
jmp 0x7ff674a3948b
cmp ecx, 0x4e0
jb 0x7ff674a3948b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x7ff674a393c0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x7ff674a39410
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x7ff674a3ed14
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x7ff674a3ed5e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x7ff674a3ed5e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x7ff674a3ed5e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x7ff674a3ed5e
cmp dword [rcx + 0x84], 0xe
jbe 0x7ff674a3ed5e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x7ff674a3ed60
xor al, al
add rsp, 0x28
ret
Function at 0x7ff674a50f70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
push r12
sub rsp, 0x50
mov rax, qword [rcx + 8]
mov r12d, r8d
mov ecx, 0x3e80000
mov rbx, qword [rax + 0x2f0]
mov rax, qword [rdx + 0x80]
movzx edx, word [rdx + 0x68]
movzx edi, word [rax + 0x18]
mov eax, 0x40000
shl edi, 0x10
cmp edi, eax
cmovl edi, eax
shl edx, 0x10
call fcn.7ff674a3fa40
mov dword [rsp + 0x24], eax
mov ecx, eax
cmp eax, 0x28f
jge 0x7ff674a50fc8
xor eax, eax
add rsp, 0x50
pop r12
pop rdi
pop rbx
ret
mov eax, dword [rbx + 0x24]
mov qword [rsp + 0x80], rbp
mov ebp, dword [rbx + 0x40]
mov qword [rsp + 0x48], rsi
mov esi, dword [rbx + 0x28]
mov qword [rsp + 0x40], r13
mov r13d, dword [rbx + 0x3c]
mov dword [rsp + 0x88], eax
mov eax, dword [rbx + 0x2c]
mov qword [rsp + 0x38], r14
mov r14d, dword [rbx + 0x34]
mov dword [rsp + 0x70], eax
mov eax, dword [rbx + 0x38]
mov qword [rsp + 0x30], r15
mov r15d, dword [rbx + 0x30]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x20], r13d
test r12d, r12d
jg 0x7ff674a5101f
mov ebx, 0x4b0000
jmp 0x7ff674a5102f
shl r12d, 0x10
mov edx, ecx
mov ecx, r12d
call fcn.7ff674a42030
mov ebx, eax
bsr ecx, ebx
bsr eax, edi
shl r13d, 0x10
add eax, ecx
cmp eax, 0x2e
jl 0x7ff674a51045
mov ecx, r13d
jmp 0x7ff674a51050
mov edx, edi
mov ecx, ebx
call fcn.7ff674a42030
mov ecx, eax
mov r8d, dword [rsp + 0x88]
mov eax, r8d
shl eax, 0x10
cmp ecx, eax
jge 0x7ff674a5106c
shl esi, 0x10
mov ecx, esi
jmp 0x7ff674a51132
mov edx, dword [rsp + 0x70]
mov r12d, edx
shl r12d, 0x10
cmp ecx, r12d
jge 0x7ff674a5109f
mov r13d, edx
mov ecx, eax
mov edx, edi
sub r13d, r8d
call fcn.7ff674a3fa40
mov ecx, ebx
sub ecx, eax
test r13d, r13d
je 0x7ff674a510ef
sub r15d, esi
mov r8d, r13d
mov edx, r15d
jmp 0x7ff674a510d8
mov eax, r14d
shl eax, 0x10
cmp ecx, eax
jl 0x7ff674a510f3
cmp ecx, r13d
jge 0x7ff674a5112d
mov r15d, dword [rsp + 0x20]
mov edx, edi
sub r15d, r14d
shl r14d, 0x10
mov ecx, r14d
call fcn.7ff674a3fa40
sub ebx, eax
test r15d, r15d
je 0x7ff674a5112d
mov esi, dword [rsp + 0x78]
mov r8d, r15d
sub ebp, esi
mov ecx, ebx
mov edx, ebp
call fcn.7ff674a41f20
shl esi, 0x10
mov edx, edi
mov ecx, esi
mov ebx, eax
call fcn.7ff674a3fa40
add ebx, eax
jmp 0x7ff674a5113b
mov edx, dword [rsp + 0x70]
mov esi, r14d
mov ecx, r12d
sub esi, edx
mov edx, edi
call fcn.7ff674a3fa40
mov ecx, ebx
sub ecx, eax
test esi, esi
je 0x7ff674a510ae
mov edx, dword [rsp + 0x78]
mov r8d, esi
sub edx, r15d
call fcn.7ff674a41f20
shl r15d, 0x10
mov edx, edi
mov ecx, r15d
mov ebx, eax
call fcn.7ff674a3fa40
add ebx, eax
jmp 0x7ff674a5113b
shl ebp, 0x10
mov ecx, ebp
mov edx, edi
call fcn.7ff674a3fa40
mov ebx, eax
mov edx, dword [rsp + 0x24]
mov ecx, ebx
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r12
pop rdi
pop rbx
jmp fcn.7ff674a3fa40
Function at 0x7ff674a9dfe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x7ff675045040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov ebp, r9d
mov byte [rsp + 0x20], dl
xor r9d, r9d
mov r14d, r8d
mov r13d, r9d
mov rbx, rcx
mov ecx, dword [rbx + 4]
mov r10d, 0xffff
mov eax, ecx
mov dword [rbx + 0x38], r9d
imul eax, r14d
mov r15d, 0xffffffff
imul ecx, ebp
mov edi, r9d
mov qword [rbx + 0x60], r9
mov qword [rbx + 0x58], r9
mov dword [rbx + 0x54], r9d
mov dword [rbx + 0x48], eax
mov rax, qword [rbx + 0x18]
mov qword [rbx + 0x30], rax
mov rax, qword [rbx + 0x20]
sub rax, 4
mov dword [rbx + 0x4c], ecx
mov qword [rbx + 0x28], rax
mov word [rbx + 0x50], r9w
cmp r9w, word [rbx + 0x78]
jge 0x7ff674a9e11f
movsx r12d, dl
mov rsi, r9
nop dword [rax + rax]
mov rax, qword [rbx + 0x90]
lea edx, [r15 + 1]
mov dword [rbx + 0x70], r9d
mov rcx, rbx
mov qword [rbx + 0x68], r9
mov r9d, r12d
movsx r15d, word [rsi + rax]
mov r8d, r15d
call fcn.7ff674a9d0a0
test al, al
jne 0x7ff674a9e188
mov rdx, qword [rbx + 0x68]
test rdx, rdx
je 0x7ff674a9e101
mov eax, dword [rbx + 4]
mov ecx, dword [rbx + 0x44]
dec eax
test ecx, eax
jne 0x7ff674a9e0e2
cmp ecx, dword [rbx + 0x48]
jl 0x7ff674a9e0e2
cmp ecx, dword [rbx + 0x4c]
jg 0x7ff674a9e0e2
mov rax, qword [rbx + 0x58]
movzx ecx, byte [rdx + 0x1c]
xor cl, byte [rax + 0x1c]
test cl, 8
jne 0x7ff674a9e0e2
add qword [rbx + 0x30], 0xfffffffffffffffc
mov rcx, rbx
call fcn.7ff674a9d7c0
test al, al
jne 0x7ff674a9e188
cmp qword [rbx + 0x60], 0
jne 0x7ff674a9e101
mov rax, qword [rbx + 0x68]
mov qword [rbx + 0x60], rax
movsx eax, word [rbx + 0x78]
inc edi
add rsi, 2
mov r9d, 0
cmp edi, eax
jl 0x7ff674a9e080
mov r10d, 0xffff
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x7ff674a9e15d
movzx r8d, word [rbx + 0x50]
sub r8w, 1
je 0x7ff674a9e15a
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
cmp qword [rdx + 8], rax
jne 0x7ff674a9e151
mov qword [rcx + 8], rdx
mov rcx, rdx
add r8w, r10w
jne 0x7ff674a9e140
mov qword [rcx], r9
cmp qword [rbx + 0x60], 0
je 0x7ff674a9e16c
mov rcx, rbx
call fcn.7ff674a9d3e0
sub r13, 1
js 0x7ff674a9e1b3
movzx edx, byte [rsp + 0x20]
lea ebp, [r14 - 1]
mov r14d, dword [rsp + r13*4 + 0x30]
xor r9d, r9d
jmp 0x7ff674a9e01c
mov eax, dword [rbx + 0x38]
cmp eax, 0x62
jne 0x7ff674a9e1b5
cmp r14d, ebp
je 0x7ff674a9e1b5
movzx edx, byte [rsp + 0x20]
mov dword [rsp + r13*4 + 0x30], r14d
add r14d, ebp
sar r14d, 1
inc r13
inc r14d
xor r9d, r9d
jmp 0x7ff674a9e01c
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.7ff674a3df50
mov rbx, qword [rsp + 0x110]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x7ff674aa2a30
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push rbx
push rbp
sub rsp, 0x48
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
jne 0x7ff674aa2a4c
lea eax, [rcx + 0x28]
add rsp, 0x48
pop rbp
pop rbx
ret
mov qword [rsp + 0x68], rsi
xor r9d, r9d
mov qword [rsp + 0x40], r14
mov edx, 0x80000000
xor r14d, r14d
mov rcx, rbp
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r14 + 1]
call qword [sym.imp.kernel32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x7ff674aa2aa0
mov r14, qword [rsp + 0x40]
lea eax, [rsi + 2]
mov rsi, qword [rsp + 0x68]
add rsp, 0x48
pop rbp
pop rbx
ret
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x78], rdi
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetFileSizeEx]
test eax, eax
je 0x7ff674aa2bc5
mov rax, qword [rsp + 0x70]
cmp rax, 0x7fffffff
jg 0x7ff674aa2bc5
test rax, rax
je 0x7ff674aa2bc5
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov dword [rsp + 0x20], r14d
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.kernel32.dll_CreateFileMappingA]
mov rdi, rax
test rax, rax
je 0x7ff674aa2bc5
mov ecx, dword [rsp + 0x70]
xor r9d, r9d
mov dword [rbx + 8], ecx
xor r8d, r8d
mov rcx, rax
mov dword [rbx + 0xc], r14d
mov qword [rsp + 0x20], r14
lea edx, [r9 + 4]
call qword [sym.imp.kernel32.dll_MapViewOfFile]
mov rcx, rdi
mov qword [rbx], rax
call qword [sym.imp.kernel32.dll_CloseHandle]
cmp qword [rbx], r14
je 0x7ff674aa2b3a
lea rax, [0x7ff674aa2c20]
jmp 0x7ff674aa2b93
mov rcx, qword [rbx + 0x30]
xor edx, edx
movsxd r8, dword [rbx + 8]
mov rcx, qword [rcx]
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x7ff674aa2bc5
mov edi, r14d
nop dword [rax + rax]
mov r8d, dword [rbx + 8]
lea r9, [rsp + 0x60]
mov edx, edi
sub r8d, edi
add rdx, qword [rbx]
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x7ff674aa2bb3
add edi, dword [rsp + 0x60]
cmp edi, dword [rbx + 8]
jne 0x7ff674aa2b60
lea rax, [0x7ff674aa2bf0]
mov rcx, rsi
mov qword [rbx + 0x28], rax
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rax, qword [rbx]
mov qword [rbx + 0x10], rax
xor eax, eax
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], r14
jmp 0x7ff674aa2bda
mov rcx, qword [rbx + 0x30]
xor edx, edx
mov r8, qword [rbx]
mov rcx, qword [rcx]
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 0x51
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
pop rbx
ret
Function at 0x7ff674aa4350
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x7ff674aa435b
xor eax, eax
ret
lea r11, [0x7ff674d197f0]
not ecx
cmp r8, 8
jb 0x7ff674aa442d
mov r10, r8
shr r10, 3
imul rax, r10, 0xfffffffffffffff8
add r8, rax
nop dword [rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x7ff674aa4380
test r8, r8
je 0x7ff674aa445d
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x7ff674aa4440
not ecx
mov eax, ecx
ret
Function at 0x7ff674aa9888
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, [0x7ff674d1b5c0]
mov r9d, 2
call qword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x7ff674aa98c2
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x7ff674aa98c7
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.kernel32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x7ff674aa9910
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x7ff674d1b4c0]
cmp byte [rcx + rax], 0
je 0x7ff674aa9910
dec r8
sub rdx, 1
jne 0x7ff674aa98f6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x7ff674af7270
Capabilities:
Get socket status

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x690
call fcn.7ff674cf3860
sub rsp, rax
mov rax, qword [0x7ff675045040]
xor rax, rsp
mov qword [rsp + 0x670], rax
mov rsi, qword [rsp + 0x6d8]
mov eax, edx
xor edx, edx
mov r10d, ecx
mov dword [rsp + 0x460], 0
mov dword [rsp + 0x250], 0
mov dword [rsp + 0x40], edx
cmp ecx, 0xffffffff
je 0x7ff674af72d8
test eax, eax
je 0x7ff674af72d8
mov qword [rsp + 0x468], r10
mov dword [rsp + 0x460], 1
cmp r8d, 0xffffffff
je 0x7ff674af72f9
test r9d, r9d
je 0x7ff674af72f9
mov eax, r8d
mov qword [rsp + 0x258], rax
mov dword [rsp + 0x250], 1
cmp r10d, 0xffffffff
je 0x7ff674af730d
mov edx, 1
mov qword [rsp + 0x48], r10
mov dword [rsp + 0x40], edx
cmp r8d, 0xffffffff
je 0x7ff674af7342
xor eax, eax
test edx, edx
je 0x7ff674af732d
mov r9d, r8d
nop dword [rax]
cmp qword [rsp + rax*8 + 0x48], r9
je 0x7ff674af732d
inc eax
cmp eax, edx
jb 0x7ff674af7320
cmp eax, edx
jne 0x7ff674af7342
cmp edx, 0x40
jae 0x7ff674af7342
mov edx, r8d
mov qword [rsp + rax*8 + 0x48], rdx
inc dword [rsp + 0x40]
mov rbx, qword [rsp + 0x6d0]
cmp r8d, r10d
mov edi, r8d
cmovle edi, r10d
cmp r10d, 0xffffffff
jne 0x7ff674af736c
cmp r8d, r10d
jne 0x7ff674af736c
cmp rbx, 0xffffffffffffffff
jb 0x7ff674af736c
xor eax, eax
jmp 0x7ff674af74a3
mov qword [rsp + 0x6b8], rbp
mov qword [rsp + 0x688], r12
mov qword [rsp + 0x680], r15
test rsi, rsi
je 0x7ff674af7391
mov rcx, rsi
call fcn.7ff674b67c40
lea ebp, [rdi + 1]
movabs r15, 0x12e0be826d694b2f
movabs r12, 0x624dd2f1a9fbe77
nop dword [rax + rax]
cmp rbx, 0xffffffffffffffff
jae 0x7ff674af743b
call fcn.7ff674b5cf10
cmp rax, rbx
jbe 0x7ff674af73cb
mov ecx, 0x3e7
jmp 0x7ff674af73ef
mov rcx, rbx
sub rcx, rax
mov rax, rcx
not rax
cmp rax, 0x3e7
jae 0x7ff674af73e8
mov rcx, 0xffffffffffffffff
jmp 0x7ff674af73ef
add rcx, 0x3e7
mov rax, r15
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x1d
mov dword [rsp + 0x30], eax
imul rax, rax, 0x3b9aca00
sub rcx, rax
mov rax, r12
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 9
mov dword [rsp + 0x34], ecx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x38]
jmp 0x7ff674af743d
xor eax, eax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x250]
mov ecx, ebp
lea rdx, [rsp + 0x460]
call qword [sym.imp.ws2_32.dll_select]
mov edi, eax
cmp eax, 0xffffffff
jne 0x7ff674af7477
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x7ff674af73b0
mov r15, qword [rsp + 0x680]
mov r12, qword [rsp + 0x688]
mov rbp, qword [rsp + 0x6b8]
test rsi, rsi
je 0x7ff674af749c
mov rcx, rsi
call fcn.7ff674b67bd0
not edi
shr edi, 0x1f
mov eax, edi
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.7ff674a3df50
add rsp, 0x690
pop rdi
pop rsi
pop rbx
ret
Function at 0x7ff674b072c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x30
call fcn.7ff674cf3860
sub rsp, rax
mov rax, qword [0x7ff675045040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, qword [rdx + 0x18]
lea r9, [rsp + 0x20]
mov rdi, qword [rdx]
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 8]
call fcn.7ff674b06c20
test eax, eax
je 0x7ff674b07345
movzx ecx, byte [rdi]
shr cl, 3
not cl
and cl, 0x10
or cl, 0xf
and cl, byte [rsp + 0x20]
xor cl, byte [rdi]
mov byte [rdi], cl
and cl, 3
add cl, 1
je 0x7ff674b07340
lea rdx, [rsp + 0x21]
movzx ecx, cl
sub rdx, rbx
nop dword [rax + rax]
movzx eax, byte [rbx + rdx]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rcx, 1
jne 0x7ff674b07330
mov eax, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.7ff674a3df50
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x7ff674b07360
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x30
call fcn.7ff674cf3860
sub rsp, rax
mov rax, qword [0x7ff675045040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, qword [rdx + 0x18]
lea r9, [rsp + 0x20]
mov rdi, qword [rdx]
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 8]
call fcn.7ff674b06c20
test eax, eax
je 0x7ff674b073e9
movzx eax, byte [rdi]
and al, 3
add al, 1
je 0x7ff674b073d0
lea rdx, [rsp + 0x21]
movzx ecx, al
sub rdx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx + rdx]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rcx, 1
jne 0x7ff674b073c0
movzx ecx, byte [rdi]
mov eax, 1
shr cl, 3
not cl
and cl, 0x10
or cl, 0xf
and cl, byte [rsp + 0x20]
xor byte [rdi], cl
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.7ff674a3df50
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x7ff674b30b70
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.7ff674cf3860
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.kernel32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x7ff674b30d60
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
push rdi
push r13
mov eax, 0x30
call fcn.7ff674cf3860
sub rsp, rax
mov eax, dword [0x7ff67506efd8]
mov r13d, ecx
mov ebx, 1
cmp eax, 2
je 0x7ff674b30dd3
nop word [rax + rax]
xor eax, eax
lock cmpxchg dword [0x7ff67506efd8], ebx
je 0x7ff674b30dad
cmp eax, ebx
je 0x7ff674b30d90
mov eax, dword [0x7ff67506efd8]
cmp eax, 2
jne 0x7ff674b30df1
jmp 0x7ff674b30dd3
call qword [sym.imp.kernel32.dll_TlsAlloc]
lea r8, [0x7ff674b30c80]
xor edx, edx
xor ecx, ecx
mov dword [0x7ff67506efd4], eax
call fcn.7ff674b99a40
mov dword [0x7ff67506efd8], 2
mov r8d, 0x97
lea rdx, [0x7ff674d35c60]
lea ecx, [r8 - 0x3f]
call fcn.7ff674b331a0
mov rdi, rax
test rax, rax
jne 0x7ff674b30dfc
xor eax, eax
add rsp, 0x30
pop r13
pop rdi
pop rbx
ret
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
call fcn.7ff674b67bf0
mov qword [rdi + 0x30], rax
call fcn.7ff674b677f0
mov qword [rdi + 0x40], rax
call fcn.7ff674b677f0
mov qword [rdi + 0x50], rax
call fcn.7ff674b67bf0
mov qword [rdi + 0x38], rax
call fcn.7ff674b67bf0
mov qword [rdi + 0x48], rax
call fcn.7ff674b67bf0
cmp r13d, ebx
mov qword [rdi + 0x30], rax
mov r8d, 0x85
lea rdx, [0x7ff674d35c60]
cmovge ebx, r13d
inc ebx
movsxd rbx, ebx
lea rcx, [rbx*8]
call fcn.7ff674b331a0
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x10], rax
test rax, rax
je 0x7ff674b30ea1
cmp qword [rdi + 0x40], 0
je 0x7ff674b30ea1
cmp qword [rdi + 0x50], 0
je 0x7ff674b30ea1
cmp qword [rdi + 0x30], 0
je 0x7ff674b30ea1
cmp qword [rdi + 0x38], 0
je 0x7ff674b30ea1
cmp qword [rdi + 0x48], 0
jne 0x7ff674b30efa
mov r8d, 0xa9
lea rdx, [0x7ff674d35c60]
mov rcx, rax
call fcn.7ff674b32f10
lea rcx, [rdi + 0x40]
call fcn.7ff674b67750
lea rcx, [rdi + 0x50]
call fcn.7ff674b67750
lea rcx, [rdi + 0x38]
call fcn.7ff674b67b80
lea rcx, [rdi + 0x48]
call fcn.7ff674b67b80
lea rcx, [rdi + 0x30]
call fcn.7ff674b67b80
mov r8d, 0xaf
lea rdx, [0x7ff674d35c60]
mov rcx, rdi
call fcn.7ff674b32f10
xor edi, edi
mov r15, qword [rsp + 0x20]
mov rax, rdi
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop r13
pop rdi
pop rbx
ret
Function at 0x7ff674b30f20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
mov eax, 0x20
call fcn.7ff674cf3860
sub rsp, rax
mov rbx, rcx
lea esi, [rax - 0x21]
call qword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [0x7ff67506efd4]
mov edi, eax
call qword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, edi
mov r14, rax
call qword [sym.imp.kernel32.dll_SetLastError]
test r14, r14
jne 0x7ff674b30fae
mov r8d, 0xde
lea rdx, [0x7ff674d35c60]
lea ecx, [r8 + 0x12]
call fcn.7ff674b331a0
mov r14, rax
test rax, rax
jne 0x7ff674b30f9f
mov r8d, 0xdf
lea rdx, [0x7ff674d35c60]
lea rcx, [0x7ff674d35c78]
call fcn.7ff674b80d80
mov ecx, dword [0x7ff67506efd4]
mov rdx, r14
call qword [sym.imp.kernel32.dll_TlsSetValue]
xor ecx, ecx
mov rax, r14
cmp qword [rax], 0
jne 0x7ff674b30fbf
cmp esi, 0xffffffff
cmove esi, ecx
cmp qword [rax + 0x10], rbx
je 0x7ff674b31083
inc ecx
add rax, 0x18
cmp ecx, 0xa
jl 0x7ff674b30fb3
prefetchw byte [rbx + 0x24]
mov eax, dword [rbx + 0x24]
nop dword [rax + rax]
mov ecx, eax
lock cmpxchg dword [rbx + 0x24], ecx
jne 0x7ff674b30fe0
mov rcx, qword [rbx + 0x10]
mov r8d, eax
lea rdx, [r8*8]
lock inc qword [rdx + rcx]
prefetchw byte [rbx + 0x24]
mov eax, dword [rbx + 0x24]
mov ecx, eax
lock cmpxchg dword [rbx + 0x24], ecx
jne 0x7ff674b31004
cmp r8d, eax
je 0x7ff674b31062
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
lock dec qword [rdx + rax]
prefetchw byte [rbx + 0x24]
mov eax, dword [rbx + 0x24]
mov ecx, eax
lock cmpxchg dword [rbx + 0x24], ecx
jne 0x7ff674b31030
mov r8d, eax
mov rax, qword [rbx + 0x10]
lea rdx, [r8*8]
lock inc qword [rdx + rax]
prefetchw byte [rbx + 0x24]
mov eax, dword [rbx + 0x24]
mov ecx, eax
lock cmpxchg dword [rbx + 0x24], ecx
jne 0x7ff674b31054
cmp r8d, eax
jne 0x7ff674b31020
movsxd rax, esi
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x10]
lea rdx, [r14 + rcx*8]
mov dword [rdx + 8], 1
mov qword [rdx + 0x10], rbx
lea rcx, [rax + r8*8]
mov qword [rdx], rcx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret