joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ec8a0
Capabilities:
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rbx, r8
mov rdi, rcx
mov rax, qword [0x14039bf08]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea r13, [0x1402fad40]
mov qword [rsp + 0x40], r13
lea r14, [rsp + 0x40]
mov qword [rsp + 0x78], r14
lea rcx, [rsp + 0x30]
mov r8b, 1
mov r9, r14
call fcn.1400eb6b0
mov r15, qword [rsp + 0x38]
mov rdx, r15
xor r8d, r8d
call fcn.1400ec2e0
cmp eax, 2
jne 0x1400eca2c
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r12, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, 0xfde9
xor edx, edx
mov r8, r15
mov r9d, 0xffffffff
call r12
movsxd rbp, eax
lea rcx, [rbp*2]
call fcn.140023770
mov rsi, rax
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, r15
mov r9d, 0xffffffff
call r12
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x78], r14
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8b, 1
mov r9, r14
call fcn.1400eb6b0
mov r14, qword [rsp + 0x38]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call r12
movsxd r15, eax
lea rcx, [r15 + r15]
call fcn.140023770
mov rbx, rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call r12
mov rcx, rdi
mov rdx, r14
call fcn.1400e56e0
cmp eax, 1
jne 0x1400eca02
mov rdx, r14
xor r8d, r8d
call fcn.1400ec2e0
cmp eax, 2
jne 0x1400eca02
mov rdx, r14
call fcn.1400ec600
test al, al
je 0x1400eca5f
mov rcx, rsi
mov rdx, rbx
mov r8d, 9
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
mov rcx, rbx
call fcn.14026b828
mov rcx, rsi
call fcn.14026b828
jmp 0x1400eca39
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140263300
mov eax, edi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor edi, edi
jmp 0x1400eca1a
Function at 0x1400ee270
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14039bf08]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 0x18
call fcn.140263580
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rsi
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
lea r8, [0x1400ee310]
xor esi, esi
xor ecx, ecx
mov edx, 0x100000
mov r9, rax
call fcn.140282410
lea rcx, [rax + 1]
cmp rcx, 1
ja 0x1400ee2e1
call fcn.140275c78
mov esi, dword [rax]
jmp 0x1400ee2ea
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140263300
mov eax, esi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400ee990
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rsi, rdx
mov ebx, ecx
mov rax, qword [0x14039bf08]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
test rax, rax
je 0x1400eea77
mov eax, dword [rsp + 0x44]
cmp eax, ebx
jle 0x1400ee9e6
mov dword [rsp + 0x44], ebx
mov eax, ebx
test eax, eax
jle 0x1400eea6e
xor r12d, r12d
xorps xmm6, xmm6
mov r13, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop dword [rax + rax]
mov rbx, qword [rdi + r12*8]
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, 0xffffffff
call r13
movsxd r14, eax
mov rcx, r14
call fcn.140023770
mov r15, rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, 0xffffffff
call r13
mov qword [rsi + r12*8], r15
inc r12
movsxd rax, dword [rsp + 0x44]
cmp r12, rax
jl 0x1400eea00
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140263300
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14010e4b0
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov eax, 0x2038
call fcn.1402635e0
sub rsp, rax
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14039bf08]
xor rax, rsp
mov qword [rsp + 0x2030], rax
cmp qword [0x14039e290], 0
jne 0x14010e503
mov ecx, 8
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [0x14039e290], rax
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x410
xor edx, edx
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x14010e58f
mov rbx, rax
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov rcx, rax
mov r8d, 0x2000
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x14010e570
cmp dword [rsp + 0x2c], 8
jb 0x14010e570
xor r15d, r15d
mov r12, qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
mov rcx, qword [rsp + r15*8 + 0x30]
mov rdx, rdi
call r12
test rax, rax
jne 0x14010e5c7
inc r15
mov eax, dword [rsp + 0x2c]
shr rax, 3
cmp r15, rax
jb 0x14010e550
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.None_of_the_loaded_modules_contained_the_requested_symbol__s.
xor r14d, r14d
xor ecx, ecx
mov r8, rdi
call fcn.14018fc00
jmp 0x14010e5a0
lea rdx, str.Failed_to_open_current_process.
xor r14d, r14d
xor ecx, ecx
call fcn.14018fc00
mov qword [rsi], rax
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.140263300
mov rax, r14
add rsp, 0x2038
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14010e5a3
Function at 0x140131220
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov eax, dword [0x1403a3040]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rdi, qword [rax + 8]
test rdi, rdi
je 0x14013127b
mov rcx, qword [rdi + 0x690]
lea rsi, [0x14039e598]
test rcx, rcx
je 0x1401312d5
mov rdx, qword [0x14039e588]
test rdx, rdx
je 0x1401312a6
mov rax, qword [rcx + 0x380]
mov rcx, qword [rax + 8]
call fcn.140266590
test rax, rax
jne 0x1401312cd
jmp 0x1401312d5
mov ecx, dword [0x140399e50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14013129f
cmp byte [rax + 8], 0
jne 0x1401312d1
mov rcx, rax
call fcn.140048300
test rax, rax
jne 0x1401312d1
call fcn.14018eef0
jmp 0x1401312d1
mov rax, qword [0x14039e300]
test rax, rax
je 0x1401312bd
mov rax, qword [rax + 0x50]
cmp rax, rcx
jne 0x1401312c4
jmp 0x1401312cd
xor eax, eax
cmp rax, rcx
je 0x1401312cd
call fcn.14012acf0
test al, al
jne 0x1401312d5
mov rax, qword [rdi + 0x10]
mov rsi, qword [rax + 0x40]
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1401473e0
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rcx + 7]
mov rax, rdx
sar rax, 1
mov r8, qword [rcx - 1]
and r8d, 0xfffff000
cmp r8d, 0x5d000
je 0x140147412
mov r8, qword [rcx - 1]
and r8d, 0xfffff000
cmp r8d, 0x5f000
jne 0x140147478
mov r8, qword [rcx - 1]
and r8d, 0xfffff000
cmp r8d, 0x5d000
jne 0x14014742c
add rcx, 0xf
jmp 0x140147430
mov rcx, qword [rcx + 0xf]
xor r8d, r8d
cmp rdx, 2
jl 0x1401474db
inc rax
xor edx, edx
nop word cs:[rax + rax]
movzx r8d, byte [rcx]
add r8d, edx
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov edx, r9d
shr edx, 6
xor edx, r9d
inc rcx
dec rax
cmp rax, 1
ja 0x140147450
jmp 0x1401474d7
mov r8, qword [rcx - 1]
and r8d, 0xfffff000
cmp r8d, 0x5e000
jne 0x140147492
add rcx, 0xf
jmp 0x140147496
mov rcx, qword [rcx + 0xf]
xor r8d, r8d
cmp rdx, 2
jl 0x1401474db
inc rax
xor edx, edx
nop word cs:[rax + rax]
movzx r8d, word [rcx]
add r8d, edx
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov edx, r9d
shr edx, 6
xor edx, r9d
add rcx, 2
dec rax
cmp rax, 1
ja 0x1401474b0
lea r8d, [rdx + rdx*8]
mov ecx, r8d
shr ecx, 0xb
xor ecx, r8d
mov eax, ecx
shl eax, 0xf
add eax, ecx
and eax, 0x3fffffff
cmp eax, 1
adc eax, 0
ret
Function at 0x140156c40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rbx, r9
mov r15, r8
mov qword [rsp + 0x30], rdx
mov rdi, rcx
mov rax, qword [0x14039bf08]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [0x1403a3040]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
mov rsi, qword [rax + 0x18]
mov rcx, rsi
call fcn.1400f7d20
mov r12, rax
mov rcx, rsi
call fcn.1400f7d20
mov r13, rax
mov rax, qword [rdi + 8]
add rdi, 8
cmp rax, qword [0x140399cf0]
je 0x140156df8
mov rbp, qword [rax + 0xf]
cmp rbp, 2
jl 0x140156df8
mov qword [rsp + 0x48], rsi
sar rbp, 1
xor esi, esi
xor r14d, r14d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], rbx
jmp 0x140156d0d
test rsi, rsi
je 0x140156df1
mov rcx, qword [rsi + 8]
mov r8, qword [r13 + 8]
lea rdx, [rcx + r14*8]
add rdx, 0x27
dec rcx
call fcn.1400ef8d0
inc r14
cmp r14, rbp
je 0x140156dfa
mov rax, qword [rdi]
mov rdx, qword [rax + r14*8 + 0x27]
mov rcx, r12
call fcn.1400f7d40
mov rax, qword [r12]
mov rcx, qword [rsp + 0xd8]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rsp + 0xd0]
mov dword [rsp + 0x20], ecx
mov rcx, r12
lea rdx, [rsp + 0x58]
mov r8, r15
mov r9, rbx
call qword [rax + 0x358]
mov rdx, qword [rsp + 0x58]
mov rcx, r13
call fcn.1400f7d40
mov rax, qword [r12 + 8]
cmp rax, qword [r13 + 8]
je 0x140156ce0
test rsi, rsi
jne 0x140156ce0
lea rcx, [rsp + 0x50]
mov rdx, rbp
mov r8d, dword [rsp + 0xd0]
call fcn.14014cea0
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call fcn.1400eef80
mov rsi, rax
test r14, r14
je 0x140156ce9
xor ebx, ebx
mov r15, r14
nop word [rax + rax]
mov rax, qword [rdi]
mov rdx, qword [rax + rbx + 0x27]
mov rcx, r12
call fcn.1400f7d40
mov rcx, qword [rsi + 8]
mov r8, qword [r12 + 8]
lea rdx, [rcx + rbx]
add rdx, 0x27
dec rcx
call fcn.1400ef8d0
add rbx, 8
dec r15
jne 0x140156db0
mov rbx, qword [rsp + 0x38]
mov r15, qword [rsp + 0x40]
jmp 0x140156ce9
xor esi, esi
jmp 0x140156d01
xor esi, esi
lea rax, [rsi + 8]
test rsi, rsi
cmove rax, rdi
mov rax, qword [rax]
mov rsi, qword [rsp + 0x30]
mov qword [rsi], rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140263300
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140162ec0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14039bf08]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [0x1403a3040]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
mov rcx, qword [rax + 0x690]
mov rcx, qword [rcx + 0x20]
mov rdx, qword [rcx + 0x4d0]
mov rcx, qword [rax + 0x18]
call fcn.1401631a0
mov qword [rsp + 0x20], rbx
mov rcx, qword [rbx + 8]
test byte [rcx + 7], 2
cmove rax, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
pcmpeqd xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0xffffffffffffffff
lea rcx, [rsp + 0x20]
call fcn.140163070
test al, al
je 0x14016304c
lea rbx, str.0x_.8x:
lea r14, [rsp + 0x20]
lea r15, [0x1402da199]
lea r12, [0x1402fd21e]
nop dword [rax]
mov r8d, dword [rsp + 0x38]
mov rcx, rdi
mov rdx, rbx
call fcn.140023fd0
mov r13, qword [rsp + 0x48]
test r13, r13
js 0x140162fc0
add r13, qword [rsp + 0x50]
jg 0x140162fd4
jmp 0x140163030
mov rcx, r14
call fcn.14017ffd0
mov r13, qword [rsp + 0x48]
add r13, qword [rsp + 0x50]
jle 0x140163030
xor ebp, ebp
jmp 0x140162ff0
mov rcx, rdi
call fcn.140024140
inc rbp
cmp r13, rbp
je 0x140163030
cmp qword [rsp + 0x48], 0
jns 0x140163000
mov rcx, r14
call fcn.14017ffd0
mov rax, rbp
shr rax, 3
add rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
movzx eax, byte [rcx + rax + 0xb]
mov ecx, ebp
and ecx, 7
bt eax, ecx
mov rdx, r15
jae 0x140162fe0
mov rdx, r12
jmp 0x140162fe0
mov rcx, r14
call fcn.140163070
test al, al
je 0x14016304c
mov rcx, rdi
mov rdx, rsi
call fcn.140024140
jmp 0x140162f90
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140263300
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140164bf0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, r8
mov r8, rdx
mov rsi, rcx
mov rbx, qword [rsp + 0xd8]
mov ecx, dword [rsp + 0xe0]
mov rdx, qword [0x14039bf08]
xor rdx, rsp
mov qword [rsp + 0x60], rdx
mov edx, dword [0x1403a3040]
mov r10, qword gs:[0x58]
mov rdx, qword [r10 + rdx*8]
mov rdx, qword [rdx + 8]
mov r15, qword [rdx + 0x18]
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], r9
lea rcx, [rsp + 0x58]
mov rdx, r15
mov r9, rax
call fcn.1401649d0
mov rdx, qword [rsp + 0x58]
mov rcx, r15
call fcn.140164b10
mov rdi, rax
lea rax, [rbx + 2]
mov qword [rsp + 0x48], rax
lea r8, [rbx*2 + 4]
lea rcx, [rsp + 0x50]
mov edx, 0x59
mov r9d, 1
call fcn.140174a90
mov rdx, qword [rsp + 0x50]
mov rcx, r15
call fcn.1400f2300
mov r14, rax
mov rcx, r15
call fcn.1400f8ba0
test rbx, rbx
jle 0x140164cfc
mov r15, rax
mov rbp, qword [rsp + 0xe8]
xor r13d, r13d
mov r12, rbx
nop word [rax + rax]
mov rax, qword [rbp + 0x10]
mov r8, qword [rax + r13]
add r8, r8
mov qword [r15 + 8], r8
mov rcx, qword [r14 + 8]
lea rdx, [rcx + r13]
add rdx, 0x17
dec rcx
call fcn.1400ef8d0
add r13, 8
dec r12
jne 0x140164cd0
mov r15, qword [rsp + 0xf0]
mov rax, qword [r15 + 8]
mov rcx, qword [rax + 0x3f]
call fcn.14011ee80
mov rcx, qword [r14 + 8]
mov r8, qword [rax + 8]
lea rdx, [rcx + rbx*8]
add rdx, 0x1f
dec rcx
call fcn.1400ef8d0
mov rcx, qword [r14 + 8]
mov r8, qword [r15 + 8]
lea rdx, [rcx + rbx*8]
add rdx, 0x17
dec rcx
call fcn.1400ef8d0
mov rcx, r14
mov rdx, qword [rsp + 0x48]
mov r8, rdi
call fcn.140163c80
mov rdx, qword [rdi + 8]
lea rcx, [rdx - 1]
mov r8, qword [r14 + 8]
add rdx, 0x17
call fcn.14017d340
mov rax, qword [rdi + 8]
mov qword [rsi], rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140263300
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14016fbe0
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14039bf08]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [0x1403a3040]
mov rcx, qword gs:[0x58]
mov r14, qword [rcx + rax*8]
mov rdi, qword [r14 + 8]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 8
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
mov edx, 0x3c
mov r8d, reloc.WS2_32.dll_recv
mov r9d, 1
call fcn.14014b040
mov rcx, qword [rsp + 0x40]
call fcn.1401707c0
mov rcx, qword [rax + 8]
mov qword [rcx + 7], rbx
mov rdx, qword [rax + 8]
mov rcx, qword [rdi + 0x18]
call fcn.1401707f0
mov rbx, rax
mov r8d, 0x430
add r8, qword [rdi + 0x690]
mov rdx, qword [r14 + 8]
lea r14, [rsp + 0x40]
mov rcx, r14
call fcn.140130b10
mov rax, qword [rbx]
lea rdx, [rsp + 0x38]
mov rcx, rbx
mov r8, rdi
call qword [rax + 0x2d8]
lea rax, [0x1402fb0f0]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x58]
call fcn.14009c470
mov rcx, r14
call fcn.14010fc20
mov rax, qword [rsp + 0x38]
mov qword [rbx + 8], rax
mov qword [rsi], rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140263300
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140170a70
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
movaps xmm6, xmm1
mov rsi, rcx
mov rax, qword [0x14039bf08]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov eax, dword [0x1403a3040]
mov rcx, qword gs:[0x58]
mov r14, qword [rcx + rax*8]
mov rdi, qword [r14 + 8]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 8
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0x48]
mov edx, 0x3d
mov r8d, reloc.WS2_32.dll_recv
mov r9d, 1
call fcn.14014b040
mov rcx, qword [rsp + 0x48]
call fcn.140170a40
mov rcx, qword [rax + 8]
movsd qword [rcx + 7], xmm6
mov rdx, qword [rax + 8]
mov rcx, qword [rdi + 0x18]
call fcn.140170b90
mov rbx, rax
mov r8d, 0x430
add r8, qword [rdi + 0x690]
mov rdx, qword [r14 + 8]
lea r14, [rsp + 0x48]
mov rcx, r14
call fcn.140130b10
mov rax, qword [rbx]
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov r8, rdi
call qword [rax + 0x2d8]
lea rax, [0x1402fb0f0]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x60]
call fcn.14009c470
mov rcx, r14
call fcn.14010fc20
mov rax, qword [rsp + 0x40]
mov qword [rbx + 8], rax
mov qword [rsi], rax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140263300
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140171120
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
jle 0x140171138
mov eax, edx
and eax, 3
cmp rdx, 4
jae 0x14017113f
xor r8d, r8d
jmp 0x1401711c9
xor eax, eax
jmp 0x1401711f8
and rdx, 0xfffffffffffffffc
xor r8d, r8d
nop word cs:[rax + rax]
movzx r9d, byte [rcx]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, byte [rcx + 1]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
movzx r9d, byte [rcx + 2]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, byte [rcx + 3]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
add rcx, 4
add rdx, 0xfffffffffffffffc
jne 0x140171150
test rax, rax
je 0x1401711f4
xor edx, edx
movzx r9d, byte [rcx + rdx]
add r9d, r8d
mov r10d, r9d
shl r10d, 0xa
add r10d, r9d
mov r8d, r10d
shr r8d, 6
xor r8d, r10d
inc rdx
cmp rax, rdx
jne 0x1401711d0
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
and eax, 0x3fffffff
cmp eax, 1
adc eax, 0
ret

Function at 0x140171220
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
jle 0x140171238
mov eax, edx
and eax, 3
cmp rdx, 4
jae 0x14017123f
xor r8d, r8d
jmp 0x1401712c9
xor eax, eax
jmp 0x1401712f8
and rdx, 0xfffffffffffffffc
xor r8d, r8d
nop word cs:[rax + rax]
movzx r9d, word [rcx]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, word [rcx + 2]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
movzx r9d, word [rcx + 4]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, word [rcx + 6]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
add rcx, 8
add rdx, 0xfffffffffffffffc
jne 0x140171250
test rax, rax
je 0x1401712f4
xor edx, edx
movzx r9d, word [rcx + rdx*2]
add r9d, r8d
mov r10d, r9d
shl r10d, 0xa
add r10d, r9d
mov r8d, r10d
shr r8d, 6
xor r8d, r10d
inc rdx
cmp rax, rdx
jne 0x1401712d0
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
and eax, 0x3fffffff
cmp eax, 1
adc eax, 0
ret
Function at 0x1401721f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
movdqa xmmword [rsp + 0x90], xmm11
movdqa xmmword [rsp + 0x80], xmm10
movdqa xmmword [rsp + 0x70], xmm9
movdqa xmmword [rsp + 0x60], xmm8
movdqa xmmword [rsp + 0x50], xmm7
movdqa xmmword [rsp + 0x40], xmm6
mov rax, r8
mov r8, rdx
mov rsi, rcx
mov rcx, qword [0x14039bf08]
xor rcx, rsp
mov qword [rsp + 0x38], rcx
test rax, rax
jle 0x140172404
xor ecx, ecx
cmp rax, 4
jae 0x14017225e
mov r11b, 1
xor r10d, r10d
mov rdx, rax
jmp 0x1401723c0
mov r10, rax
and r10, 0xfffffffffffffffc
movq xmm1, rax
movdqa xmm2, xmmword [0x140305840]
pxor xmm0, xmm0
xor edx, edx
movdqa xmm3, xmmword [0x1402fba40]
movdqa xmm4, xmmword [0x140305850]
movdqa xmm5, xmmword [0x140305860]
movdqa xmm6, xmmword [0x140305870]
movdqa xmm7, xmmword [0x140305880]
movdqa xmm8, xmm2
nop word cs:[rax + rax]
movdqa xmm10, xmm8
movdqa xmm8, xmm2
movq xmm11, qword [r8 + rdx*4]
movq xmm9, qword [r8 + rdx*4 + 8]
movdqa xmm2, xmm11
pxor xmm2, xmm3
pcmpgtd xmm2, xmm4
packssdw xmm2, xmm2
packsswb xmm2, xmm2
pandn xmm2, xmm8
movdqa xmm8, xmm9
pxor xmm8, xmm3
pcmpgtd xmm8, xmm4
packssdw xmm8, xmm8
packsswb xmm8, xmm8
pandn xmm8, xmm10
paddd xmm11, xmm5
paddd xmm9, xmm5
pxor xmm11, xmm3
movdqa xmm10, xmm6
pcmpgtd xmm10, xmm11
pshufd xmm10, xmm10, 0xd4
pand xmm10, xmm7
paddq xmm1, xmm10
pxor xmm9, xmm3
movdqa xmm10, xmm6
pcmpgtd xmm10, xmm9
pshufd xmm9, xmm10, 0xd4
pand xmm9, xmm7
paddq xmm0, xmm9
add rdx, 4
cmp r10, rdx
jne 0x1401722b0
movdqa xmm3, xmmword [0x140305840]
pcmpeqb xmm2, xmm3
pcmpeqd xmm4, xmm4
pxor xmm2, xmm4
punpcklbw xmm2, xmm2
pshuflw xmm2, xmm2, 0x60
pshufd xmm2, xmm2, 0x50
pcmpeqb xmm8, xmm3
pxor xmm8, xmm4
punpcklbw xmm3, xmm8
pshuflw xmm3, xmm3, 0x60
pshufd xmm3, xmm3, 0x50
por xmm3, xmm2
movmskpd edx, xmm3
test edx, edx
sete r11b
paddq xmm0, xmm1
pshufd xmm1, xmm0, 0xee
paddq xmm1, xmm0
movq rdx, xmm1
cmp r10, rax
je 0x1401723ea
nop word cs:[rax + rax]
mov edi, dword [r8 + r10*4]
cmp edi, 0x100
movzx r11d, r11b
cmovae r11d, ecx
add edi, 0xffff0000
cmp edi, 0x100000
adc rdx, 0
inc r10
cmp rax, r10
jne 0x1401723c0
test r11b, 1
jne 0x140172404
mov dword [rsp + 0x20], r9d
lea rcx, [rsp + 0x30]
mov r9, rax
call fcn.1401725f0
jmp 0x140172414
lea rcx, [rsp + 0x30]
mov rdx, r8
mov r8, rax
call fcn.140172460
mov rax, qword [rsp + 0x30]
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140263300
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm8, xmmword [rsp + 0x60]
movaps xmm9, xmmword [rsp + 0x70]
movaps xmm10, xmmword [rsp + 0x80]
movaps xmm11, xmmword [rsp + 0x90]
add rsp, 0xa8
pop rdi
pop rsi
ret
Function at 0x140182510
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14039bf08]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov qword [rcx], rdx
mov rax, qword [rdx + 0x18]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], r8
lea rdi, [rcx + 0x18]
mov rcx, qword [rdx + 0x18]
xorps xmm0, xmm0
movups xmmword [rsi + 0x18], xmm0
mov qword [rsi + 0x28], 0
mov qword [rsi + 0x30], rcx
mov qword [rsi + 0x20], 2
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
sub rdx, rax
cmp rdx, 0x10
jge 0x14018257a
mov edx, reloc.WS2_32.dll_recv
call fcn.1401c8d10
jmp 0x140182586
lea rdx, [rax + 0x10]
mov qword [rcx], rdx
add qword [rcx + 0x10], 0x10
mov qword [rsi + 0x28], rax
lea rcx, [rsp + 0x20]
mov edx, 2
xor r8d, r8d
call fcn.14014eab0
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rsp + 0x20]
call fcn.1400f9ee0
mov qword [rsi + 0x38], rax
mov rax, qword [rbx + 0x18]
xorps xmm0, xmm0
movups xmmword [rsi + 0x40], xmm0
mov qword [rsi + 0x50], 0
mov qword [rsi + 0x58], rax
mov eax, dword [0x1403a3040]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
mov rax, qword [rbx + 8]
mov rax, qword [rax + 0x18]
movups xmmword [rsi + 0x60], xmm0
mov qword [rsi + 0x70], 0
mov qword [rsi + 0x78], rax
mov rax, qword [rbx + 8]
mov rax, qword [rax + 0x18]
movups xmmword [rsi + 0x80], xmm0
mov qword [rsi + 0x90], 0
mov qword [rsi + 0x98], rax
mov rax, qword [rbx + 8]
mov rax, qword [rax + 0x18]
movups xmmword [rsi + 0xa0], xmm0
mov qword [rsi + 0xb0], 0
mov qword [rsi + 0xb8], rax
mov rax, qword [rbx + 8]
mov rax, qword [rax + 0x18]
movups xmmword [rsi + 0xc0], xmm0
mov qword [rsi + 0xd0], 0
mov qword [rsi + 0xd8], rax
mov rax, qword [rbx + 8]
mov rax, qword [rax + 0x18]
movups xmmword [rsi + 0xe0], xmm0
mov qword [rsi + 0xf0], 0
mov qword [rsi + 0xf8], rax
movups xmmword [rsi + 0x100], xmm0
mov edx, 2
mov rcx, rdi
call fcn.1400fa000
mov rdi, qword [0x140399cf0]
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x18]
call fcn.140128e10
mov qword [rax + 8], rdi
mov qword [rax], 0
mov rcx, qword [rsi + 0x28]
mov qword [rcx], rax
mov rdi, qword [0x140399cf0]
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x18]
call fcn.140128e10
mov qword [rax + 8], rdi
mov qword [rax], 0
mov rcx, qword [rsi + 0x28]
mov qword [rcx + 8], rax
mov rcx, qword [rsi + 0x38]
mov rdx, qword [0x14039ec00]
xor r8d, r8d
call fcn.14014ed80
mov rcx, qword [rsi + 0x38]
mov rdx, qword [0x14039ec00]
xor r8d, r8d
call fcn.14014ed80
mov qword [rsi + 0x100], 2
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140263300
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret