joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009704
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x40
movsxd rdi, r9d
lea rax, [r11 - 0x10]
mov r9, rdi
mov qword [r11 - 0x28], rax
mov rbp, r8
mov rbx, rdx
mov rsi, rcx
call fcn.140008dcc
mov r9, qword [rsp + 0x38]
mov dword [rsp + 0x30], r9d
test al, al
je 0x14000968b
mov eax, r9d
jmp 0x1400096ec
mov rdx, rbx
mov rcx, rsi
call fcn.1400099e0
mov dword [rsp + 0x68], 4
mov rsi, rax
test rax, rax
je 0x1400096ea
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov rcx, rsi
sete bl
call fcn.1400088f8
test bl, bl
je 0x1400096ea
cmp dword [rsp + 0x68], 0
je 0x1400096ea
mov edi, dword [rsp + 0x30]
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
mov rcx, 0xffffffff80000001
jmp 0x140009648

Function at 0x14000971c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x858
mov rax, qword [0x1400318e0]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov r14, qword [rsp + 0x8c0]
mov rbx, r9
mov esi, dword [rsp + 0x8c8]
lea r9, [rsp + 0x40]
mov r12, r8
mov qword [rsp + 0x20], 0x400
mov rbp, rdx
mov rdi, rcx
call fcn.14000912c
xor r13d, r13d
test al, al
jne 0x140009791
mov r8d, esi
mov rdx, r14
mov rcx, rbx
call fcn.140007f78
cmp byte [0x140031299], r13b
sete al
jmp 0x1400097b2
lea rcx, [rsp + 0x40]
call fcn.140008e58
test rax, rax
mov r8, rsi
mov rcx, rbx
cmove rax, r14
mov rdx, rax
call fcn.140007f78
mov al, 1
test al, al
je 0x1400097bd
mov al, 1
jmp 0x140009840
mov rdx, rbp
mov rcx, rdi
call fcn.1400099e0
mov rbp, rax
mov dil, r13b
test rax, rax
je 0x14000982f
lea ecx, [rsi + rsi]
xor r8d, r8d
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
mov rcx, rbp
mov qword [rsp + 0x20], rbx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov rcx, rbp
sete dil
call fcn.1400088f8
test dil, dil
je 0x14000982f
mov ecx, dword [rsp + 0x30]
shr ecx, 1
test esi, esi
jne 0x140009820
mov word [rbx], r13w
jmp 0x14000983d
lea eax, [rsi - 1]
cmp ecx, eax
cmovb eax, ecx
mov word [rbx + rax*2], r13w
jmp 0x14000983d
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call fcn.140007f78
mov al, dil
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.14000bb30
add rsp, 0x858
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140009ac0
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x858
mov rax, qword [0x1400318e0]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rbx, r9
mov qword [rsp + 0x20], 0x400
lea r9, [rsp + 0x40]
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
call fcn.14000912c
test al, al
jne 0x140009b0c
cmp byte [0x140031299], al
sete al
jmp 0x140009b21
mov r8d, 1
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.140008968
mov al, 1
test al, al
je 0x140009b29
xor eax, eax
jmp 0x140009b80
lea r8, [rsp + 0x30]
mov rdx, rsi
mov rcx, rdi
call fcn.140009248
mov rdi, rax
test rax, rax
je 0x140009b7a
mov rcx, rbx
call fcn.14000f758
mov r9d, 1
xor r8d, r8d
mov rdx, rbp
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
mov ebx, eax
call fcn.1400088f8
jmp 0x140009b7e
mov ebx, dword [rsp + 0x30]
mov eax, ebx
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.14000bb30
add rsp, 0x858
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140009b9c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x20], r9d
push rdi
sub rsp, 0x40
mov r9d, r9d
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.1400091c4
test al, al
je 0x140009bc9
xor eax, eax
jmp 0x140009c17
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
call fcn.140009248
mov rdi, rax
test rax, rax
je 0x140009c11
mov r9d, 4
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
mov ebx, eax
call fcn.1400088f8
jmp 0x140009c15
mov ebx, dword [rsp + 0x30]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140009c28
Capabilities:
Set registry value

Disassembly:
mov r9, r8
mov r8, rdx
mov rdx, rcx
mov rcx, 0xffffffff80000001
jmp fcn.140009ac0

Function at 0x140009c40
Capabilities:
Set registry value

Disassembly:
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
mov rcx, 0xffffffff80000001
jmp fcn.140009b9c

Function at 0x14000a090
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
mov rax, rdx
mov rdx, rcx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x14000a1f8
Capabilities:
Copy file
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x1030
call fcn.14000bac0
sub rsp, rax
mov rax, qword [0x1400318e0]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov edi, 0x800
lea rdx, [rsp + 0x20]
xor ebx, ebx
lea rcx, str.sfxname
mov r8d, edi
mov word [rsp + 0x20], bx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14000a2e7
cmp word [rsp + 0x20], bx
je 0x14000a2e7
mov r8d, edi
lea rdx, str.rarreg.key
lea rcx, [rsp + 0x20]
call fcn.140006034
lea rcx, [rsp + 0x20]
call fcn.140004ae4
test al, al
jne 0x14000a287
mov r8d, edi
lea rdx, str.rarreg.txt
lea rcx, [rsp + 0x20]
call fcn.140006034
lea rcx, [rsp + 0x20]
call fcn.140004ae4
test al, al
je 0x14000a2ad
mov r8d, 1
lea rdx, str.rarreg.key
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov r8, rdi
lea rdx, str.winrar.ini
lea rcx, [rsp + 0x20]
call fcn.140006034
lea rcx, [rsp + 0x20]
call fcn.140004ae4
test al, al
je 0x14000a2e7
mov r8d, 1
lea rdx, str.winrar.ini
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.14000bb30
mov rbx, qword [rsp + 0x1040]
add rsp, 0x1030
pop rdi
ret
Function at 0x14000b404
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rsi, rdx
mov rcx, rdx
call fcn.14000f758
mov rbx, rax
lea rcx, [rax*2 + 4]
call fcn.14001220c
mov rdi, rax
test rax, rax
je 0x14000b470
lea r8, [rbx + 1]
mov rdx, rax
mov rcx, rsi
call fcn.140008500
mov rcx, rdi
call fcn.1400123e0
mov r8, rax
mov r9, rbp
mov edx, 1
mov rcx, rdi
call fcn.140012188
mov rcx, rdi
call fcn.14000f750
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000b488
Capabilities:
Accept command line arguments
Create process on windows
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x890
mov rax, qword [0x1400318e0]
xor rax, rsp
mov qword [rsp + 0x880], rax
mov rbx, rcx
mov cl, 1
call fcn.1400081e0
xor r8d, r8d
lea rcx, [0x140034480]
mov rdx, rbx
call fcn.1400078d8
lea rdx, str.uninstall.lng
lea rcx, [0x140034490]
call fcn.140006984
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
lea rcx, str.riched20.dll
call fcn.140008168
mov rcx, qword [0x140034440]
lea rdx, str.RARICON
mov rbx, rax
call qword [sym.imp.USER32.dll_LoadIconW]
xor edi, edi
mov qword [0x14003a780], rax
test rax, rax
jne 0x14000b533
mov rcx, qword [0x140034448]
cmp rcx, qword [0x140034440]
je 0x14000b533
lea rdx, str.RARICON
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [0x14003a780], rax
mov ecx, 0xfffffff4
call fcn.14000a024
mov ecx, eax
xor r9d, r9d
lea rax, str.MS_Shell_Dlg
xor r8d, r8d
mov qword [rsp + 0x68], rax
xor edx, edx
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 0x2bc
call qword [sym.imp.GDI32.dll_CreateFontW]
mov r8d, 0x400
mov byte [rsp + 0x70], dil
lea rdx, [rsp + 0x80]
mov qword [0x14003a788], rax
lea rcx, str.sfxcmd
mov byte [rsp + 0x71], dil
mov word [rsp + 0x80], di
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r9, [rsp + 0x71]
mov cl, 1
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x80]
call fcn.14000a6ac
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r9, [rsp + 0x71]
xor ecx, ecx
mov rdx, rax
lea r8, [rsp + 0x70]
call fcn.14000a6ac
cmp byte [rsp + 0x70], dil
je 0x14000b6b3
mov rcx, qword [0x140034440]
lea r9, [0x14000a93c]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.SETUPDLG
call qword [sym.imp.USER32.dll_DialogBoxParamW]
test rax, rax
je 0x14000b6b3
call fcn.14000a1f8
mov al, byte [0x14003b7e1]
test al, al
jne 0x14000b657
mov rcx, qword [0x140034440]
lea r9, [0x14000a404]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.DONEDLG
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov al, byte [0x14003b7e1]
cmp word [0x14003a790], di
je 0x14000b6b3
cmp byte [0x14003b7e0], dil
jne 0x14000b6b3
test al, al
jne 0x14000b6b3
cmp byte [0x14003b7e2], dil
jne 0x14000b6b3
lea rcx, [0x14003a790]
call fcn.140004ae4
test al, al
je 0x14000b6b3
lea rax, [0x1400225f0]
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, [0x14003a790]
xor ecx, ecx
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp byte [rsp + 0x71], dil
je 0x14000b6bf
call fcn.14000ada0
test rbx, rbx
je 0x14000b6cd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call qword [sym.imp.ole32.dll_OleUninitialize]
mov rcx, qword [0x14003a788]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [0x14003a780]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [0x14003b7e4]
mov rcx, qword [rsp + 0x880]
xor rcx, rsp
call fcn.14000bb30
mov rbx, qword [rsp + 0x8a8]
add rsp, 0x890
pop rdi
ret
Function at 0x140013980
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140013754
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140013754
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140013754
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140013754
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140013754
cmp dword [rcx + 0x84], 0xe
jbe 0x140013754
cmp dword [rcx + 0xf8], esi
je 0x140013754
mov ecx, r14d
call fcn.14001389c
mov ecx, 2
call fcn.1400195e8
nop
cmp byte [0x14003bf80], 0
jne 0x14001381e
mov r15d, 1
mov eax, r15d
xchg dword [0x14003bf70], eax
test ebx, ebx
jne 0x1400137c7
mov rdi, qword [0x1400318e0]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14003bf78]
cmp rcx, rax
je 0x1400137be
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.14000f6f4]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14003c0b8]
jmp 0x1400137d3
cmp ebx, r15d
jne 0x1400137d9
lea rcx, [0x14003c0d0]
call fcn.140014310
nop
test ebx, ebx
jne 0x1400137f0
lea rdx, [0x1400225d8]
lea rcx, [0x1400225b8]
call fcn.1400146c4
lea rdx, [0x1400225e8]
lea rcx, [0x1400225e0]
call fcn.1400146c4
movzx eax, byte [0x14003bf80]
test esi, esi
cmove eax, r15d
mov byte [0x14003bf80], al
jmp 0x14001381e
mov ecx, 2
call fcn.14001963c
test esi, esi
jne 0x140013835
mov ecx, r14d
call fcn.140013850
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400136e4
Function at 0x140018f8c
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x140018f69
call fcn.140015a7c
mov dword [rax], 0x16
call fcn.1400158e8
or eax, 0xffffffff
jmp 0x140018f86
sub dword [rcx + 0x10], 1
jns 0x140018f78
add rsp, 0x28
jmp 0x14001ebe4
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x140018f48
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x14001ea84
call fcn.140015a7c
mov dword [rax], 0x16
call fcn.1400158e8
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14001ea6c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x14001ea6c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x14001eab6
lock or dword [rax + 0x14], 0x10
jmp 0x14001ea6c
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x14001ead3
mov rcx, qword [rbp + 0x10]
call fcn.14001dda4
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140016fe8
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.14001f11c
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x14001eb2a
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x14001ea6c
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14001eb96
mov rcx, qword [rbp + 0x10]
call fcn.140016fe8
cmp eax, 0xffffffff
je 0x14001eb7d
mov rcx, qword [rbp + 0x10]
call fcn.140016fe8
cmp eax, 0xfffffffe
je 0x14001eb7d
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140016fe8
movsxd rdi, eax
lea rsi, [0x14003c150]
mov rcx, rbx
sar rdi, 6
call fcn.140016fe8
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x14001eb84
lea rax, [0x140031bb0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14001eb96
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x14001ebcc
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x14001ebc8
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x14001ebc8
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x14001ea6f
jmp 0x14001ea3c
Function at 0x140008ff0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140678b00]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [0x14067aff0], 0
mov ebx, ecx
ja 0x140009029
mov eax, 0xffffdcd8
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002e1d0
add rsp, 0x50
pop rbx
ret
inc dword [0x14067a768]
mov dword [0x14067a76c], 0x9823ae8d
call fcn.1400350d4
mov dword [0x14067a764], eax
test ebx, ebx
je 0x140009051
or dword [0x14067af90], 1
jmp 0x140009058
and dword [0x14067af90], 0xfffffffe
movups xmm0, xmmword [0x14067af90]
mov rcx, qword [0x14067aff0]
xor r9d, r9d
movups xmm1, xmmword [0x14067afa0]
lea rax, [0x14067af80]
mov dword [rsp + 0x28], socket
movaps xmmword [0x14067a770], xmm0
lea rdx, [0x14067a760]
movups xmm0, xmmword [0x14067afb0]
lea r8d, [r9 + 0x48]
mov qword [rsp + 0x20], rax
movaps xmmword [0x14067a780], xmm1
movsd xmm1, qword [0x14067afc0]
movaps xmmword [0x14067a790], xmm0
movsd qword [0x14067a7a0], xmm1
call qword [sym.imp.WS2_32.dll_sendto]
mov rcx, qword [0x14067aff0]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x14067ab70]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], socket
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8d, 0x400
call qword [sym.imp.WS2_32.dll_recvfrom]
test eax, eax
jns 0x140009116
mov eax, 0xffffdcdb
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002e1d0
add rsp, 0x50
pop rbx
ret
mov eax, dword [0x14067a76c]
cmp dword [0x14067ab7c], eax
je 0x14000913c
mov eax, 0xffffdcdc
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002e1d0
add rsp, 0x50
pop rbx
ret
mov ecx, dword [0x14067a768]
mov edx, 0xffffdcdd
cmp dword [0x14067ab78], ecx
mov eax, dword [0x14067ab74]
cmovne eax, edx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002e1d0
add rsp, 0x50
pop rbx
ret
Function at 0x140009170
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140678b00]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [0x14067aff0], 0
movsx edi, dx
movsx ebx, cx
ja 0x1400091a3
mov eax, 0xffffdcd8
jmp 0x1400092af
inc dword [0x14067a768]
mov dword [0x14067a76c], 0xaede7345
call fcn.1400350d4
movups xmm1, xmmword [0x14067afa0]
mov rcx, qword [0x14067aff0]
lea rdx, [0x14067a760]
mov dword [0x14067af94], ebx
xor r9d, r9d
mov dword [0x14067af98], edi
movups xmm0, xmmword [0x14067af90]
mov dword [0x14067a764], eax
lea rax, [0x14067af80]
movaps xmmword [0x14067a780], xmm1
lea r8d, [r9 + 0x48]
movsd xmm1, qword [0x14067afc0]
movaps xmmword [0x14067a770], xmm0
movups xmm0, xmmword [0x14067afb0]
mov dword [rsp + 0x28], socket
movsd qword [0x14067a7a0], xmm1
movaps xmmword [0x14067a790], xmm0
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
mov rcx, qword [0x14067aff0]
lea rdx, [0x14067ab70]
xor eax, eax
mov dword [rsp + 0x30], socket
mov qword [0x14067af94], rax
xor r9d, r9d
lea rax, [rsp + 0x30]
mov r8d, 0x400
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
test eax, eax
jns 0x140009280
mov eax, 0xffffdcdb
jmp 0x1400092af
mov eax, dword [0x14067a76c]
cmp dword [0x14067ab7c], eax
je 0x140009295
mov eax, 0xffffdcdc
jmp 0x1400092af
mov ecx, dword [0x14067a768]
mov edx, 0xffffdcdd
cmp dword [0x14067ab78], ecx
mov eax, dword [0x14067ab74]
cmovne eax, edx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002e1d0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400119f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsd xmm2, qword [0x140062018]
mov r9, rcx
movsd xmm4, qword [0x140062050]
xorps xmm3, xmm3
xorps xmm0, xmm0
mov edi, 2
xor esi, esi
nop
mov edx, dword [r9]
cmp edx, 0x270
jne 0x140011a81
lea r8, [r9 + 8]
mov r10d, edx
nop dword [rax]
nop word [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140011a40
mov edx, dword [r9]
jmp 0x140011b62
cmp edx, 0x4e0
jb 0x140011b62
lea r10, [r9 + 0x9c4]
mov r11d, 0xe3
mov ebx, dword [r10]
nop dword [rax]
mov eax, ebx
mov ebx, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, ebx
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub r11, 1
jne 0x140011aa0
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov ebx, dword [r10]
nop word [rax + rax]
mov eax, ebx
mov ebx, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, ebx
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub r11, 1
jne 0x140011af0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov edx, esi
mov dword [r9 + 0x9c0], ecx
mov dword [r9], esi
mov eax, edx
xorps xmm1, xmm1
mov ecx, dword [r9 + rax*4 + 4]
lea eax, [rdx + 1]
mov dword [r9], eax
mov eax, ecx
shr eax, 0xb
and eax, dword [r9 + 0x1384]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cvtsi2sd xmm1, rax
subsd xmm1, xmm3
mulsd xmm1, xmm2
mulsd xmm2, xmm4
addsd xmm0, xmm1
sub rdi, 1
jne 0x140011a20
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
divsd xmm0, xmm2
ret
Function at 0x140016bf0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x140016c51
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140016c10
mov ecx, dword [r9]
jmp 0x140016d38
cmp ecx, 0x4e0
jb 0x140016d38
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140016c70
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140016cc0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret