joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400036e7
Capabilities:
Read file on windows

Disassembly:
mov r8d, edx
mov rdx, rcx
mov rcx, qword [0x14000a020]
jmp fcn.140006eea

Function at 0x14000370f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov ebx, 0x8000
lea rdi, [0x14001e9c0]
test r8, r8
mov qword [rsp + 0x118], rdx
mov r13, r8
mov r12d, r9d
cmovne ebx, r9d
cmovne rdi, r8
test ecx, ecx
js 0x14000375a
movsxd rcx, ecx
add rcx, qword [0x14001a9b4]
call fcn.1400036f9
lea rcx, [rsp + 0x3c]
mov edx, 4
call fcn.1400036e7
test eax, eax
je 0x140003934
mov r9d, dword [rsp + 0x3c]
test r9d, r9d
jns 0x140003944
mov r15, qword [sym.imp.KERNEL32.dll_GetTickCount]
xor r12d, r12d
call r15
mov ebp, dword [rsp + 0x3c]
mov dword [0x14002ea00], 8
mov qword [0x14002ef24], 0
mov r14d, eax
lea rax, [0x1400305ac]
mov qword [0x1400385c0], rax
and ebp, 0x7fffffff
mov qword [0x1400385b8], rax
add rax, 0x8000
mov qword [0x1400385b0], rax
mov dword [rsp + 0x3c], ebp
mov esi, dword [rsp + 0x3c]
test esi, esi
jle 0x140003973
cmp esi, 0x4000
mov eax, 0x4000
lea rcx, [0x14001a9c0]
cmovg esi, eax
mov edx, esi
call fcn.1400036e7
test eax, eax
je 0x140003934
lea rax, [0x14001a9c0]
sub dword [rsp + 0x3c], esi
mov qword [0x14002e9e0], rax
mov dword [0x14002e9e8], esi
lea rcx, [0x14002e9e0]
mov qword [0x14002e9f0], rdi
mov dword [0x14002e9f8], ebx
call fcn.1400080fd
mov dword [rsp + 0x28], eax
test eax, eax
js 0x14000393c
mov rsi, qword [0x14002e9f0]
call r15
mov r9d, eax
mov rax, qword [0x14000c0d0]
sub rsi, rdi
test byte [rax + 0x34], 1
je 0x1400038b5
mov edx, r9d
mov eax, dword [rsp + 0x3c]
sub edx, r14d
cmp edx, 0xc8
ja 0x140003874
test eax, eax
jne 0x1400038b5
mov ecx, ebp
mov dword [rsp + 0x2c], r9d
lea r14, [rsp + 0x40]
mov r8d, ebp
sub ecx, eax
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov rcx, r14
lea rdx, str....__d__
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, r14
xor ecx, ecx
call fcn.140006476
mov r9d, dword [rsp + 0x2c]
mov r14d, r9d
test esi, esi
je 0x1400037d4
test r13, r13
jne 0x1400038e2
mov rcx, qword [rsp + 0x118]
mov r8d, esi
mov rdx, rdi
call fcn.140006f19
test eax, eax
je 0x14000396d
add r12d, esi
jmp 0x1400038ee
mov rdi, qword [0x14002e9f0]
add r12d, esi
sub ebx, esi
cmp dword [rsp + 0x28], 1
jne 0x14000381c
jmp 0x140003973
mov rcx, qword [rsp + 0x118]
mov r8d, esi
mov rdx, rdi
call fcn.140006f19
test eax, eax
je 0x14000396d
sub dword [rsp + 0x3c], esi
add r12d, esi
mov esi, dword [rsp + 0x3c]
test esi, esi
jle 0x140003973
cmp esi, ebx
mov rcx, rdi
cmovg esi, ebx
mov edx, esi
call fcn.1400036e7
test eax, eax
jne 0x1400038fb
mov r12d, 0xfffffffd
jmp 0x140003973
mov r12d, 0xfffffffc
jmp 0x140003973
test r13, r13
jne 0x140003955
xor r12d, r12d
lea rdi, [0x14001a9c0]
jmp 0x140003919
cmp r9d, r12d
mov rcx, r13
cmovle r12d, r9d
mov edx, r12d
call fcn.1400036e7
test eax, eax
jne 0x140003973
jmp 0x140003934
mov r12d, 0xfffffffe
mov eax, r12d
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140003c60
Capabilities:
Get common file path

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov rax, qword [0x14000c160]
mov rbx, qword [rax]
lea r12, [rbx + 0xc800]
mov rcx, r12
call fcn.140007302
mov rcx, r12
call fcn.140006c6c
test eax, eax
je 0x140003cb2
mov rcx, r12
call fcn.14000728c
mov rcx, r12
call fcn.140006ac3
lea rcx, [rbx + 0xc000]
mov rdx, r12
add rsp, 0x28
pop rbx
pop r12
jmp fcn.140006e7e
xor eax, eax
add rsp, 0x28
pop rbx
pop r12
ret

Function at 0x140003cbc
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x14000c0c0]
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x140003cde
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], 0xffffffffffffffff
call fcn.140004315
mov rax, qword [0x14000c160]
mov edx, 7
mov rcx, qword [rax]
add rcx, 0xd000
add rsp, 0x20
pop rbx
jmp fcn.1400077c7
Function at 0x140006a30
Capabilities:
Create directory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x60
lea rax, [0x14000b7f0]
mov qword [rsp + 0x40], rax
lea rsi, [rsp + 0x38]
mov r12, rcx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x48], rax
sub rax, 0x10
mov dword [rsp + 0x38], 0x40001
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 0x18
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140006a93
xor eax, eax
jmp 0x140006aba
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbx
cmp eax, 0xb7
jne 0x140006aba
mov r8, rsi
mov edx, 0x80000007
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
jne 0x140006a8f
call rbx
add rsp, 0x60
pop rbx
pop rsi
pop r12
ret

Function at 0x140006ac3
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140006ade
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
add rsp, 0x28
ret

Function at 0x140006ae5
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x78
xor r8d, r8d
xor r9d, r9d
mov dword [0x1400401c0], 0x68
lea rax, [rsp + 0x58]
mov rdx, rcx
xor ecx, ecx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], rax
lea rax, [0x1400401c0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov r8d, eax
xor eax, eax
test r8d, r8d
je 0x140006b56
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x58]
add rsp, 0x78
ret

Function at 0x140006b5b
Capabilities:
Create process on windows

Disassembly:
mov dword [rcx], 0x70
mov qword [rcx + 0x40], 0
jmp qword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x140006d9f
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push r12
sub rsp, 0x20
mov qword [rsp + 0x30], rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r12d, eax
cmp eax, 0xffffffff
je 0x140006dc8
mov edx, eax
mov rcx, qword [rsp + 0x30]
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, r12d
add rsp, 0x20
pop r12
ret

Function at 0x140006dd2
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov r12, rcx
mov ebx, edx
call fcn.140006d9f
mov r13d, eax
cmp eax, 0xffffffff
jne 0x140006df1
xor ebx, ebx
jmp 0x140006e25
mov rcx, r12
test bl, 1
je 0x140006e1d
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140006e16
and ebx, 4
jne 0x140006ded
mov edx, r13d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x140006e25
mov ebx, 1
jmp 0x140006e25
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140006dff
mov eax, ebx
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
Function at 0x140006e31
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x40
mov dword [rsp + 0x58], edx
mov ebx, r8d
mov qword [rsp + 0x50], rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [rsp + 0x50]
mov edx, dword [rsp + 0x58]
cmp eax, 0xffffffff
jne 0x140006e58
xor eax, eax
mov dword [rsp + 0x28], eax
xor r9d, r9d
mov r8d, 1
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
add rsp, 0x40
pop rbx
ret

Function at 0x140006e7e
Capabilities:
Get common file path

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
mov ebx, 0x65
movabs rdi, 0x610073006e
mov r12, rcx
mov rsi, rdx
dec ebx
je 0x140006ed3
mov qword [rsp + 0x28], rdi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1a
xor edx, edx
xor r8d, r8d
div ecx
mov r9, r12
mov rcx, rsi
add word [rsp + 0x2c], dx
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x140006e9c
jmp 0x140006edd
mov word [r12], 0
xor r12d, r12d
mov rax, r12
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
ret

Function at 0x140006eea
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x20], 0
mov ebx, r8d
lea r9, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140006f13
xor eax, eax
cmp dword [rsp + 0x3c], ebx
sete al
add rsp, 0x40
pop rbx
ret

Function at 0x140006f19
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x20], 0
mov ebx, r8d
lea r9, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140006f42
xor eax, eax
cmp dword [rsp + 0x3c], ebx
sete al
add rsp, 0x40
pop rbx
ret

Function at 0x140006fef
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rax, qword [0x14000c0d0]
inc dword [rax + 0x10]
add rsp, 0x28
ret

Function at 0x140007107
Capabilities:
Query or enumerate registry value

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov r12, r8
mov r8d, dword [rsp + 0x80]
mov dword [rsp + 0x30], 0x800
mov rbx, r9
test r8d, r8d
je 0x140007130
mov r8d, 0x200
or r8d, 0x20019
lea r9, [rsp + 0x38]
call fcn.14000706b
test eax, eax
je 0x14000714c
mov word [rbx], 0
jmp 0x140007196
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
xor r8d, r8d
mov rdx, r12
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [rbx + 0x7fe], 0
test esi, esi
jne 0x140007145
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 1
ja 0x140007145
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
Function at 0x140007712
Capabilities:
Get file attributes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdx, rcx
lea rcx, [0x14003f1c0]
call fcn.140007271
lea rcx, [0x14003f1c0]
call fcn.140006c96
mov rbx, rax
test rax, rax
jne 0x140007740
xor eax, eax
jmp 0x1400077bf
mov rcx, rax
call fcn.140007302
mov rax, qword [0x14000c0f0]
test byte [rax], 0x80
je 0x140007762
mov ax, word [rbx]
test ax, ax
je 0x14000773c
cmp ax, 0x5c
je 0x14000773c
lea rsi, [0x14003f1c0]
mov rdi, qword [sym.imp.KERNEL32.dll_lstrlenW]
sub rbx, rsi
sar rbx, 1
mov rcx, rsi
call rdi
cdqe
cmp rax, rbx
jle 0x14000779e
mov rcx, rsi
call fcn.1400076e4
test rax, rax
je 0x140007794
test byte [rax], 0x10
je 0x14000773c
mov rcx, rsi
call fcn.140006c2f
jmp 0x140007776
lea rcx, [0x14003f1c0]
call fcn.14000728c
lea rcx, [0x14003f1c0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
setne al
movzx eax, al
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x1400077c7
Capabilities:
Delete file

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x288
mov edi, edx
mov r12, rcx
mov esi, edx
call fcn.140007712
and edi, 4
mov ebp, eax
test sil, 8
je 0x14000780d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [0x14000c0d0]
cmp eax, 1
adc dword [rdx + 8], 0
jmp 0x1400079dc
mov r14d, esi
and r14d, 1
je 0x140007828
test eax, eax
je 0x1400079c2
test sil, 2
je 0x14000797f
mov rdx, r12
lea rcx, [0x14003f9c0]
call fcn.140007271
test r14d, r14d
je 0x140007851
lea rdx, str..
lea rcx, [0x14003f9c0]
call sub.KERNEL32.dll_lstrcatW
jmp 0x140007859
mov rcx, r12
call fcn.140006c2f
cmp word [r12], 0
jne 0x14000786b
cmp word [0x14003f9c0], 0x5c
jne 0x14000787a
lea rdx, [0x14000b600]
mov rcx, r12
call sub.KERNEL32.dll_lstrcatW
mov rcx, r12
lea r15, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, r15
lea rcx, [0x14003f9c0]
movsxd rbx, eax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
add rbx, rbx
add rbx, r12
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140007970
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov qword [rsp + 0x20], rax
cmp word [rsp + 0x5c], 0x2e
jne 0x1400078e4
mov ax, word [rsp + 0x5e]
test ax, ax
je 0x140007952
cmp ax, 0x2e
jne 0x1400078e4
cmp word [rsp + 0x60], 0
je 0x140007952
mov rdx, qword [rsp + 0x28]
mov rcx, rbx
call fcn.140007271
test byte [rsp + 0x30], 0x10
je 0x14000790e
mov eax, esi
and eax, 3
cmp eax, 3
jne 0x140007952
mov edx, esi
mov rcx, r12
call fcn.1400077c7
jmp 0x140007952
mov edx, edi
mov rcx, r12
call fcn.140006dd2
test eax, eax
jne 0x140007945
test edi, edi
je 0x140007939
mov rdx, r12
mov ecx, 0xfffffff1
call fcn.140006476
xor edx, edx
mov rcx, r12
call fcn.140006fef
jmp 0x140007952
mov rax, qword [0x14000c0d0]
inc dword [rax + 8]
jmp 0x140007952
mov rdx, r12
mov ecx, 0xfffffff2
call fcn.140006476
mov rax, qword [rsp + 0x20]
mov rdx, r15
mov rcx, r13
call rax
test eax, eax
jne 0x1400078c4
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
test r14d, r14d
je 0x1400079dc
mov word [rbx - 2], 0
test ebp, ebp
je 0x1400079c2
mov rcx, r12
call fcn.1400076e4
test rax, rax
je 0x1400079dc
mov rcx, r12
call fcn.14000728c
mov edx, edi
mov rcx, r12
or edx, 1
call fcn.140006dd2
test eax, eax
jne 0x1400079ce
test edi, edi
je 0x1400079c2
mov rdx, r12
mov ecx, 0xfffffff1
call fcn.140006476
xor edx, edx
mov rcx, r12
call fcn.140006fef
jmp 0x1400079dc
mov rax, qword [0x14000c0d0]
inc dword [rax + 8]
jmp 0x1400079dc
mov rdx, r12
mov ecx, 0xffffffe5
call fcn.140006476
nop
add rsp, 0x288
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400079f0
Capabilities:
Get common file path

Disassembly:
push r12
sub rsp, 0x260
mov edx, 0x104
lea r12, [rsp + 0x24]
mov qword [rsp + 0x270], rcx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r9, qword [rsp + 0x270]
lea edx, [rax - 1]
cmp edx, 0x103
ja 0x140007a35
cmp word [rsp + rdx*2 + 0x24], 0x5c
sete dl
movzx edx, dl
jmp 0x140007a3c
xor eax, eax
mov edx, 1
mov eax, eax
add rdx, rdx
add rax, rax
lea rcx, [r12 + rax]
lea rax, [0x14000b600]
lea r8, [rax + rdx]
lea rdx, str._s_S.dll
call qword [sym.imp.USER32.dll_wsprintfW]
mov r8d, 8
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
add rsp, 0x260
pop r12
ret
Function at 0x140001140
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
mov r9, qword [rdx]
mov r10, qword [r8]
mov rax, qword [r9 + 0x10]
mov edx, 3
cmp rax, 0xfb
jb 0x140001181
mov edx, 5
cmp rax, 0x10000
jb 0x140001181
movabs r11, 0x100000000
mov edx, 0xb
mov esi, 7
cmp rax, r11
cmovb rdx, rsi
add r10, rdx
add r10, rax
mov rax, qword [r9 + 0x28]
mov edx, 1
cmp rax, 0xfb
jb 0x1400011c0
mov edx, 3
cmp rax, 0x10000
jb 0x1400011c0
movabs r11, 0x100000000
mov edx, 9
mov esi, 5
cmp rax, r11
cmovb rdx, rsi
add r10, rdx
add r10, rax
mov r11, qword [r9 + 0x40]
cmp r11, 0xfb
jb 0x140001206
cmp r11, 0x10000
jb 0x1400011fd
movabs rax, 0x100000000
cmp r11, rax
jb 0x1400011f4
add r10, 9
mov rax, r10
jmp 0x14000126d
add r10, 5
mov rax, r10
jmp 0x14000126d
add r10, 3
mov rax, r10
jmp 0x14000126d
mov eax, dword [section..data]
or eax, dword [0x1400c5004]
mov esi, 0x29061f24
xor edx, edx
div esi
xor eax, 0xa70a2812
add eax, 0x95db6224
cmp eax, 0x7dd7fa5b
jae 0x1400012de
jmp 0x140001232
mov eax, dword [0x1400c5008]
xor edx, edx
div dword [0x1400c500c]
xor eax, 0x74784eef
xor eax, 0xceb63e52
imul esi, eax, 0x787408a8
mov rax, r10
add rax, 1
cmp r11, 0
sete dl
cmp esi, 0x876a1497
je 0x140001232
test dl, 1
jne 0x1400012ca
jmp 0x14000126d
mov rdx, qword [r9 + 0x38]
imul r10, r11, 0x18
mov r9, rdx
add r9, r10
mov r10, qword [rdx + 0x10]
mov r11d, 1
cmp r10, 0xfb
jb 0x1400012b9
mov r11d, 3
cmp r10, 0x10000
jb 0x1400012b9
movabs rsi, 0x100000000
mov r11d, 9
mov edi, 5
cmp r10, rsi
cmovb r11, rdi
add rax, r10
add rax, r11
add rdx, 0x18
cmp rdx, r9
jne 0x14000127b
jmp 0x1400012ca
add rax, 1
mov qword [r8], rax
mov qword [rcx], 8
mov rax, rcx
pop rdi
pop rsi
ret
movsb byte [rdi], byte [rsi]
invalid
Function at 0x14000f830
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, dword [0x1400c5110]
xor eax, dword [0x1400c5114]
sub eax, 0x867f74ef
xor eax, 0xf19963d0
or eax, 0xd58f559
cmp eax, 0xc4909e1a
jbe 0x14000f8a6
jmp 0x14000f854
mov eax, dword [0x1400c5118]
and eax, dword [0x1400c511c]
xor eax, 0x3be19991
and eax, 0x3b08f60e
imul r8d, eax, 0x7c7116ac
mov rax, 0xffffffff886786ff
sub rax, rdx
mov r9, rax
shr r9, 0x18
xor r9, rax
mov r10, r9
rol r10, 3
xor r10, r9
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp r8d, 0xdd56c2b6
ja 0x14000f854
ret
movabs byte [0xebe99efc5038c826], al
movabs byte [0x3148c0d148d08948], al
mov rax, rdx
rol rax, 1
xor rax, rdx
xor rax, 0xffffffffbf1062ba
mov rdx, rax

Function at 0x140010b00
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1400c5130]
sub eax, dword [0x1400c5134]
and eax, 0x999b76e6
mov r9d, 0xcec5471e
xor edx, edx
div r9d
sub eax, 0x5322f4ec
cmp eax, 0x6d1b95c8
je 0x140010b82
jmp 0x140010b2d
mov eax, dword [0x1400c5138]
imul eax, dword [0x1400c513c]
sub eax, 0x9fe791ba
add eax, 0x8a40ee11
imul edx, eax, 0x33f35409
mov rax, r8
xor rax, 0x7b78d199
mov r9, rax
rol r9, 5
xor r9, rax
xor eax, eax
sub rax, r9
mov r9, rax
rol r9, 3
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x25bf1df9
jb 0x140010b2d
and eax, 0x86c3ac72
pop rbx
invalid
ret
xchg byte [rbx + 0x27], bl
jbe 0x140010b7e
out dx, al
movsb byte [rdi], byte [rsi]
mov dl, byte [rdx - 0x144e8c8f]
wait
Function at 0x140011cd0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdx, qword [rsi]
cmp rdx, 0
je 0x140011cf6
mov rcx, qword [rsi + 8]
mov r8d, 1
call fcn.140044c20
mov rbx, rsi
add rbx, 0x20
mov rdi, qword [rsi + 0x28]
mov r14, qword [rsi + 0x30]
cmp r14, 0
je 0x140011d44
xor r15d, r15d
jmp 0x140011d10
mov rax, r15
add r15, 1
imul rcx, rax, 0x28
mov rax, rdi
add rax, rcx
add rax, 8
mov rdx, qword [rax]
cmp rdx, 0
je 0x140011d3d
mov rcx, qword [rax + 8]
mov r8d, 1
call fcn.140044c20
cmp r15, r14
jne 0x140011d10
jmp 0x140011d44
mov eax, dword [0x1400c5170]
imul eax, dword [0x1400c5174]
imul eax, eax, 0x7d96b2d8
and eax, 0xe2e616dc
mov ecx, 0x645fd62b
xor edx, edx
div ecx
cmp eax, 0xd30bc803
ja 0x140011e66
jmp 0x140011d72
mov eax, dword [0x1400c5178]
xor edx, edx
div dword [0x1400c517c]
and eax, 0x3d277ca8
xor eax, 0xd15430d1
imul edx, eax, 0x5e38093c
mov rax, qword [rbx]
cmp rax, 0
sete cl
cmp edx, 0x7c7583c0
jae 0x140011d72
test cl, 1
jne 0x140011dbb
jmp 0x140011da9
imul rdx, rax, 0x28
mov rcx, rdi
mov r8d, 8
call fcn.140044c20
mov rcx, rsi
add rcx, 0x88
call fcn.140037de0
mov rdx, qword [rsi + 0x38]
movabs rax, 0x8000000000000000
cmp rdx, rax
je 0x140011df2
cmp rdx, 0
je 0x140011df2
mov rcx, qword [rsi + 0x40]
mov r8d, 1
call fcn.140044c20
mov eax, dword [rsi + 0x58]
mov ecx, eax
sub ecx, 4
jb 0x140011e0f
jmp 0x140011dfe
sub eax, 6
je 0x140011e0f
jmp 0x140011e05
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [rsi + 0x68]
mov ecx, eax
sub ecx, 4
jb 0x140011e2c
jmp 0x140011e1b
sub eax, 6
je 0x140011e2c
jmp 0x140011e22
mov rcx, qword [rsi + 0x70]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [rsi + 0x78]
mov ecx, eax
sub ecx, 4
jb 0x140011e4c
jmp 0x140011e38
sub eax, 6
je 0x140011e4c
jmp 0x140011e3f
mov rcx, qword [rsi + 0x80]
call qword [sym.imp.kernel32.dll_CloseHandle]
add rsi, 0xa8
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.140037a60
in eax, 0x76
invalid
Function at 0x14002af60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
movzx eax, byte [rsi + 0x10]
mov ecx, eax
sub ecx, 3
je 0x14002af86
jmp 0x14002af77
sub eax, 4
je 0x14002afa9
jmp 0x14002af7e
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
cmp word [rsi + 0x18], 3
jne 0x14002af7e
mov rsi, qword [rsi + 0x20]
mov rcx, rsi
call fcn.14004f0d0
test al, 1
jne 0x14002af9f
jmp 0x14002af7e
mov rcx, rsi
call fcn.1400500f0
jmp 0x14002af7e
cmp byte [rsi + 0xb0], 3
jne 0x14002afbe
mov rcx, rsi
add rcx, 0x68
call fcn.14002b290
cmp dword [rsi + 0x20], 0
je 0x14002afe1
mov rdx, qword [rsi + 0x38]
cmp rdx, 0
je 0x14002afe1
mov rcx, qword [rsi + 0x28]
shl rdx, 5
mov r8d, 4
call fcn.140044c20
mov eax, dword [0x1400c55d8]
imul eax, dword [0x1400c55dc]
xor eax, 0x2a475d05
mov ecx, 0xc36d2a68
xor edx, edx
div ecx
xor eax, 0x3e068993
cmp eax, 0xd535d1f
jbe 0x14002b0b3
jmp 0x14002b00e
mov eax, dword [0x1400c55e0]
sub eax, dword [0x1400c55e4]
xor eax, 0x219326af
mov ecx, 0x17a9d45d
xor edx, edx
div ecx
mov ecx, 0xb4059b66
xor edx, edx
div ecx
mov rcx, qword [rsi + 0x18]
cmp rcx, 0
sete dl
cmp eax, 0xc1d345d4
ja 0x14002b00e
test dl, 1
jne 0x14002af7e
jmp 0x14002b04e
mov eax, ecx
and eax, 3
lea rdx, [0x1400a6098]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
push rdx
psubusb mm7, qword [0x1ab6d985e]
or esp, dword [rax]
invalid

Function at 0x14002b290
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
movzx eax, byte [rcx + 0x40]
test eax, eax
je 0x14002b2b8
cmp eax, 3
jne 0x14002b314
add rsi, 0x10
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14002b0d0
mov rdi, qword [rsi + 8]
test rdi, rdi
je 0x14002b304
mov rcx, rdi
call fcn.140062b50
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14002b2da
mov rcx, rdi
call fcn.140036db0
mov rax, qword [rdi + 8]
lock dec qword [rax]
jne 0x14002b2f0
add rdi, 8
mov rcx, rdi
call fcn.140037300
mov rcx, qword [rsi + 8]
mov edx, 0x20
mov r8d, 8
call fcn.140044c20
mov rcx, qword [rsi]
add rsp, 0x28
pop rdi
pop rsi
jmp qword [sym.imp.ws2_32.dll_closesocket]
nop
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14002b640
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov r10, r8
mov r9, rdx
mov eax, dword [0x1400c5618]
xor eax, dword [0x1400c561c]
and eax, 0x7ca8dd49
and eax, 0x4f9cd4e
mov r8d, 0x3bd03c94
xor edx, edx
div r8d
cmp eax, 0xb8bf6a6b
je 0x14002bc29
jmp 0x14002b689
mov eax, dword [0x1400c5620]
mov edx, dword [0x1400c5624]
sub eax, edx
xor eax, 0x2a306d96
imul edx, eax, 0x112d3e83
xor edx, 0xa78b5dc6
mov eax, 0x20
call fcn.14008eba0
sub rsp, rax
mov r8, rsp
mov eax, 0x20
call fcn.14008eba0
sub rsp, rax
mov r11, rsp
mov eax, 0x30
call fcn.14008eba0
sub rsp, rax
mov r14, rsp
mov eax, 0x70
call fcn.14008eba0
sub rsp, rax
mov r15, rsp
mov eax, 0x20
call fcn.14008eba0
sub rsp, rax
mov r12, rsp
mov eax, 0x20
call fcn.14008eba0
sub rsp, rax
mov rsi, rsp
mov eax, 0x30
call fcn.14008eba0
sub rsp, rax
mov r13, rsp
mov eax, 0x20
call fcn.14008eba0
sub rsp, rax
mov rdi, rsp
mov rbx, r9
add rbx, 0x10
movzx eax, byte [r9 + 0x10]
cmp edx, 0x22359d4b
jbe 0x14002b689
mov eax, eax
lea rdx, [0x1400a60a8]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
xor dh, 0xa3
int3