joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400716f0
Capabilities:
Set socket configuration

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401dedc0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r9
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov esi, ecx
call qword [sym.imp.WS2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
mov rcx, rbx
mov rdi, rax
sete dl
call fcn.14004e6e0
cmp rdi, 0xffffffffffffffff
jne 0x140071742
mov rax, rdi
jmp 0x14007176f
cmp esi, 0x17
jne 0x14007176c
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0
lea edx, [rsi + 0x12]
mov dword [rsp + 0x20], 4
lea r8d, [rsi + 4]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14014b190
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x140071ee0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
sub rsp, 0x58
mov rax, qword [0x1401dedc0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, qword [rsp + 0xa0]
mov r11, r9
mov rax, qword [rcx + 8]
mov r10, r8
mov rdi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x98], 0
je 0x140071f30
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call fcn.1400625a0
jmp 0x140071fe1
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x140071f53
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rbx
call fcn.1400625a0
jmp 0x140071fe1
mov eax, dword [rsp + 0x90]
lea r9, [rsp + 0x40]
xor edx, edx
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x44]
mov dword [rsp + 0x40], edx
mov r8d, r11d
mov qword [rsp + 0x28], rbx
mov rdx, r10
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rsi
call qword [sym.imp.WS2_32.dll_WSARecv]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x140071fa2
mov eax, 0x2746
jmp 0x140071faf
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
mov rsi, qword [rsp + 0x50]
je 0x140071fd5
cmp eax, 0x3e5
je 0x140071fd5
mov r9d, dword [rsp + 0x40]
mov r8d, eax
mov rcx, qword [rdi + 8]
mov rdx, rbx
call fcn.1400625a0
jmp 0x140071fe1
mov rcx, qword [rdi + 8]
mov rdx, rbx
call fcn.140062630
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14014b190
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x1400721a0
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x1401dedc0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0xa0]
mov r11, r9
mov rax, qword [rcx + 8]
mov r10, r8
mov rsi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x98], 0
je 0x1400721f0
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call fcn.1400625a0
jmp 0x140072288
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x140072210
mov rcx, qword [rsi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rdi
call fcn.1400625a0
jmp 0x140072288
xor eax, eax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov r8d, r11d
mov eax, dword [rsp + 0x90]
mov rdx, r10
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
mov rbx, qword [rsp + 0x50]
je 0x14007227c
cmp eax, 0x3e5
je 0x14007227c
mov r9d, dword [rsp + 0x40]
mov r8d, eax
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.1400625a0
jmp 0x140072288
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.140062630
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14014b190
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x14007da10
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x1401dedc0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov r15, rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
xor r12d, r12d
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x19], r12
movups xmmword [rbp - 0x11], xmm0
movups xmm0, xmmword [0x1401818c8]
movups xmmword [rbp - 1], xmm0
movups xmm1, xmmword [0x1401818d8]
movups xmmword [rbp + 0xf], xmm1
mov rax, rdx
sub rax, rcx
mov ecx, r12d
add dword [rbp - 0x11], eax
mov edx, r12d
nop word [rax + rax]
add ecx, dword [rbp + rdx*4 - 0x11]
mov dword [rbp + rdx*4 - 0x11], ecx
cmp ecx, 0x10000
jb 0x14007dac2
shr ecx, 0x10
mov word [rbp + rdx*4 - 0xf], r12w
inc rdx
cmp rdx, 4
jb 0x14007daa0
mov r14, qword [rbp - 0x21]
cmp r15, rsi
je 0x14007db09
nop dword [rax + rax]
movzx eax, byte [r15]
mov byte [rbp - 0x39], al
cmp r14, qword [rbp - 0x19]
je 0x14007daed
mov byte [r14], al
mov r14, qword [rbp - 0x21]
inc r14
mov qword [rbp - 0x21], r14
jmp 0x14007db01
lea r8, [rbp - 0x39]
mov rdx, r14
lea rcx, [rbp - 0x29]
call fcn.14007c130
mov r14, qword [rbp - 0x21]
inc r15
cmp r15, rsi
jne 0x14007dad0
mov r15, r12
mov rax, r14
mov rsi, qword [rbp - 0x29]
sub rax, rsi
cmp rax, 0x40
jb 0x14007db4c
nop dword [rax]
lea rdx, [rsi + r15]
lea r8, [rdx + 0x40]
lea rcx, [rbp - 1]
call fcn.14007d150
add r15, 0x40
mov r14, qword [rbp - 0x21]
mov rcx, r14
mov rsi, qword [rbp - 0x29]
sub rcx, rsi
lea rax, [r15 + 0x40]
cmp rax, rcx
jbe 0x14007db20
lea rdx, [rsi + r15]
cmp rsi, rdx
je 0x14007db6b
sub r14, rdx
mov r8, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + rsi]
mov qword [rbp - 0x21], rax
lea rcx, [rbp - 0x29]
call fcn.14007f350
lea r9, [rbp - 1]
mov r8, r12
nop dword [rax + rax]
cmp rbx, rdi
je 0x14007dba6
mov ecx, 3
sub cl, r8b
shl cl, 3
mov edx, dword [r9]
shr edx, cl
mov rax, rbx
inc rbx
mov byte [rax], dl
inc r8
cmp r8, 4
jb 0x14007db80
add r9, 4
lea rax, [rbp + 0x1f]
cmp r9, rax
jne 0x14007db78
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14007dbf0
mov rdx, qword [rbp - 0x19]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007dbeb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007dbeb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14014ac44
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14014b190
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14007ddc0
Capabilities:
Enumerate process modules

Disassembly:
mov byte [rsp + 0x18], r8b
push rbp
push r12
push r14
mov eax, 0x2180
call fcn.14014b7b0
sub rsp, rax
mov rax, qword [0x1401dedc0]
xor rax, rsp
mov qword [rsp + 0x2150], rax
mov r12, r9
mov dword [rsp + 0x20], 1
mov rbp, rdx
lea r9, [rsp + 0x30]
mov r14, rcx
lea rdx, [rsp + 0x40]
mov rcx, r12
mov r8d, 0x2000
call sub.KERNEL32.dll_K32EnumProcessModulesEx
test eax, eax
je 0x14007e03d
mov r8d, dword [rbp + 0x80]
test r8d, r8d
je 0x14007e03b
mov rdx, rbp
mov rcx, r14
call fcn.140089840
test rax, rax
je 0x14007e03b
cmp dword [rax + 0x10], 0
mov qword [rsp + 0x2160], r15
lea r15, [rax + 0x10]
je 0x14007e033
mov qword [rsp + 0x2178], rbx
mov qword [rsp + 0x2170], rsi
mov qword [rsp + 0x2168], rdi
nop dword [rax]
mov r8d, dword [r15 - 4]
mov rdx, rbp
mov rcx, r14
call fcn.140089840
mov rsi, rax
test rax, rax
je 0x14007e01b
lea rdi, [rsp + 0x40]
mov rdx, qword [rdi]
lea r8, [rsp + 0x2040]
mov r9d, 0x104
mov rcx, r12
call sub.KERNEL32.dll_K32GetModuleFileNameExA
test eax, eax
je 0x14007dff8
mov edx, 0x5c
lea rcx, [rsp + 0x2040]
call sub.VCRUNTIME140.dll_strrchr
test rax, rax
je 0x14007def0
lea rcx, [rax + 1]
lea rdx, [rsp + 0x2040]
sub rdx, rcx
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x14007dee0
jmp 0x14007df2e
mov edx, 0x2f
lea rcx, [rsp + 0x2040]
call sub.VCRUNTIME140.dll_strrchr
test rax, rax
je 0x14007df2e
inc rax
lea rdx, [rsp + 0x2040]
sub rdx, rax
nop word [rax + rax]
movzx ecx, byte [rax]
mov byte [rdx + rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x14007df20
movzx eax, byte [rsp + 0x2040]
test al, al
je 0x14007df58
lea rbx, [rsp + 0x2040]
movsx ecx, al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rbx], al
lea rbx, [rbx + 1]
movzx eax, byte [rbx]
test al, al
jne 0x14007df42
movzx eax, byte [rsi]
test al, al
je 0x14007df78
mov rbx, rsi
movsx ecx, al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rbx], al
lea rbx, [rbx + 1]
movzx eax, byte [rbx]
test al, al
jne 0x14007df62
lea rax, [rsp + 0x2040]
mov r8, rsi
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14007dfa3
inc rax
test ecx, ecx
jne 0x14007df90
test edx, edx
jne 0x14007dff8
mov r8d, dword [r15]
mov rdx, rbp
mov rcx, r14
call fcn.140089840
mov rbx, rax
mov r8, qword [rax]
test r8, r8
je 0x14007dff8
mov rdx, rbp
mov rcx, r14
call fcn.140089840
lea rdx, [rsp + 0x2040]
lea rcx, [rsp + 0x21b0]
lea r8, [rax + 2]
call fcn.14007ede0
mov eax, eax
mov qword [rbx], rax
lea rbx, [rbx + 8]
mov rax, qword [rbx]
mov r8d, eax
test rax, rax
jne 0x14007dfc0
add rdi, 8
lea rax, [rsp + 0x2040]
cmp rdi, rax
jne 0x14007de90
add r15, 0x14
cmp dword [r15], 0
jne 0x14007de70
mov rdi, qword [rsp + 0x2168]
mov rsi, qword [rsp + 0x2170]
mov rbx, qword [rsp + 0x2178]
mov r15, qword [rsp + 0x2160]
mov al, 1
mov rcx, qword [rsp + 0x2150]
xor rcx, rsp
call fcn.14014b190
add rsp, 0x2180
pop r14
pop r12
pop rbp
ret
Function at 0x14007f2c0
Capabilities:
Enumerate threads

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x40]
mov dword [rax], Ordinal_29
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x14007f32f
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x48]
cmp dword [rax + 0xc], ecx
jne 0x14007f31c
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x40]
jmp 0x14007f34b
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x14007f2fc
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x40]
mov dword [rax + 8], 0
mov rax, qword [rsp + 0x40]
add rsp, 0x38
ret

Function at 0x1400809e0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x2c8
mov rax, qword [0x1401dedc0]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov dword [rsp + 0x44], 0
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x140080a26
xor eax, eax
jmp 0x140080b57
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140080b48
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
lea r8, [rsp + 0x9c]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rsp + 0x40], eax
movsxd rax, dword [rsp + 0x40]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140002ae0
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.14002b9d0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov ecx, dword [rsp + 0x40]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rsp + 0x9c]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rsp + 0x50]
call fcn.1400415a0
mov rcx, qword [rsp + 0x2d0]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x140080b0a
inc rax
test dl, dl
jne 0x140080af7
xor eax, eax
jmp 0x140080b0f
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140080b27
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0x50]
call fcn.140002e60
jmp 0x140080b48
lea rcx, [rsp + 0x50]
call fcn.140002e60
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140080a45
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14014b190
add rsp, 0x2c8
ret
Function at 0x1400898b0
Capabilities:
Enumerate pe sections

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 8], rax
mov dword [rsp], 0
jmp 0x1400898f4
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 8]
add rax, 0x28
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 6]
cmp dword [rsp], eax
jge 0x14008992f
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x28], eax
jb 0x14008992d
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 8]
add eax, dword [rcx + 8]
cmp dword [rsp + 0x28], eax
jae 0x14008992d
mov rax, qword [rsp + 8]
jmp 0x140089931
jmp 0x1400898de
xor eax, eax
add rsp, 0x18
ret

Function at 0x140089940
Capabilities:
Enumerate pe sections

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 8], rax
mov dword [rsp], 0
jmp 0x140089984
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 8]
add rax, 0x28
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 6]
cmp dword [rsp], eax
jge 0x1400899bf
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x28], eax
jb 0x1400899bd
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 8]
add eax, dword [rcx + 8]
cmp dword [rsp + 0x28], eax
jae 0x1400899bd
mov rax, qword [rsp + 8]
jmp 0x1400899c1
jmp 0x14008996e
xor eax, eax
add rsp, 0x18
ret
Function at 0x14008aec0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1401dedc0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, rcx
mov qword [rsp + 0x50], rcx
xor ebp, ebp
mov dword [rsp + 0x38], ebp
lea edx, [rbp + 8]
lea rcx, [rsp + 0x70]
call sub.libcrypto_3_x64.dll_RAND_bytes
cmp eax, 1
je 0x14008af12
lea ecx, [rbp + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rbp
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], bpl
mov dword [rsp + 0x38], 1
movabs r15, 0xe3c473c77c4255fc
movabs r14, 0x85e4e962d95f93c6
movabs r12, 0xe3c473c7047065d9
nop dword [rax]
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
movdqa xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm0
movzx r8d, byte [rsp + rbp + 0x70]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.14008ccf0
lea rax, [rsp + 0x58]
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x14008afc0
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rbx, rax
ja 0x14008b00a
lea rax, [rcx + rbx]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0xf
jbe 0x14008aff0
mov rax, qword [rsi]
lea rdi, [rax + rcx]
mov r8, rbx
lea rdx, [rsp + 0x58]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x14008b022
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x58]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.140002740
inc rbp
cmp rbp, 8
jl 0x14008af50
mov rax, rsi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14014b190
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14008b440
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1401dedc0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, rcx
mov qword [rsp + 0x50], rcx
xor ebp, ebp
mov dword [rsp + 0x38], ebp
lea edx, [rbp + 0x10]
lea rcx, [rsp + 0x70]
call sub.libcrypto_3_x64.dll_RAND_bytes
cmp eax, 1
je 0x14008b495
lea ecx, [rbp + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rbp
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], bpl
mov dword [rsp + 0x38], 1
movabs r15, 0xe3c473c77c4255fc
movabs r14, 0x85e4e962d95f93c6
movabs r12, 0xe3c473c7047065d9
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
movdqa xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm0
movzx r8d, byte [rsp + rbp + 0x70]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.14008ccf0
lea rax, [rsp + 0x58]
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x14008b540
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rbx, rax
ja 0x14008b58a
lea rax, [rcx + rbx]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0xf
jbe 0x14008b570
mov rax, qword [rsi]
lea rdi, [rax + rcx]
mov r8, rbx
lea rdx, [rsp + 0x58]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x14008b5a2
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x58]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.140002740
inc rbp
cmp rbp, 0x10
jb 0x14008b4d0
mov rax, rsi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14014b190
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140096730
Capabilities:
Hash data with crc32

Disassembly:
xor edx, edx
xor ecx, ecx
jmp fcn.140096740

Function at 0x140096740
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401dedc0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1401e4320]
mov edi, edx
mov esi, ecx
cmp byte [rbx + 0x43fd], 0
jne 0x1400967a8
cmp byte [rbx + 0x43fe], 0
jne 0x1400967a8
movsx r9d, word [rbx + 0x54de]
lea r8, str.Tooltip__02d
mov edx, select
lea rcx, [rsp + 0x20]
call fcn.1400b2790
test sil, 1
je 0x1400968e0
jmp 0x140096848
movss xmm1, dword [rbx + 0x39c0]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x14018e4bc]
xor eax, eax
mov edx, select
mulss xmm1, dword [0x14018e4b4]
addss xmm0, dword [rbx + 0xd9c]
addss xmm1, dword [rbx + 0xda0]
or dword [rbx + 0x40f0], 1
mov qword [rbx + 0x410c], rax
movss dword [rbx + 0x4104], xmm0
mov dword [rbx + 0x40f4], 1
movss dword [rbx + 0x4108], xmm1
mov byte [rbx + 0x412c], 1
movss xmm0, dword [rbx + 0x3a1c]
mov rax, qword [0x1401e4320]
mulss xmm0, dword [0x14018e440]
or dword [rax + 0x40f0], 0x40
movss dword [rax + 0x4150], xmm0
movsx r9d, word [rbx + 0x54de]
call fcn.1400b2790
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140096898
lea r11, [0x140181d80]
cmp r9b, 0x23
jne 0x14009687b
cmp byte [r8], r9b
jne 0x14009687b
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140096868
not ecx
call fcn.1400ae1f0
test rax, rax
je 0x1400968e0
cmp byte [rax + 0xcb], 0
je 0x1400968e0
mov byte [rax + 0xd2], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xec], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x54de]
mov edx, select
movsx r9d, word [rbx + 0x54de]
call fcn.1400b2790
or edi, 0x22c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.140091900
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14014b190
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14009f560
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
push r14
push r15
sub rsp, 0x20
movzx r9d, byte [rcx]
lea r15, [0x140181d80]
inc rcx
mov ebp, 0xffffffff
mov r14, rdx
mov r8d, ebp
test r9b, r9b
je 0x14009f5c2
nop dword [rax]
cmp r9b, 0x23
jne 0x14009f5a3
cmp byte [rcx], r9b
jne 0x14009f5a3
cmp byte [rcx + 1], r9b
cmove r8d, ebp
movzx edx, r8b
movzx eax, r9b
movzx r9d, byte [rcx]
xor rdx, rax
shr r8d, 8
inc rcx
xor r8d, dword [r15 + rdx*4]
test r9b, r9b
jne 0x14009f590
not r8d
mov ecx, r8d
call fcn.1400ae1f0
mov rdi, rax
test rax, rax
je 0x14009f72a
mov qword [rsp + 0x48], rbx
mov ecx, ebp
mov qword [rsp + 0x50], rsi
lea rbx, [r14 + 1]
movzx esi, byte [r14]
mov r8, rbx
movzx r9d, sil
test sil, sil
je 0x14009f62f
nop dword [rax]
cmp r9b, 0x23
jne 0x14009f612
cmp byte [r8], r9b
jne 0x14009f612
cmp byte [r8 + 1], r9b
cmove ecx, ebp
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x14009f600
not ecx
call fcn.1400ae1f0
test rax, rax
je 0x14009f66b
movsd xmm0, qword [rdi + 0x48]
movsd qword [rax + 0x48], xmm0
movsd xmm1, qword [rdi + 0x50]
movsd qword [rax + 0x50], xmm1
movsd xmm0, qword [rdi + 0x58]
movsd qword [rax + 0x58], xmm0
movzx ecx, byte [rdi + 0xce]
mov byte [rax + 0xce], cl
jmp 0x14009f720
mov ecx, ebp
test sil, sil
je 0x14009f6a0
cmp sil, 0x23
jne 0x14009f684
cmp byte [rbx], sil
jne 0x14009f684
cmp byte [rbx + 1], sil
cmove ecx, ebp
movzx edx, cl
movzx eax, sil
movzx esi, byte [rbx]
xor rdx, rax
shr ecx, 8
inc rbx
xor ecx, dword [r15 + rdx*4]
test sil, sil
jne 0x14009f672
not ecx
call fcn.1400ae4a0
mov rcx, rax
test rax, rax
jne 0x14009f6bf
mov rcx, r14
call fcn.140099b30
mov rcx, rax
test rax, rax
je 0x14009f720
cvttss2si eax, dword [rdi + 0x48]
mov word [rsp + 0x40], ax
cvttss2si eax, dword [rdi + 0x4c]
mov word [rsp + 0x42], ax
mov eax, dword [rdi + 0x38]
test eax, eax
je 0x14009f6f4
cmp eax, 0x11111111
je 0x14009f6f4
mov eax, dword [rsp + 0x40]
mov dword [rcx + 0xc], eax
mov eax, dword [rdi + 0x38]
mov dword [rcx + 0x10], eax
xor eax, eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rcx + 4], eax
cvttss2si eax, dword [rdi + 0x58]
mov word [rsp + 0x40], ax
cvttss2si eax, dword [rdi + 0x5c]
mov word [rsp + 0x42], ax
mov eax, dword [rsp + 0x40]
mov dword [rcx + 8], eax
movzx eax, byte [rdi + 0xce]
mov byte [rcx + 0x1e], al
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14009f740
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov ebp, edx
mov edx, 0xffffffff
mov ebx, edx
mov rsi, rcx
test r9b, r9b
je 0x14009f7a3
lea r10, [0x140181d80]
cmp r9b, 0x23
jne 0x14009f786
cmp byte [r8], r9b
jne 0x14009f786
cmp byte [r8 + 1], r9b
cmove ebx, edx
movzx ecx, bl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr ebx, 8
inc r8
xor ebx, dword [r10 + rcx*4]
test r9b, r9b
jne 0x14009f774
not ebx
mov ecx, ebx
call fcn.1400ae1f0
mov rdi, rax
test rax, rax
je 0x14009f7cf
mov r8d, 1
mov edx, ebp
mov rcx, rax
call fcn.1400c4bb0
mov word [rdi + 0x402], 0xffff
jmp 0x14009f7ec
mov ecx, ebx
call fcn.1400ae4a0
test rax, rax
jne 0x14009f7e3
mov rcx, rsi
call fcn.140099b30
mov dword [rax + 0x14], ebp
mov word [rax + 0x1c], 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret