joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1806d1c54
Capabilities:
Encode data using base64

Disassembly:
xor dword [rsp + rcx - 0x3cd600f0], edx
dec bpl
mov rsi, qword [rsp + rcx - 0x3cd600f0]
mov ebx, ebp
mov qword [rsp + rcx*2 - 0x79ac01f0], rbx
and bl, 0xa6
movsxd rdx, edx
btr rbp, r10
adc r8, rdx
mov rax, qword [r11 + rcx*2 - 0x79ac0200]
call fcn.1806fef2d
mov ebp, 0xe50c2d23
mov r10, r11
lea r9, [rbp*2 + 0x449eb581]
imul r9d, r9d
mov qword [r11 + r9 - 0x537aecb9], r10
movsx edx, r9w
movsx ecx, dx
mov ecx, dword [rdi + r9 - 0x537aecb1]
ror rdx, 0x76
xor ecx, esi
bt ebp, r9d
adc dl, 0x18
shl bp, 0xaa
ror ecx, 3
and dl, 0xa0
sal r9d, 0xe6
sbb ecx, 0x32c7919
inc r9
neg ecx
mov ebx, edx
neg r9
bt dx, 0x3f
dec ecx
push rsi
dec r9d
xor dword [rsp + r9*2 - 0x4289a77c], ecx
bts bp, bx
pop rsi
movsxd rcx, ecx
push rbx
movsx eax, r9w
adc r8, rcx
sar dword [rsp + r9 - 0x2144d3be], 0xaa
cdqe
mov rdx, qword [rax + r11 + 0x2c3a]
cdqe
movsx r10d, bpl
xor dword [rsp + r9 - 0x2144d3be], ebp
movzx eax, byte [rdi + r9*2 - 0x4289a778]
ja 0x1806f0b37
lea rdi, [rdx + rdi - 0x12220f36]
movsx ecx, dl
xor ebp, esi
or dl, cl
jp 0x1806e8d3d
neg dx
dec r10d
xor si, dx
sar byte [rsp + rbp - 0x7289a69e], 0xe6
cwde
sar ax, 0x4a
lea rdx, [rsp + rdx + 8]
shl word [rsp + rax], 0x6e
shr word [rsp + rax*2 + 4], 0xae
lea rcx, [rbx*4 + 0xa2ce2a5]
movzx cx, byte [rdx + rax*4 - 4]
ror rax, 0xce
xchg al, r9b
rol byte [rsp + r9 - 0x7289a6f9], 0x65
lea r11, [rbp + r11 - 0x7289a6a5]
cdq
mov word [r11 + rbp - 0x7289a6a3], cx
sbb r10d, dword [rsp + r9 - 0x7289a6fe]
mov eax, dword [rdi + r9 - 0x7289a700]
jg 0x1806e9ce1
lea rdi, [rdi + r9 - 0x7289a6fc]
shl qword [rsp + r9 - 0x7289a700], 0xdd
mov ecx, 0xacafa61a
ror edx, cl
xor eax, esi
bswap eax
btr r10d, ebp
sbb eax, 0xec0e36bb
xchg qword [rsp + rbp - 0x7289a6a3], r9
xor eax, 0xd806feb1
bts ebx, edx
call fcn.1806c1f93
movzx ecx, bl
lea rdi, [r9 + rdi - 0x2144d3b9]
shl word [rsp + r9*2 - 0x4289a779], 0x4e
pop r10
xor al, sil
inc r9
call fcn.1806f9c7f
Function at 0x1806dd451
Capabilities:
Encode data using base64

Disassembly:
xor dword [rsp + rax], ebx
shl ax, 0x28
inc rax
sal rdx, 0xe3
pop rsi
call fcn.1806fda3c
bswap edx
lea r9, [rax*4 - 0x7bf232fd]
call fcn.1806c670e
bts r10, rdx
xor ebx, esi
rol ebx, 3
btr r9d, r9d
movsx ebp, r10w
dec ebx
and rdx, 0x258b9095
imul r10d, edx
mov ecx, edx
bswap ebx
add edx, ecx
rol cl, 0x61
ror ebx, 1
push rsi
jmp 0x1806f0afc
mov qword [rsp + rax*2], rsi
imul rax, rbp
jae 0x1806d9129
mov r10d, 0x770c3528
movsx edx, r10b
mov eax, r10d
mov rax, qword [r10 + r11 - 0x770c3528]
mov ebx, r10d
mov ecx, r10d
mov rcx, qword [rax + rdx*2 - 0x50]
movzx eax, r10w
dec dx
btc dx, r10w
mov qword [rdx + r11 - 0x127], rcx
ror r10w, 0xe2
cbw
mov r9d, dword [rdx + rdi - 0x127]
sbb ebx, r10d
dec ebx
lea rdi, [rdi + rdx - 0x123]
push r10
sal byte [rsp + rdx - 0x127], 0xe3
dec qword [rsp + rdx - 0x127]
xor r9d, esi
shr qword [rsp + rdx - 0x127], 0xff
add dword [rsp + rdx*2 - 0x24a], 0x2d14c627
mov ecx, 0x2263d9c
lea r9d, [r9 + r10 + 0x7a2e8ee7]
bswap r9d
xor bl, 0x94
not r9d
sbb r9d, 0xac983a3f
sar word [rsp + r10 - 0x770c0d44], 0x4d
mov qword [rsp + r10 - 0x770c0d4a], rsi
xor dword [rsp + rdx*2 - 0x24e], r9d
neg rbx
movsx esi, al
add cx, 0xb72d
pop rsi
movsxd r9, r9d
cqo
adc r8, r9
add rdx, r8
jmp rdx
movsx esi, bpl
sub r9, r10
xor dword [rsp + rdx - 0xa14010a], ebx
lea rax, [r10 + r10*2 - 0x4b71cb68]
pop rsi
rol rbp, 0x8e
movsxd rbx, ebx
adc r8, rbx
btc ax, 0x3a
xadd rax, rbp
sub dx, dx
mov rax, qword [r11 + rdx*4 - 0x28500000]
jae 0x180703a17
adc r10d, 0x19abdaac
bts r10, r10
mov r10, qword gs:[rax + rdx*2 - 0x14280000]
mov qword [rdx + r11 - 0xa140000], r10
movsx r10d, bpl
xor bp, dx
jmp r8
Function at 0x1806e942d
Capabilities:
Encode data using base64

Disassembly:
bswap ecx
xor ecx, 0xbf079233
mul rbx
shr bp, 0xc6
lea r9, [rdx*4 - 0xc696959]
dec ecx
sub ebx, ebp
ror ecx, 3
xor r10, 0xffffffffad990224
dec r10
bswap r10d
push rsi
jle 0x1807007df
ja 0x180703f38
lea r11, [r9 + r11 - 0x44a85fb7]
sal rdx, cl
call fcn.1806e2077
adc r11, 0xc
mov qword [rsp], 0x70bd5d23
sar word [rsp + 4], 0x2d
xor edx, edx
ror byte [rsp + 6], 0xa3
jae 0x180708122
mov ecx, 0x26989887
mov ebx, ecx
movzx ebp, bx
not edx
lea r10, [rbx + rbp - 0x596eb94e]
mov dword [r11 + rcx*2 - 0x4d31310e], edx
mov ecx, dword [rdi + rbp*2 - 0x1310e]
mov edx, ebx
movsx eax, bp
lea rdi, [rbp + rdi - 0x9883]
btc rdx, rbp
btc ebx, edx
or dx, r10w
xor ecx, esi
cwde
shl rdx, 0x2e
jae 0x1806c1dff
jb 0x18070b664
mov rdx, qword [r11]
mov r9d, 0x44a85fb9
lea r10, [r9*4 + 0x3490c080]
movsx eax, r10w
mov cl, byte [r11 + r9 - 0x44a85fb1]
jmp 0x1806e6e59
sub r9, rax
xor dword [rsp + rbx*2 - 0x4d312b4a], ecx
div r10d
push r9
rol dword [rsp + rbx - 0x269895a5], 0x58
mov rsi, qword [rsp + rbx*2 - 0x4d312b42]
mov qword [rsp + rdx - 0x5cb553a9], rbx
sal r10d, 0x2a
movsxd rcx, ecx
inc ebx
add r8, rcx
xchg qword [rsp + rbp*4 - 0x980], r10
xadd rdx, r9
xchg dword [rsp + rbx - 0x2698959f], r10d
mov qword [rsp + rbx*2 - 0x4d312b4c], r8
ret 8
rol word [rsp + 6], 0x8d
test rcx, rcx
lea rsp, [rsp + 8]
je 0x1806eb9b0
mov r9d, 0x860acab6
add r9d, r9d
push r11
movzx r11d, r9w
lea r11, [0x1807051f8]
mov r9d, 0x7838508f
sar r9b, 0x24
movzx r9d, byte [r10 + r9 - 0x783850f8]
jb 0x1806fb0e1
mov r9d, 0xae8d733f
mov edx, r9d
mov eax, dword [rdi + riz]
or rdx, r9
shl r9d, 0x9d
movzx ecx, dx
xor eax, esi
inc cx
inc eax
movsx ebx, cx
ror eax, 1
dec dl
push rbx
xor eax, 0x69336d95
shr dword [rsp + rcx*8 - 0x399ff], 0xa5
lea rbp, [rdx*8 + 0x7e2dd696]
bt r9, 0x22
lea eax, [rax + rdx - 0x1bf1a422]
push rcx
setb bl
mov qword [rsp + rcx*4 - 0x1ccf8], rsi
push rbp
sar r9b, 0xa6
xor dword [rsp + rcx - 0x7330], eax
xor dword [rsp + rcx*2 - 0xe67e], ebx
mov rsi, qword [rsp + rcx - 0x7330]
movsxd rax, eax
btc r9d, ebp
dec r9d
mov qword [rsp + rcx - 0x7330], r9
adc r8, rax
neg cl
sub qword [rsp + rcx - 0x73b8], 0xfffffffff436e01b
movzx edx, byte [rcx + rdi - 0x73bc]
sal dword [rsp + rcx*2 - 0xe77c], 0x10
lea rdi, [rdi + rcx*8 - 0x39dfb]
sar rbx, 0xfe
call fcn.1806d2fdb
jnp 0x180711cd4

Function at 0x1806ed0db
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp], r13
mov esi, 0x5994a6b1
pushfq
Function at 0x1806f0148
Capabilities:
Authenticate hmac

Disassembly:
lea rdi, [rdi + r9 - 0x28]
push rax
adc byte [rsp + r9 - 0x2a], al
xor rbx, rsi
sub al, 0xa5
ror byte [rsp + r9 - 0x2b], 0xc4
rol r9, 0xff
not rbx
movsx r10d, byte [rsp + r9 - 0x18]
neg rbx
pop rcx
add ax, cx
lea rbx, [rbx + r9 - 0x2b440c6b]
add ecx, ecx
xor rbx, 0x2934e71f
xor rsi, rbx
mul ecx
neg ecx
lea r11, [r11 + r9 - 0x20]
rol rdx, cl
mov qword [r11 + r9 - 0x18], rbx
not r10w
shl r9b, 0xa5
shr r9, cl
mov ebp, dword [r9 + rdi]
shr r10, 9
lea rbx, [r10*4 - 0x777bd05f]
adc rax, rbx
lea rdi, [rax + rdi - 0x57c9a7ba]
inc bl
xor ebp, esi
inc al
rol cl, 7
adc dx, cx
neg ebp
cwd
rol ebp, 1
neg dl
adc ebp, r9d
div rbx
inc rax
dec r10w
bswap ebp
xadd cl, ah
push rsi
imul r10b
lea r9, [rdx + r10*4 - 0x1dffeae0]
dec al
xor dword [rsp + r10*4 - 0x1f8], ebp
lea rax, [r10*4 - 0x6046e773]
pop rsi
sub r9w, r10w
div al
movsxd rbp, ebp
add r8, rbp
jmp fcn.1806d30d8
xadd bpl, bl
mov qword [rsp + r9*4 - 0x1f9b5b38], rsi
imul rcx, rbx
xor dword [rsp + rbx - 0x4c0948d7], eax
neg r9
mov qword [rsp + r9*2 + 0xfcdada0], rbx
jp 0x18070f903
inc bpl
and word [rsp + rax - 0x6e97ec59], cx
shl qword [rsp + rdx - 0xf62f], 0x8f
idiv qword [rsp + rdx*2 - 0x1ec5e]
not bpl
and eax, eax
inc byte [rsp + rax*2 - 0x59041]
sub al, 0xb9
xor bpl, 0x26
mov r9d, ecx
sub bpl, 8
shl ecx, 0xd8
xchg rdx, rax
xor sil, bpl
lea rbp, [rsp + rbp + 8]
inc r10w
mov ax, word [rbp + rdx*2 - 0x590d0]
ror ebx, 8
jp 0x1806e9d58
mov eax, 0xb7b94830
movzx r9d, al
movzx ebp, r9b
mov rbx, qword [r9 + rdi - 0x30]
bt eax, 0x3a
jb 0x1806e2d92

Function at 0x1806f53e8
Capabilities:
Encode data using base64

Disassembly:
call fcn.1806f81e3
dec byte [rsp + rdx - 0x142090fc]
neg ax
mov qword [rdx + rbx - 0x14209109], r10
mov qword [rsp + rdx - 0x14209109], r9
mov r10d, dword [rdx + rdi - 0x14209109]
js 0x1806efb62

Function at 0x1806f6b68
Capabilities:
Encode data using base64

Disassembly:
inc r10d
neg r10d
xadd r9d, ebx
shr bx, 0xe1
sar rbx, 0x25
mov qword [rsp + r9 - 0x3eb564b4], rsi
mov qword [rsp + rbx*2], rbx
call fcn.180709f7b
Function at 0x1806f6ec5
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rcx - 0x65172b23], rcx
call fcn.1806e624f

Function at 0x1806f8a97
Capabilities:
Authenticate hmac

Disassembly:
lea rdx, [rsp + rdx + 8]
mov qword [rsp + rbp - 0x6151fe38], rbx
cmovno r9w, word [rsp + rcx - 0x97504]
push r9
mov r9, qword [rdx + rcx*2 - 0x12ea0e]
lea r10, [r10*8 - 0x286671fa]
mov qword [rbp + r11 - 0x6151fe40], r9
mov r9d, 0x9280bc91
shl bx, 0xc1
mov r10d, dword [rdi + rcx*2 - 0x12ea0d]
pop rcx
or rbx, 0x8812c2f
lea rdi, [rdi + rax*4 - 0x12b75b7f]
dec rbx
sub qword [rsp + rax*2 - 0x95badc2], 0x7318da9
xor r10d, esi
jmp 0x18070eb59
lea rcx, [rbp + 0x1b37cc0a]
rol r10d, 1
ror eax, 0x2f
sbb rbx, qword [rsp + rcx - 0x7c89ca42]
xor r10d, 0x57a58639
xor dword [rsp + rbx - 0xf32b9d5], ecx
bswap r10d
jge 0x1806f3087
mov rbp, qword [r11]
mov r9d, 0xf43d54b4
movzx ecx, r9b
movzx r10w, byte ss:[rcx + rbp - 0xb4]
movsx edx, cx
mov bp, r10w
lea rax, [rcx + rcx*2 - 0x4c7b8fc2]
lea rax, [rax + rdx*8 - 0x25486646]
sar dl, 0xc1
movzx bp, bpl
mov r9b, byte [r11 + rcx*4 - 0x2c8]
jg 0x1806e0013
adc ax, dx
div al
not bpl
not r9b
mov r10d, 0x378d8a81
cbw
xchg r10d, ecx
or bpl, r9b
idiv dl
add r10b, r10b
add al, ch
mov word [r11 + rcx - 0x378d8a79], bp
movzx ebx, r10b
lea r11, [rcx + r11 - 0x378d8a79]
movsx ebp, r10w
ror ecx, cl
ror bx, 0x4a
mov ebp, dword [rdx + rdi - 0xda]
lea rdi, [rdi + r10 - 0x64]
movsx r9d, bx
cqo
rol edx, 0x3a
xor ebp, esi
not r10
add ebp, edx
dec ax
sub rbx, 0x2009b623
cmovbe dx, ax
not ebp
mul bl
ror edx, 0x58
inc ebp
sal ecx, 0xf0
and dx, 0xb50a
cdq
xor ebp, 0xe692f682
push rbx
btc eax, ebx
sal r9w, 0xa4
mov qword [rsp + r10 + 0x69], rsi
xor dword [rsp + r10*2 + 0xd2], ebp
cwd
movsx esi, al
cdq
pop rsi
jmp 0x1806e9672

Function at 0x18070283a
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror cx, 0x2a
push rax
neg dl
call fcn.1806f41f0

Function at 0x180702de3
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov rsi, qword [rsp + rcx - 0x1095fff8]
dec rbp
movsxd r10, r10d
pop r9
add r8, r10
lea r9, [rax*8 + 0x3794c0aa]
lea r9, [r11 + rcx - 0x1095fffc]
mov qword [rsp + rcx*4 - 0x42580000], rcx
pop rbx
mov qword [r11 + rcx*2 - 0x212c0004], r9
btr edx, ebp
lea r11, [r11 + rbp*2 - 2]
movzx r10d, dx
cqo
sar bx, 0xb
jae fcn.1806d30d8
lea r11, [r10 + r11 - 0x50fc2413]
and word [rsp + r9 - 0x50fc2415], 0x2aa7
sal dl, cl
ror r9d, 0x9f
jb 0x18070b8d4
mov word [r11 + r10 - 0x50fc2415], dx
inc r10w
mov eax, dword [rdi + r10 - 0x50fc2416]
rol word [rsp + r10 - 0x50fc2416], 0x68
movsx ecx, byte [rsp + r10 - 0x50fc2414]
call fcn.1806f75ea
Function at 0x18070ba7e
Capabilities:
Encode data using base64

Disassembly:
mov ebp, dword [rdi + rax - 0xb95ab24]
or rax, rax
movzx r10d, al
mov edx, 0x973c21b1
lea rdi, [rdi + rax*4 - 0x2e56ac8c]
xor ebp, esi
ror ebp, 1
btr r10d, edx
neg ebp
bswap ebp
push r10
call fcn.1806dab73
movzx dx, byte [r11]
mov r9d, 0x1a9f0ea4
mov r10d, r9d
movsx eax, r9w
mov bl, byte [r11 + r9 - 0x1a9f0ea2]
movzx ebp, r10b
not dl
not bl
or r9, rax
and dl, bl
movsx ebx, r10w
xchg r10b, bpl
movzx ecx, r10w
mov word [r11 + r9*4 - 0x6a7c3a8e], dx
movzx edx, byte [rdi + r9*4 - 0x6a7c3a90]
shr r9d, cl
push rax
dec al
xor dl, sil
and dword [rsp + r9 - 0x1a9f0e7], 0x362cedbf
cdqe
pop r10
rol dl, 1
cwde
btr cx, ax
sbb dl, 0x9b
div r10b
xor al, bpl
not dl
call fcn.1806e7434
neg dword [rsp + r9*2 - 0x3169023a]
mov rsi, qword [rsp + r10 - 0xfffffaa]
add bl, 0x35
mov qword [rsp + r10*8 - 0x7ffffd88], r9
sbb byte [rsp + r10 - 0xfffffa3], 0xa1
movsxd rax, eax
and byte [rsp + r10*2 - 0x1fffff5d], 0x25
adc r8, rax
movzx eax, word [rsp + r10 - 0xfffffb2]
and rax, 0x7e37d687
pop rbx
mov rax, qword [r11 + r10*2 - 0x1fffff64]
ror r9b, 0xe1
xor r9, qword [rsp + r10 - 0xfffffb2]
push r9
mov cl, byte [r11 + r10*4 - 0x3ffffec0]
or r9, r10
call fcn.180711cdc
lea rdi, [rbp + rdi - 0x66b0]
xor ecx, esi
dec ecx
movsx ebx, bp
mov qword [rsp + rbp*4 - 0x19ad0], rbp
xor ecx, 0xb629fa38
shr qword [rsp + rbp*8 - 0x335a0], 0x6b
lea ecx, [rcx + rbp - 0x598f5bd2]
adc dword [rsp + rbp*2 - 0xcd66], ebx
not ecx
adc rbx, r9
shr byte [rsp + rbp*2 - 0xcd61], 0xe3
jb 0x1806f0d7b
mov qword [rsp + rbp - 0x66b4], rsi
or rbx, rbp
bswap rbx
xor dword [rsp + rbp*2 - 0xcd68], ecx
dec bx
sub bx, 0xeba8
pop rsi
neg r9b
call fcn.18070e9e4
mov ecx, 0xd98d992b
movsx eax, cx
mov r10d, dword [rdi + riz]
call fcn.180700a0c

Function at 0x1400018e8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001932
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001932
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001932
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001932
cmp dword [rcx + 0x84], 0xe
jbe 0x140001932
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001934
xor al, al
add rsp, 0x28
ret
Function at 0x140080650
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbx, rdx
mov r14, rcx
mov ecx, dword [0x140145f08]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebp, ebp
test rax, rax
je 0x14008068b
mov rdx, qword [rax + 8]
jmp 0x14008068e
mov rdx, rbp
mov r9d, 8
mov r8d, 0x88
movzx ecx, byte [rsp + 0x50]
call fcn.140088c00
mov r8, rax
mov rcx, qword [rbx + 8]
mov qword [rax + 0x10], rcx
mov rdx, qword [rbx + 0x20]
mov qword [rbx + 0x20], rbp
mov rcx, qword [rbx + 0x18]
mov qword [rbx + 0x18], rbp
mov rax, qword [rbx + 0x10]
mov qword [rbx + 0x10], rbp
mov qword [r8 + 0x18], rax
mov qword [r8 + 0x20], rcx
mov qword [r8 + 0x28], rdx
mov rax, qword [rbx + 0x28]
mov qword [r8 + 0x30], rax
mov rax, qword [rbx + 0x30]
mov qword [r8 + 0x38], rax
mov rax, qword [rbx + 0x38]
mov qword [r8 + 0x40], rax
mov rax, qword [rbx + 0x40]
mov qword [r8 + 0x48], rax
mov eax, dword [rbx + 0x48]
mov dword [r8 + 0x50], eax
mov qword [r8 + 0x58], rbp
mov qword [r8 + 0x60], rbp
mov rax, qword [rbx + 0x50]
mov qword [r8 + 0x58], rax
mov rax, qword [rbx + 0x58]
mov qword [r8 + 0x60], rax
mov qword [rbx + 0x50], rbp
mov qword [rbx + 0x58], rbp
movups xmm0, xmmword [rbx + 0x60]
movups xmmword [r8 + 0x68], xmm0
mov rax, qword [rbx + 0x70]
mov qword [r8 + 0x78], rax
lea rax, [0x140089e70]
mov qword [r8], rax
mov qword [r14], r8
mov rdi, qword [rbx + 0x58]
test rdi, rdi
je 0x14008076d
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x14008076d
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock xadd dword [rdi + 0xc], esi
cmp esi, 1
jne 0x14008076d
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WSOCK32.dll_htonl]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400807b3
mov rdx, qword [rbx + 0x20]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
cmp rdx, 0x1000
jb 0x1400807a2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400807c9
mov rcx, r8
call fcn.14010a738
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], rbp
mov rax, r14
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400819e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbx, rdx
xor edi, edi
mov cl, 1
call sub.MSVCP140.dll_private:_static_class_std::locale::_Locimp____ptr64___cdecl_std::locale::_Init_bool_
mov rcx, rax
mov qword [rsp + 0x28], rax
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140081a27
mov rdx, qword [rbx]
mov r8, rdx
mov rsi, rdx
jmp 0x140081a2d
mov rsi, rbx
mov r8, rbx
mov rbp, qword [rbx + 0x10]
add rbp, r8
cmp rdx, rbp
je 0x140081a9e
movabs r14, 0xcbf29ce484222325
movabs r15, 0x100000001b3
mov r12d, 0x9e3779b9
movzx ebx, byte [rsi]
lea rcx, [rsp + 0x20]
call fcn.140091370
movzx edx, bl
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::ctype_char_::toupper_char_const___ptr64]
movzx ecx, al
xor rcx, r14
imul rcx, r15
mov rax, rdi
shl rax, 6
mov rdx, rdi
shr rdx, 2
add rcx, rax
lea rax, [rdx + r12]
add rcx, rax
xor rdi, rcx
inc rsi
cmp rsi, rbp
jne 0x140081a53
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140081abc
mov rdx, qword [rcx]
call qword [rdx + select]
test rax, rax
je 0x140081abc
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x1400895d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rdi, rdx
mov rbp, qword [rcx]
lea r14, [rcx + 0x40]
lea rsi, [rcx + 8]
mov qword [rsp + 0x30], rdx
mov ecx, dword [0x140145f08]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor r15d, r15d
test rax, rax
je 0x140089615
mov rdx, qword [rax + 8]
jmp 0x140089618
mov rdx, r15
mov r9d, 8
mov r8d, 0xa0
movzx ecx, byte [rsp + 0x70]
call fcn.140088ae0
mov rbx, rax
mov qword [rsp + 0x38], rax
mov qword [rax + 0x20], r15
lea rax, [0x1400b3b80]
mov qword [rbx + 0x28], rax
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
mov dword [rbx + 0x30], r15d
mov dword [rbx + 0x38], r15d
lea rax, [0x1401405e8]
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x48], r15
mov rax, qword [rdi]
mov qword [rbx + 0x50], rax
movzx eax, byte [rdi + 8]
mov byte [rbx + 0x58], al
mov rax, qword [rdi + 0x10]
mov qword [rbx + 0x60], rax
lea rcx, [rbx + 0x68]
mov r9, r14
xor r8d, r8d
xor edx, edx
call fcn.140093ca0
mov qword [rsp + 0x40], rbx
mov byte [rsi + 8], 1
lea r9, [rsi + 0x10]
lea rdx, [rbp + 0x28]
mov qword [rsp + 0x20], rbx
mov r8, rsi
mov rcx, qword [rbp + 0x58]
call fcn.140090fc0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
lea rcx, [rsp + 0x30]
call fcn.1400c5a90
nop
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14008ae90
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rsi, rcx
cmp qword [rcx + 0x20], 0
je 0x14008b00d
mov rcx, qword [rcx + 0x28]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14008aef3
lea rcx, [0x140089a00]
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x58], rdx
lea rdx, [rbp - 0x60]
mov rcx, rsi
call rax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov r14, qword [rcx + 0x10]
mov rax, qword [rdx]
mov qword [rbp - 0x40], rax
mov rax, qword [rdx + 8]
mov qword [rbp - 0x38], rax
mov rax, qword [rdx + 0x10]
mov qword [rbp - 0x30], rax
xor ebx, ebx
mov qword [rdx + 8], rbx
mov qword [rdx + 0x10], rbx
mov rax, qword [rdx + 0x18]
mov qword [rbp - 0x28], rax
movzx eax, word [rdx + 0x20]
mov word [rbp - 0x20], ax
movups xmm0, xmmword [rdx + 0x28]
movups xmmword [rbp - 0x18], xmm0
lea rax, [rbp - 0x40]
mov qword [rbp + 0x30], rax
mov ecx, dword [0x140145f08]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14008af4f
mov rdx, qword [rax + 8]
jmp 0x14008af52
mov rdx, rbx
mov r9d, 8
lea r8d, [r9 + 0x40]
movzx ecx, byte [rbp + 0x20]
call fcn.140088c00
mov rdx, rax
mov rcx, qword [rbp - 0x40]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbx
mov rcx, qword [rbp - 0x38]
mov qword [rax + 0x10], rcx
mov rcx, qword [rbp - 0x30]
mov qword [rax + 0x18], rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
mov rax, qword [rbp - 0x28]
mov qword [rdx + 0x20], rax
movzx eax, word [rbp - 0x20]
mov word [rdx + 0x28], ax
movups xmm0, xmmword [rbp - 0x18]
movups xmmword [rdx + 0x30], xmm0
lea rax, [0x140089a20]
mov qword [rdx], rax
mov qword [rbp + 0x20], rdx
mov rbx, qword [rbp - 0x30]
test rbx, rbx
je 0x14008afec
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14008afec
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14008afec
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WSOCK32.dll_htonl]
nop
lea rdx, [rbp + 0x20]
mov rcx, rsi
call r14
nop
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x14008b008
mov rax, qword [rcx]
xor edx, edx
call rax
nop
jmp 0x14008aedb
lea rcx, [rbp - 0x60]
call fcn.140094b40
nop
lea rcx, [rbp - 0x60]
call fcn.1400911a0
int3
Function at 0x140094210
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1e0
mov rax, qword [0x140140880]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
movzx edi, dl
mov rbx, rcx
mov eax, 1
lock xadd dword [0x140145f18], eax
inc eax
cmp eax, 1
jne 0x14009425f
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WSOCK32.dll_WSAStartup]
xchg dword [0x140145f1c], eax
test dil, dil
je 0x140094272
xor eax, eax
lock xadd dword [0x140145f1c], eax
test eax, eax
jne 0x140094296
mov rax, rbx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.14010aaf0
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1e0
pop rdi
ret
mov dword [rsp + 0x20], eax
call fcn.1400b9fe0
lea rdx, str.winsock
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
call fcn.1400b5080
int3
Function at 0x1400ab420
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140140880]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400ab4f3
cmp byte [rcx + 0x71], 0
je 0x1400ab4f3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400ab4ef
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400ab4b4
sub eax, 1
je 0x1400ab4b8
cmp eax, 2
jne 0x1400ab4ef
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14010aaf0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400ab4e6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400ab4ef
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400ab49c
xor al, al
jmp 0x1400ab49c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14010aaf0
add rsp, 0x60
pop rbx
ret