joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010160
Capabilities:
Encode data using xor
Execute command
Terminate process

Disassembly:
sub rsp, 0x28
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Incorect___n_Closing...
call fcn.1400154b0
lea rdx, [0x140015680]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x30]
call fcn.1400102a0
mov r9, rax
cmp byte [rax + 3], 0
je 0x14001027d
xor ecx, ecx
cmp dword [0x140538250], 2
jl 0x140010248
movdqa xmm3, xmmword [0x1403a6090]
mov eax, 4
movdqa xmm2, xmm3
movdqa xmm0, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1403a6120]
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1403a6120]
shufps xmm2, xmm0, 0xdd
movd xmm0, eax
mov eax, 0x1f
psrad xmm2, xmm0
movdqa xmm1, xmm2
movd xmm0, eax
psrld xmm1, xmm0
paddd xmm1, xmm2
pmulld xmm1, xmmword [0x1403a60d0]
psubd xmm3, xmm1
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [r9]
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1403a60f0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.77777777777777778888888888888888]
pxor xmm2, xmm0
movd dword [r9], xmm2
jmp 0x14001027d
mov r8, r9
nop dword [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x37
xor byte [r8 - 1], al
cmp ecx, 4
jl 0x140010250
mov rcx, r9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140016be0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140016c41
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140016c00
mov ecx, dword [r10]
jmp 0x140016d2a
cmp ecx, 0x4e0
jb 0x140016d2a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140016c60
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140016cb0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140018380
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x140538240]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor ebx, ebx
lea rdx, [0x140550400]
mov ecx, ebx
mov rax, rdx
nop dword [rax]
cmp dword [rax], ebx
je 0x1400183fa
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x1400183b0
xor eax, eax
mov qword [rsp + 0x170], rdi
lea rdi, [rsp + 0x20]
mov ecx, 0x130
rep stosb byte [rdi], al
lea ecx, [rax + 2]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140018442
lea rcx, [0x1403a6018]
call fcn.14001bfa0
jmp 0x1400184d1
movsxd rax, ecx
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], bl
je 0x1400183bf
mov ecx, ebx
mov rax, rdx
nop
cmp dword [rax], ebx
je 0x140018426
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140018410
call rbx
jmp 0x1400184db
movsxd rax, ecx
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], bl
je 0x14001843b
mov rbx, qword [rdx + rcx*8 + 0x28]
call rbx
jmp 0x1400184db
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x14001846a
lea rcx, [0x1403a6038]
call fcn.14001bfa0
jmp 0x1400184c8
lea rdx, str.csrss.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rdi
test eax, eax
jne 0x14001848f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x28]
jmp 0x1400184d1
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1400184c8
nop
lea rdx, str.csrss.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rdi
test eax, eax
je 0x140018483
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400184a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x170]
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14015af10
add rsp, 0x160
pop rbx
ret
Function at 0x14001bd70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
call rcx
cmp eax, 1
jne 0x14001bf97
cmp byte [0x1403a6013], 0
movups xmm0, xmmword [0x1403a6000]
mov eax, dword [0x1403a6010]
mov dword [rsp + 0x40], eax
movups xmmword [rsp + 0x30], xmm0
je 0x14001bf76
xor r8d, r8d
cmp dword [0x140538250], 2
jl 0x14001bf31
movdqa xmm0, xmmword [0x1403a6110]
lea rcx, [rsp + 0x34]
movdqa xmm5, xmmword [0x1403a6090]
mov eax, 5
movdqa xmm4, xmmword [0x1403a6150]
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm7
movdqa xmm7, xmmword [0x1403a60e0]
movd xmm6, eax
mov eax, 0x1f
movdqa xmmword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm8
movd xmm8, eax
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
pand xmm2, xmmword [0x1403a60f0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
pxor xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1403a60f0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
pxor xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x10
jl 0x14001be10
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x70]
cmp r8d, 0x14
jge 0x14001bf76
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
nop dword [rax]
mov eax, 0x92492493
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul edx, eax, 0x38
add dl, r8b
inc r8d
xor byte [r9 - 1], dl
cmp r8d, 0x14
jl 0x14001bf40
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x30]
call fcn.1400154b0
lea rdx, [0x140015680]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rsp, 0x88
ret
Function at 0x14001c0d4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14001c158
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14015e740]
cmp byte [rcx + rax], 0
je 0x14001c158
dec r8
sub rdx, 1
jne 0x14001c13e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140069f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x48
movsx eax, byte [rsp + 0x58]
and eax, 1
mov dword [rsp + 0x34], eax
movsx eax, byte [rsp + 0x60]
mov ecx, eax
call fcn.1400699a0
mov dword [rsp + 0x30], eax
movzx eax, byte [rsp + 0x58]
and eax, 0xf
mov byte [rsp + 0x20], al
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x24], eax
jmp 0x140069fa0
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 3
ja 0x14006a023
movsx eax, byte [rsp + 0x60]
mov ecx, dword [rsp + 0x24]
sar eax, cl
and eax, 1
cmp eax, dword [rsp + 0x34]
jne 0x140069fc5
mov dword [rsp + 0x28], 1
jmp 0x140069fcd
mov dword [rsp + 0x28], 0
cmp dword [rsp + 0x28], 0
jne 0x140069fde
mov dword [rsp + 0x2c], 0
jmp 0x140069fe6
mov dword [rsp + 0x2c], 1
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
test eax, eax
je 0x14006a009
movzx edx, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
call fcn.140069de0
jmp 0x14006a01e
movzx eax, byte [rsp + 0x20]
xor eax, 1
movzx edx, al
mov rcx, qword [rsp + 0x50]
call fcn.140069de0
jmp 0x140069f96
movzx edx, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
call fcn.140069de0
add rsp, 0x48
ret
Function at 0x14015bb90
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14015bbda
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14015bbda
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14015bbda
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14015bbda
cmp dword [rcx + 0x84], 0xe
jbe 0x14015bbda
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14015bbdc
xor al, al
add rsp, 0x28
ret
Function at 0x1400021dc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140004650], rbx
je 0x140002228
cmp rax, rbx
jne 0x14000221b
mov ebx, 1
mov esi, ebx
jmp 0x14000222d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002200
mov ebx, 1
mov eax, dword [0x140004658]
cmp eax, ebx
jne 0x140002243
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x1400022a8
mov eax, dword [0x140004658]
test eax, eax
jne 0x1400022a2
mov dword [0x140004658], ebx
lea r15, [0x1400033b0]
lea rdi, [0x140003398]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140002294
test eax, eax
jne 0x140002298
cmp qword [rdi], 0
je 0x140002289
mov rax, qword [rdi]
mov rcx, qword [0x140003378]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000226a
test eax, eax
je 0x1400022a8
mov eax, 0xff
jmp 0x140002384
mov dword [0x140004064], ebx
mov eax, dword [0x140004658]
cmp eax, ebx
jne 0x1400022cf
lea rdx, [0x140003390]
lea rcx, [0x140003380]
call sub.msvcrt.dll__initterm
mov dword [0x140004658], 2
test esi, esi
jne 0x1400022dc
xor eax, eax
xchg qword [0x140004650], rax
cmp qword [0x140004660], 0
je 0x140002310
lea rcx, [0x140004660]
call fcn.140002540
test eax, eax
je 0x140002310
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140004660]
mov r9, qword [0x140003378]
call r9
mov r8, qword [0x140004078]
mov rdx, qword [0x140004070]
mov ecx, dword [0x140004068]
call fcn.140001800
mov dword [0x140004060], eax
cmp dword [0x140004080], 0
jne 0x140002340
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140004064], 0
jne 0x140002355
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140004060]
jmp 0x140002384
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140140000
add rsp, 0x28
jmp 0x1400021dc

Function at 0x140002450
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000249c
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140002494
cmp dword [rcx + 0x3c], edx
jl 0x140002494
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140002494
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000249c
mov rax, rdx
add rsp, 0x18
ret
Function at 0x1cb5d58
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1cb5d62
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1cb5d8b
pop rbp
sub rbp, 0x33
sub rbp, 0x18b5d58
sub rsp, 0x20
jmp 0x1cb5daa
mov rax, 0x18b5d58
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x6b41c6f8
xor byte [rax], dl
inc rax
dec rcx
jne 0x1cb5dc9
jmp 0x1cb5de0
mov al, 0x71
adc dword [rbx + 0x71], esi
invalid
Function at 0x401000
Capabilities:
Packed with generic packer

Disassembly:
push rax
nop word cs:[rax + rax]
adc al, 0x1f
add byte [rax - 0x7d], cl
invalid
invalid
jno 0x400fa6
add qword [0x0070801f], rax
xor dword [rax], edi
js 0x40101f
add dword [rax], eax
add byte [rax], al
mov rax, qword [0x00f08110]
mov dword [rax], 1
mov rdx, qword [rcx + rbp*8 + 0x70]
xor byte [rdx - 0x39], dh
add byte [rcx], al
push rbp
add byte [rax], al
invalid

Function at 0x401010
Capabilities:
Packed with generic packer

Disassembly:
push rax
nop word cs:[rax + rax]
adc al, 0x1f
add byte [rax - 0x7d], cl
invalid
invalid
jno 0x400fa6
add qword [0x0070801f], rax
xor dword [rax], edi
js 0x40101f
add dword [rax], eax
add byte [rax], al
mov rax, qword [0x00f08110]
mov dword [rax], 1
mov rdx, qword [rcx + rbp*8 + 0x70]
xor byte [rdx - 0x39], dh
add byte [rcx], al
push rbp
add byte [rax], al
invalid

Function at 0x4391ee
Capabilities:
Encode data using xor

Disassembly:
sti
push rbp
push r15
mov byte [r9 + 0x18], al
push r12
push rdi
push rsi
push rbx
jno 0x4391e9
invalid

Function at 0x43e1ce
Capabilities:
Read file on windows

Disassembly:
push r12
xchg dword [rbx + 0x3d4920ec], eax
lahf
leave
je 0x43e1f3
mov bl, 0x8b
or dword [rsi], edx
adc eax, 0x459b3b
mov rcx, r12
add rsp, 0xffffffffffffffbc
pop r12
jmp sym.free
add rsp, 0x20
insb byte [rdi], dx
iretd

Function at 0x43f6f9
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x6c0000f8
out 0xc9, al
mov bl, 0xb8
rol byte [rax], 1
add cl, cl
mov edx, 0x510001
mov ecx, 0x594f0001
call 0xffffffffd843e83f
mov rbp, qword [rdx - 0x40]
mov fs, word [rbx - 0xfb14700]
add byte [rax], al
call rbx
jnp 0x43f6fd
adc eax, 0x25f896a
mov ecx, 0xc7ab4f
mov word [rdx], ax
call rbx
mov edi, 0xd849988b

Function at 0x453b20
Capabilities:
Read file on windows

Disassembly:
push rbx
mov dh, 0xc8
in al, dx
and byte [rax - 0x5f], cl
leave
je 0x453b60
cmp byte [rcx + 0x1008], 0
invalid
invalid

Function at 0x453e90
Capabilities:
Encode data using xor

Disassembly:
mov dword [rcx - 0xa], eax
xor byte [rsi + 0x4d], ah
minpd xmm0, xmmword cs:[rax + rax]
test qword [rdx - 0x5e], rbx
and ecx, dword [rax - 0x7b]
fcom dword [rsi + rbx]
and rax, 0x1894802
mov rax, qword [rdx + 8]
mov rdi, rsi
or byte [rax - 0x75], cl
adc byte [rax - 0x77], cl
adc byte [r15 + 0x4889428b], al
mov dword [rbx], ebx
jae 0x453e7d
nop word [rax + rax]

Function at 0x454e30
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
add rcx, rcx
jmp rax

Function at 0x454e50
Capabilities:
Set socket configuration

Disassembly:
jp 0x454e58
jno 0x454e8e
add dil, r9b
invalid
outsd dx, dword [rsi]
add byte [rax], al
shl byte [rbx - 0x37], 1
lea r8, [rsp + 0x2c]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [rsp + 0x2c]
or qword [rdx], 0x38
ret

Function at 0x454e80
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov edx, 0x4064667f
mov dword [rsp + 0x2c], 0x6f00
Function at 0x45fe70
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x41563657
push rbp
push r12
push rbp
mov ecx, 0x8348534c
in al, dx
push 0x483c5139
mov eax, dword [rcx + 0x20]
scasd eax, dword [rdi]
xchg byte [rbx + 0x48000001], ah
invalid

Function at 0x46bf50
Capabilities:
Encode data using xor

Disassembly:
xor bh, bl
add byte [rax], al
jg 0x46bf4c
add dl, byte [rdi + 0x42]
movzx edx, dl
cmp dword [rcx + 0xd704cc], edx
je 0x46bf94
adc edx, ecx
fcomp dword [rbp]
add byte [rcx + 0x4dcc75], cl
add byte [rdi], bl
sal byte [rcx + rsi + 0x31], 0xd2
mov eax, edx
and dl, al
xor eax, 0x60c49748
cdq
invalid
xor eax, eax
ret

Function at 0x47bd20
Capabilities:
Encode data using xor

Disassembly:
push rbx
pslld mm3, qword [rcx + 4]
movzx eax, word [rcx + 2]
xor r9d, r9d
mov r10, rdx
cmp bx, ax
mov edi, dword [0x2920249e]
mov si, 0x4419
movzx ebx, ax
sub ebx, eax
jmp 0x47bd6b
cmp r9w, bx
jb 0x47bda9
mov eax, r9d
pop rbx
invalid
cmp cl, byte [rdi]
mov bh, 0xf5
lea eax, [r9 + r8]
cdq
xor al, 0xf7
sti
movsxd rdi, dword [rdx + 0x8518b48]
mov rax, qword [rsi + rsi*4]
mov qword [r10 + r8*8], rax
add al, 0xc2
in eax, 0xc0
add dword [rsi + 0x44], esp
cmp ebx, eax
ja 0x47bd90
pop r14
fldpi
mov bh, 0x57
nop
nop
nop
nop
nop

Function at 0x47d8d0
Capabilities:
Encode data using xor

Disassembly:
movsd dword [rdi], dword [rsi]
push rdi
push rsi
push rbx
pop rsi
in al, dx
in al, 0x39
adc ch, byte [rax + 0x48]
mov edi, dword [rcx + 0x60]
jbe 0x47da90
sub rax, 0xffffffffa2840fa0
add dword [rax], eax
add byte [rax + 0x63], cl
fimul dword [rax - 0x77]
fmul dword [rax - 0x3f]
jrcxz 0x47d8ff
rcr qword [rbx + 6], 0x48
sub ebx, eax
add rdi, rbx
cmp byte [rdi], 0
je 0x47db90
mov r10d, dword [rcx + 0x61]
add al, byte [rbp - 0x777bf02e]
add byte [rax], al
add byte [rbx + rcx*4 - 0x76bbaf8f], ah
invalid
sbb eax, 0x264501c1
rcr dword [rdi], 1
nop
cmp byte [rdi + 0x20], 0
je 0x47d9ae
sub word [rcx + 0xca], 0xffe9
mov rsi, rcx
pop rbp
mov ebx, eax
or byte [rcx + 0x6124614c], cl
invalid
popfq
ret 0xd285
mov eax, 0xffffffe3
and byte [rbx + 0x5ebc28c4], al
call [rbp + 0x49]
push 0x4bd90
add byte [rax], al
js 0x47da34
insb byte [rdi], dx
insd dword [rdi], dx
add byte [rax - 0x7552d373], ah
add byte [rbx - 0x17feb800], bl
mov dword [rax + 4], 0x5100e6
mov dword [rax + 8], 0
mov dword [rax + 0xc], 0xbd000000
jmp 0x47d997
and al, 0xd
jmp 0x47dba9
add rbx, 0xffffffffffffffc0
movabs rdx, 0x8002d67b806777eb
add ecx, dword [rbx - 0x138af7ad]
cmp byte [rbx - 0x2a], 2
add byte [rbx], 0x8b
push rbx
or byte [rbp - 0x14], dh
test dword [rdx + 0x74], edi
xor al, 0x83
call 0x62831cbf
wait
mov rcx, qword [r15 + 0x60]
jae 0x47dba0
test rcx, rcx
je 0x47dba0
cdqe
mov qword [r15 + 0x7e07348], rdi
shl qword [r11 - 0x3fd6b3fc], 0x48
add dword [rdi - 0x341e01d8], ecx
add qword [rdi - 0x341e01d8], rcx
mov esi, 0x19ad8b48
mov r9d, dword [rsp + 0x2c]
movzx edx, dl
mov ah, 0x89
loopne 0x47dbda
mov edx, 0x854000ae
sal byte [rbp + 0x27], 0x48
add ebx, 0x27
mov r14d, 1
fsub st(3), st(0)
jne 0x47dba9
nop dword [rax]
invalid
Function at 0x481160
Capabilities:
Encode data using xor

Disassembly:
push rbp
movsd dword [rdi], dword [rsi]
push r14
sbb eax, 0x57044155
push rsi
push rbx
sub rsp, 0x830
in al, dx
xor byte [rax], cl
add byte [rax], al
lea rbp, [rsp - 0x1dfff465]
mov edi, r8d
test eax, 0x2e28df69
add bl, ch
lea r13, [rcx + rbx + 0x711250]
lea r11, [rbp + 0x2e4a60db]
add byte [rcx + 0x2a], al
jge 0x48116e
add ah, byte [rsi + 0x1101c]
add bl, al
lea eax, [rbp + 0x20]
mov qword [rbp - 0x38], rdx
scasb al, byte [rdi]
mov ebp, 0x2e288419
add bh, al
mov ebp, 0x8003824
add byte [rax], al
lea rdx, [rcx + rcx*8 + 0x2ea9d4]
lea r8, [rcx + rbx + 0x462e28b4]
mov qword [rdx - 0x3076b648], rbx
iretq

Function at 0x484d90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
in al, dx
and byte [rax - 0x7b], cl
cli
fiadd dword [rdx + rdx*4 + 0x48000000]
mov ebx, ecx
insd dword [rdi], dx
mov ecx, dword [rcx + 0x10]
and al, 0x31
leave
xor r8d, r8d
mov edx, 0xcb0080
call 0xffffffffaa41385b
mov rcx, qword [rbx + 0x10]
xor dword [r9], r12d
xor dword [r9 - 0x46], r9d
ja 0x484df0
add byte [rax], al
call fcn.00450bc0
lodsd eax, dword [rsi]
mov ecx, dword [rbx + 0x10]
xor dword [r11 - 0x454acebb], r9d
invalid
dec dword [rax - 0x75]
adc byte [r13 + 0x31], al
jg 0x484e3e
xor eax, eax
mov edx, 0x8d
call 0xffffffffffaf37bd
retf 0x4b8b
nop
invalid

Function at 0x4f4280
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rdx
mov r10, qword [rbx + rsi*2 + 0x40]
mov r11d, 0x5a
xor ebx, ebx
movsxd rax, dword [rax + 0x72c9634d]
rol byte [rcx - 0x39], cl
add al, byte [rax]
add byte [rax], al
add byte [rax + 0x38b60541], dl
movzx esi, byte [rcx]
invalid

Function at 0x5022b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
lea rax, [rsp + 0x6c]
movsxd rdx, edx
invalid

Function at 0x5045b0
Capabilities:
Encode data using xor

Disassembly:
xchg r8d, eax
push rbp
push rdi
push rsi
push rbx
mov al, 0x83
in al, dx
xchg r12, rax
invalid

Function at 0x54a8c0
Capabilities:
Encode data using xor

Disassembly:
sal ecx, 0x1f
test byte [rax], al
add byte [rax], al
add byte [rax], al
mov qword [rcx], r8
or al, 0x89
or byte [r8 + 1], cl
and al, 0x83
call 0xffffffffc4461dc1
or al, al
xor r13d, r10d
sahf
sbb al, 0x8d
jg 0x54a8a7
mov dh, 0x1c
add dword [rbx + 0x45016f2c], esi
invalid

Function at 0x580450
Capabilities:
Encode data using xor

Disassembly:
cmovl esp, dword [rsp - 0xc49f780]
sub esi, dword [rax + rbp + 0x89066ac]
add byte [rcx + 0x5c48148], bl
or byte [rax], al
add byte [rbx - 0x47], bl
ficomp word [rbp + 0x2b]
pop rsp
pop r13
mov r10b, 0xc3
lea ax, [rbp + 0x66]
nop dword cs:[rsi]
add byte [rax], al
add byte [rax], al
movsx eax, word [rcx]
pxor xmm6, xmm2
movsxd r8, r8d
js 0x58041c
push r12
add byte [rax + 5], bl
add byte [rdi], bh
and eax, 0x690ef8c1
rol byte [rcx + 0x2d], 0
add byte [0xffffffffa3582473], al
sar eax, 0x48
in eax, dx
push rdi
and cl, al
clc
invalid

Function at 0x5804e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
pop rdx
sub dword [rsp], esi
out dx, eax
sub ebx, ecx
and al, 0x10
xor cl, byte [rdi]
sub dword [rcx], ebp
and al, 0x83
invalid