joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ec2e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x90
mov ebp, r8d
mov rax, qword [0x1403a6f08]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rax, [0x140302d70]
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x48]
mov qword [rsp + 0x80], r9
lea rcx, [rsp + 0x38]
mov r8b, 1
call fcn.1400eb6b0
mov rsi, qword [rsp + 0x40]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rbx, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, 0xfde9
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call rbx
movsxd r14, eax
lea rcx, [r14 + r14]
call fcn.140023770
mov rdi, rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400ec3a1
mov ebx, eax
test eax, 0x400
jne 0x1400ec3a8
shr ebx, 4
and ebx, 1
jmp 0x1400ec415
mov ebx, 5
jmp 0x1400ec415
mov ebx, 2
test bpl, bpl
je 0x1400ec415
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400ec415
mov r14, rax
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x48]
shr eax, 4
and eax, 1
test ebx, ebx
mov ebx, 2
cmovne ebx, eax
mov rcx, rdi
call fcn.14026c948
cmp byte [rsp + 0x38], 0
je 0x1400ec42c
mov rcx, rsi
call fcn.14026c948
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140263800
mov eax, ebx
add rsp, 0x90
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1400ec600
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rax, qword [0x1403a6f08]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rax, [0x140302da0]
mov qword [rsp + 0x40], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x78], r9
lea rcx, [rsp + 0x30]
mov r8b, 1
call fcn.1400eb6b0
mov rdi, qword [rsp + 0x38]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rbx, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, 0xffffffff
call rbx
movsxd r14, eax
lea rcx, [r14 + r14]
call fcn.140023770
mov rsi, rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, 0xffffffff
call rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400ec6c2
mov ecx, eax
and ecx, 0x400
je 0x1400ec6c2
mov rcx, rsi
test al, 0x10
jne 0x1400ec6d1
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400ec6d7
mov ecx, 0x1126
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
jmp 0x1400ec6dd
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne dil
mov rcx, rsi
call fcn.14026c948
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140263800
mov eax, edi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400ec710
Capabilities:
Move file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, r8
mov rax, qword [0x1403a6f08]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea r14, [0x140302da0]
mov qword [rsp + 0x48], r14
lea rdi, [rsp + 0x48]
mov qword [rsp + 0x80], rdi
lea rcx, [rsp + 0x38]
mov r8b, 1
mov r9, rdi
call fcn.1400eb6b0
mov rbx, qword [rsp + 0x40]
mov rdx, rbx
xor r8d, r8d
call fcn.1400ec2e0
test eax, eax
je 0x1400ec782
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x1400ec876
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x80], rdi
lea rcx, [rsp + 0x38]
mov rdx, rsi
mov r8b, 1
mov r9, rdi
call fcn.1400eb6b0
mov rsi, qword [rsp + 0x40]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r14, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, 0xffffffff
call r14
movsxd r15, eax
lea rcx, [r15 + r15]
call fcn.140023770
mov rdi, rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, 0xffffffff
call r14
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call r14
movsxd r15, eax
lea rcx, [r15 + r15]
call fcn.140023770
mov rbx, rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call r14
mov rcx, rdi
mov rdx, rbx
mov r8d, 9
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne sil
mov rcx, rbx
call fcn.14026c948
mov rcx, rdi
call fcn.14026c948
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140263800
mov eax, esi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400ec8a0
Capabilities:
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rbx, r8
mov rdi, rcx
mov rax, qword [0x1403a6f08]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea r13, [0x140302da0]
mov qword [rsp + 0x40], r13
lea r14, [rsp + 0x40]
mov qword [rsp + 0x78], r14
lea rcx, [rsp + 0x30]
mov r8b, 1
mov r9, r14
call fcn.1400eb6b0
mov r15, qword [rsp + 0x38]
mov rdx, r15
xor r8d, r8d
call fcn.1400ec2e0
cmp eax, 2
jne 0x1400eca2c
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r12, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, 0xfde9
xor edx, edx
mov r8, r15
mov r9d, 0xffffffff
call r12
movsxd rbp, eax
lea rcx, [rbp*2]
call fcn.140023770
mov rsi, rax
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, r15
mov r9d, 0xffffffff
call r12
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x78], r14
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8b, 1
mov r9, r14
call fcn.1400eb6b0
mov r14, qword [rsp + 0x38]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call r12
movsxd r15, eax
lea rcx, [r15 + r15]
call fcn.140023770
mov rbx, rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call r12
mov rcx, rdi
mov rdx, r14
call fcn.1400e56e0
cmp eax, 1
jne 0x1400eca02
mov rdx, r14
xor r8d, r8d
call fcn.1400ec2e0
cmp eax, 2
jne 0x1400eca02
mov rdx, r14
call fcn.1400ec600
test al, al
je 0x1400eca5f
mov rcx, rsi
mov rdx, rbx
mov r8d, 9
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
mov rcx, rbx
call fcn.14026c948
mov rcx, rsi
call fcn.14026c948
jmp 0x1400eca39
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140263800
mov eax, edi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor edi, edi
jmp 0x1400eca1a
Function at 0x1400ee270
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1403a6f08]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 0x18
call fcn.140263a80
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rsi
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
lea r8, [0x1400ee310]
xor esi, esi
xor ecx, ecx
mov edx, 0x100000
mov r9, rax
call fcn.140283af0
lea rcx, [rax + 1]
cmp rcx, 1
ja 0x1400ee2e1
call fcn.140277360
mov esi, dword [rax]
jmp 0x1400ee2ea
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140263800
mov eax, esi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400ee990
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rsi, rdx
mov ebx, ecx
mov rax, qword [0x1403a6f08]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
test rax, rax
je 0x1400eea77
mov eax, dword [rsp + 0x44]
cmp eax, ebx
jle 0x1400ee9e6
mov dword [rsp + 0x44], ebx
mov eax, ebx
test eax, eax
jle 0x1400eea6e
xor r12d, r12d
xorps xmm6, xmm6
mov r13, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop dword [rax + rax]
mov rbx, qword [rdi + r12*8]
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, 0xffffffff
call r13
movsxd r14, eax
mov rcx, r14
call fcn.140023770
mov r15, rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, 0xffffffff
call r13
mov qword [rsi + r12*8], r15
inc r12
movsxd rax, dword [rsp + 0x44]
cmp r12, rax
jl 0x1400eea00
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140263800
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14010e250
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov eax, 0x2038
call fcn.140263ae0
sub rsp, rax
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1403a6f08]
xor rax, rsp
mov qword [rsp + 0x2030], rax
cmp qword [0x1403a93c0], 0
jne 0x14010e2a3
mov ecx, 8
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [0x1403a93c0], rax
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x410
xor edx, edx
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x14010e32f
mov rbx, rax
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov rcx, rax
mov r8d, 0x2000
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x14010e310
cmp dword [rsp + 0x2c], 8
jb 0x14010e310
xor r15d, r15d
mov r12, qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
mov rcx, qword [rsp + r15*8 + 0x30]
mov rdx, rdi
call r12
test rax, rax
jne 0x14010e367
inc r15
mov eax, dword [rsp + 0x2c]
shr rax, 3
cmp r15, rax
jb 0x14010e2f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.None_of_the_loaded_modules_contained_the_requested_symbol__s.
xor r14d, r14d
xor ecx, ecx
mov r8, rdi
call fcn.14018ee40
jmp 0x14010e340
lea rdx, str.Failed_to_open_current_process.
xor r14d, r14d
xor ecx, ecx
call fcn.14018ee40
mov qword [rsi], rax
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.140263800
mov rax, r14
add rsp, 0x2038
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14010e343
Function at 0x140131360
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov eax, dword [0x1403ae1f0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rdi, qword [rax + 8]
test rdi, rdi
je 0x1401313bb
mov rcx, qword [rdi + 0x698]
lea rsi, [0x1403a96c8]
test rcx, rcx
je 0x140131415
mov rdx, qword [0x1403a96b8]
test rdx, rdx
je 0x1401313e6
mov rax, qword [rcx + 0x380]
mov rcx, qword [rax + 8]
call fcn.1402676f0
test rax, rax
jne 0x14013140d
jmp 0x140131415
mov ecx, dword [0x1403a4e50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1401313df
cmp byte [rax + 8], 0
jne 0x140131411
mov rcx, rax
call fcn.140048300
test rax, rax
jne 0x140131411
call fcn.14018e130
jmp 0x140131411
mov rax, qword [0x1403a9430]
test rax, rax
je 0x1401313fd
mov rax, qword [rax + 0x50]
cmp rax, rcx
jne 0x140131404
jmp 0x14013140d
xor eax, eax
cmp rax, rcx
je 0x14013140d
call fcn.14012ae30
test al, al
jne 0x140131415
mov rax, qword [rdi + 0x10]
mov rsi, qword [rax + 0x50]
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140147490
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rcx + 7]
mov rax, rdx
sar rax, 1
mov r8, qword [rcx - 1]
and r8d, 0xfffff000
cmp r8d, 0x5d000
je 0x1401474c2
mov r8, qword [rcx - 1]
and r8d, 0xfffff000
cmp r8d, 0x5f000
jne 0x140147528
mov r8, qword [rcx - 1]
and r8d, 0xfffff000
cmp r8d, 0x5d000
jne 0x1401474dc
add rcx, 0xf
jmp 0x1401474e0
mov rcx, qword [rcx + 0xf]
xor r8d, r8d
cmp rdx, 2
jl 0x14014758b
inc rax
xor edx, edx
nop word cs:[rax + rax]
movzx r8d, byte [rcx]
add r8d, edx
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov edx, r9d
shr edx, 6
xor edx, r9d
inc rcx
dec rax
cmp rax, 1
ja 0x140147500
jmp 0x140147587
mov r8, qword [rcx - 1]
and r8d, 0xfffff000
cmp r8d, 0x5e000
jne 0x140147542
add rcx, 0xf
jmp 0x140147546
mov rcx, qword [rcx + 0xf]
xor r8d, r8d
cmp rdx, 2
jl 0x14014758b
inc rax
xor edx, edx
nop word cs:[rax + rax]
movzx r8d, word [rcx]
add r8d, edx
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov edx, r9d
shr edx, 6
xor edx, r9d
add rcx, 2
dec rax
cmp rax, 1
ja 0x140147560
lea r8d, [rdx + rdx*8]
mov ecx, r8d
shr ecx, 0xb
xor ecx, r8d
mov eax, ecx
shl eax, 0xf
add eax, ecx
and eax, 0x3fffffff
cmp eax, 1
adc eax, 0
ret
Function at 0x140156cf0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rbx, r9
mov r15, r8
mov qword [rsp + 0x30], rdx
mov rdi, rcx
mov rax, qword [0x1403a6f08]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [0x1403ae1f0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
mov rsi, qword [rax + 0x18]
mov rcx, rsi
call fcn.1400f7d20
mov r12, rax
mov rcx, rsi
call fcn.1400f7d20
mov r13, rax
mov rax, qword [rdi + 8]
add rdi, 8
cmp rax, qword [0x1403a4cf0]
je 0x140156ea8
mov rbp, qword [rax + 0xf]
cmp rbp, 2
jl 0x140156ea8
mov qword [rsp + 0x48], rsi
sar rbp, 1
xor esi, esi
xor r14d, r14d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], rbx
jmp 0x140156dbd
test rsi, rsi
je 0x140156ea1
mov rcx, qword [rsi + 8]
mov r8, qword [r13 + 8]
lea rdx, [rcx + r14*8]
add rdx, 0x27
dec rcx
call fcn.1400ef8d0
inc r14
cmp r14, rbp
je 0x140156eaa
mov rax, qword [rdi]
mov rdx, qword [rax + r14*8 + 0x27]
mov rcx, r12
call fcn.1400f7d40
mov rax, qword [r12]
mov rcx, qword [rsp + 0xd8]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rsp + 0xd0]
mov dword [rsp + 0x20], ecx
mov rcx, r12
lea rdx, [rsp + 0x58]
mov r8, r15
mov r9, rbx
call qword [rax + 0x358]
mov rdx, qword [rsp + 0x58]
mov rcx, r13
call fcn.1400f7d40
mov rax, qword [r12 + 8]
cmp rax, qword [r13 + 8]
je 0x140156d90
test rsi, rsi
jne 0x140156d90
lea rcx, [rsp + 0x50]
mov rdx, rbp
mov r8d, dword [rsp + 0xd0]
call fcn.14014cf50
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call fcn.1400eef80
mov rsi, rax
test r14, r14
je 0x140156d99
xor ebx, ebx
mov r15, r14
nop word [rax + rax]
mov rax, qword [rdi]
mov rdx, qword [rax + rbx + 0x27]
mov rcx, r12
call fcn.1400f7d40
mov rcx, qword [rsi + 8]
mov r8, qword [r12 + 8]
lea rdx, [rcx + rbx]
add rdx, 0x27
dec rcx
call fcn.1400ef8d0
add rbx, 8
dec r15
jne 0x140156e60
mov rbx, qword [rsp + 0x38]
mov r15, qword [rsp + 0x40]
jmp 0x140156d99
xor esi, esi
jmp 0x140156db1
xor esi, esi
lea rax, [rsi + 8]
test rsi, rsi
cmove rax, rdi
mov rax, qword [rax]
mov rsi, qword [rsp + 0x30]
mov qword [rsi], rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140263800
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140162960
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1403a6f08]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [0x1403ae1f0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
mov rcx, qword [rax + 0x698]
mov rcx, qword [rcx + 0x20]
mov rdx, qword [rcx + 0x4d8]
mov rcx, qword [rax + 0x18]
call fcn.140162c40
mov qword [rsp + 0x20], rbx
mov rcx, qword [rbx + 8]
test byte [rcx + 7], 2
cmove rax, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
pcmpeqd xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0xffffffffffffffff
lea rcx, [rsp + 0x20]
call fcn.140162b10
test al, al
je 0x140162aec
lea rbx, str.0x_.8x:
lea r14, [rsp + 0x20]
lea r15, [0x1402e21f9]
lea r12, [0x14030527e]
nop dword [rax]
mov r8d, dword [rsp + 0x38]
mov rcx, rdi
mov rdx, rbx
call fcn.140023fd0
mov r13, qword [rsp + 0x48]
test r13, r13
js 0x140162a60
add r13, qword [rsp + 0x50]
jg 0x140162a74
jmp 0x140162ad0
mov rcx, r14
call fcn.14017f230
mov r13, qword [rsp + 0x48]
add r13, qword [rsp + 0x50]
jle 0x140162ad0
xor ebp, ebp
jmp 0x140162a90
mov rcx, rdi
call fcn.140024140
inc rbp
cmp r13, rbp
je 0x140162ad0
cmp qword [rsp + 0x48], 0
jns 0x140162aa0
mov rcx, r14
call fcn.14017f230
mov rax, rbp
shr rax, 3
add rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
movzx eax, byte [rcx + rax + 0xb]
mov ecx, ebp
and ecx, 7
bt eax, ecx
mov rdx, r15
jae 0x140162a80
mov rdx, r12
jmp 0x140162a80
mov rcx, r14
call fcn.140162b10
test al, al
je 0x140162aec
mov rcx, rdi
mov rdx, rsi
call fcn.140024140
jmp 0x140162a30
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140263800
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140164690
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, r8
mov r8, rdx
mov rsi, rcx
mov rbx, qword [rsp + 0xd8]
mov ecx, dword [rsp + 0xe0]
mov rdx, qword [0x1403a6f08]
xor rdx, rsp
mov qword [rsp + 0x60], rdx
mov edx, dword [0x1403ae1f0]
mov r10, qword gs:[0x58]
mov rdx, qword [r10 + rdx*8]
mov rdx, qword [rdx + 8]
mov r15, qword [rdx + 0x18]
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], r9
lea rcx, [rsp + 0x58]
mov rdx, r15
mov r9, rax
call fcn.140164470
mov rdx, qword [rsp + 0x58]
mov rcx, r15
call fcn.1401645b0
mov rdi, rax
lea rax, [rbx + 2]
mov qword [rsp + 0x48], rax
lea r8, [rbx*2 + 4]
lea rcx, [rsp + 0x50]
mov edx, 0x59
mov r9d, 1
call fcn.140174530
mov rdx, qword [rsp + 0x50]
mov rcx, r15
call fcn.1400f2300
mov r14, rax
mov rcx, r15
call fcn.1400f8ba0
test rbx, rbx
jle 0x14016479c
mov r15, rax
mov rbp, qword [rsp + 0xe8]
xor r13d, r13d
mov r12, rbx
nop word [rax + rax]
mov rax, qword [rbp + 0x10]
mov r8, qword [rax + r13]
add r8, r8
mov qword [r15 + 8], r8
mov rcx, qword [r14 + 8]
lea rdx, [rcx + r13]
add rdx, 0x17
dec rcx
call fcn.1400ef8d0
add r13, 8
dec r12
jne 0x140164770
mov r15, qword [rsp + 0xf0]
mov rax, qword [r15 + 8]
mov rcx, qword [rax + 0x3f]
call fcn.14011ebf0
mov rcx, qword [r14 + 8]
mov r8, qword [rax + 8]
lea rdx, [rcx + rbx*8]
add rdx, 0x1f
dec rcx
call fcn.1400ef8d0
mov rcx, qword [r14 + 8]
mov r8, qword [r15 + 8]
lea rdx, [rcx + rbx*8]
add rdx, 0x17
dec rcx
call fcn.1400ef8d0
mov rcx, r14
mov rdx, qword [rsp + 0x48]
mov r8, rdi
call fcn.140163720
mov rdx, qword [rdi + 8]
lea rcx, [rdx - 1]
mov r8, qword [r14 + 8]
add rdx, 0x17
call fcn.14017cde0
mov rax, qword [rdi + 8]
mov qword [rsi], rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140263800
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14016f680
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1403a6f08]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [0x1403ae1f0]
mov rcx, qword gs:[0x58]
mov r14, qword [rcx + rax*8]
mov rdi, qword [r14 + 8]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 8
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
mov edx, 0x3c
mov r8d, reloc.WS2_32.dll_recv
mov r9d, 1
call fcn.14014b0f0
mov rcx, qword [rsp + 0x40]
call fcn.140170260
mov rcx, qword [rax + 8]
mov qword [rcx + 7], rbx
mov rdx, qword [rax + 8]
mov rcx, qword [rdi + 0x18]
call fcn.140170290
mov rbx, rax
mov r8d, 0x430
add r8, qword [rdi + 0x698]
mov rdx, qword [r14 + 8]
lea r14, [rsp + 0x40]
mov rcx, r14
call fcn.140130c50
mov rax, qword [rbx]
lea rdx, [rsp + 0x38]
mov rcx, rbx
mov r8, rdi
call qword [rax + 0x2d8]
lea rax, [0x140303150]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x58]
call fcn.14009c470
mov rcx, r14
call fcn.14010f9b0
mov rax, qword [rsp + 0x38]
mov qword [rbx + 8], rax
mov qword [rsi], rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140263800
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140170510
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
movaps xmm6, xmm1
mov rsi, rcx
mov rax, qword [0x1403a6f08]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov eax, dword [0x1403ae1f0]
mov rcx, qword gs:[0x58]
mov r14, qword [rcx + rax*8]
mov rdi, qword [r14 + 8]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 8
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0x48]
mov edx, 0x3d
mov r8d, reloc.WS2_32.dll_recv
mov r9d, 1
call fcn.14014b0f0
mov rcx, qword [rsp + 0x48]
call fcn.1401704e0
mov rcx, qword [rax + 8]
movsd qword [rcx + 7], xmm6
mov rdx, qword [rax + 8]
mov rcx, qword [rdi + 0x18]
call fcn.140170630
mov rbx, rax
mov r8d, 0x430
add r8, qword [rdi + 0x698]
mov rdx, qword [r14 + 8]
lea r14, [rsp + 0x48]
mov rcx, r14
call fcn.140130c50
mov rax, qword [rbx]
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov r8, rdi
call qword [rax + 0x2d8]
lea rax, [0x140303150]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x60]
call fcn.14009c470
mov rcx, r14
call fcn.14010f9b0
mov rax, qword [rsp + 0x40]
mov qword [rbx + 8], rax
mov qword [rsi], rax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140263800
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140170bc0
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
jle 0x140170bd8
mov eax, edx
and eax, 3
cmp rdx, 4
jae 0x140170bdf
xor r8d, r8d
jmp 0x140170c69
xor eax, eax
jmp 0x140170c98
and rdx, 0xfffffffffffffffc
xor r8d, r8d
nop word cs:[rax + rax]
movzx r9d, byte [rcx]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, byte [rcx + 1]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
movzx r9d, byte [rcx + 2]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, byte [rcx + 3]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
add rcx, 4
add rdx, 0xfffffffffffffffc
jne 0x140170bf0
test rax, rax
je 0x140170c94
xor edx, edx
movzx r9d, byte [rcx + rdx]
add r9d, r8d
mov r10d, r9d
shl r10d, 0xa
add r10d, r9d
mov r8d, r10d
shr r8d, 6
xor r8d, r10d
inc rdx
cmp rax, rdx
jne 0x140170c70
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
and eax, 0x3fffffff
cmp eax, 1
adc eax, 0
ret

Function at 0x140170cc0
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
jle 0x140170cd8
mov eax, edx
and eax, 3
cmp rdx, 4
jae 0x140170cdf
xor r8d, r8d
jmp 0x140170d69
xor eax, eax
jmp 0x140170d98
and rdx, 0xfffffffffffffffc
xor r8d, r8d
nop word cs:[rax + rax]
movzx r9d, word [rcx]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, word [rcx + 2]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
movzx r9d, word [rcx + 4]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, word [rcx + 6]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
add rcx, 8
add rdx, 0xfffffffffffffffc
jne 0x140170cf0
test rax, rax
je 0x140170d94
xor edx, edx
movzx r9d, word [rcx + rdx*2]
add r9d, r8d
mov r10d, r9d
shl r10d, 0xa
add r10d, r9d
mov r8d, r10d
shr r8d, 6
xor r8d, r10d
inc rdx
cmp rax, rdx
jne 0x140170d70
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
and eax, 0x3fffffff
cmp eax, 1
adc eax, 0
ret