joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140170300
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
xor r15d, r15d
mov dword [r11 - 0x58], r15d
mov dword [r11 + 0x20], r15d
lea rax, [r11 + 0x20]
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x68], r15
lea r9, [r11 - 0x58]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401704b3
cmp dword [rsp + 0x30], 7
jne 0x1401704b3
mov eax, dword [rsp + 0xa8]
test eax, eax
je 0x1401704a5
mov edx, eax
shr rdx, 1
lea r8, [rsp + 0x90]
lea rcx, [rsp + 0x48]
call fcn.140170030
nop
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
mov r14, qword [rsp + 0x48]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401704a9
mov rax, r14
mov qword [rsp + 0x38], rax
mov rsi, qword [rsp + 0x50]
lea rdi, [rsi - 2]
cmp r14, rdi
jae 0x140170460
mov rbx, rax
cmp rax, rsi
je 0x1401703ef
nop dword [rax]
cmp word [rbx], 0
je 0x1401703ef
add rbx, 2
cmp rbx, rsi
jne 0x1401703e0
mov qword [rsp + 0x90], rbx
mov rcx, qword [rbp + 8]
cmp qword [rbp + 0x10], rcx
je 0x14017042e
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 7
mov word [rcx], r15w
cmp rax, rbx
je 0x140170427
mov r8, rbx
sub r8, rax
sar r8, 1
mov rdx, rax
call fcn.140086f50
add qword [rbp + 8], 0x20
jmp 0x14017044e
lea r9, [rsp + 0x90]
lea r8, [rsp + 0x38]
mov rdx, rcx
mov rcx, rbp
call fcn.14016fed0
mov rbx, qword [rsp + 0x90]
lea rax, [rbx + 2]
mov qword [rsp + 0x38], rax
cmp rax, rdi
jb 0x1401703d1
test r14, r14
je 0x1401704a5
mov rax, qword [rsp + 0x58]
sub rax, r14
sar rax, 1
lea rdx, [rax + rax]
mov rax, r14
cmp rdx, 0x1000
jb 0x14017049c
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017049c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.140082ab0
nop
mov al, 1
jmp 0x1401704b5
lea rcx, [rsp + 0x48]
call fcn.1400b7bb0
xor al, al
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140170510
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov r10, rdx
mov rbx, rcx
mov rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], 0
jne 0x140170523
lea ecx, [rax + rax]
test eax, eax
mov edx, 2
mov r9d, 1
cmovne edx, ecx
mov rcx, qword [rbx]
mov dword [rsp + 0x28], edx
mov rdx, r10
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14017056e
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x140170580
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x28], 4
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1401705c6
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x1401705d0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x98], rbx
mov r15, r8
mov r13, rdx
mov r12, rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
xor ebx, ebx
mov qword [rbp - 8], rbx
mov r14, qword [r8 + 8]
mov rdi, qword [r8]
mov rax, qword [rbp - 0x10]
cmp rdi, r14
je 0x1401706b8
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14017062f
mov rdx, qword [rdi]
mov rcx, qword [rdi + 0x10]
lea rsi, [rdx + rcx*2]
mov rbx, rdi
jb 0x14017063f
mov rbx, qword [rdi]
cmp rbx, rsi
je 0x14017067a
cmp qword [rbp - 8], rax
je 0x14017065e
movzx ecx, word [rbx]
mov word [rax], cx
mov rax, qword [rbp - 0x10]
add rax, 2
mov qword [rbp - 0x10], rax
jmp 0x140170671
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.1400af7c0
mov rax, qword [rbp - 0x10]
add rbx, 2
cmp rbx, rsi
jne 0x140170644
xor ebx, ebx
mov word [rbp + 0x40], bx
cmp qword [rbp - 8], rax
je 0x140170697
mov word [rax], bx
mov rax, qword [rbp - 0x10]
add rax, 2
mov qword [rbp - 0x10], rax
jmp 0x1401706ab
lea r8, [rbp + 0x40]
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.1400af7c0
mov rax, qword [rbp - 0x10]
add rdi, 0x20
cmp rdi, r14
jne 0x140170622
mov rcx, qword [rbp - 0x18]
sub rax, rcx
sar rax, 1
lea edx, [rax + rax]
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rcx
mov r9d, 7
xor r8d, r8d
mov rdx, r13
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14017074f
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140170743
mov rax, qword [rbp - 8]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140170732
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140170732
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082ab0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rbx
mov rcx, r15
call fcn.140102500
mov al, 1
jmp 0x1401707a9
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14017079f
mov rax, qword [rbp - 8]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017078e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017078e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082ab0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rbx
mov rcx, r15
call fcn.140102500
xor al, al
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140170900
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x298
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1403644c8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, r9
mov rsi, rcx
mov dword [rsp + 0x38], r8d
mov rax, r9
cmp qword [r9 + 0x18], 8
jb 0x14017093f
mov rax, qword [r9]
xor ebp, ebp
mov qword [r9 + 0x10], rbp
mov word [rax], bp
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, edx
xor r8d, r8d
mov rdx, qword [str.P2_]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x140170a8a
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140170a7f
movdqa xmm0, xmmword [0x14027bc70]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], bp
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], bp
jne 0x1401709f0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.140086f50
nop
lea rax, [rsp + 0x50]
cmp rbx, rax
je 0x140170a39
mov rcx, rbx
call fcn.1400867f0
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rbx + 0x10], xmm1
mov edx, 7
mov word [rsp + 0x50], bp
jmp 0x140170a3e
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140170a7f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140170a79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140170a79
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082ab0
nop
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400e39a0
add rsp, 0x298
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140172cf0
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0xd0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x100], rbx
mov rax, qword [0x1403644c8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rdx
mov rsi, rcx
cmp qword [rcx + 0x18], 8
jb 0x140172d2f
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140172d59
test rbx, rbx
je 0x140172d55
mov dword [rbx], 0
mov byte [rbx + 4], 0
lea rdi, [0x14028b1b8]
mov qword [rbx + 8], rdi
mov al, 1
jmp 0x140172dbc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov dword [rsp + 0x20], 0
mov byte [rsp + 0x24], 0
lea rdi, [0x14028b1b8]
mov qword [rsp + 0x28], rdi
lea r8, [rsp + 0x20]
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.1401733b0
cmp dword [rax], 3
jne 0x140172da7
test rbx, rbx
je 0x140172dba
mov dword [rbx], 0
mov byte [rbx + 4], 0
mov qword [rbx + 8], rdi
jmp 0x140172dba
test rbx, rbx
je 0x140172de0
mov r8, rdi
mov edx, r14d
mov rcx, rbx
call fcn.1401728f0
xor al, al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400e39a0
mov rbx, qword [rsp + 0x100]
add rsp, 0xd0
pop r14
pop rdi
pop rsi
ret
lea rdx, str.boost::filesystem::create_directory
lea rcx, [rsp + 0x48]
call fcn.1400a53f0
nop
call fcn.140173560
mov r8, rax
mov edx, r14d
lea rcx, [rsp + 0x38]
call fcn.140172800
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x20], xmm0
lea r9, [rsp + 0x20]
mov r8, rsi
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.1401772b0
lea rdx, [0x14035ade8]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x1401731d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebp, ebp
lea r14, [0x14028b1b8]
cmp qword [rcx + 0x18], 8
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x20], ebp
mov byte [rsp + 0x24], bpl
mov qword [rsp + 0x28], r14
jb 0x140173209
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140173230
lea r8, [rsp + 0x20]
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.1401730a0
mov ebp, dword [rsp + 0x20]
mov ebx, dword [rax]
jmp 0x140173295
bt ebx, 0xa
jae 0x14017328c
mov rcx, rsi
call fcn.140172e40
test al, al
je 0x140173254
test bl, 0x10
mov eax, listen
mov ebx, 4
cmovne ebx, eax
jmp 0x140173295
mov ebx, 9
test rdi, rdi
je 0x14017326c
mov dword [rdi], 0
mov byte [rdi + 4], 0
mov qword [rdi + 8], r14
mov r8, rdi
mov edx, ebx
mov rcx, rsi
call fcn.1401732c0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
test ebx, ebx
jne 0x140173259
test ebp, ebp
je 0x140173259
lea r9, str.boost::filesystem::remove
mov r8, rdi
mov rdx, rsi
mov ecx, ebp
call fcn.140177610
xor al, al
jmp 0x140173279
Function at 0x1401732c0
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rcx
cmp edx, 1
jne 0x1401732fe
test rbx, rbx
je 0x1401732f1
lea rax, [0x14028b1b8]
mov dword [r8], 0
mov qword [r8 + 8], rax
mov byte [r8 + 4], 0
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea eax, [rdx - 3]
test eax, 0xfffffff7
je 0x14017331a
cmp qword [rcx + 0x18], 8
jb 0x140173312
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14017332a
cmp qword [rcx + 0x18], 8
jb 0x140173324
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140173385
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x35
ja 0x140173349
movabs rdx, 0x2000000020800c
bt rdx, rax
jb 0x140173385
cmp eax, 0x7b
je 0x140173385
cmp eax, 0x57
je 0x140173385
cmp eax, 0xa1
je 0x140173385
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140173385
lea r9, str.boost::filesystem::remove
mov r8, rbx
mov rdx, rdi
mov ecx, eax
call fcn.140177610
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test rbx, rbx
je 0x14017339f
lea rax, [0x14028b1b8]
mov byte [rbx + 4], 0
mov qword [rbx + 8], rax
mov dword [rbx], 0
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1401733b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1403644c8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r8
mov rsi, rdx
mov rdi, rcx
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x1401733f0
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x140173410
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call fcn.1401730a0
jmp 0x140173534
mov edx, ebp
mov rcx, rsi
call fcn.140172f40
mov r15d, eax
xor r12d, r12d
bt ebp, 0xa
jae 0x1401734f2
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140173437
mov rdx, qword [rsi]
movdqa xmm0, xmmword [0x14027bc70]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r12w
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r12w
jne 0x140173452
lea rcx, [rsp + 0x50]
call fcn.140086f50
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
call fcn.1400867f0
nop
cmp rbx, 0xffffffffffffffff
jne 0x1401734c6
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call fcn.1401730a0
nop
jmp 0x140173534
mov rcx, rsi
call fcn.140172e40
test al, al
jne 0x1401734e8
mov dword [rdi], 9
mov dword [rdi + 4], r15d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x140173534
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test r14, r14
je 0x14017350a
mov dword [r14], r12d
mov byte [r14 + 4], 0
lea rax, [0x14028b1b8]
mov qword [r14 + 8], rax
and ebp, 0x10
je 0x140173515
mov eax, dword [rsp + 0x40]
jmp 0x14017351d
mov eax, r15d
mov r15d, dword [rsp + 0x40]
test ebp, ebp
setne r12b
add r12d, 2
mov dword [rdi], r12d
test ebp, ebp
cmove r15d, eax
mov dword [rdi + 4], r15d
mov rax, rdi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400e39a0
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401781f0
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x28
call fcn.1400e3930
sub rsp, rax
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x28
jmp fcn.1401785d0
Function at 0x1401860c0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1400e3930
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x14019fae0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1400e3930
sub rsp, rax
lea rcx, [0x140374208]
add rsp, 0x28
jmp fcn.140185f20

Function at 0x1401b0320
Capabilities:
Encode data using xor

Disassembly:
mov eax, gethostname
call fcn.1400e3930
sub rsp, rax
mov r10, rdx
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
add rdx, 0xf
lea rax, [r8 + 0xf]
mov r11, rcx
cmp r10, rax
ja 0x1401b0350
xor r9d, r9d
cmp rdx, r8
jae 0x1401b0369
movdqu xmm1, xmmword [r10]
movdqu xmm0, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [r10], xmm1
mov r9d, reloc.WS2_32.dll_recv
cmp r9, 0x10
jae 0x1401b0391
sub r8, r10
lea rax, [r9 + r10]
mov edx, reloc.WS2_32.dll_recv
sub rdx, r9
nop
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1401b0380
mov rcx, qword [r11 + 8]
lea r8, [rsp + 0x40]
mov r9, r10
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rdx, r10
call fcn.14017cf30
test eax, eax
je 0x1401b03c2
cmp dword [rsp + 0x40], 0x10
jne 0x1401b03c2
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret

Function at 0x1401b0570
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x1401b05f8
test r8, r8
je 0x1401b05f8
mov rax, qword [rcx + 0x18]
cmp r8, rax
mov r9, rax
cmovb r9, r8
test r9, r9
je 0x1401b05b6
add rcx, 0x20
mov r11, rdx
sub r11, r10
nop
movzx eax, byte [r11 + rcx - 0x20]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x1401b05a0
mov rax, qword [r10 + 0x18]
cmp r8, rax
jbe 0x1401b05f8
sub r8, rax
mov eax, reloc.WS2_32.dll_recv
cmp r8, rax
cmova r8, rax
xor ecx, ecx
test r8, r8
je 0x1401b05f8
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x18]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x40], al
inc rcx
cmp rcx, r8
jb 0x1401b05e0
ret

Function at 0x1401c05a0
Capabilities:
Query environment variable

Disassembly:
push rbx
mov eax, 0x20
call fcn.1400e3930
sub rsp, rax
mov rbx, rcx
call fcn.140083e70
test eax, eax
je 0x1401c05c3
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]

Function at 0x1401fbe40
Capabilities:
Encode data using xor

Disassembly:
mov eax, gethostname
call fcn.1400e3930
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x1401fbe69
lea rax, [0x1401fa4b0]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.14018c930
lea rax, [0x1401f9670]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.14018c680
Function at 0x140202e09
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x140202ffa
push rbx
mov eax, 0xd0
call fcn.1400e3930
sub rsp, rax
mov rax, qword [0x1403644c8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov rbx, rdx
mov qword [rsp + 0xf0], rsi
lea rbp, [r8 - 1]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea r14, [rcx + 0xc]
shr rbp, 3
mov qword [rsp + 0xc0], r15
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r14
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
lea rbx, [rbx + 8]
shl eax, 8
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
or esi, eax
mov dword [rsp + 0x20], edi
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x28], edi
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x2c], esi
call fcn.1401efde0
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.1401ef780
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.1401ec4c0
mov rcx, r15
call fcn.1401efde0
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.1401ef780
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1401ec4c0
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
xor r8d, edi
xor edi, dword [rsp + 0x28]
xor edx, esi
xor esi, dword [rsp + 0x2c]
mov eax, edi
mov byte [r14], dil
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, edx
shr eax, 8
shr edi, 0x18
mov byte [r14 + 3], dil
mov byte [r14 + 4], dl
mov byte [r14 + 5], al
mov eax, edx
shr eax, 0x10
mov byte [r14 + 6], al
mov eax, r8d
shr eax, 8
shr edx, 0x18
mov byte [r14 + 7], dl
mov byte [r15], r8b
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
mov byte [r15 + 2], al
shr r8d, 0x18
mov byte [r15 + 3], r8b
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr eax, 0x10
shr esi, 0x18
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
sub rbp, 1
jne 0x140202e70
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400e39a0
add rsp, 0xd0
pop rbx
ret
Function at 0x14024bca0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, r9
mov r14, rdx
mov rsi, rcx
mov edx, dword [r8]
movzx r8d, dl
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs r9, 0x100000001b3
imul r8, r9
mov eax, edx
shr eax, 8
movzx ecx, al
xor r8, rcx
imul r8, r9
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, r9
mov eax, edx
shr rax, 0x18
xor r8, rax
imul r8, r9
mov r9, qword [rsi + 0x30]
and r9, r8
add r9, r9
mov rcx, qword [rsi + 0x18]
mov rbx, qword [rsi + 8]
mov rax, qword [rcx + r9*8]
cmp rbx, rax
je 0x14024bd7c
mov rbx, qword [rcx + r9*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x14024bd7c
mov rbx, qword [rbx + 8]
cmp edx, dword [rbx + 0x10]
jne 0x14024bd37
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
mov edx, 0x18
mov rcx, rdi
call fcn.140082ab0
nop
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x14024beab
mov qword [rsp + 0x80], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x14024bdb9
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r9*8]
cmp rax, qword [rsi + 8]
jne 0x14024bdd6
mov qword [rdx + r9*8], rdi
mov rax, qword [rsi + 0x18]
mov qword [rax + r9*8 + 8], rdi
jmp 0x14024be05
cmp rax, rbx
jne 0x14024bde1
mov qword [rdx + r9*8], rdi
jmp 0x14024be05
mov rax, qword [rdx + r9*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r9*8 + 8], rcx
cmp rcx, rdi
je 0x14024be05
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r9*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r9*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x140280f34]
test rax, rax
jns 0x14024be26
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14024be37
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x14024bea0
cmp rdx, 0x200
jae 0x14024be53
lea rdx, [rdx*8]
jmp 0x14024be65
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x14024be65
add rdx, rdx
mov rcx, rsi
call fcn.14009f990
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x14024bea0
mov r15, qword [rax + 8]
nop word [rax + rax]
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
lea r8, [rbx + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.14024bca0
cmp rbx, r15
jne 0x14024be80
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14024ca50
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov rsi, rdx
mov rdi, rcx
mov r10d, dword [r8 + 0x10]
movzx r11d, r10b
movabs rax, 0xcbf29ce484222325
xor r11, rax
movabs rdx, 0x100000001b3
imul r11, rdx
mov eax, r10d
shr eax, 8
movzx r9d, al
xor r11, r9
imul r11, rdx
mov eax, r10d
shr eax, 0x10
movzx ecx, al
xor r11, rcx
imul r11, rdx
shr r10, 0x18
xor r11, r10
imul r11, rdx
mov rdx, qword [rdi + 0x30]
and rdx, r11
shl rdx, 4
mov rcx, qword [rdi + 0x18]
add rcx, rdx
cmp qword [rcx + 8], r8
jne 0x14024cafb
cmp qword [rcx], r8
jne 0x14024caf1
mov rax, qword [rdi + 8]
mov qword [rcx], rax
mov rax, qword [rdi + 8]
mov rcx, qword [rdi + 0x18]
mov qword [rdx + rcx + 8], rax
jmp 0x14024cb06
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x14024cb06
cmp qword [rcx], r8
jne 0x14024cb06
mov rax, qword [r8]
mov qword [rcx], rax
mov rbx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
dec qword [rdi + 0x10]
mov edx, 0x18
mov rcx, r8
call fcn.140082ab0
nop
mov qword [rsi], rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret