joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004c290
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, qword [rcx]
mov rdi, rsi
add rdi, 0x38
mov rax, qword [rsi + 0x38]
lock dec qword [rax]
sete al
test al, 1
je 0x14004c318
mov eax, dword [0x1400e6c38]
add eax, dword [0x1400e6c3c]
sub eax, 0xa32105ee
and eax, 0x9ba1a230
or eax, 0x7377ccb0
cmp eax, 0xd67c450b
je 0x14004c3ad
jmp 0x14004c2d8
mov eax, dword [0x1400e6c40]
mov ecx, dword [0x1400e6c44]
imul eax, ecx
shr eax, 1
mov ecx, 0x855872b9
imul rax, rcx
shr rax, 0x39
xor eax, 0x3ca9867c
imul rbx, rax, 0x8ec845d
shr rbx, 0x39
mov rcx, rdi
call fcn.14004c7d0
cmp ebx, 0x1040532c
jae 0x14004c2d8
jmp 0x14004c318
mov eax, dword [0x1400e6c48]
add eax, dword [0x1400e6c4c]
sub eax, 0xa4da712a
mov ecx, 0x290ea8b2
xor edx, edx
div ecx
mov ecx, 0x948f0f75
xor edx, edx
div ecx
cmp eax, 0x57f74041
je 0x14004c3c6
mov ecx, dword [0x1400e6c50]
xor ecx, dword [0x1400e6c54]
and ecx, 0xa7e899ae
and ecx, 0xdae18191
add ecx, 0x7466dd6
mov rax, 0xffffffffffffffff
cmp rsi, rax
sete al
cmp ecx, 0xf96b2d6a
jae 0x14004c3c6
test al, 1
jne 0x14004c3a4
jmp 0x14004c37f
mov rax, rsi
add rax, 8
lock dec qword [rax]
sete al
test al, 1
je 0x14004c3a4
mov rcx, rsi
mov edx, 0x40
mov r8d, 8
call fcn.140063a00
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
jg 0x14004c3d2
out dx, eax
xchg edx, eax
invalid
invalid
jmp 0x14004c346

Function at 0x14004d180
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [rcx]
mov rcx, qword [rsi + 0x10]
mov edx, 0x800
mov r8d, 8
call fcn.140063a00
mov rax, 0xffffffffffffffff
cmp rsi, rax
je 0x14004d21c
mov rax, rsi
add rax, 8
lock dec qword [rax]
sete al
test al, 1
je 0x14004d21c
mov eax, dword [0x1400e6d20]
add eax, dword [0x1400e6d24]
sub eax, 0xb4dc7ace
xor eax, 0x9b5ea9fd
or eax, 0x921c9760
cmp eax, 0x338126a0
jb 0x14004d223
jmp 0x14004d1df
mov eax, dword [0x1400e6d28]
mov ecx, dword [0x1400e6d2c]
xor eax, ecx
imul edi, eax, 0x4c84540a
add edi, 0xbc613024
or edi, 0x49b78e13
mov rcx, rsi
mov edx, 0x28
mov r8d, 8
call fcn.140063a00
cmp edi, 0xa7cf55a5
je 0x14004d1df
jmp 0x14004d21c
add rsp, 0x28
pop rdi
pop rsi
ret
add ah, cl
lahf
mov dh, 0xa4
insb byte [rdi], dx
invalid
Function at 0x14004d330
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, qword [rcx]
mov rcx, rsi
add rcx, 0x80
call fcn.14006f9f0
mov rdi, qword [rsi + 0xb0]
cmp rdi, 0
je 0x14004d3b1
mov eax, dword [0x1400e6d40]
imul eax, dword [0x1400e6d44]
add eax, 0x72b2eaee
add eax, 0x8ee566c8
xor eax, 0xbd674a15
cmp eax, 0xa9100c3
je 0x14004d4af
jmp 0x14004d37f
mov ebx, dword [0x1400e6d48]
and ebx, dword [0x1400e6d4c]
sub ebx, 0x5e87f0ff
xor ebx, 0xe531dbe4
and ebx, 0xa6865a41
mov rcx, qword [rsi + 0xb8]
call qword [rdi + 0x18]
cmp ebx, 0xadf3818b
je 0x14004d37f
jmp 0x14004d3b1
mov eax, dword [0x1400e6d50]
sub eax, dword [0x1400e6d54]
or eax, 0x1a6e62f9
mov ecx, 0x4273b58a
xor edx, edx
div ecx
or eax, 0xbe7cef01
cmp eax, 0x2525914b
jbe 0x14004d4ca
mov ecx, dword [0x1400e6d58]
or ecx, dword [0x1400e6d5c]
or ecx, 0x3757291c
xor ecx, 0xdfa8c1ba
xor ecx, 0x1fef6f15
mov rbx, qword [rsi + 0xc0]
cmp rbx, 0
sete al
cmp ecx, 0x45f72b43
ja 0x14004d4ca
test al, 1
jne 0x14004d475
jmp 0x14004d419
mov eax, dword [0x1400e6d60]
sub eax, dword [0x1400e6d64]
xor eax, 0x7f781517
or eax, 0x1e57e7a4
add eax, 0x2bebb6fd
cmp eax, 0x68c94607
jae 0x14004d4db
mov eax, dword [0x1400e6d68]
xor edx, edx
div dword [0x1400e6d6c]
mov edi, eax
and edi, 0x772f4459
or edi, 0xdcbf2734
xor edi, 0x444a42d
mov rcx, qword [rsi + 0xc8]
call qword [rbx + 0x18]
cmp edi, 0x933bbf9e
je 0x14004d4db
jmp 0x14004d475
mov rax, 0xffffffffffffffff
cmp rsi, rax
je 0x14004d4a6
mov rax, rsi
add rax, 8
lock dec qword [rax]
sete al
test al, 1
je 0x14004d4a6
mov rcx, rsi
mov edx, 0x100
mov r8d, 0x80
call fcn.140063a00
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov edi, 0x58a1f427
push rdx
xchg ebx, eax
in al, 0xc
adc eax, 0x8e8b481d
mov eax, 0xff000000
push rdi
sbb cl, ch
mov bl, 0xfe
invalid
add byte [rax], al
call qword [rdi + 0x18]
jmp 0x14004d37d
out 9, al
sahf
lahf
int 3
mov esp, 0x38bcfb53
ja 0x14004d4c0
add bh, bh
invalid
movsd dword [rdi], dword [rsi]
fldenv [rbx + 0x31]
mov eax, 0xe81d3c5b
jrcxz fcn.14004d540
cmp ecx, dword [rax - 0x75]
mov cs, eax
add byte [rax], al
add bh, bh
push rbx
sbb cl, ch
invalid
Function at 0x140051290
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdx, qword [rsi]
movabs rax, 0x8000000000000001
mov rcx, rdx
add rcx, rax
xor eax, eax
movabs r8, 0x8000000000000002
mov r9, rdx
sub r9, r8
cmovl rax, rcx
test rax, rax
je 0x1400512de
jmp 0x1400512cf
sub rax, 1
je 0x140051f55
jmp 0x140051fe2
movzx eax, byte [rsi + 0x38]
test eax, eax
je 0x1400512ff
jmp 0x1400512e8
mov ecx, eax
sub ecx, 3
cmp qword [rsi + 8], 0
je 0x140051fe2
mov rdi, qword [rsi + 0x10]
mov rsi, qword [rsi + 0x18]
cmp rdi, 0
je 0x140051fe2
mov rbx, qword [rsi]
cmp rbx, 0
je 0x140051fcc
mov eax, dword [0x1400e71d0]
sub eax, dword [0x1400e71d4]
xor eax, 0x86dedbb4
sub eax, 0x10738839
add eax, 0x79f0b613
cmp eax, 0x398f37af
je 0x140052109
and al, byte [rsi + 0x55]
popfq

Function at 0x140052630
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp byte [rcx + 0x68], 3
jne 0x1400526a9
mov rsi, rcx
movzx eax, byte [rcx + 0x60]
cmp eax, 3
je 0x1400526b1
test eax, eax
jne 0x1400526a9
mov rdi, qword [rsi + 0x28]
test rdi, rdi
je 0x140052698
mov rcx, rdi
call fcn.140081e00
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14005266e
mov rcx, rdi
call fcn.14004cc20
mov rax, qword [rdi + 8]
lock dec qword [rax]
jne 0x140052684
add rdi, 8
mov rcx, rdi
call fcn.14004d7d0
mov rcx, qword [rsi + 0x28]
mov edx, 0x20
mov r8d, 8
call fcn.140063a00
mov rcx, qword [rsi + 0x20]
add rsp, 0x28
pop rdi
pop rsi
jmp qword [sym.imp.ws2_32.dll_closesocket]
nop
add rsp, 0x28
pop rdi
pop rsi
ret
add rsi, 0x30
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140052120
Function at 0x140054970
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, qword [rcx + 8]
mov rdi, qword [rcx + 0x10]
cmp rdi, 0
je 0x1400549b6
xor ebx, ebx
jmp 0x140054989
imul rcx, rbx, 0x18
mov rax, rsi
add rax, rcx
add rbx, 1
mov rdx, qword [rax]
cmp rdx, 0
je 0x1400549af
mov rcx, qword [rax + 8]
mov r8d, 1
call fcn.140063a00
cmp rbx, rdi
jne 0x140054989
jmp 0x1400549b6
mov eax, dword [0x1400e7420]
xor edx, edx
div dword [str.7___f_]
add eax, 0xa0cca767
add eax, 0xaf7ec472
sub eax, 0x38e708ad
cmp eax, 0x459d7b70
ja 0x140054a06
jmp 0x1400549dc
mov eax, dword [0x1400e7428]
xor eax, dword [0x1400e742c]
sub eax, 0x24b09aa7
xor eax, 0x22efaab8
add eax, 0xb0548e93
cmp eax, 0x391a4c35
je 0x1400549dc
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
pop rsp
stc
leave
add eax, 0xe27a0b5e
fild dword [rdi - 0x7c]
jnp 0x1400549fe
invalid
Function at 0x1400558d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r8, rdx
mov rsi, rcx
mov r12, qword [r8]
mov rdi, qword [r8 + 8]
mov rax, rdi
sub rax, r12
mov ecx, 0x18
xor edx, edx
div rcx
mov r13, rax
mov rbp, qword [r8 + 0x10]
xor eax, eax
mov r14, r13
sub r14, rbp
cmovb r14, rax
imul r15, r14, 0x18
xor ecx, ecx
movabs rax, 0x555555555555555
cmp r14, rax
ja 0x1400559b2
mov eax, dword [0x1400e74e0]
or eax, dword [0x1400e74e4]
imul eax, eax, 0x82076023
xor eax, 0xb1d966bb
xor eax, 0xacb668e1
cmp eax, 0x5cb20c51
je 0x140055ab1
jmp 0x140055952
mov ecx, dword [0x1400e74e8]
or ecx, dword [0x1400e74ec]
xor ecx, 0x7d551cf9
add ecx, 0x2d387c68
add ecx, 0xe68aab83
cmp r13, rbp
seta al
cmp ecx, 0x9e377de1
jae 0x140055952
xor r8d, r8d
mov ebx, 8
test al, 1
jne 0x14005598c
jmp 0x1400559ba
mov al, byte [0x1400e8bf0]
mov rcx, r15
mov edx, 8
call fcn.1400639f0
mov rbx, rax
mov ecx, 8
cmp rbx, 0
je 0x1400559b2
mov r8, r14
jmp 0x1400559ba
mov rdx, r15
call fcn.14006f020
mov eax, dword [0x1400e74f0]
or eax, dword [0x1400e74f4]
and eax, 0xc8e72f72
add eax, 0x1be98c7e
sub eax, 0x3e8ea55d
cmp eax, 0xf8e69dab
je 0x140055abe
mov eax, dword [0x1400e74f8]
xor edx, edx
div dword [0x1400e74fc]
xor eax, 0x86a9d194
xor eax, 0xd7cf3b76
or eax, 0x2c519128
cmp rbp, 0
sete cl
cmp eax, 0x6ce449b8
jbe 0x140055abe
test cl, 1
je 0x140055a16
jmp 0x140055a2c
mov rax, rbp
add rax, 0xffffffffffffffff
imul rcx, rbp, 0x18
add r12, rcx
xor r15d, r15d
cmp r13, rax
jbe 0x140055a92
xor r15d, r15d
cmp r12, rdi
je 0x140055a92
mov r14, r8
sub rdi, r12
mov ecx, 0x18
mov rax, rdi
xor edx, edx
div rcx
mov r15, rax
xor edi, edi
imul rax, rdi, 0x18
mov rdx, r12
add rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400a0630
imul rax, rdi, 0x18
mov rcx, rbx
add rcx, rax
mov rax, qword [rsp + 0x20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x30]
mov qword [rcx + 0x10], rax
add rdi, 1
cmp rdi, r15
jne 0x140055a4c
mov r8, r14
jmp 0x140055a92
mov qword [rsi], r8
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor ch, byte [rbp + 0x4b275144]
btc ecx, ebp
xchg edx, eax
invalid
lahf
iretd
Function at 0x140059ba0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov eax, dword [0x1400e78a8]
and eax, dword [0x1400e78ac]
sub eax, 0xf5c5df42
mov r8d, 0x22e17e45
xor edx, edx
div r8d
imul eax, eax, 0xd30cad8d
cmp eax, 0x69b80104
jae 0x140059daa
jmp 0x140059bd8
jrcxz 0x140059e21
or edi, dword [rbx + 0x75]
invalid
invalid

Function at 0x14005c470
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
and byte [rax - 0x77], cl
invalid
movzx eax, byte [rsi + 0x20]
mov dh, 0x46
and byte [rcx + 0x3e983c1], cl
Function at 0x14005f540
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rcx, rsi
call fcn.14006df30
mov rcx, rax
and rcx, 8
cmp rcx, 0
jne 0x14005f598
mov rcx, qword [rsi + 0x28]
call fcn.140070cf0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdx
mov rcx, rsi
add rcx, 0x30
call fcn.140017580
movabs rax, 0x8000000000000001
mov qword [rsi + 0x30], rax
lea rcx, [rsp + 0x30]
call fcn.140070d90
jmp 0x14005f5b1
and rax, 0x10
cmp rax, 0
je 0x14005f5b1
mov rcx, rsi
add rcx, 0xc00
call fcn.140071650
mov eax, dword [0x1400e7d80]
imul eax, dword [0x1400e7d84]
xor eax, 0xc2157faf
imul eax, eax, 0xc9ba8002
sub eax, 0xfa785b48
cmp eax, 0xdc02e1a6
ja 0x14005f690
jmp 0x14005f5db
mov ebx, dword [0x1400e7d88]
xor ebx, dword [0x1400e7d8c]
and ebx, 0x881eb7d9
add ebx, 0x160f653d
or ebx, 0x6ff498ba
mov qword [rsp + 0x28], rsi
mov rdi, rsi
add rdi, 0x20
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140073e40
mov edx, 2
mov ecx, 1
cmp rax, 0
cmove rdx, rcx
mov rcx, rsi
call fcn.14006df60
cmp ebx, 0x637d8192
jb 0x14005f5db
test al, 1
jne 0x14005f642
jmp 0x14005f63a
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rdi]
lock dec qword [rax]
sete al
test al, 1
je 0x14005f658
mov rcx, rdi
call fcn.14004d980
mov rcx, rsi
add rcx, 0x30
call fcn.14005c760
mov rax, qword [rsi + 0xc10]
cmp rax, 0
je 0x14005f67b
mov rcx, qword [rsi + 0xc18]
call qword [rax + 0x18]
mov rcx, rsi
mov edx, 0xc80
mov r8d, 0x80
call fcn.140063a00
jmp 0x14005f63a
cli
in al, 0xef
jge 0x14005f6ac
mov ah, 0x5d
xchg dword [rdx + 0x4848983e], ecx
mov dword [rsp + 0x28], esi
mov rcx, rsi
add rcx, 0x20
lea rdx, [rsp + 0x28]
call fcn.140073e40
mov edx, 2
sub al, ch
mov es, word [rdi + 1]
add byte [rdx + 2], bh
mov ecx, 1
cmp rax, 0
cmove rdx, rcx
mov rcx, rsi
call fcn.14006df60
jmp 0x14005f5d9
Function at 0x140062390
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rcx, qword [rsi]
xor ebx, ebx
cmp rcx, 0xffffffffffffffff
je 0x140062521
mov rax, rcx
add rax, 1
mov rdx, rcx
shl rdx, 1
mov r8, rdx
sub r8, rax
cmova rax, rdx
mov rdx, rax
sub rdx, 5
mov r15d, 4
cmovae r15, rax
mov rdi, r15
shl rdi, 5
movabs rax, 0x7ffffffffffffff
cmp r15, rax
seta al
movabs rdx, 0x7ffffffffffffff8
cmp rdi, rdx
seta dl
or al, dl
xor ebx, ebx
test al, 1
jne 0x140062521
mov eax, dword [0x1400e7fb0]
xor edx, edx
div dword [0x1400e7fb4]
or eax, 0xd475043f
sub eax, 0x6f3b5000
xor eax, 0x6c998753
cmp eax, 0x6088ac33
je 0x140062592
mov eax, dword [0x1400e7fb8]
and eax, dword [0x1400e7fbc]
mov r8d, 0x1b4d8624
xor edx, edx
div r8d
sub eax, 0x31bff51d
imul edx, eax, 0xe3e8fb4a
mov r14, rsi
add r14, 8
cmp rcx, 0
sete al
cmp edx, 0x282f4dd3
jbe 0x140062592
xor r12d, r12d
test al, 1
jne 0x14006248e
jmp 0x140062477
mov rax, qword [r14]
shl rcx, 5
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rcx
mov r12d, 8
mov eax, dword [0x1400e7fc0]
and eax, dword [str.3oUk]
and eax, 0xf481216
xor eax, 0x323a843c
mov ecx, 0x4cca2a38
xor edx, edx
div ecx
cmp eax, 0xb8874b86
ja 0x14006259f
jmp 0x1400624ba
mov eax, dword [0x1400e7fc8]
xor eax, dword [0x1400e7fcc]
imul eax, eax, 0x72d1f867
or eax, 0x9ae3e8f1
mov ecx, 0x6e527499
xor edx, edx
div ecx
mov ebx, eax
mov qword [rsp + 0x30], r12
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0x28]
mov edx, 8
mov r8, rdi
call fcn.140062290
cmp qword [rsp + 0x40], 0
sete cl
lea rax, [rsp + 0x40]
add rax, 8
cmp ebx, 0xdb3f147c
ja 0x1400624ba
test cl, 1
jne 0x14006257b
jmp 0x140062519
mov rbx, qword [rax]
mov r14, qword [rsp + 0x50]
mov eax, dword [0x1400e7fd0]
imul eax, dword [0x1400e7fd4]
or eax, 0xaf3e9239
or eax, 0xa988527
and eax, 0xc33d0dee
cmp eax, 0x21f2f615
je 0x1400625cc
mov esi, dword [0x1400e7fd8]
or esi, dword [0x1400e7fdc]
sub esi, 0xe12682f0
and esi, 0xf0517484
sub esi, 0x3530a6e6
mov rcx, rbx
mov rdx, r14
call fcn.14006f020
cmp esi, 0xef77527b
ja 0x1400625cc
ud2
mov rax, qword [rax]
mov qword [r14], rax
mov qword [rsi], r15
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
cmc
hlt
push rcx
invalid
sbb al, ah
ret
Function at 0x140062c60
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
mov rsi, rcx
lea rcx, [rsp + 0x28]
call fcn.140054a20
mov al, byte [rsp + 0x28]
cmp al, 0x11
jne 0x140062cac
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov rdx, rbx
mov r8, r14
call fcn.1400a30e0
cmp qword [rsp + 0x48], 0
je 0x140062ce5
jmp 0x140062cf6
mov ecx, dword [rsp + 0x29]
mov dword [rsi + 1], ecx
mov cx, word [rsp + 0x2d]
mov word [rsi + 5], cx
mov cl, byte [rsp + 0x2f]
mov byte [rsi + 7], cl
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
mov byte [rsi], al
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], r8
jmp 0x140062d6d
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], r14
mov byte [rsi], 0x11
jmp 0x140062d6d
movdqu xmm6, xmmword [rsp + 0x50]
cmp rdi, 0
je 0x140062d13
mov rcx, rbx
mov rdx, rdi
mov r8d, 1
call fcn.140063a00
mov eax, dword [0x1400e8038]
or eax, dword [str.ys__]
mov ecx, 0x84b96ea6
xor edx, edx
div ecx
mov ecx, 0xe0b879b5
xor edx, edx
div ecx
and eax, 0x58a52776
cmp eax, 0xb203ffa1
ja 0x140062d7f
jmp 0x140062d3f
mov eax, dword [0x1400e8040]
xor edx, edx
div dword [0x1400e8044]
sub eax, 0x9bb3b122
sub eax, 0xb4ef8d97
xor eax, 0xd690970a
mov byte [rsi], 5
movdqu xmmword [rsi + 8], xmm6
cmp eax, 0x76f5c074
jbe 0x140062d3f
jmp 0x140062d6d
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
cmp dword [rbx + 0xc], ebp
jge 0x140062dbe
push rcx
xor al, 0xc8
mov byte [rsi], 5
movdqu xmmword [rsi + 8], xmm6
jmp 0x140062d3d
dec dword [rax - 0x7d]
stc
dec dword [rdi]
test byte [rsi + 0x48000002], cl
mov dword [rsp + 0x28], ecx
Function at 0x140064570
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
movzx eax, word [rdx]
cmp eax, 0x5a4d
jne 0x1400645fc
movsxd rax, dword [rdx + 0x3c]
test rax, rax
je 0x140064601
cmp eax, 0x40
jb 0x1400646f1
cmp rax, r8
ja 0x1400646f1
movzx r9d, word [rax + rdx + 0x18]
cmp r9d, 0x10b
je 0x140064606
mov r10b, 5
cmp r9d, 0x20b
jne 0x140064631
mov r10b, 2
cmp dword [rdx + rax], 0x4550
jne 0x140064631
lea r9, [rdx + rax]
movzx r11d, word [r9 + 4]
mov r10b, 3
cmp r11d, 0x8664
jne 0x140064631
mov r10b, 4
test byte [r9 + 0x16], 2
je 0x140064631
lea r10, [rax + 0x108]
mov r11d, 1
cmp r10, r8
jbe 0x140064664
jmp 0x1400646f1
xor r10d, r10d
jmp 0x140064631
mov r10b, 1
jmp 0x140064631
mov r10b, 2
cmp dword [rdx + rax], 0x4550
jne 0x140064631
lea r9, [rdx + rax]
movzx r11d, word [r9 + 4]
mov r10b, 3
cmp r11d, 0x14c
jne 0x140064631
mov r10b, 4
test byte [r9 + 0x16], 2
jne 0x140064651
mov byte [rcx], r10b
mov r8d, 2
mov eax, 0x18
mov qword [rcx + rax], r8
mov rax, rcx
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r10, [rax + 0xf8]
cmp r10, r8
ja 0x1400646f1
xor r11d, r11d
mov rsi, r8
sub rsi, r10
movzx ebx, word [rdx + rax + 6]
lea rdi, [rbx*8]
lea rdi, [rdi + rdi*4]
sub rsi, rdi
jb 0x1400646f1
add rax, 0xffffffffffffffc0
lea r14, [rdx + 0x40]
add r10, rdx
mov r15, rdx
shr r15, 8
add rdi, r10
mov ebp, ebx
shr ebp, 8
mov byte [rcx], dl
mov r12, rdx
shr r12, 0x38
mov byte [rcx + 7], r12b
mov r12, rdx
shr r12, 0x28
mov word [rcx + 5], r12w
mov dword [rcx + 1], r15d
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], r11
mov qword [rcx + 0x20], r9
mov qword [rcx + 0x28], r10
mov byte [rcx + 0x30], bl
mov dword [rcx + 0x31], ebp
mov byte [rcx + 0x37], 0
mov word [rcx + 0x35], 0
mov qword [rcx + 0x38], rdi
mov qword [rcx + 0x40], rsi
mov qword [rcx + 0x48], rdx
mov eax, 0x50
jmp 0x14006463f
ud2
Function at 0x14006df30
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x14006df40
test al, 1
je 0x14006df5b
test al, 2
jne 0x14006df5b
xor rax, 3
ret
ud2

Function at 0x1400704c0
Capabilities:
Set socket configuration

Disassembly:
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x1400704d0
add rcx, 0x18
jmp 0x1400824e0
ud2
jmp 0x1400898f0
sub rsp, 0x38
movzx eax, dl
mov rcx, qword [rcx]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 6
mov r8d, 1
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x140089928
xor eax, eax
add rsp, 0x38
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
Function at 0x140070560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140078ab0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x140078afa
mov r15, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov rdx, r15
mov r8, rdi
xor r9d, r9d
call fcn.14006db50
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x140078b25
mov eax, 1
jmp 0x140078c93
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov r8, rdi
xor r9d, r9d
call fcn.14006db50
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x140078c5c
mov eax, 1
jmp 0x140078c93
add rbx, 0x18
lea r13, [rsp + 0x20]
mov qword [rsp + 0x30], rdi
jmp 0x140078b7f
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.140063a00
mov r13, rbx
mov rcx, rbx
mov rdx, r15
mov r8, qword [rsp + 0x30]
xor r9d, r9d
call fcn.14006db50
movzx eax, byte [rsp + 0x29]
cmp al, 3
mov rbx, rsi
mov rsi, r14
je 0x140078af0
mov rbp, qword [rsp + 0x20]
cmp al, 2
je 0x140078c65
mov r8, qword [rsi + 8]
mov r12, qword [rsi + 0x10]
sub r8, r12
jb 0x140078caf
movzx edi, byte [rsp + 0x28]
mov r14, rsi
mov rdx, qword [rsi]
add rdx, r12
mov rsi, rbx
mov qword [rsp + 0x20], rbx
mov rbx, r13
mov rcx, r13
call fcn.140082500
mov r13, rdx
test rax, rax
je 0x140078c69
mov rcx, r13
call fcn.140078750
cmp al, 0xd
jne 0x140078c8e
and ebp, 0x23
mov rax, qword [r15 + 0x90]
xor rbp, 0x2f
mov rcx, rdi
shl rcx, 0x10
nop
mov edx, eax
shr edx, 0x10
cmp dil, dl
jne 0x140078c0c
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r15 + 0x90], rdx
jne 0x140078bf0
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x140078b56
test rax, rax
je 0x140078b56
mov rbp, qword [r13 - 1]
mov rdi, qword [r13 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x140078c3e
mov rcx, rbp
call rax
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x140078b40
mov r8, qword [rdi + 0x10]
mov rcx, rbp
call fcn.140063a00
jmp 0x140078b40
cmp al, 2
jne 0x140078ca7
mov rbp, qword [rsp + 0x20]
xor eax, eax
jmp 0x140078c93
lea rax, [r12 + r13]
mov rcx, qword [r14 + 0x18]
cmp rax, rcx
jbe 0x140078c7d
mov qword [r14 + 0x18], rax
mov rcx, rax
add r12, r13
jb 0x140078caf
cmp rax, rcx
ja 0x140078caf
mov qword [r14 + 0x10], rax
xor r13d, r13d
xor eax, eax
mov rbp, r13
mov rdx, rbp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x10]
cmp rax, qword [rsi + 8]
ud2

Function at 0x1400716b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword [rcx]
add rcx, 0x10
jmp 0x140078ab0
Function at 0x140078ab0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140078ab0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x140078afa
mov r15, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov rdx, r15
mov r8, rdi
xor r9d, r9d
call fcn.14006db50
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x140078b25
mov eax, 1
jmp 0x140078c93
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov r8, rdi
xor r9d, r9d
call fcn.14006db50
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x140078c5c
mov eax, 1
jmp 0x140078c93
add rbx, 0x18
lea r13, [rsp + 0x20]
mov qword [rsp + 0x30], rdi
jmp 0x140078b7f
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.140063a00
mov r13, rbx
mov rcx, rbx
mov rdx, r15
mov r8, qword [rsp + 0x30]
xor r9d, r9d
call fcn.14006db50
movzx eax, byte [rsp + 0x29]
cmp al, 3
mov rbx, rsi
mov rsi, r14
je 0x140078af0
mov rbp, qword [rsp + 0x20]
cmp al, 2
je 0x140078c65
mov r8, qword [rsi + 8]
mov r12, qword [rsi + 0x10]
sub r8, r12
jb 0x140078caf
movzx edi, byte [rsp + 0x28]
mov r14, rsi
mov rdx, qword [rsi]
add rdx, r12
mov rsi, rbx
mov qword [rsp + 0x20], rbx
mov rbx, r13
mov rcx, r13
call fcn.140082500
mov r13, rdx
test rax, rax
je 0x140078c69
mov rcx, r13
call fcn.140078750
cmp al, 0xd
jne 0x140078c8e
and ebp, 0x23
mov rax, qword [r15 + 0x90]
xor rbp, 0x2f
mov rcx, rdi
shl rcx, 0x10
nop
mov edx, eax
shr edx, 0x10
cmp dil, dl
jne 0x140078c0c
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r15 + 0x90], rdx
jne 0x140078bf0
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x140078b56
test rax, rax
je 0x140078b56
mov rbp, qword [r13 - 1]
mov rdi, qword [r13 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x140078c3e
mov rcx, rbp
call rax
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x140078b40
mov r8, qword [rdi + 0x10]
mov rcx, rbp
call fcn.140063a00
jmp 0x140078b40
cmp al, 2
jne 0x140078ca7
mov rbp, qword [rsp + 0x20]
xor eax, eax
jmp 0x140078c93
lea rax, [r12 + r13]
mov rcx, qword [r14 + 0x18]
cmp rax, rcx
jbe 0x140078c7d
mov qword [r14 + 0x18], rax
mov rcx, rax
add r12, r13
jb 0x140078caf
cmp rax, rcx
ja 0x140078caf
mov qword [r14 + 0x10], rax
xor r13d, r13d
xor eax, eax
mov rbp, r13
mov rdx, rbp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x10]
cmp rax, qword [rsi + 8]
ud2