joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003a044
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
cmp byte [0x14030cb33], 0
mov rbx, rcx
movsd xmm0, qword [str.VYYP_j]
mov r11d, 0x8d3dcb09
mov eax, dword [str.TPV_]
movsd qword [rbp - 0x10], xmm0
mov dword [rbp - 8], eax
je 0x14003a0a5
xor r8d, r8d
lea r9, [rbp - 0x10]
mov eax, r11d
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
inc r8d
sub al, cl
add al, 0x35
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x14003a080
cmp qword [rbx + 0x18], 0x10
mov r8, rbx
jb 0x14003a0b2
mov r8, qword [rbx]
movsd xmm0, qword [str._ERJW_VY]
lea r10, [rbp - 0x30]
mov al, byte [0x14030c788]
xor r9d, r9d
movsd qword [rbp - 0x30], xmm0
mov byte [rbp - 0x28], al
mov eax, r11d
mul r9d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r9b
inc r9d
sub al, cl
add al, 0x35
xor byte [r10], al
inc r10
cmp r9d, 9
jl 0x14003a0cf
movsd xmm0, qword [str._ERJW_VY]
lea r10, [rbp - 0x20]
mov al, byte [0x14030c788]
xor r9d, r9d
movsd qword [rbp - 0x20], xmm0
mov byte [rbp - 0x18], al
mov eax, r11d
mul r9d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r9b
inc r9d
sub al, cl
add al, 0x35
xor byte [r10], al
inc r10
cmp r9d, 9
jl 0x14003a111
lea r9, [rbp - 0x10]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14003a17e
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14003a179
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003a199
mov rcx, r8
call fcn.1400609b0
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
call fcn.140160d50
int3
Function at 0x14003a1a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
cmp byte [0x14030bf83], 0
mov rbx, rcx
movsd xmm0, qword [str.VYYP_z]
mov r11d, 0x8d3dcb09
mov eax, dword [0x14030bf80]
movsd qword [rbp - 0x10], xmm0
mov dword [rbp - 8], eax
je 0x14003a201
xor r8d, r8d
lea r9, [rbp - 0x10]
mov eax, r11d
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
inc r8d
sub al, cl
add al, 0x35
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x14003a1dc
cmp qword [rbx + 0x18], 0x10
mov r8, rbx
jb 0x14003a20e
mov r8, qword [rbx]
movsd xmm0, qword [str.eWDKNUIX]
lea r10, [rbp - 0x30]
mov al, byte [0x14030c070]
xor r9d, r9d
movsd qword [rbp - 0x30], xmm0
mov byte [rbp - 0x28], al
mov eax, r11d
mul r9d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r9b
inc r9d
sub al, cl
add al, 0x35
xor byte [r10], al
inc r10
cmp r9d, 9
jl 0x14003a22b
movsd xmm0, qword [str.eWDKNUIX]
lea r10, [rbp - 0x20]
mov al, byte [0x14030c070]
xor r9d, r9d
movsd qword [rbp - 0x20], xmm0
mov byte [rbp - 0x18], al
mov eax, r11d
mul r9d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r9b
inc r9d
sub al, cl
add al, 0x35
xor byte [r10], al
inc r10
cmp r9d, 9
jl 0x14003a26d
lea r9, [rbp - 0x10]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14003a2da
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14003a2d5
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003a2f5
mov rcx, r8
call fcn.1400609b0
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
call fcn.140160d50
int3
Function at 0x14003a990
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
movaps xmmword [rax - 0x18], xmm6
call fcn.140041fa8
mov rcx, qword [0x140339630]
call fcn.14000e7e8
mov rax, qword [0x1403395c0]
lea r9, [rbp - 0x29]
movups xmm0, xmmword [0x14030cb60]
movups xmm1, xmmword [0x14030cb70]
or dword [rax + 0x1c40], 2
mov dword [rax + 0x1c64], 0x43d90000
xor r8d, r8d
mov dword [rax + 0x1c68], 0x43330000
mov dword [rax + 0x1c48], 1
movzx eax, word [0x14030cb98]
movups xmmword [rbp - 0x29], xmm0
mov word [rbp + 0xf], ax
movups xmm0, xmmword [0x14030cb80]
mov al, byte [0x14030cb9a]
movups xmmword [rbp - 0x19], xmm1
mov byte [rbp + 0x11], al
movsd xmm1, qword [0x14030cb90]
movups xmmword [rbp - 9], xmm0
movsd qword [rbp + 7], xmm1
mov eax, 0x8d3dcb09
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
inc r8d
sub al, cl
add al, 0x35
xor byte [r9], al
inc r9
cmp r8d, 0x3b
jl 0x14003aa2d
mov r8d, Ordinal_41
lea rdx, [0x1403395bb]
lea rcx, [rbp - 0x29]
call fcn.14000be1c
movss xmm0, dword [0x14030f4b4]
lea rcx, [rbp + 0x67]
movss xmm1, dword [0x14030f4e8]
movss dword [rbp + 0x67], xmm0
movss dword [rbp + 0x6b], xmm1
call fcn.14000f040
movss xmm3, dword [0x14030f598]
lea r8, [rbp + 0x67]
movss xmm4, dword [0x14030f528]
mov edx, 1
and dword [rsp + 0x20], 0
mov r9b, 1
xor ecx, ecx
movss dword [rbp + 0x67], xmm3
movss dword [rbp + 0x6b], xmm4
call fcn.1400091d8
movaps xmm0, xmmword [0x14030d720]
lea r9, [rbp - 0x29]
movaps xmm1, xmmword [0x14030d730]
xor r8d, r8d
movaps xmmword [rbp - 0x29], xmm0
movaps xmm0, xmmword [0x14030d740]
movaps xmmword [rbp - 9], xmm0
movaps xmm0, xmmword [0x14030d760]
movaps xmmword [rbp - 0x19], xmm1
movaps xmm1, xmmword [0x14030d750]
movaps xmmword [rbp + 0x17], xmm0
movsd xmm0, qword [0x14030d780]
movaps xmmword [rbp + 7], xmm1
movaps xmm1, xmmword [0x14030d770]
movsd qword [rbp + 0x37], xmm0
movaps xmmword [rbp + 0x27], xmm1
mov eax, 0x8d3dcb09
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
inc r8d
sub al, cl
add al, 0x35
xor byte [r9], al
inc r9
cmp r8d, 0x68
jl 0x14003ab15
lea rcx, [rbp - 0x29]
call fcn.14002d63c
call fcn.1400093d8
movss xmm1, dword [0x14033ca20]
movss xmm6, dword [0x14030f524]
comiss xmm6, xmm1
jbe 0x14003ab8d
addss xmm1, dword [0x14030f448]
comiss xmm1, xmm6
movss dword [0x14033ca20], xmm1
jb 0x14003ab82
and dword [0x14033ca20], 0
mov byte [0x1403395bb], 0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
movss xmm0, dword [0x14030f4c0]
lea rcx, [rbp + 0x67]
movss xmm1, dword [0x14030f548]
movss dword [rbp + 0x67], xmm0
movss dword [rbp + 0x6b], xmm1
call fcn.14000f040
movss xmm0, dword [0x14030f594]
call fcn.14000f0b8
movss xmm0, dword [0x14033ca20]
lea rdx, [rbp + 0x67]
and dword [rbp + 0x67], 0
and dword [rbp + 0x6b], 0
divss xmm0, xmm6
call fcn.14002f4b8
call fcn.14000f158
call fcn.14000e328
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb0
pop rbp
jmp fcn.14000e880
Function at 0x14003abfc
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1320]
mov eax, 0x1420
call fcn.1401a0c50
sub rsp, rax
mov rax, qword [0x140322010]
xor rax, rsp
mov qword [rbp + 0x1310], rax
mov edi, edx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
and dword [rsp + 0x20], 0
movups xmm0, xmmword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789]
movups xmmword [rbp + 0x12d0], xmm0
movups xmm1, xmmword [0x14030dcf0]
movups xmmword [rbp + 0x12e0], xmm1
movups xmm0, xmmword [0x14030dd00]
movups xmmword [rbp + 0x12f0], xmm0
movsd xmm1, qword [0x14030dd10]
movsd qword [rbp + 0x1300], xmm1
mov eax, dword [0x14030dd18]
mov dword [rbp + 0x1308], eax
movzx eax, word [0x14030dd1c]
mov word [rbp + 0x130c], ax
mov al, byte [0x14030dd1e]
mov byte [rbp + 0x130e], al
and qword [rcx], 0
and qword [rcx + 0x10], 0
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], 0
mov dword [rsp + 0x20], 1
call fcn.1400645f8
mov edx, eax
or dword [rbp + 0x12c4], 0xffffffff
mov dword [rsp + 0x44], eax
mov ecx, 1
mov r8d, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x44], edx
inc rcx
cmp rcx, r8
jb 0x14003acd5
mov dword [rsp + 0x40], r8d
and dword [rsp + 0x28], 0
mov dword [rsp + 0x2c], 0x3d
test edi, edi
jle 0x14003ad58
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.14004d9d0
movsxd rcx, eax
mov r9b, byte [rbp + rcx + 0x12d0]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x14003ad4a
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14003ad3f
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14003ad52
mov rcx, rbx
call fcn.14004ec44
sub rdi, 1
jne 0x14003ad06
mov rax, rbx
mov rcx, qword [rbp + 0x1310]
xor rcx, rsp
call fcn.1400607e0
lea r11, [rsp + 0x1420]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14003b030
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
mov eax, 0x13d0
call fcn.1401a0c50
sub rsp, rax
mov rax, qword [0x140322010]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
mov ebx, edx
call fcn.1400645f8
or dword [rsp + 0x13b4], 0xffffffff
mov edx, 0x270
mov dword [rsp + 0x34], eax
mov r8d, 1
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, r8d
mov dword [rsp + r8*4 + 0x34], eax
inc r8
cmp r8, rdx
jb 0x14003b06f
mov dword [rsp + 0x30], edx
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 5
mov dword [rsp + 0x24], ebx
call fcn.14004d9d0
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.1400607e0
add rsp, 0x13d0
pop rbx
ret
Function at 0x140047f9c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140047fc1
xor eax, eax
jmp 0x1400480be
cmp qword [rcx + 0x68], 0
je 0x140047fd2
call fcn.1400491a8
jmp 0x1400480be
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x140047fe9
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140047feb
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140048020
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1401302d0
mov rax, qword [rsi + 0x50]
sub rbp, rbx
add r14, rbx
mov r8, rbp
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400480b8
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x14004805b
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
mov rbx, r8
cmp r8, r15
jbe 0x140048093
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call fcn.1401488a0
sub rbp, rax
add r14, rax
mov rbx, rbp
cmp rax, r15
jne 0x1400480cf
cmp rbp, r15
ja 0x140048069
mov r8, rbx
test rbx, rbx
je 0x1400480b8
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.1401488a0
mov r8, rbx
sub r8, rax
sub rdi, r8
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
sub rdi, rbp
jmp 0x1400480bb
Function at 0x140048494
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140322010]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x1400484cd
xor eax, eax
jmp 0x1400485ef
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x140048507
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x140048507
lea ecx, [r8 - 1]
mov eax, esi
mov dword [rdx], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
jmp 0x1400485ef
cmp qword [rbx + 0x80], 0
je 0x1400485ed
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140048542
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140048565
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call fcn.140153d70
cmp eax, edi
cmovne edi, esi
jmp 0x1400485ed
lea r8, [rbp - 0x40]
mov byte [rbp - 0x30], sil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp - 0x2f]
lea r8, [rbp - 8]
mov qword [rsp + 0x30], r8
lea r8, [rbp - 0x28]
mov qword [rsp + 0x28], r8
lea r8, [rbp - 0x38]
mov qword [rsp + 0x20], r8
lea r8, [rbp - 0x30]
call qword [rax + gethostname]
test eax, eax
je 0x1400485b3
sub eax, 1
je 0x1400485b3
cmp eax, 2
jne 0x1400485ed
movsx ecx, byte [rbp - 0x30]
jmp 0x14004854f
mov r14, qword [rbp - 0x40]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x1400485dd
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call fcn.14013b380
cmp r14, rax
jne 0x1400485ed
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x38], rax
mov eax, esi
jne 0x1400485ef
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400607e0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14004b2a8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140322010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14004b317
cmp byte [rcx + 0x71], 0
je 0x14004b317
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14004b36b
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x14004b331
sub eax, 1
je 0x14004b335
cmp eax, 2
jne 0x14004b36b
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400607e0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14004b362
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.14013b380
cmp rdi, rax
jne 0x14004b36b
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14004b319
xor al, al
jmp 0x14004b319

Function at 0x14004e0f4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140322010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.140061690
mov qword [rax], rbx
mov qword [rsp + 0x30], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14005d1c0]
xor edx, edx
xor ecx, ecx
call fcn.1401547d0
mov qword [rdi], rax
test rax, rax
je 0x14004e169
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400607e0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
and dword [rbx], 0
mov ecx, 6
call fcn.140063008
int3
Function at 0x14005c838
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov rbx, rcx
mov esi, 0x7fffffff
mov ebp, 0x9908b0df
mov r9, qword [rbx]
mov r8d, dword [r9]
cmp r8d, 0x270
jne 0x14005c8a8
lea r8, [r9 + 8]
mov r10d, 0x270
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
and edx, esi
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14005c86d
mov r8d, dword [r9]
jmp 0x14005c976
cmp r8d, 0x4e0
jb 0x14005c976
lea r10, [r9 + 0x9c4]
mov r11d, 0xe3
mov eax, dword [r10]
lea r8, [r10 + 4]
mov edx, dword [r8]
xor edx, eax
and edx, esi
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x14005c8c5
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov eax, dword [r10]
mov edx, eax
lea r8, [r10 + 4]
xor edx, dword [r8]
and edx, esi
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r10 - 0xd4c]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x14005c90a
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 4]
and edx, esi
xor edx, dword [r9 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
and dword [r9], 0
xor r8d, r8d
mov eax, r8d
mov edx, dword [r9 + rax*4 + 4]
mov ecx, edx
lea eax, [r8 + 1]
shr ecx, 0xb
mov dword [r9], eax
mov eax, dword [r9 + 0x1384]
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
cmp eax, dword [rbx + 0x10]
ja 0x14005c854
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
ret

Function at 0x14007bc40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x140065c72
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x140065c55
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x140065c40
Function at 0x140093880
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x30]
mov ecx, reloc.WS2_32.dll_recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x80]
mov dword [rsp + 0x54], 4
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
mov r8d, 0x1008
mov edx, 0xffff
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1400938f4
cmp dword [rsp + 0x34], 1
jne 0x1400938f4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.WS2_32.dll_send]
mov rcx, rsp
lea rdx, reloc.XINPUT1_3.dll_Ordinal_2
call fcn.1401a0ca0
add rsp, 0x70
pop rdi
ret

Function at 0x140099ad0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x1505
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jae 0x140099b5b
mov rax, qword [rsp + 0x28]
shl rax, 5
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
movzx ecx, byte [rsp + 0x30]
call fcn.1400bc140
movsx rax, al
mov rcx, qword [rsp + 0x28]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
jmp 0x140099afd
xor edx, edx
mov rax, qword [rsp + 0x28]
mov ecx, 0x100
div rcx
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1400b1b90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0xaa8]
test eax, eax
je 0x1400b1c9a
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x260], 0
je 0x1400b1c25
mov rcx, qword [rsp + 0x50]
call fcn.140091840
mov byte [rsp + 0x30], al
mov dl, 1
mov rcx, qword [rsp + 0x50]
call fcn.1400917d0
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x1d8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
call qword [rax + 0x260]
movzx edx, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call fcn.1400917d0
jmp 0x1400b1c9a
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x1400b1c44
cmp dword [rsp + 0x34], 1
je 0x1400b1c44
cmp dword [rsp + 0x34], 2
je 0x1400b1c44
jmp 0x1400b1c9a
movsxd rax, dword [rsp + 0x58]
imul rax, rax, 3
lea rcx, [0x1401af880]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
mov r9, qword [rcx + 0x1d0]
mov r8d, 1
mov edx, 2
mov rcx, rax
call fcn.14013b380
mov rax, qword [rsp + 0x50]
mov r9, qword [rax + 0x1d0]
mov r8d, 1
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.14013b380
add rsp, 0x40
pop rdi
ret

Function at 0x1400b56f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rcx, qword [rsp + 0x40]
call fcn.1400b5550
mov r8d, eax
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
call fcn.140177550
cdqe
add rsp, 0x20
pop rdi
ret
Function at 0x1400b5c60
Capabilities:
Initialize winsock library

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x220
lea rdi, [rsp + 0x30]
mov ecx, 0x7c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x230]
mov rax, qword [0x140322010]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov eax, dword [rsp + 0x230]
and eax, 2
test eax, eax
je 0x1400b5d37
mov eax, 0x202
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x50]
movzx ecx, word [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x1f4], eax
cmp dword [rsp + 0x1f4], 0
je 0x1400b5cdd
mov eax, 2
jmp 0x1400b5def
movzx eax, word [rsp + 0x50]
and rax, 0xff
movzx eax, al
movzx ecx, word [rsp + 0x30]
and rcx, 0xff
movzx ecx, cl
cmp eax, ecx
jne 0x1400b5d27
movzx eax, word [rsp + 0x50]
shr rax, 8
and rax, 0xff
movzx eax, al
movzx ecx, word [rsp + 0x30]
shr rcx, 8
and rcx, 0xff
movzx ecx, cl
cmp eax, ecx
je 0x1400b5d37
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
jmp 0x1400b5def
call fcn.1401167b0
mov dword [rsp + 0x1f8], eax
cmp dword [rsp + 0x1f8], 0
je 0x1400b5d59
mov eax, dword [rsp + 0x1f8]
jmp 0x1400b5def
lea rcx, str.iphlpapi.dll
call fcn.1400b5e90
mov qword [0x140338178], rax
cmp qword [0x140338178], 0
je 0x1400b5dac
lea rdx, str.if_nametoindex
mov rcx, qword [0x140338178]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x200], rax
cmp qword [rsp + 0x200], 0
je 0x1400b5dac
mov rax, qword [rsp + 0x200]
mov qword [0x140338170], rax
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov ecx, 6
call fcn.140116300
movzx eax, al
test eax, eax
je 0x1400b5dd9
mov byte [0x14033cf3c], 1
jmp 0x1400b5de0
mov byte [0x14033cf3c], 0
lea rcx, [0x14033cf40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_accept
call fcn.1401a0ca0
mov rax, rdi
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.1400607e0
add rsp, 0x220
pop rdi
ret