joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140162c30
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, r8
mov r8, rdx
mov qword [rsp + 0x48], rcx
mov rsi, qword [rsp + 0xd8]
mov ecx, dword [rsp + 0xe0]
mov rdx, qword [0x1403a6f68]
xor rdx, rsp
mov qword [rsp + 0x60], rdx
mov edx, dword [0x1403aea80]
mov r10, qword gs:[0x58]
mov rdx, qword [r10 + rdx*8]
mov rdx, qword [rdx + 8]
mov r15, qword [rdx + 0x18]
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x20], r9
lea rcx, [rsp + 0x58]
mov rdx, r15
mov r9, rax
call fcn.140162a10
mov rdx, qword [rsp + 0x58]
mov rcx, r15
call fcn.140162b50
mov rdi, rax
lea rbx, [rsi + 2]
lea r8, [rsi*2 + 4]
lea rcx, [rsp + 0x50]
mov edx, 0x59
mov r9d, 1
call fcn.140172c20
mov rdx, qword [rsp + 0x50]
mov rcx, r15
call fcn.1400f1dd0
mov r14, rax
mov rcx, r15
call fcn.1400f86a0
test rsi, rsi
jle 0x140162d3c
mov r15, rax
mov rbp, qword [rsp + 0xe8]
xor r13d, r13d
mov r12, rsi
nop word cs:[rax + rax]
mov rax, qword [rbp + 0x10]
mov r8, qword [rax + r13]
add r8, r8
mov qword [r15 + 8], r8
mov rcx, qword [r14 + 8]
lea rdx, [rcx + r13]
add rdx, 0x17
dec rcx
call fcn.1400ef370
add r13, 8
dec r12
jne 0x140162d10
mov r15, qword [rsp + 0xf0]
mov rax, qword [r15 + 8]
mov rcx, qword [rax + 0x3f]
call fcn.14011d070
mov rcx, qword [r14 + 8]
mov r8, qword [rax + 8]
lea rdx, [rcx + rsi*8]
add rdx, 0x1f
dec rcx
call fcn.1400ef370
mov rcx, qword [r14 + 8]
mov r8, qword [r15 + 8]
lea rdx, [rcx + rsi*8]
add rdx, 0x17
dec rcx
call fcn.1400ef370
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.140161cc0
mov rdx, qword [rdi + 8]
lea rcx, [rdx - 1]
mov r8, qword [r14 + 8]
add rdx, 0x17
call fcn.1400eeaa0
mov rax, qword [rdi + 8]
mov rsi, qword [rsp + 0x48]
mov qword [rsi], rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140262cb0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14016db30
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1403a6f68]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [0x1403aea80]
mov rcx, qword gs:[0x58]
mov r14, qword [rcx + rax*8]
mov rdi, qword [r14 + 8]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 8
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
mov edx, 0x3c
mov r8d, reloc.WS2_32.dll_recv
mov r9d, 1
call fcn.140149ae0
mov rcx, qword [rsp + 0x40]
call fcn.14016e6d0
mov rcx, qword [rax + 8]
mov qword [rcx + 7], rbx
mov rdx, qword [rax + 8]
mov rcx, qword [rdi + 0x18]
call fcn.14016e700
mov rbx, rax
mov r8d, 0x430
add r8, qword [rdi + 0x698]
mov rdx, qword [r14 + 8]
lea r14, [rsp + 0x40]
mov rcx, r14
call fcn.14012f140
mov rax, qword [rbx]
lea rdx, [rsp + 0x38]
mov rcx, rbx
mov r8, rdi
call qword [rax + 0x2d8]
lea rax, [0x140303b90]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x58]
call fcn.14009cef0
mov rcx, r14
call fcn.14010c790
mov rax, qword [rsp + 0x38]
mov qword [rbx + 8], rax
mov qword [rsi], rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140262cb0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14016e980
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
movaps xmm6, xmm1
mov rsi, rcx
mov rax, qword [0x1403a6f68]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov eax, dword [0x1403aea80]
mov rcx, qword gs:[0x58]
mov r14, qword [rcx + rax*8]
mov rdi, qword [r14 + 8]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 8
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0x48]
mov edx, 0x3d
mov r8d, reloc.WS2_32.dll_recv
mov r9d, 1
call fcn.140149ae0
mov rcx, qword [rsp + 0x48]
call fcn.14016e950
mov rcx, qword [rax + 8]
movsd qword [rcx + 7], xmm6
mov rdx, qword [rax + 8]
mov rcx, qword [rdi + 0x18]
call fcn.14016eaa0
mov rbx, rax
mov r8d, 0x430
add r8, qword [rdi + 0x698]
mov rdx, qword [r14 + 8]
lea r14, [rsp + 0x48]
mov rcx, r14
call fcn.14012f140
mov rax, qword [rbx]
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov r8, rdi
call qword [rax + 0x2d8]
lea rax, [0x140303b90]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x60]
call fcn.14009cef0
mov rcx, r14
call fcn.14010c790
mov rax, qword [rsp + 0x40]
mov qword [rbx + 8], rax
mov qword [rsi], rax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140262cb0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14016f030
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
jle 0x14016f048
mov eax, edx
and eax, 3
cmp rdx, 4
jae 0x14016f04f
xor r8d, r8d
jmp 0x14016f0d9
xor eax, eax
jmp 0x14016f108
movabs r8, 0x7ffffffffffffffc
and rdx, r8
xor r8d, r8d
nop
movzx r9d, byte [rcx]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, byte [rcx + 1]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
movzx r9d, byte [rcx + 2]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, byte [rcx + 3]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
add rcx, 4
add rdx, 0xfffffffffffffffc
jne 0x14016f060
test rax, rax
je 0x14016f104
xor edx, edx
movzx r9d, byte [rcx + rdx]
add r9d, r8d
mov r10d, r9d
shl r10d, 0xa
add r10d, r9d
mov r8d, r10d
shr r8d, 6
xor r8d, r10d
inc rdx
cmp rax, rdx
jne 0x14016f0e0
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
and eax, 0x3fffffff
cmp eax, 1
adc eax, 0
ret

Function at 0x14016f130
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
jle 0x14016f148
mov eax, edx
and eax, 3
cmp rdx, 4
jae 0x14016f14f
xor r8d, r8d
jmp 0x14016f1d9
xor eax, eax
jmp 0x14016f208
movabs r8, 0x7ffffffffffffffc
and rdx, r8
xor r8d, r8d
nop
movzx r9d, word [rcx]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, word [rcx + 2]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
movzx r9d, word [rcx + 4]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, word [rcx + 6]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
add rcx, 8
add rdx, 0xfffffffffffffffc
jne 0x14016f160
test rax, rax
je 0x14016f204
xor edx, edx
movzx r9d, word [rcx + rdx*2]
add r9d, r8d
mov r10d, r9d
shl r10d, 0xa
add r10d, r9d
mov r8d, r10d
shr r8d, 6
xor r8d, r10d
inc rdx
cmp rax, rdx
jne 0x14016f1e0
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
and eax, 0x3fffffff
cmp eax, 1
adc eax, 0
ret
Function at 0x140170130
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
movdqa xmmword [rsp + 0x90], xmm11
movdqa xmmword [rsp + 0x80], xmm10
movdqa xmmword [rsp + 0x70], xmm9
movdqa xmmword [rsp + 0x60], xmm8
movdqa xmmword [rsp + 0x50], xmm7
movdqa xmmword [rsp + 0x40], xmm6
mov rax, r8
mov r8, rdx
mov rsi, rcx
mov rcx, qword [0x1403a6f68]
xor rcx, rsp
mov qword [rsp + 0x38], rcx
test rax, rax
jle 0x140170334
xor ecx, ecx
cmp rax, 4
jae 0x14017019e
mov r11b, 1
xor r10d, r10d
mov rdx, rax
jmp 0x1401702f0
movabs r10, 0x7ffffffffffffffc
and r10, rax
movq xmm2, rax
movdqa xmm0, xmmword [0x14030d5b0]
pxor xmm1, xmm1
xor edx, edx
movdqa xmm3, xmmword [0x1402b36c0]
movdqa xmm4, xmmword [0x14030d5c0]
movdqa xmm5, xmmword [0x14030d5d0]
movdqa xmm6, xmmword [0x14030d5e0]
movdqa xmm7, xmmword [0x1402b36e0]
movdqa xmm8, xmm0
nop dword [rax + rax]
movdqa xmm10, xmm8
movdqa xmm8, xmm0
movq xmm11, qword [r8 + rdx*4]
movq xmm9, qword [r8 + rdx*4 + 8]
movdqa xmm0, xmm11
pxor xmm0, xmm3
pcmpgtd xmm0, xmm4
packssdw xmm0, xmm0
packsswb xmm0, xmm0
pandn xmm0, xmm8
movdqa xmm8, xmm9
pxor xmm8, xmm3
pcmpgtd xmm8, xmm4
packssdw xmm8, xmm8
packsswb xmm8, xmm8
pandn xmm8, xmm10
paddd xmm11, xmm5
paddd xmm9, xmm5
pxor xmm11, xmm3
movdqa xmm10, xmm6
pcmpgtd xmm10, xmm11
pshufd xmm10, xmm10, 0xd4
pand xmm10, xmm7
paddq xmm2, xmm10
pxor xmm9, xmm3
movdqa xmm10, xmm6
pcmpgtd xmm10, xmm9
pshufd xmm9, xmm10, 0xd4
pand xmm9, xmm7
paddq xmm1, xmm9
add rdx, 4
cmp r10, rdx
jne 0x1401701f0
paddq xmm1, xmm2
pshufd xmm2, xmm1, 0xee
paddq xmm2, xmm1
movq rdx, xmm2
movdqa xmm1, xmmword [0x14030d5b0]
pcmpeqb xmm0, xmm1
pcmpeqd xmm2, xmm2
pxor xmm0, xmm2
pcmpeqb xmm8, xmm1
pxor xmm8, xmm2
por xmm8, xmm0
punpcklbw xmm8, xmm8
pshuflw xmm0, xmm8, 0x50
pshufd xmm0, xmm0, 0x50
movmskpd r11d, xmm0
test r11d, r11d
sete r11b
cmp r10, rax
je 0x14017031a
nop word [rax + rax]
mov edi, dword [r8 + r10*4]
cmp edi, 0x100
movzx r11d, r11b
cmovae r11d, ecx
add edi, 0xffff0000
cmp edi, 0x100000
adc rdx, 0
inc r10
cmp rax, r10
jne 0x1401702f0
test r11b, 1
jne 0x140170334
mov dword [rsp + 0x20], r9d
lea rcx, [rsp + 0x30]
mov r9, rax
call fcn.140170540
jmp 0x140170344
lea rcx, [rsp + 0x30]
mov rdx, r8
mov r8, rax
call fcn.140170390
mov rax, qword [rsp + 0x30]
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140262cb0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm8, xmmword [rsp + 0x60]
movaps xmm9, xmmword [rsp + 0x70]
movaps xmm10, xmmword [rsp + 0x80]
movaps xmm11, xmmword [rsp + 0x90]
add rsp, 0xa8
pop rdi
pop rsi
ret
Function at 0x14017fe10
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1403a6f68]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov qword [rcx], rdx
mov rax, qword [rdx + 0x18]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], r8
lea rdi, [rcx + 0x18]
mov rcx, qword [rdx + 0x18]
xorps xmm0, xmm0
movups xmmword [rsi + 0x18], xmm0
mov qword [rsi + 0x28], 0
mov qword [rsi + 0x30], rcx
mov qword [rsi + 0x20], 2
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
sub rdx, rax
cmp rdx, 0x10
jge 0x14017fe7a
mov edx, reloc.WS2_32.dll_recv
call fcn.1401c63e0
jmp 0x14017fe86
lea rdx, [rax + 0x10]
mov qword [rcx], rdx
add qword [rcx + 0x10], 0x10
mov qword [rsi + 0x28], rax
lea rcx, [rsp + 0x20]
mov edx, 2
xor r8d, r8d
call fcn.14014d470
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rsp + 0x20]
call fcn.1400f9a40
mov qword [rsi + 0x38], rax
mov rax, qword [rbx + 0x18]
xorps xmm0, xmm0
movups xmmword [rsi + 0x40], xmm0
mov qword [rsi + 0x50], 0
mov qword [rsi + 0x58], rax
mov eax, dword [0x1403aea80]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
mov rax, qword [rbx + 8]
mov rax, qword [rax + 0x18]
movups xmmword [rsi + 0x60], xmm0
mov qword [rsi + 0x70], 0
mov qword [rsi + 0x78], rax
mov rax, qword [rbx + 8]
mov rax, qword [rax + 0x18]
movups xmmword [rsi + 0x80], xmm0
mov qword [rsi + 0x90], 0
mov qword [rsi + 0x98], rax
mov rax, qword [rbx + 8]
mov rax, qword [rax + 0x18]
movups xmmword [rsi + 0xa0], xmm0
mov qword [rsi + 0xb0], 0
mov qword [rsi + 0xb8], rax
mov rax, qword [rbx + 8]
mov rax, qword [rax + 0x18]
movups xmmword [rsi + 0xc0], xmm0
mov qword [rsi + 0xd0], 0
mov qword [rsi + 0xd8], rax
mov rax, qword [rbx + 8]
mov rax, qword [rax + 0x18]
movups xmmword [rsi + 0xe0], xmm0
mov qword [rsi + 0xf0], 0
mov qword [rsi + 0xf8], rax
movups xmmword [rsi + 0x100], xmm0
mov edx, 2
mov rcx, rdi
call fcn.1400f9b60
mov rdi, qword [0x1403a4da0]
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x18]
call fcn.1401273c0
mov qword [rax + 8], rdi
mov qword [rax], 0
mov rcx, qword [rsi + 0x28]
mov qword [rcx], rax
mov rdi, qword [0x1403a4da0]
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x18]
call fcn.1401273c0
mov qword [rax + 8], rdi
mov qword [rax], 0
mov rcx, qword [rsi + 0x28]
mov qword [rcx + 8], rax
mov rcx, qword [rsi + 0x38]
mov rdx, qword [0x1403aa520]
xor r8d, r8d
call fcn.14014d720
mov rcx, qword [rsi + 0x38]
mov rdx, qword [0x1403aa520]
xor r8d, r8d
call fcn.14014d720
mov qword [rsi + 0x100], 2
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140262cb0
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x14018c8f0
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1403a6f68]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 0x18
call fcn.140262f30
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rsi
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
lea r8, [0x14018c820]
xor esi, esi
xor ecx, ecx
mov edx, 0x100000
mov r9, rax
call fcn.1402829a0
lea rcx, [rax + 1]
cmp rcx, 1
ja 0x14018c961
call fcn.140276810
mov esi, dword [rax]
jmp 0x14018c96a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140262cb0
mov eax, esi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x14018c990
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x1403a6f68]
xor rax, rsp
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14018c9d3
mov ecx, eax
mov rdx, rsi
mov esi, eax
call fcn.14018ca10
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140262cb0
mov eax, esi
add rsp, 0x40
pop rsi
ret
lea rax, str..._.._runtime_vm_os_thread_win.cc
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], WSASetLastError
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.TlsAlloc_failed__d
lea rcx, [rsp + 0x28]
mov r8d, eax
call fcn.140023df0
int3

Function at 0x14018cba0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1403a6f68]
xor rax, rsp
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14018cbd0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140262cb0
nop
add rsp, 0x38
ret
lea rax, str..._.._runtime_vm_os_thread_win.cc
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0xe2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.TlsSetValue_failed__d
lea rcx, [rsp + 0x20]
mov r8d, eax
call fcn.140023df0
int3
Function at 0x14018fe30
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xf0
movaps xmmword [rsp + 0xe0], xmm6
mov r14, r9
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1403a6f68]
xor rax, rsp
mov qword [rsp + 0xd8], rax
mov byte [r8 + 8], 0
mov qword [rcx + 0x30], r8
mov eax, dword [0x1403aea80]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x18]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x40]
mov qword [rdi + 0x20], rax
lea r15, [rsp + 0x30]
mov rcx, r15
call fcn.14019ede0
mov rcx, qword [rdi + 0x30]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + 0x128]
mov dword [rsp + 0xa6], 0
mov byte [rsp + 0xaa], 0
mov dword [rsp + 0xac], 0
mov byte [rsp + 0xb0], 0
mov dword [rsp + 0xb2], 0
mov byte [rsp + 0xb6], 0
mov qword [rsp + 0xb8], 0
mov byte [rsp + 0xc0], 0
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x90], xmm6
mov qword [rsp + 0x9d], 0
mov qword [rsp + 0xc8], WSAGetLastError
mov dword [rsp + 0xd0], 0xffffffff
mov rax, qword [r14]
lea r8, [rsp + 0x60]
mov rcx, r14
mov rdx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 0x30]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + 0x30]
mov rcx, qword [rdi + 0x30]
mov rax, qword [rcx]
call qword [rax + 0xc8]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x14018ffb9
lea r14, [rsp + 0x60]
nop dword [rax + rax]
lea rcx, [rax - 1]
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rdx + rax*8 - 8]
mov rax, qword [rcx]
mov rdx, rdi
mov r8, r14
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [rsp + 0x40]
test rax, rax
jne 0x14018ff90
cmp byte [rdi + 0x39], 0
je 0x14018ffd1
mov rcx, 0xffffffffffffffff
lea rdx, str.RegExp_too_big
xor eax, eax
jmp 0x14018ffee
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.1401a0ac0
mov rcx, qword [rsp + 0x28]
call fcn.140190030
mov rcx, qword [rdi + 8]
xor edx, edx
mov qword [rsi], rdx
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.140262cb0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140191100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r15, qword [rsp + 0xb0]
cmp qword [r15], 0
je 0x1401911e3
mov rsi, r9
mov r12, r8
mov r14, rdx
mov rax, qword [rcx]
cmp dword [r9 + 0x70], 0
sete byte [rsp + 0x20]
xor r13d, r13d
mov rdx, r15
mov r8, r14
xor r9d, r9d
call qword [rax + 0x20]
cmp byte [r15 + 0x28], 0
jne 0x1401911e6
movzx eax, byte [r14 + 0x38]
test al, al
mov ecx, 0xffff
mov edx, 0xff
cmove edx, ecx
mov qword [r15 + 0x20], 0
mov r9, qword [r15]
xor r13d, r13d
test r9, r9
jle 0x1401911e6
xor ecx, ecx
test al, al
sete cl
lea r8d, [rcx*8 + 8]
lea r10, [r15 + 0xa]
mov r11d, 1
mov qword [rsp + 0x30], r9
mov rax, r9
xor edi, edi
xor ebp, ebp
xor ebx, ebx
movzx r9d, word [r10 - 2]
test r9b, r9b
movzx edi, dil
cmovne edi, r11d
and r9d, edx
mov ecx, r13d
shl r9d, cl
or ebp, r9d
mov dword [r15 + 0x20], ebp
movzx r9d, word [r10]
and r9d, edx
shl r9d, cl
or ebx, r9d
mov dword [r15 + 0x24], ebx
add r13d, r8d
add r10, 6
dec rax
jne 0x1401911a0
test dil, 1
jne 0x1401911fa
xor r13d, r13d
mov eax, r13d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r13, qword [r14 + 0x30]
mov rcx, qword [rsp + 0x30]
cmp qword [rsi + 0x28], rcx
je 0x140191233
movzx r9d, byte [rsp + 0xa0]
xor r9b, 1
mov r8, qword [r12 + 0x10]
mov rdx, qword [rsi]
mov rax, qword [r13]
mov qword [rsp + 0x20], rcx
mov rcx, r13
call qword [rax + 0x100]
mov rcx, qword [r15]
cmp rcx, 2
je 0x140191257
cmp rcx, 1
jne 0x140191264
cmp byte [r14 + 0x38], 0
mov eax, 0xffff
mov ecx, 0xff
cmove ecx, eax
and ebp, ecx
cmp ebp, ecx
jmp 0x140191267
cmp byte [r14 + 0x38], 0
je 0x140191264
cmp bp, 0xffff
jmp 0x140191267
cmp ebp, 0xffffffff
setne al
cmp byte [rsp + 0xb8], 0
je 0x140191292
mov r10, qword [r13]
mov rcx, r13
mov edx, ebx
test al, al
je 0x1401912af
mov r8d, ebp
mov r9, qword [rsp + 0xa8]
call qword [r10 + 0x48]
jmp 0x1401912c7
mov r9, qword [rsi + 0x10]
mov r10, qword [r13]
mov rcx, r13
mov edx, ebx
test al, al
je 0x1401912bd
mov r8d, ebp
call qword [r10 + 0x88]
jmp 0x1401912c7
mov r8, qword [rsp + 0xa8]
call qword [r10 + 0x40]
jmp 0x1401912c7
mov r8, r9
call qword [r10 + 0x80]
mov r13b, 1
jmp 0x1401911e6
Function at 0x140192510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x1403a6f68]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x50], 0
movzx eax, byte [rsp + 0xd0]
setne bpl
or bpl, al
mov rax, qword [rcx + 0x48]
mov r12, qword [rax]
mov rax, qword [rax + 0x10]
mov rcx, qword [rax]
mov rax, qword [rcx]
mov byte [rsp + 0x20], bpl
call qword [rax + 0x20]
cmp r12, 2
jl 0x1401926c0
lea r13, [rsp + 0x50]
lea rax, [rsi + rsi*2]
lea rax, [rax*2 + 0xc]
mov qword [rsp + 0x28], rax
mov r15d, 1
jmp 0x1401925b6
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
movups xmm2, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x20], xmm2
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx], xmm0
inc r15
cmp r15, r12
je 0x1401926c0
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
mov dword [rsp + 0x3e], 0
mov byte [rsp + 0x42], 0
mov dword [rsp + 0x44], 0
mov byte [rsp + 0x48], 0
mov dword [rsp + 0x4a], 0
mov byte [rsp + 0x4e], 0
mov byte [r13 + 8], 0
mov qword [r13], 0
mov rax, qword [r14 + 0x48]
mov rax, qword [rax + 0x10]
mov rcx, r15
shl rcx, 4
mov rcx, qword [rax + rcx]
mov rax, qword [rcx]
mov byte [rsp + 0x20], bpl
lea rdx, [rsp + 0x30]
mov r8, rdi
mov r9, rsi
call qword [rax + 0x20]
cmp byte [rsp + 0x58], 0
jne 0x1401925aa
cmp byte [rbx + 0x28], 0
jne 0x140192590
mov rax, qword [rsp + 0x28]
mov rcx, rsi
cmp qword [rbx], rsi
jg 0x14019268e
jmp 0x1401925aa
mov byte [rbx + rax], 0
mov r11d, r10d
and r11d, r9d
mov r9d, r8d
and r9d, r11d
mov word [rsp + rax + 0x2e], r9w
xor r8d, edx
not r8d
and r8d, r11d
mov word [rbx + rax - 4], r8w
and r8d, edx
mov word [rbx + rax - 2], r8w
inc rcx
add rax, 6
cmp rcx, qword [rbx]
jge 0x1401925aa
movzx r9d, word [rbx + rax - 4]
movzx edx, word [rbx + rax - 2]
movzx r10d, word [rsp + rax + 0x2c]
movzx r8d, word [rsp + rax + 0x2e]
cmp r9w, r10w
jne 0x140192650
cmp dx, r8w
jne 0x140192650
cmp byte [rsp + rax + 0x30], 0
mov r8d, edx
mov r11d, r9d
jne 0x140192657
jmp 0x140192650
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140262cb0
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401a4870
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
call fcn.1401a4700
mov rax, qword [rsi + 0x60]
cmp rax, 1
je 0x1401a48c1
test rax, rax
jne 0x1401a48cd
mov eax, dword [0x1403aa780]
mov ecx, dword [0x1403aea80]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x10]
jg 0x1401a4973
mov rax, qword [0x1403aa778]
jmp 0x1401a4969
mov rax, qword [rsi + 0x70]
mov rax, qword [rax]
jmp 0x1401a4969
mov rdx, qword [rsi]
mov ecx, 0x20
call fcn.14010c6d0
mov rdi, rax
mov eax, dword [0x1403aea80]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x18]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], rax
cmp qword [rsi + 0x60], 0
jle 0x1401a494b
xor ebx, ebx
nop word cs:[rax + rax]
mov r14, qword [rsi + 0x70]
mov rdx, qword [rdi]
inc rdx
mov rcx, rdi
call fcn.1400f9b60
mov rax, qword [r14 + rbx*8]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 0x10]
mov qword [rdx + rcx*8 - 8], rax
inc rbx
cmp rbx, qword [rsi + 0x60]
jl 0x1401a4920
mov rdx, qword [rsi]
mov ecx, 0x20
call fcn.14010c6d0
mov rsi, rax
mov rcx, rax
mov rdx, rdi
call fcn.1401a1710
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1403aa780]
call fcn.140263138
cmp dword [0x1403aa780], 0xffffffff
jne 0x1401a48b5
mov ecx, 8
call fcn.140262f30
lea rcx, [0x140324ea0]
mov qword [rax], rcx
mov qword [0x1403aa778], rax
lea rcx, [0x1403aa780]
call fcn.1402630d8
jmp 0x1401a48b5
Function at 0x1401a95a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, r8
mov rax, qword [0x1403a6f68]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov eax, dword [0x1403aea80]
mov r8, qword gs:[0x58]
mov rax, qword [r8 + rax*8]
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x58], 0x200000
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov byte [rsp + 0x78], 1
mov dword [rsp + 0x7c], edx
mov dword [rsp + 0x80], 0
mov rax, qword [rcx + 8]
mov rcx, qword [rax + 7]
cmp rcx, 2
jl 0x1401a9642
lea rcx, [rsp + 0x30]
mov dl, 1
call fcn.1401a4e80
mov dword [rsp + 0x58], eax
jmp 0x1401a965e
mov dword [rsp + 0x58], 0x200000
mov rax, qword [rax + 7]
sar rax, 1
inc rax
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x78], 0
lea rbx, [rsp + 0x30]
mov rcx, rbx
call fcn.1401a5150
mov rdi, rax
mov rcx, rbx
call fcn.1401a6660
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x98]
test al, al
je 0x1401a96b3
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x90]
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx + 7]
sar rcx, 1
cmp qword [rax], rcx
jne 0x1401a96b3
mov byte [rsp + 0x80], 1
mov qword [rsi], rdi
mov rbx, qword [rsp + 0x68]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x98]
cmp byte [rsp + 0x80], 0
setne cl
test rbx, rbx
sete dl
and dl, cl
and dl, al
mov byte [rsi + 0x10], dl
movzx eax, byte [rsp + 0x81]
mov byte [rsi + 0x11], al
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
call fcn.1401a8a80
mov rax, qword [rsi + 0x18]
mov rcx, qword [rsp + 0x28]
mov qword [rax + 8], rcx
mov qword [rsi + 0x28], rbx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140262cb0
nop
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret