joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140085ef0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x60
mov rax, qword [0x140229680]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword [rcx + 0x78]
xor esi, esi
mov qword [rsp + 0x48], rsi
mov rbx, rcx
test rax, rax
je 0x140086019
mov rdx, qword [rax]
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x50], rsi
add rdx, 0x18
je 0x140086019
mov rax, qword [rcx + 0x70]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], r8
mov r9d, 8
lea r8, [rsp + 0x48]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
cmp qword [rsp + 0x48], rsi
je 0x140086019
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, qword [rbx]
lea r9, [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov r8, rax
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], esi
mov rcx, qword [rcx]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140085fa8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x78]
mov qword [rsp + 0x40], rsi
test rdx, rdx
je 0x140085fdf
mov rax, qword [rdx + 0x18]
lea r8, [rsp + 0x40]
mov rdx, qword [rdx]
mov r9d, 8
add rdx, 0x18
mov qword [rsp + 0x20], rsi
mov rcx, qword [rax + 0x70]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rcx]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rdx, qword [rbx + 0x88]
mov qword [rsp + 0x40], rsi
test rdx, rdx
je 0x140086019
mov rax, qword [rdx + 0x18]
lea r8, [rsp + 0x40]
mov rdx, qword [rdx]
mov r9d, 8
add rdx, 0x18
mov qword [rsp + 0x20], rsi
mov rcx, qword [rax + 0x70]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rcx]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x14008602c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x40], rsi
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400860da
call fcn.140085d70
test al, al
je 0x1400860da
mov rcx, qword [rbx + 0x20]
xor edx, edx
mov qword [rsp + 0x78], rdi
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x20]
mov edx, 0xffffffff
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdi, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x140086087
jle 0x140086083
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x10], rsi
mov dword [rdi + 8], esi
mov rdi, qword [rbx + 0x28]
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x28], rsi
test rdi, rdi
je 0x1400860c7
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x1400860c7
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock xadd dword [rdi + 0xc], esi
cmp esi, 1
jne 0x1400860c7
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rbx + 0x48]
mov rdi, qword [rsp + 0x78]
test rcx, rcx
je 0x1400860da
call fcn.140085bd0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f3120
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rsi
ret
Function at 0x1400866d0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140229680]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [0x14022d158], 0
jne 0x140086741
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x24]
dec ecx
mov eax, ecx
shr eax, 1
or ecx, eax
mov eax, ecx
shr eax, 2
or ecx, eax
mov eax, ecx
shr eax, 4
or ecx, eax
mov eax, ecx
shr eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x10
or eax, ecx
inc eax
mov qword [0x14022d148], rax
mov eax, dword [rsp + 0x48]
mov qword [0x14022d150], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [0x14022d158], rax
lea rax, [0x14022d148]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400f3120
add rsp, 0x68
ret
Function at 0x140087d60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140229680]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r14, rcx
mov qword [rsp + 0x58], rcx
xor ebx, ebx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.14012ade0
mov dword [rsp + 0x58], 0x104
call fcn.14007f0f0
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.QueryFullProcessImageNameW
lea rcx, [rsp + 0x20]
call fcn.14000b230
nop
call fcn.140082880
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
movabs r9, 0xcbf29ce484222325
mov ecx, ebx
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x140087e43
movabs r10, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x140087e30
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.14007fb50
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140087e68
cmp rdx, qword [rsi + 8]
je 0x140087e68
mov rbx, qword [rdx + 0x30]
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0x20]
call fcn.14000a070
test rbx, rbx
je 0x140087e9b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
xor edx, edx
call rbx
jmp 0x140087ead
mov r8d, dword [rsp + 0x58]
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140087ed0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.14007fa30
nop
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.140087c50
nop
lea rcx, [rsp + 0x20]
call fcn.14007f6e0
mov rax, r14
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400f3120
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140088720
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
xor esi, esi
mov rcx, qword [rcx + 0x10]
movzx edi, dl
test rcx, rcx
je 0x14008874c
jle 0x140088748
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbx + 0x10], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140088761
jle 0x14008875d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], rsi
mov rcx, qword [rbx]
test rcx, rcx
je 0x140088774
jle 0x140088771
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rsi
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x140088789
jle 0x140088785
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov qword [rbx + 0x48], rsi
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x28], rsi
test dil, dil
jne 0x1400887e8
lea rax, [rbx + 0xf8]
mov qword [rax + 0x10], rsi
cmp qword [rax + 0x18], 7
jbe 0x1400887ab
mov rax, qword [rax]
mov word [rax], si
cmp byte [rbx + 0x1c], sil
je 0x1400887d0
add rbx, 0x118
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x1400887c8
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400887d7
add rbx, 0x118
mov qword [rbx + 0x10], rsi
cmp qword [rbx + 0x18], 7
jbe 0x1400887e5
mov rbx, qword [rbx]
mov word [rbx], si
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14008c5c0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rdi + 8], eax
jne 0x14008c5e5
mov al, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rax, qword [rdi]
mov rcx, qword [rax + 0x10]
cmp dword [rcx + 0x10], 3
jne 0x14008c658
cmp byte [rcx + 0x16], 0
jne 0x14008c658
call fcn.14007f0f0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.Wow64SuspendThread
lea rcx, [rsp + 0x20]
call fcn.14000b230
nop
lea r8, [rdi + 0x10]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14008c680
cmp eax, 0xffffffff
setne bl
lea rcx, [rsp + 0x20]
call fcn.14000a070
movzx eax, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
setne al
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x14008c680
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, r8
mov rbx, rdx
mov rsi, rcx
call fcn.140082880
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [rbx + 0x18], 0xf
mov rdx, rbx
mov r10, qword [rbx + 0x10]
jbe 0x14008c6b6
mov rdx, qword [rbx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x14008c6e4
movabs r8, 0x100000001b3
movzx eax, byte [rdx + rcx]
inc rcx
xor r9, rax
imul r9, r8
cmp rcx, r10
jb 0x14008c6d1
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14007fb50
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x14008c72c
cmp rbx, qword [rsi + 8]
je 0x14008c72c
mov rbx, qword [rbx + 0x30]
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14008c736
mov rcx, qword [r14]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
jmp rax
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14008c750
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x970
mov rax, qword [0x140229680]
xor rax, rsp
mov qword [rsp + 0x960], rax
mov edi, edx
mov rbx, rcx
cmp edx, 4
ja 0x14008c8ed
xor edx, edx
mov qword [rsp + 0x988], rsi
mov r8d, 0x670
lea rcx, [rsp + 0x2f0]
call fcn.14012ade0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2cc
call fcn.14012ade0
mov rcx, qword [rbx]
mov rdx, qword [rbx + 0x10]
mov rax, qword [rcx + 0x10]
movzx esi, byte [rax + 0x16]
test sil, sil
jne 0x14008c7df
mov dword [rsp + 0x320], 0x100010
lea r8, [rsp + 0x2f0]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x58]
jmp 0x14008c7f6
mov dword [rsp + 0x20], 0x100010
lea r8, [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x50]
test sil, sil
lea r8, [rsp + 0x360]
lea rcx, [rsp + 0x38]
cmovne r8, rcx
test eax, eax
js 0x14008c8c4
mov edx, dword [r8]
test edi, edi
jne 0x14008c821
and edx, 0xfff0fffe
jmp 0x14008c841
cmp edi, 1
jne 0x14008c82e
and edx, 0xff0ffffb
jmp 0x14008c841
cmp edi, 2
jne 0x14008c83b
and edx, 0xf0ffffef
jmp 0x14008c841
and edx, 0xfffffbf
mov eax, edx
mov dword [r8], edx
shr eax, 2
mov ecx, eax
or ecx, edx
shr ecx, 4
or ecx, eax
or ecx, edx
test cl, 1
jne 0x14008c860
btr edx, 8
mov dword [r8], edx
mov rcx, rbx
mov edi, 0xc000071c
call fcn.14008c5c0
test sil, sil
jne 0x14008c891
test al, al
je 0x14008c8c2
mov rax, qword [rbx]
lea r8, [rsp + 0x2f0]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x68]
jmp 0x14008c8ab
test al, al
je 0x14008c8c2
mov rax, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 8], eax
je 0x14008c8c2
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, edi
mov rsi, qword [rsp + 0x988]
mov rcx, qword [rsp + 0x960]
xor rcx, rsp
call fcn.1400f3120
mov rbx, qword [rsp + 0x990]
add rsp, 0x970
pop rdi
ret
xor eax, eax
jmp 0x14008c8cc
Function at 0x14008c900
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x970
mov rax, qword [0x140229680]
xor rax, rsp
mov qword [rsp + 0x960], rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x2f0]
mov r8d, 0x670
call fcn.14012ade0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2cc
call fcn.14012ade0
mov rcx, qword [rdi]
mov rdx, qword [rdi + 0x10]
mov rax, qword [rcx + 0x10]
movzx esi, byte [rax + 0x16]
test sil, sil
jne 0x14008c984
mov dword [rsp + 0x320], 0x100010
lea r8, [rsp + 0x2f0]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x58]
jmp 0x14008c99b
mov dword [rsp + 0x20], 0x100010
lea r8, [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x50]
test sil, sil
lea r8, [rsp + 0x360]
lea rcx, [rsp + 0x38]
cmovne r8, rcx
test eax, eax
jns 0x14008c9ba
xor eax, eax
jmp 0x14008caad
xor edx, edx
mov ecx, edx
mov eax, edx
cmp qword [rsp + rax*8 + 0x338], rbx
je 0x14008c9e5
cmp dword [rsp + rax*4 + 0x24], ebx
je 0x14008c9e5
inc ecx
inc rax
cmp rax, 4
jl 0x14008c9c0
mov eax, 0xc0000225
jmp 0x14008caad
movsxd rax, ecx
test sil, sil
jne 0x14008c9f7
mov qword [rsp + rax*8 + 0x338], rdx
jmp 0x14008c9fb
mov dword [rsp + rax*4 + 0x24], edx
mov edx, dword [r8]
test ecx, ecx
jne 0x14008ca0a
and edx, 0xfff0fffe
jmp 0x14008ca2a
cmp ecx, 1
jne 0x14008ca17
and edx, 0xff0ffffb
jmp 0x14008ca2a
cmp ecx, 2
jne 0x14008ca24
and edx, 0xf0ffffef
jmp 0x14008ca2a
and edx, 0xfffffbf
mov eax, edx
mov dword [r8], edx
shr eax, 2
mov ecx, eax
or ecx, edx
shr ecx, 4
or ecx, eax
or ecx, edx
test cl, 1
jne 0x14008ca49
btr edx, 8
mov dword [r8], edx
mov rcx, rdi
mov ebx, 0xc000071c
call fcn.14008c5c0
test sil, sil
jne 0x14008ca7a
test al, al
je 0x14008caab
mov rax, qword [rdi]
lea r8, [rsp + 0x2f0]
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x68]
jmp 0x14008ca94
test al, al
je 0x14008caab
mov rax, qword [rdi]
lea r8, [rsp + 0x20]
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rdi + 8], eax
je 0x14008caab
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, ebx
mov rcx, qword [rsp + 0x960]
xor rcx, rsp
call fcn.1400f3120
lea r11, [rsp + 0x970]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14008cba0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140229680]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, r9
mov r15d, r8d
mov r14, rdx
mov rbp, rcx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
call fcn.14007f0f0
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.NtQueryVirtualMemory
lea rcx, [rsp + 0x30]
call fcn.14000b230
nop
call fcn.140082880
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
movabs r9, 0xcbf29ce484222325
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x14008cc54
movabs r8, 0x100000001b3
movzx eax, byte [rcx + rbx]
xor r9, rax
imul r9, r8
inc rbx
cmp rbx, rdx
jb 0x14008cc41
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14007fb50
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14008ccb2
cmp rdx, qword [rsi + 8]
je 0x14008ccb2
mov rbx, qword [rdx + 0x30]
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14008ccbc
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9, r12
mov r8d, r15d
mov rdx, r14
mov rcx, qword [rbp + 8]
call rbx
mov ebx, eax
jmp 0x14008ccc1
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
lea rcx, [rsp + 0x30]
call fcn.14000a070
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400f3120
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14008cdf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140229680]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12d, r9d
mov r15, r8
mov r14d, edx
mov rbp, rcx
xor ebx, ebx
mov dword [rsp + 0x60], ebx
call fcn.14007f0f0
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov r8d, Ordinal_27
lea rdx, str.NtQueryInformationProcess
lea rcx, [rsp + 0x30]
call fcn.14000b230
nop
call fcn.140082880
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
movabs r9, 0xcbf29ce484222325
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x14008cea3
movabs r8, 0x100000001b3
movzx eax, byte [rcx + rbx]
xor r9, rax
imul r9, r8
inc rbx
cmp rbx, rdx
jb 0x14008ce90
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14007fb50
mov r10, qword [rax + 8]
test r10, r10
je 0x14008cef4
cmp r10, qword [rsi + 8]
je 0x14008cef4
mov rbx, qword [r10 + 0x30]
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14008cefe
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, r12d
mov r8, r15
mov edx, r14d
mov rcx, qword [rbp + 8]
call rbx
mov ebx, eax
jmp 0x14008cf03
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
lea rcx, [rsp + 0x30]
call fcn.14000a070
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400f3120
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14008cf30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r12d, r9d
mov r15, r8
mov r14d, edx
mov rbp, rcx
call fcn.14007f0f0
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.NtSetInformationProcess
lea rcx, [rsp + 0x20]
call fcn.14000b230
nop
call fcn.140082880
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
movabs r9, 0xcbf29ce484222325
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x14008cfd3
movabs r8, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rbx]
xor r9, rax
imul r9, r8
inc rbx
cmp rbx, rdx
jb 0x14008cfc0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14007fb50
mov r10, qword [rax + 8]
test r10, r10
je 0x14008d01a
cmp r10, qword [rsi + 8]
je 0x14008d01a
mov rbx, qword [r10 + 0x30]
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14008d024
mov r9d, r12d
mov r8, r15
mov edx, r14d
mov rcx, qword [rbp + 8]
call rbx
mov ebx, eax
jmp 0x14008d029
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
lea rcx, [rsp + 0x20]
call fcn.14000a070
mov eax, ebx
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14008d050
Capabilities:
Create thread
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
mov r15, r9
mov r14, r8
mov rdi, rdx
mov r13, rcx
call fcn.14007f0f0
mov rbp, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor r12d, r12d
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.NtCreateThreadEx
lea rcx, [rsp + 0x60]
call fcn.14000b230
nop
call fcn.140082880
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rdx, qword [rsp + 0x60]
movabs r9, 0xcbf29ce484222325
mov ecx, r12d
mov r8, qword [rsp + 0x70]
test r8, r8
je 0x14008d103
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x14008d0f0
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov rcx, rbp
call fcn.14007fb50
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x14008d137
cmp rbx, qword [rbp + 8]
je 0x14008d137
mov rbx, qword [rbx + 0x30]
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14008d144
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, r12
lea rcx, [rsp + 0x60]
call fcn.14000a070
mov r10, qword [r13 + 8]
xor r8d, r8d
test rbx, rbx
je 0x14008d1a3
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], 0x100000
mov qword [rsp + 0x40], 0x1000
mov qword [rsp + 0x38], r12
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov r9, r10
mov edx, dword [rsp + 0x108]
mov rcx, rdi
call rbx
test eax, eax
jns 0x14008d1e8
mov qword [rdi], r12
jmp 0x14008d1e8
mov ecx, dword [rsp + 0x100]
and ecx, 1
shl ecx, 2
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r15
mov r9, r14
xor edx, edx
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rdi], rax
test rax, rax
je 0x14008d1d9
mov eax, r12d
jmp 0x14008d1e8
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14008d230
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov r14, r8
mov rbp, rdx
cmp byte [rcx + 0x15], 0
jne 0x14008d255
xor eax, eax
jmp 0x14008d34c
call fcn.14007f0f0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.Wow64GetThreadContext
lea rcx, [rsp + 0x20]
call fcn.14000b230
nop
call fcn.140082880
lea rsi, [rdi + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
movabs r9, 0xcbf29ce484222325
mov ecx, ebx
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x14008d2e3
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x14008d2d0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14007fb50
mov r8, qword [rax + 8]
test r8, r8
je 0x14008d322
cmp r8, qword [rdi + 8]
je 0x14008d322
mov rdi, qword [r8 + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x14008d32b
mov rdx, r14
mov rcx, rbp
call rdi
mov edi, eax
jmp 0x14008d32d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, ebx
lea rcx, [rsp + 0x20]
call fcn.14000a070
test edi, edi
jne 0x14008d34a
mov rax, qword gs:[0x30]
mov ebx, dword [rax + 0x1250]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret