joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400312a0
Capabilities:
Start service

Disassembly:
push rbx
sub rsp, 0x30
lea rdx, str.ServicesActive
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x1400312cc
or eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
mov qword [rsp + 0x40], rsi
lea rsi, str.AMD_FUEL_Service
mov r8d, 0xf01ff
mov rcx, rax
mov rdx, rsi
mov qword [rsp + 0x48], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
jne 0x140031313
mov rsi, qword [rsp + 0x40]
lea eax, [rdi - 2]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
lea rax, str._start
lea r8, [rsp + 0x20]
mov edx, 2
mov rcx, rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140031350
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, 0xfffffffd
add rsp, 0x30
pop rbx
ret
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x140031370
Capabilities:
Stop service

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x140055020]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rdx, str.ServicesActive
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x1400313b8
or eax, 0xffffffff
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140032000
add rsp, 0x50
pop rdi
ret
lea rdx, str.AMD_FUEL_Service
mov r8d, 0xf01ff
mov rcx, rax
mov qword [rsp + 0x60], rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
jne 0x1400313e9
lea eax, [rbx - 2]
jmp 0x140031418
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14003140d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0xfffffffd
jmp 0x140031418
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140032000
add rsp, 0x50
pop rdi
ret

Function at 0x140031430
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x58
xor ecx, ecx
lea rax, [rsp + 0x68]
lea rdx, str.SOFTWAREAMDFuel
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
xor r9d, r9d
mov rcx, 0xffffffff80000002
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14003147f
xor al, al
add rsp, 0x58
ret
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
lea rdx, str.ServiceStatus
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 1
movzx ebx, bl
test eax, eax
cmove ebx, ecx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
ret
Function at 0x1400314e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x58]
mov rbx, rcx
lea rdx, str.SOFTWAREAMDFuel
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003156e
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.ServiceStatus
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140031563
cmp dword [rsp + 0x50], 4
jne 0x140031563
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x58]
lea rdx, str.SOFTWAREAMDFuel
mov r9d, 0x20219
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400315e4
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.ServiceStatus
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400315d9
cmp dword [rsp + 0x50], 4
je 0x140031550
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x1400315f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x58]
lea rdx, str.SOFTWAREAMDFuel
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140031687
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x50]
lea rdx, str.EnableNonAmdSystems
xor r8d, r8d
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003167c
cmp dword [rsp + 0x50], 4
jne 0x14003167c
cmp dword [rsp + 0x40], eax
je 0x14003167c
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add rsp, 0x38
ret
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x58]
lea rdx, str.SOFTWAREAMDFuel
mov r9d, 0x20219
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140031701
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x50]
lea rdx, str.EnableNonAmdSystems
xor r8d, r8d
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140031701
cmp dword [rsp + 0x50], 4
jne 0x140031701
cmp dword [rsp + 0x40], eax
jne 0x14003166a
xor al, al
add rsp, 0x38
ret
Function at 0x140031710
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea rax, [rsp + 0x30]
lea rdx, str.SOFTWAREAMDFuel
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140031789
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, str.DefaultDataPath
xor r8d, r8d
mov dword [rsp + 0x68], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140031789
cmp dword [rsp + 0x70], 1
je 0x140031835
lea r9, [rsp + 0x78]
lea rcx, [0x140039c60]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x78], 0
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jns 0x1400317e7
lea rax, str.Could_not_retrieve_the_Program_Data_directory_for_Profiles
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x68], rax
call qword [sym.imp.MSVCR100.dll_public:_void___cdecl_std::exception::constructor_char_const__const___ptr64_const____ptr64____ptr64]
lea r11, vtable.std::runtime_error.0
lea rdx, [0x140050e88]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], r11
call sub.MSVCR100.dll__CxxThrowException
int3
mov r8, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x60]
mov edx, 0x104
call qword [sym.imp.MSVCR100.dll_wcscpy_s]
mov rcx, qword [rsp + 0x60]
lea r8, [0x14003cfa8]
mov edx, 0x104
call qword [sym.imp.MSVCR100.dll_wcscat_s]
mov rcx, qword [rsp + 0x60]
lea r8, str.AMDFuel_
mov edx, 0x104
call qword [sym.imp.MSVCR100.dll_wcscat_s]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, 1
add rsp, 0x58
ret
Function at 0x140031840
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x140055020]
xor rax, rsp
mov qword [rbp + 0x180], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rax, [rsp + 0x40]
lea rdx, str.SOFTWAREAMDFuel
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dil, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
jne 0x1400319a9
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea rdx, str.LogFilePath
xor r8d, r8d
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400318eb
cmp dword [rsp + 0x34], 1
movzx edi, dil
cmove edi, ebx
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea rdx, str.LogLevel
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140031938
cmp dword [rsp + 0x34], 4
jne 0x140031942
mov eax, dword [rsp + 0x38]
mov dword [0x140057650], eax
jmp 0x140031942
mov dword [0x140057650], 4
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea rdx, str.LogGroup
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003198f
cmp dword [rsp + 0x34], 4
jne 0x140031999
mov eax, dword [rsp + 0x38]
mov dword [0x140055450], eax
jmp 0x140031999
mov dword [0x140055450], 0xffffffff
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test dil, dil
je 0x1400319d4
lea rax, [rsp + 0x70]
test rax, rax
je 0x1400319bd
lea rcx, [rsp + 0x70]
call fcn.140031710
lea r8, str.Fuel.txt
lea rcx, [rsp + 0x70]
mov edx, 0x104
call qword [sym.imp.MSVCR100.dll_wcscat_s]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x60], 7
not rcx
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], bx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x48]
call fcn.140004580
lea rcx, [rsp + 0x48]
call fcn.14002bc20
lea rcx, [0x140058150]
mov dword [0x140058188], 0xfffff
mov word [0x14005818c], 0x101
mov dword [0x140058158], ebx
call fcn.14002fbe0
mov edx, dword [0x140057650]
mov dword [0x140056040], edx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140032000
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400325af
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140055020]
jne 0x14003201a
rol rcx, 0x10
test cx, 0xffff
jne 0x140032016
repz ret
ror rcx, 0x10
jmp 0x140032508
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400565a0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140056698]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14003258d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400565a0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400325af
mov rax, qword [rsp + 0x88]
mov qword [0x140056698], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140056638], rax
mov rax, qword [0x140056698]
mov qword [0x140056510], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140056620], rax
mov dword [0x140056500], 0xc0000409
mov dword [0x140056504], 1
mov rax, qword [0x140055020]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140055028]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140056598], eax
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140039cf8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140056598], 0
jne 0x140032636
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140003fd0
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1400c0f58]
test rax, rax
jne 0x1400041bc
mov rax, qword gs:[0x60]
xor r11d, r11d
mov qword [rsp + 0x48], rbp
mov r9d, 0x7a798382
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x30], rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], r15
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test r11d, r11d
je 0x14000407d
psrldq xmm0, 8
mov edx, 0x9c98244
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x140004074
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x140004060
cmp edx, r11d
jne 0x14000417f
mov r10, qword [rdi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
mov ebx, ecx
shr r15, 0x20
add rbx, r10
cmp rbx, r10
je 0x14000417f
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14000417f
mov r14d, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0x9c98244
lea rax, [r14 + r8*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400040f7
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400040e0
cmp edx, r9d
je 0x140004103
test r8d, r8d
jne 0x1400040c0
jmp 0x14000417f
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
cmp rax, rbx
jbe 0x140004197
lea rcx, [r15 + rbx]
cmp rax, rcx
jae 0x140004197
movzx ecx, byte [rax]
mov r11d, 0x9c98244
mov r9d, r11d
cmp cl, 0x2e
je 0x140004158
nop dword [rax]
movsx ecx, cl
inc rax
xor ecx, r11d
imul r11d, ecx, 0x1000193
movzx ecx, byte [rax]
cmp cl, 0x2e
jne 0x140004140
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
je 0x14000417b
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx ecx, byte [rax]
test cl, cl
jne 0x140004163
mov rdi, qword [rbp]
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x140004195
cmp qword [rax + 0x30], 0
jne 0x140004030
xor eax, eax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x1400c0f58], rax
add rsp, 0x38
jmp rax
Function at 0x140004d80
Capabilities:
Encode data using xor
Execute command

Disassembly:
sub rsp, 0x68
movups xmm1, xmmword [0x1400b3e08]
movups xmm0, xmmword [str.M_HWVWS_o__ei_hfl_8_8__z0.2X_b]
movups xmmword [rsp + 0x40], xmm1
psrldq xmm1, 0xf
movd eax, xmm1
movups xmmword [rsp + 0x30], xmm0
test al, al
je 0x140004f5f
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140004f1c
movdqa xmm0, xmmword [str.9999999999999999]
lea rdx, [rsp + 0x34]
movdqa xmm5, xmmword [0x1400b3e70]
movdqa xmm4, xmmword [0x1400b3ed0]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1400b3e90]
nop dword [rax]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400b3ea0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400b3ea0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x20
jl 0x140004e00
movaps xmm6, xmmword [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x68
ret
lea r8, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
mov eax, 0xa0a0a0a1
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x33
movzx eax, cl
inc ecx
sub al, dl
add al, 0x39
xor byte [r8 - 1], al
cmp ecx, 0x20
jl 0x140004f30
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x68
ret
Function at 0x140004f70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbp, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov r14d, reloc.WS2_32.dll_sendto
mov eax, dword [r14 + rsi]
mov r12d, Ordinal_50
test al, 1
jne 0x140005018
or eax, 1
mov dword [r14 + rsi], eax
mov ebx, r12d
add rbx, rsi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rbx + 0x1384], 0xffffffff
mov dword [rbx + 4], eax
lea ecx, [r15 + 1]
lea r8, [rbx + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x140004ff0
mov dword [rbx], 0x270
mov eax, dword [r14 + rsi]
mov ebx, Ordinal_26
test al, 2
jne 0x140005039
or eax, 2
mov dword [r14 + rsi], eax
mov qword [rbx + rsi], r15
mov qword [rbx + rsi + 8], reloc.WS2_32.dll_ntohs
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
cmp rbp, 0xf
je 0x140005078
jbe 0x14000506f
mov rdx, rbp
mov rcx, rdi
call fcn.140039180
mov qword [rdi + 0x10], r15
jmp 0x140005078
test rbp, rbp
je 0x140005122
mov r15d, ebx
add r15, rsi
mov ebx, r12d
add rbx, rsi
lea r12, str.0123456789ABCDEF
nop dword [rax + rax]
dec rbp
mov qword [rsp + 0x28], rbx
mov r14, qword [r15]
mov rdx, qword [r15 + 8]
sub rdx, r14
cmp rdx, 0xffffffffffffffff
jne 0x1400050c5
mov rcx, rbx
call fcn.14003a900
mov esi, eax
shl rsi, 0x20
mov rcx, rbx
call fcn.14003a900
mov eax, eax
or rsi, rax
jmp 0x1400050d5
inc rdx
lea rcx, [rsp + 0x28]
call fcn.14003a3f0
mov rsi, rax
lea rax, [rsi + r14]
movzx r9d, byte [rax + r12]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x14000510a
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x1400050ff
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140005119
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rdi
call fcn.1400394c0
test rbp, rbp
jne 0x140005090
mov rax, rdi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400353c0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140035457
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140035457
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x429c7ad7
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140035452
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140035430
cmp r8d, 0x22d26503
je 0x14003545c
test r9d, r9d
jne 0x140035410
mov rax, qword [rax]
jmp 0x1400353e0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov edx, 3
mov rcx, qword [0x1400c0fc0]
add rax, r10
mov rbx, qword [rsp + 0x10]
pop rdi
jmp rax

Function at 0x140035490
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140035527
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140035527
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xebf631ef
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140035522
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140035500
cmp r8d, 0x15cb306b
je 0x14003552c
test r9d, r9d
jne 0x1400354e0
mov rax, qword [rax]
jmp 0x1400354b0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov edx, 7
mov rcx, qword [0x1400c0fc0]
add rax, r10
mov rbx, qword [rsp + 0x10]
pop rdi
jmp rax