joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002cea0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x14002cf36
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [0x140123750]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x140123760]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14001e960
test rdi, rdi
je 0x14002cfc5
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14002cfde
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x14002d0d6
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x14002d158
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x14002d0e3
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x14002cfa0
cmp r9, 8
jae 0x14002d0ec
jmp 0x14002d158
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14001e960
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x14002d158
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x14002d158
mov r8, rcx
cmp r9, 8
jb 0x14002d158
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x14002d0f0
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x140038150
Capabilities:
Encrypt data using speck

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2a8
movdqa xmmword [rsp + 0x290], xmm15
movdqa xmmword [rsp + 0x280], xmm14
movdqa xmmword [rsp + 0x270], xmm13
movdqa xmmword [rsp + 0x260], xmm12
movdqa xmmword [rsp + 0x250], xmm11
movdqa xmmword [rsp + 0x240], xmm10
movdqa xmmword [rsp + 0x230], xmm9
movaps xmmword [rsp + 0x220], xmm8
movdqa xmmword [rsp + 0x210], xmm7
movdqa xmmword [rsp + 0x200], xmm6
mov qword [rsp + 0x1f8], rcx
mov rax, qword [rsp + 0x318]
mov rcx, qword [rsp + 0x310]
mov qword [rsp + 0x30], r9
mov qword [rcx + 0x10], 0
mov dword [rsp + 0x100], 0
mov qword [rsp + 0xf8], 0
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x1f0], rax
add r8, rdx
pxor xmm6, xmm6
movdqu xmmword [rsp + 0x123], xmm6
mov ah, 0x24
and eax, dword [rcx]
add byte [rax], al
Function at 0x140050830
Capabilities:
Encrypt data using salsa20 or chacha
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x20
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
cmp eax, 0xc0000000
jb 0x140050883
mov ebx, eax
lea rcx, [rsp + 0x20]
mov edx, 0x20
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x1400508d0
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [0x1401942d8]
test rax, rax
je 0x140050909
test eax, 0x4000
jne 0x140050915
mov rax, qword [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
jmp 0x140050930
and ebx, 0x7fffffff
je 0x140050883
movzx eax, byte [0x140194310]
mov edx, 4
xor ecx, ecx
call fcn.1400eed30
test rax, rax
je 0x1400509ad
mov dword [rax], ebx
mov rcx, qword [0x140194260]
xor edx, edx
mov r8, rax
call sub.kernel32.dll_HeapFree
jmp 0x140050981
call fcn.140121a90
test eax, 0x4000
je 0x1400508aa
lea r8, [0x14015e140]
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x40]
call fcn.140055670
mov rax, qword [rsp + 0x60]
movups xmm0, xmmword [rsp + 0x68]
movups xmm1, xmmword [rsp + 0x78]
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm1
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0xb0], rcx
mov qword [rdi], rax
movaps xmm0, xmmword [rsp + 0x90]
movaps xmm1, xmmword [rsp + 0xa0]
movups xmmword [rdi + 8], xmm0
movups xmmword [rdi + 0x18], xmm1
mov rax, qword [rsp + 0xb0]
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
jmp fcn.1400533d0
mov ecx, 4
mov edx, 4
call fcn.1401178d0
int3
Function at 0x140097cd0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rax, r8
mov rdi, rdx
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x60]
mov r8d, 0xb
mov rdx, rax
call fcn.1400c8ec0
mov dword [rsp + 0x38], 0x800
mov dword [rsp + 0x3c], 0
movzx eax, byte [0x140194310]
mov edx, 0x800
xor ecx, ecx
call fcn.1400eed30
test rax, rax
je 0x140097e59
mov rbx, rax
mov qword [rsp + 0x48], 0x800
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
mov r14, qword [rsp + 0x68]
lea rbp, [rsp + 0x38]
lea r15, [rsp + 0x3c]
mov r12, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov rsi, qword [rsp + 0x48]
mov r13, qword [rsp + 0x58]
sub rsi, r13
nop word [rax + rax]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbx
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
mov r9, r15
call r12
cmp eax, 0xea
jne 0x140097dae
mov r8d, dword [rsp + 0x38]
cmp rsi, r8
jae 0x140097d70
lea rcx, [rsp + 0x48]
mov rdx, r13
call fcn.140119d10
mov rbx, qword [rsp + 0x50]
jmp 0x140097d5a
test eax, eax
jne 0x140097dd0
mov eax, dword [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x3c]
cmp eax, 0xb
jbe 0x140097e36
movabs rax, 0xde00000002
jmp 0x140097dd8
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rcx], rax
cmp qword [rsp + 0x48], 0
je 0x140097e09
mov r8, qword [rsp + 0x50]
mov rcx, qword [0x140194260]
xor edx, edx
call sub.kernel32.dll_HeapFree
cmp qword [rsp + 0x60], 0
je 0x140097e24
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x140194260]
xor edx, edx
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x40]
mov qword [rdx + 0x10], rcx
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rdx], xmm0
mov byte [rdx + 0x18], al
cmp qword [rsp + 0x60], 0
jne 0x140097e11
jmp 0x140097e24
mov ecx, 1
mov edx, 0x800
call fcn.1401178b0
int3
Function at 0x1400c8aa0
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
lea rcx, [rdx + 0x1f0]
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x20]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x1400c8ae0
movabs r12, 0x8000000000000000
jmp 0x1400c8b3a
mov rbx, qword [rsp + 0x20]
mov r15, qword [rbx + 8]
mov edi, dword [rbx + 0x10]
test rdi, rdi
je 0x1400c8b1a
movzx eax, byte [0x140194310]
xor ecx, ecx
mov rdx, rdi
call fcn.1400eed30
mov r14, rax
mov r12, rdi
test rax, rax
jne 0x1400c8b23
mov ecx, 1
mov rdx, rdi
call fcn.1401178b0
xor r12d, r12d
mov r14d, 1
mov rcx, r14
mov rdx, r15
mov r8, rdi
call fcn.140116da0
mov rcx, rbx
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi], r12
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400c8b60
Capabilities:
Get remote cert context via schannel

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
lea rcx, [rdx + 0xf0]
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x20]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x1400c8ba0
movabs r12, 0x8000000000000000
jmp 0x1400c8bfa
mov rbx, qword [rsp + 0x20]
mov r15, qword [rbx + 8]
mov edi, dword [rbx + 0x10]
test rdi, rdi
je 0x1400c8bda
movzx eax, byte [0x140194310]
xor ecx, ecx
mov rdx, rdi
call fcn.1400eed30
mov r14, rax
mov r12, rdi
test rax, rax
jne 0x1400c8be3
mov ecx, 1
mov rdx, rdi
call fcn.1401178b0
xor r12d, r12d
mov r14d, 1
mov rcx, r14
mov rdx, r15
mov r8, rdi
call fcn.140116da0
mov rcx, rbx
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov qword [rsi], r12
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400dac60
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x1400dac85
cmp rax, rcx
je 0x1400dac8b
cmp rdx, 4
jae 0x1400dac8f
xor eax, eax
xor r8d, r8d
jmp 0x1400dad20
pop rbp
jmp fcn.140008900
xor eax, eax
pop rbp
ret
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x1401236a0]
movdqa xmm3, xmmword [0x1401236b0]
pxor xmm1, xmm1
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x1400dacb0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x1400dad37
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1400dad20
pop rbp
ret
Function at 0x1400e1790
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
lea rsi, str.127.0.0.1:34254could_not_resolve_to_any_addresses
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], 0xf
lea rcx, [rsp + 0x30]
call fcn.14000b050
mov rdi, rax
test dil, 1
je 0x1400e1892
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
test r9, r9
je 0x1400e187d
xor ebx, ebx
cmp byte [r8], 0x3a
jne 0x1400e187d
lea r10, [r8 + 1]
lea r11, [r9 - 1]
mov bp, 0xa
mov r14, r11
mov r15, r10
xor ecx, ecx
test r14, r14
je 0x1400e1840
nop word [rax + rax]
lea rdx, [r15 + 1]
movzx r12d, byte [r15]
add r12d, 0xffffffd0
xor eax, eax
cmp r12d, 0xa
setb al
cmovb r15, rdx
sub r14, rax
cmp eax, 1
je 0x1400e184b
jmp 0x1400e1c08
xor eax, eax
cmp eax, 1
jne 0x1400e1c08
mov eax, ecx
mul bp
jo 0x1400e1bc3
add ax, r12w
setb dl
cmp r12d, 0xffff
ja 0x1400e1bc3
test dl, dl
jne 0x1400e1bc3
inc ebx
mov ecx, eax
test r14, r14
jne 0x1400e1810
jmp 0x1400e1840
xor eax, eax
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
test ax, ax
jne 0x1400e1c25
xor edi, edi
xor eax, eax
movzx ecx, di
or rcx, rax
cmp rcx, 1
jne 0x1400e1c59
cmp qword [rsp + 0x38], 0
jne 0x1400e1c70
mov esi, edi
shr esi, 0x10
shr rdi, 0x18
xor r15d, r15d
xor eax, eax
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x38], r11
jmp 0x1400e1c1b
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r14
xor eax, eax
test ebx, ebx
setne al
je 0x1400e1bc5
cmp ax, 1
jne 0x1400e187f
movabs rax, 0xffffffff00
and rdi, rax
shr rdi, 8
movzx eax, cx
shl rax, 0x30
shl rdi, 0x10
or rdi, rax
mov eax, 1
movzx ecx, di
or rcx, rax
cmp rcx, 1
je 0x1400e18a6
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], 0xf
test rcx, rcx
je 0x1400e1d2f
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x1400e1c70
mov rcx, qword [rsp + 0x30]
dec rax
movzx edx, byte [rcx]
inc rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
cmp dl, 0x5b
jne 0x1400e1c70
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x30]
call fcn.14000b3f0
cmp byte [rsp + 0x58], 0
je 0x1400e1c70
mov edi, dword [rsp + 0x59]
mov rax, qword [rsp + 0x5d]
mov qword [rsp + 0xc8], rax
mov eax, dword [rsp + 0x65]
mov dword [rsp + 0xd0], eax
rol byte [rax], 1
add byte [rax], al

Function at 0x1400e2ab0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd0
in al, dx
rol byte [rax], 1
add byte [rax], al
add byte [rax - 0x73], cl
lodsb al, byte [rsi]
and al, 0x80
add byte [rax], al
add byte [rax - 0x39], cl
invalid
invalid
invalid
invalid
invalid
dec dword [rbp - 0x7b]
invalid
je 0x1400e2b0b
mov rsi, r9
mov rbx, r8
mov rdi, rdx
call qword [sym.imp.kernel32.dll_GetStdHandle]
adc eax, 0x4079f
add byte [rcx - 0x77], cl
invalid
mov eax, 1
add byte [rbp - 0x7b], cl
invalid
je 0x1400e2b11
xor edx, edx
xor eax, eax
jmp 0x1400e2b1b
invalid
Function at 0x1400e8600
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.1400e8a40
mov rax, qword [rbp - 0x60]
movabs rdi, 0x8000000000000000
cmp rax, rdi
jne 0x1400e8656
lea rcx, [rbp - 0x58]
call fcn.1400e26d0
mov qword [rsi], rdi
jmp 0x1400e88a4
add al, byte [rax]
invalid
mov qword [rbp + 0x3f8], rsi
mov qword [rbp + 0x3f0], rax
mov rax, qword [rbp - 0x58]

Function at 0x1400e9c80
Capabilities:
Set environment variable

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
sub esp, 0xc8

Function at 0x1400eb5e0
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x10]
Function at 0x1400edcf0
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x1e8
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov rdi, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov word [rbp + 0x166], ax
mov rax, qword [0x140194268]
cmp rax, 3
jne 0x1400edee2
lea rax, [rbp + 0x166]
mov qword [rbp + 0x150], rax
cmp rdi, 0x17f
ja 0x1400edf08
lea rbx, [rbp - 0x60]
mov rcx, rbx
mov r8, rdi
call fcn.140116da0
mov byte [rbp + rdi - 0x60], 0
lea rax, [rdi + 1]
cmp rdi, 0xe
ja 0x1400edd88
xor edx, edx
nop word [rax + rax]
cmp byte [rbp + rdx - 0x60], 0
je 0x1400ede44
inc rdx
cmp rax, rdx
jne 0x1400edd70
jmp 0x1400edead
lea rcx, [rbp - 0x59]
and rcx, 0xfffffffffffffff8
sub rcx, rbx
je 0x1400eddbe
xor edx, edx
nop word [rax + rax]
cmp byte [rbp + rdx - 0x60], 0
je 0x1400ede44
inc rdx
cmp rcx, rdx
jne 0x1400edda0
lea rdx, [rdi - 0xf]
cmp rcx, rdx
jbe 0x1400eddc2
jmp 0x1400ede0e
lea rdx, [rdi - 0xf]
movdqa xmm0, xmmword [0x1401236e0]
movabs r8, 0x8080808080808080
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rbp + rcx - 0x60]
movdqa xmm2, xmm1
paddq xmm2, xmm0
pandn xmm1, xmm2
pshufd xmm2, xmm1, 0xee
por xmm2, xmm1
movq r9, xmm2
test r9, r8
jne 0x1400ede0e
add rcx, 0x10
cmp rcx, rdx
jbe 0x1400edde0
sub rax, rcx
je 0x1400edead
lea r8, [rcx + rbp]
add r8, 0xffffffffffffffa0
xor edx, edx
nop word cs:[rax + rax]
cmp byte [r8 + rdx], 0
je 0x1400ede41
inc rdx
cmp rax, rdx
jne 0x1400ede30
jmp 0x1400edead
add rdx, rcx
cmp rdx, rdi
jne 0x1400edead
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x120], xmm0
movdqa xmmword [rbp + 0x140], xmm0
movdqa xmmword [rbp + 0x130], xmm0
mov dword [rbp + 0x128], 1
mov qword [rbp + 0x158], 0
lea rcx, [rbp - 0x60]
lea r8, [rbp + 0x120]
lea r9, [rbp + 0x158]
add dword [rax], eax
add byte [rcx], dh
sar bh, cl
adc eax, 0x356cc
test eax, eax
je 0x1400edec1
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1400eded9
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1400edf1a
mov rax, qword [rbp + 0x158]
movzx ecx, word [rbp + 0x166]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
jmp 0x1400edf1a
mov rbx, rdx
call fcn.140121440
mov rdx, rbx
lea rax, [rbp + 0x166]
mov qword [rbp + 0x150], rax
cmp rdi, 0x17f
jbe 0x1400edd47
lea r9, [rbp + 0x150]
mov rcx, rsi
mov r8, rdi
call fcn.1401214b0
nop
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ee840
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x140194310]
mov edx, 0x10
xor ecx, ecx
call fcn.1400eed30
test rax, rax
je 0x1400ee931
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400ee9f0]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400ee923
mov rcx, qword [rbx]
mov qword [rbp - 0x20], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x18], rax
call qword [rax]
mov rax, qword [rbp - 0x18]
cmp qword [rax + 8], 0
mov rsi, qword [rbp - 0x20]
je 0x1400ee8fd
cmp qword [rax + 0x10], 0x11
jae 0x1400ee8e7
mov r8, qword [rbp - 0x10]
jmp 0x1400ee8ef
mov r8, qword [rbp - 0x10]
mov r8, qword [r8 - 8]
mov rcx, qword [0x140194260]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x140194260]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.1401178d0
ud2
Function at 0x1400f9a60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, r8
mov r15, rdx
mov r14, qword [rcx + 0x10]
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x20], rax
cmp rax, 0xffffffffffffffff
je 0x1400f9c19
mov rdi, qword [rcx + 0x20]
jmp 0x1400f9ac5
mov rcx, qword [0x140194260]
xor edx, edx
mov r8, rbp
call sub.kernel32.dll_HeapFree
dec r12
mov rcx, qword [0x140194260]
xor edx, edx
mov r8, r12
call sub.kernel32.dll_HeapFree
lea rcx, [rsp + 0x28]
mov rdx, r14
mov r8, r15
xor r9d, r9d
call fcn.140102ed0
movzx eax, byte [rsp + 0x31]
cmp al, 3
je 0x1400f9c35
mov r13, qword [rsp + 0x28]
cmp al, 2
je 0x1400f9c4e
mov rdx, qword [rsi + 8]
mov rbp, qword [rsi + 0x10]
mov r8, rdx
sub r8, rbp
jb 0x1400f9d02
movzx ebx, byte [rsp + 0x30]
mov rdx, qword [rsi]
add rdx, rbp
cmp r8, 0x7fffffff
mov eax, 0x7fffffff
cmovae r8, rax
mov rcx, qword [rsp + 0x20]
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x1400f9c55
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x274a
je 0x1400f9c93
mov r12d, eax
shl r12, 0x20
or r12, 2
mov rcx, r12
call fcn.14003f640
cmp al, 0xd
jne 0x1400f9b8f
test rdi, rdi
je 0x1400f9b8f
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
lock inc qword [rdx]
jle 0x1400f9ca4
add rcx, 0x10
mov r8, qword [rdi + 0x10]
movzx r9d, byte [rdi + 0x18]
call fcn.14003f3d0
test rax, rax
cmovne r12, rax
mov rcx, r12
call case.0x14009a5d7.183
cmp al, 0xd
jne 0x1400f9c7d
movzx ecx, bl
and r13d, 0x23
mov rax, qword [r14 + 0x90]
xor r13, 0x2f
shl ecx, 0x10
nop word cs:[rax + rax]
mov edx, eax
shr edx, 0x10
cmp bl, dl
jne 0x1400f9bdc
mov edx, r13d
and edx, eax
or rdx, rcx
lock cmpxchg qword [r14 + 0x90], rdx
jne 0x1400f9bc0
mov eax, r12d
and eax, 3
cmp eax, 1
jne 0x1400f9ac5
mov rbp, qword [r12 - 1]
mov rbx, qword [r12 + 7]
mov rcx, rbp
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x1400f9ab1
cmp qword [rbx + 0x10], 0x11
jb 0x1400f9aa0
mov rbp, qword [rbp - 8]
jmp 0x1400f9aa0
lea rcx, [rsp + 0x28]
mov rdx, r14
mov r8, r15
xor r9d, r9d
call fcn.140102ed0
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x1400f9c3f
mov eax, 1
mov r12, r13
jmp 0x1400f9c7f
cmp al, 2
jne 0x1400f9cf5
mov r12, qword [rsp + 0x28]
jmp 0x1400f9c7d
xor eax, eax
mov r12, r13
jmp 0x1400f9c7f
movsxd rdx, eax
lea rax, [rdx + rbp]
mov rcx, qword [rsi + 0x18]
cmp rax, rcx
jbe 0x1400f9c6c
xor edx, edx
lea rax, [rdx + rbp]
mov rcx, qword [rsi + 0x18]
mov ecx, dword [rsi + 0x18]
ud2

Function at 0x1400f9d20
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov qword [rsp + 0x30], r8
xor byte [rax - 0x77], cl
invalid
mov rdi, qword [rcx + 0x10]
mov r14, qword [rcx + 0x18]
jno 0x1400f9d58
cmp r14, 0xffffffffffffffff
je 0x1400f9eb6
invalid
cmp r9, 0x7fffffff
mov r15d, 0x7fffffff
lea rcx, [rsp + 0x20]
mov rdx, rdi
Function at 0x140113de4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x140113e2e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140113e2e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140113e2e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140113e2e
cmp dword [rcx + 0x84], 0xe
jbe 0x140113e2e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140113e30
xor al, al
add rsp, 0x28
ret

Function at 0x140116b80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140116ba8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140116ba8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14011d740
Capabilities:
Link many functions at runtime

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rcx, [0x14014d25d]
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x14011d792
mov rdi, rax
lea rdx, [0x14014d27e]
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14011d792
mov rsi, rax
lea rdx, [0x14014d28c]
mov rcx, rdi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14011d792
mov r14, rax
xor edi, edi
jmp 0x14011d816
lea rcx, [0x14014d218]
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x14011d87d
mov rsi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14011d87d
mov rbx, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rsi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14011d87d
mov rdi, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rsi
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x14011d87d
mov rsi, rax
lea rcx, [rsp + 0x20]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
jne 0x14011d87d
mov r14, qword [rsp + 0x20]
movzx eax, byte [0x140194310]
mov edx, 0x18
xor ecx, ecx
call fcn.1400eed30
test rax, rax
je 0x14011d882
mov rbx, rax
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], r14
xor eax, eax
lock cmpxchg qword [0x1401941c0], rbx
je 0x14011d870
mov rsi, rax
cmp qword [rbx], 0
je 0x14011d85c
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [0x140194260]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14011d710
mov ecx, 8
mov edx, 0x18
call fcn.1401178d0
int3