joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140148bd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x1402d4040]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
xor ebx, ebx
mov qword [rbp - 0x49], rbx
mov qword [rbp - 0x41], rbx
xor r8d, r8d
lea rdx, [0x140262727]
lea rcx, [rbp - 0x59]
call fcn.140007c30
nop
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], rbx
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], rbx
mov qword [rbp - 9], rbx
xor r8d, r8d
lea rdx, [0x140262727]
lea rcx, [rbp - 0x21]
call fcn.140007c30
nop
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], rbx
mov qword [rbp + 0x17], rbx
xor r8d, r8d
lea rdx, [0x140262727]
lea rcx, [rbp - 1]
call fcn.140007c30
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f], xmm0
mov qword [rbp + 0x2f], rbx
mov qword [rbp + 0x37], rbx
xor r8d, r8d
lea rdx, [0x140262727]
lea rcx, [rbp + 0x1f]
call fcn.140007c30
nop
mov rax, qword [rbp - 0x41]
cmp rax, 7
jb 0x140148cc3
lea rdi, [rbp - 0x59]
cmp rax, 0xf
cmova rdi, qword [rbp - 0x59]
mov qword [rbp - 0x49], 7
lea r8d, [rbx + 7]
lea rdx, str.NewEnum
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 7], bl
jmp 0x140148cd8
lea r9, str.NewEnum
mov edx, 7
lea rcx, [rbp - 0x59]
call fcn.140005c70
lea r8, [rbp + 0x47]
mov dword [rbp + 0x4b], 0x76c10c7
mov dword [rbp + 0x47], 0x2d59fc07
nop word [rax + rax]
mov eax, dword [r8]
mov ecx, ebx
shl ecx, 6
mov edx, ebx
shr edx, 2
add eax, 0x9e3779b9
add eax, ecx
add eax, edx
xor ebx, eax
add r8, 4
lea rax, [rbp + 0x4f]
cmp r8, rax
jne 0x140148cf0
lea rax, [rbp - 0x59]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
lea r9, reloc.WS2_32.dll_accept
lea r8, [0x1402dc768]
call fcn.1401630d0
nop
lea rcx, [rbp + 0x1f]
call fcn.1400050e0
lea rcx, [rbp - 1]
call fcn.1400050e0
lea rcx, [rbp - 0x21]
call fcn.1400050e0
lea rcx, [rbp - 0x39]
call fcn.1401557c0
lea rcx, [rbp - 0x59]
call fcn.1400050e0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140244f00
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140148d90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x228
mov rax, qword [0x1402d4040]
xor rax, rsp
mov qword [rsp + 0x218], rax
lea rcx, [rsp + 0x40]
call fcn.1401500a0
nop
xor ecx, ecx
mov dword [rsp + 0x210], 0x2d59fc07
mov dword [rsp + 0x214], 0x67f107b5
lea rdx, [rsp + 0x210]
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [rdx]
mov r8d, ecx
shl r8d, 6
mov r9d, ecx
shr r9d, 2
add eax, 0x9e3779b9
add eax, r8d
add eax, r9d
xor ecx, eax
add rdx, 4
lea rax, [rsp + 0x218]
cmp rdx, rax
jne 0x140148de0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea r9, reloc.WS2_32.dll_accept
lea r8, [0x1402dc780]
call fcn.140163dc0
nop
lea rcx, [rsp + 0x1d8]
call fcn.1400050e0
lea rcx, [rsp + 0x1b8]
call fcn.1400050e0
lea rcx, [rsp + 0x190]
call fcn.1400050e0
lea rcx, [rsp + 0x168]
call fcn.1400050e0
lea rcx, [rsp + 0x130]
call fcn.1400050e0
lea rcx, [rsp + 0x100]
call fcn.1400050e0
lea rcx, [rsp + 0xd8]
call fcn.1400050e0
lea rcx, [rsp + 0xa0]
call fcn.1400050e0
lea rcx, [rsp + 0x70]
call fcn.1400050e0
lea rcx, [rsp + 0x40]
call fcn.1400050e0
mov rcx, qword [rsp + 0x218]
xor rcx, rsp
call fcn.140244f00
add rsp, 0x228
ret

Function at 0x1401499a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x1402d4040]
xor rax, rsp
mov qword [rsp + 0x138], rax
lea rcx, [rsp + 0x40]
call fcn.1400f3610
nop
mov rax, qword [rsp + 0x58]
cmp rax, 0xd
jb 0x140149a04
lea rbx, [rsp + 0x40]
cmp rax, 0xf
cmova rbx, qword [rsp + 0x40]
mov qword [rsp + 0x50], recv
mov r8d, recv
lea rdx, [0x140281ad8]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xd], 0
jmp 0x140149a1a
lea r9, [0x140281ad8]
mov edx, recv
lea rcx, [rsp + 0x40]
call fcn.140005c70
lea r9, [rsp + 0x130]
xor ecx, ecx
mov dword [rsp + 0x134], 0x9032e55f
mov dword [rsp + 0x130], 0x2d59fc07
nop word [rax + rax]
mov eax, dword [r9]
mov edx, ecx
shl edx, 6
mov r8d, ecx
shr r8d, 2
add eax, 0x9e3779b9
add eax, edx
add eax, r8d
xor ecx, eax
add r9, 4
lea rax, [rsp + 0x138]
cmp r9, rax
jne 0x140149a40
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea r9, reloc.WS2_32.dll_accept
lea r8, [0x1402dc798]
call fcn.1401649b0
nop
lea rcx, [rsp + 0x110]
call fcn.1400050e0
lea rcx, [rsp + 0xf0]
call fcn.1400050e0
lea rcx, [rsp + 0xc0]
call fcn.1400050e0
lea rcx, [rsp + 0x90]
call fcn.1400050e0
lea rcx, [rsp + 0x60]
call fcn.1400050e0
lea rcx, [rsp + 0x40]
call fcn.1400050e0
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.140244f00
add rsp, 0x140
pop rbx
ret
Function at 0x140153900
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1401539ac
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x14015393a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp 0x140155300
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x14015397a
mov qword [rsp + 0x48], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x20
call fcn.140244f5c
mov rcx, rbx
test rbx, rbx
jne 0x140153960
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.1400e0090
add rsp, 0x30
pop rdi
ret
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x140155404
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x11]
imul rcx, r8
mov qword [rsp + 0x30], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.140244f5c
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x28]
je 0x140155410
cmp rbx, rbp
jne 0x1401553b0
cmp qword [rsp + 0x20], r14
jne 0x1401553dd
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], r14
jne 0x14015541f
mov qword [r15], r12
mov rax, r12
jmp 0x140155422
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x1401553dd
nop dword [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.140244f5c
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x1401554b6
cmp rbx, rbp
jne 0x140155490
jmp 0x1401553da
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x140155430
jmp 0x1401553dd
Function at 0x140155300
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1401539ac
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x14015393a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp 0x140155300
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x14015397a
mov qword [rsp + 0x48], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x20
call fcn.140244f5c
mov rcx, rbx
test rbx, rbx
jne 0x140153960
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.1400e0090
add rsp, 0x30
pop rdi
ret
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x140155404
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x11]
imul rcx, r8
mov qword [rsp + 0x30], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.140244f5c
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x28]
je 0x140155410
cmp rbx, rbp
jne 0x1401553b0
cmp qword [rsp + 0x20], r14
jne 0x1401553dd
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], r14
jne 0x14015541f
mov qword [r15], r12
mov rax, r12
jmp 0x140155422
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x1401553dd
nop dword [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.140244f5c
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x1401554b6
cmp rbx, rbp
jne 0x140155490
jmp 0x1401553da
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x140155430
jmp 0x1401553dd
Function at 0x14015fe50
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
mov r9, rcx
movabs rcx, 0x100000001b3
mov r10, rdx
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
mov rdx, qword [r9 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
xor r8d, r8d
shl rdx, 4
add rdx, qword [r9 + 0x18]
mov rax, qword [rdx + 8]
cmp rax, qword [r9 + 8]
je 0x14015fed9
mov ecx, dword [r10]
mov rdx, qword [rdx]
cmp ecx, dword [rax + 0x10]
je 0x14015fedc
nop dword [rax]
cmp rax, rdx
je 0x14015fed9
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x14015fec0
test rax, rax
setne r8b
mov rax, r8
ret
mov rax, r8
test rax, rax
setne r8b
mov rax, r8
ret
Function at 0x14016fd40
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x14016fd75
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1400dc040
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14016feb6
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14016fe30
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14016fea5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14016fe6d
mov r10, qword [rdx]
cmp r10, rax
je 0x14016fe67
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14016fea5
cmp r9, rdx
je 0x14016fe81
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x14016fec7
cmp r9, rdx
jne 0x14016fe72
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x14016fde0
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14016fea5
Function at 0x140189b70
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
lea rax, [r8 - 1]
mov r12, r9
mov r13, rax
mov qword [rsp + 0x20], rax
sar r13, 1
mov r15, r8
mov rbp, rdx
mov rsi, rcx
mov r14, rdx
mov rdi, rdx
cmp rdx, r13
jge 0x140189bf4
nop word [rax + rax]
lea rbx, [rdi + rdi]
lea rdx, [rbx + 2]
shl rdx, 5
add rdx, rsi
lea r8, [rdx - 0x20]
call fcn.140116b30
movzx edi, al
xor rdi, 1
shl rbp, 5
inc rdi
add rdi, rbx
mov rdx, rdi
shl rdx, 5
lea rcx, [rsi + rbp]
add rdx, rsi
call fcn.1400079a0
mov rbp, rdi
cmp rdi, r13
jl 0x140189bb0
mov rbx, rdi
cmp rdi, r13
jne 0x140189c1f
test r15b, 1
jne 0x140189c1f
shl rdi, 5
lea rdx, [rsi - 0x20]
shl r15, 5
add rdx, r15
lea rcx, [rsi + rdi]
call fcn.1400079a0
mov rbx, qword [rsp + 0x20]
cmp r14, rbx
jge 0x140189c68
nop dword [rax]
nop dword [rax + rax]
lea rdi, [rbx - 1]
mov r8, r12
sar rdi, 1
mov rbp, rdi
shl rbp, 5
add rbp, rsi
mov rdx, rbp
call fcn.140116b30
test al, al
je 0x140189c68
shl rbx, 5
mov rdx, rbp
lea rcx, [rsi + rbx]
call fcn.1400079a0
mov rbx, rdi
cmp r14, rdi
jl 0x140189c30
shl rbx, 5
mov rdx, r12
lea rcx, [rsi + rbx]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.1400079a0

Function at 0x14018d8e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov r14, rcx
mov rax, r8
lea rcx, [r8 - 1]
mov qword [rsp + 0x20], rax
mov r15, rcx
mov qword [rsp + 0x28], rcx
sar r15, 1
mov rbp, r9
mov r13, rdx
mov r12, rdx
mov rsi, rdx
cmp rdx, r15
jge 0x14018d97c
nop dword [rax]
lea rbx, [rsi + rsi]
lea rax, [rbx + 2]
lea rax, [rax + rax*4]
lea rcx, [r14 + rax*8]
lea rdx, [rcx - 0x28]
call fcn.1400065b0
movzx eax, al
lea rsi, [rbx + 1]
xor rax, 1
add rsi, rax
lea rax, [rsi + rsi*4]
lea rdi, [r14 + rax*8]
lea rax, [r13*4]
mov rdx, rdi
add rax, r13
lea rbx, [r14 + rax*8]
mov rcx, rbx
call fcn.1400079a0
mov eax, dword [rdi + 0x20]
mov r13, rsi
mov dword [rbx + 0x20], eax
cmp rsi, r15
jl 0x14018d920
mov rax, qword [rsp + 0x20]
mov rdi, rsi
cmp rsi, r15
jne 0x14018d9af
test al, 1
jne 0x14018d9af
lea rax, [rax + rax*4]
lea rdi, [r14 + rax*8]
lea rax, [rsi + rsi*4]
lea rbx, [r14 + rax*8]
mov rcx, rbx
lea rdx, [rdi - 0x28]
call fcn.1400079a0
mov eax, dword [rdi - 8]
mov rdi, qword [rsp + 0x28]
mov dword [rbx + 0x20], eax
cmp r12, rdi
jge 0x14018d9ff
nop dword [rax]
nop dword [rax + rax]
lea rbx, [rdi - 1]
mov rdx, rbp
sar rbx, 1
lea rax, [rbx + rbx*4]
lea rsi, [r14 + rax*8]
mov rcx, rsi
call fcn.1400065b0
test al, al
je 0x14018d9ff
lea rax, [rdi + rdi*4]
mov rdx, rsi
lea rdi, [r14 + rax*8]
mov rcx, rdi
call fcn.1400079a0
mov eax, dword [rsi + 0x20]
mov dword [rdi + 0x20], eax
mov rdi, rbx
cmp r12, rbx
jl 0x14018d9c0
lea rax, [rdi + rdi*4]
mov rdx, rbp
lea rbx, [r14 + rax*8]
mov rcx, rbx
call fcn.1400079a0
mov eax, dword [rbp + 0x20]
mov dword [rbx + 0x20], eax
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401a3520
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402d4040]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, r8
mov rsi, rdx
mov rbx, rcx
mov qword [rbp - 0x38], rcx
xor r15d, r15d
mov dword [rbp - 0x38], r15d
mov dword [rbp - 0x3c], r15d
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x38]
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1401a365f
cmp dword [rbp - 0x38], 1
jne 0x1401a365f
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], recv
mov byte [rbp - 0x30], r15b
mov eax, dword [rbp - 0x3c]
sub eax, 1
mov edi, eax
jne 0x1401a35b8
mov qword [rbp - 0x20], rdi
mov byte [rbp + rax - 0x30], r15b
jmp 0x1401a35e2
lea rcx, [rbp - 0x30]
cmp rdi, 0xf
ja 0x1401a35d7
mov qword [rbp - 0x20], rdi
mov r8, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov byte [rbp + rdi - 0x30], 0
jmp 0x1401a35e2
mov r9, rdi
mov rdx, rdi
call fcn.140005950
lea rax, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rax, qword [rbp - 0x30]
lea rcx, [rbp - 0x3c]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x38]
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1401a3635
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], recv
mov byte [rbx], 0
lea rcx, [rbp - 0x30]
call fcn.1400050e0
jmp 0x1401a3674
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rbx + 0x10], xmm1
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], recv
mov byte [rbp - 0x30], 0
lea rcx, [rbp - 0x30]
call fcn.1400050e0
jmp 0x1401a3674
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], recv
mov byte [rbx], r15b
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140244f00
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401a45e0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1402d4040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1402a60d0]
movdqu xmmword [rsp + 0x30], xmm1
mov byte [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
call fcn.1401a4780
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
cmp dword [0x1402d88e0], 0
je 0x1401a466e
mov rcx, qword [0x1402d8a88]
cmp rcx, 0xffffffffffffffff
je 0x1401a466e
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1401a4650
inc r8d
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
setne bl
jmp 0x1401a4670
mov bl, 1
lea rcx, [rsp + 0x20]
call fcn.1400050e0
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140244f00
add rsp, 0x50
pop rbx
ret

Function at 0x1401a8030
Capabilities:
Read file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rax, qword [0x1402d4040]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp qword [rcx + 0x18], 0xf
mov rdi, rdx
mov qword [rsp + 0x20], 0
jbe 0x1401a805b
mov rcx, qword [rcx]
mov rdx, rcx
lea r8, [0x14025d010]
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
jne 0x1401a808f
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140244f00
add rsp, 0x30
pop rdi
ret
xor edx, edx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov rsi, qword [rdi + 8]
mov rdx, qword [rdi]
mov rcx, rsi
sub rcx, rdx
movsxd rbx, eax
cmp rbx, rcx
jae 0x1401a80cb
lea rax, [rdx + rbx]
jmp 0x1401a80fa
jbe 0x1401a80fe
mov rax, qword [rdi + 0x10]
sub rax, rdx
cmp rbx, rax
jbe 0x1401a80e6
mov rdx, rbx
mov rcx, rdi
call fcn.140177cb0
jmp 0x1401a80fe
sub rbx, rcx
xor edx, edx
mov r8, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
lea rax, [rbx + rsi]
mov qword [rdi + 8], rax
mov rcx, qword [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, qword [rdi]
mov r8d, 1
mov rdx, qword [rdi + 8]
mov r9, qword [rsp + 0x20]
sub rdx, rcx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x58]
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140244f00
add rsp, 0x30
pop rdi
ret
Function at 0x1401aa330
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x1401aa355
cvtsi2ss xmm0, rdx
jmp 0x1401aa36a
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x1402a5fd4]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1401aa398
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1401aa398
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1401aa3ca
cmp rbx, 0x200
jae 0x1401aa3c7
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x1401aa3ca
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400e4d60