joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002b1b8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x14003fda0], eax
call fcn.14002b940
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14003fda0], 0
jne case.default.0x14002b20e
mov ecx, 1
call fcn.14002b940
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
xchg byte [0xe4f1d890], cl
cmpsb byte [rsi], byte [rdi]
pop rsi
or al, 0xec
push rbp
imul ebp, esp, 0x5d
mov eax, 0x1ad1acb0
sbb byte [rbx], r14b
cmp eax, 0xce29ab5e
scasb al, byte [rdi]
xor dh, dl
mov ecx, 0x8af0a328
mov dl, 2
call [rdi]
cmp eax, 0x483a3d32
invalid
Function at 0x14005fce0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
push rbx
push rbp
push r15
sub rsp, 0xa0
mov rax, qword [0x1402f3440]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r10, qword [r9 + 0x10]
mov rbp, rdx
mov rdx, qword [r8 + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rdx
mov qword [rsp + 0x40], rcx
xor ebx, ebx
mov r15, rcx
cmp rax, r10
jb 0x14005feca
cmp qword [r8 + 0x18], 0xf
mov qword [r11 - 0x20], rsi
mov qword [r11 - 0x28], rdi
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x38], r14
jbe 0x14005fd42
mov r8, qword [r8]
cmp qword [r9 + 0x18], 0xf
jbe 0x14005fd4c
mov r9, qword [r9]
mov qword [rsp + 0x30], r10
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], r9
mov r9, r8
mov qword [rsp + 0x20], rdx
call fcn.140063f00
mov r13, qword [rsp + 0x68]
lea r8, [rsp + 0x50]
mov r14, qword [rsp + 0x50]
cmp r13, 0xf
mov rsi, qword [rsp + 0x60]
movabs rdx, 0xcbf29ce484222325
cmova r8, r14
mov rcx, rbx
test rsi, rsi
je 0x14005fdb4
movabs r9, 0x100000001b3
movzx eax, byte [r8 + rcx]
inc rcx
xor rdx, rax
imul rdx, r9
cmp rcx, rsi
jb 0x14005fda0
mov rcx, qword [r15 + 0xe8]
mov rax, qword [r15 + 0xd0]
and rcx, rdx
add rcx, rcx
mov rdi, qword [rax + rcx*8 + 8]
cmp rdi, qword [r15 + 0xc0]
je 0x14005fe23
mov r15, qword [rax + rcx*8]
nop word [rax + rax]
cmp qword [rdi + 0x28], 0xf
lea rdx, [rdi + 0x10]
mov rax, qword [rdx + 0x10]
jbe 0x14005fdf2
mov rdx, qword [rdx]
cmp r13, 0xf
lea rcx, [rsp + 0x50]
cmova rcx, r14
cmp rsi, rax
jne 0x14005fe10
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14005fe1b
cmp rdi, r15
je 0x14005fe1e
mov rdi, qword [rdi + 8]
jmp 0x14005fde0
mov rbx, rdi
mov r15, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x90]
test rbx, rbx
mov rsi, qword [rsp + 0x98]
cmove rbx, qword [r15 + 0xc0]
cmp r13, 0xf
jbe 0x14005fe78
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14005fe70
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005fe70
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.140235564
mov rax, rbp
cmp rbx, qword [r15 + 0xc0]
jne 0x14005fe91
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
jmp 0x14005fea1
movups xmm0, xmmword [rbx + 0x30]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rbx + 0x40]
movups xmmword [rbp + 0x10], xmm1
mov r13, qword [rsp + 0x88]
mov r14, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1402352c0
add rsp, 0xa0
pop r15
pop rbp
pop rbx
ret
call fcn.14005b070
int3
Function at 0x140062670
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r13
push r15
sub rsp, 0x30
mov qword [rsp + 0x50], rbx
mov r15, rdx
mov qword [rsp + 0x58], rsi
mov r13, rcx
mov rsi, qword [r8 + 0x10]
mov r9, r8
mov qword [rsp + 0x60], rdi
mov rdi, r8
mov qword [rsp + 0x28], r12
mov r12, qword [r8 + 0x18]
cmp r12, 0xf
jbe 0x1400626ab
mov r9, qword [r8]
xor ebp, ebp
movabs r8, 0xcbf29ce484222325
mov ecx, ebp
test rsi, rsi
je 0x1400626e4
movabs rdx, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [r9 + rcx]
inc rcx
xor r8, rax
imul r8, rdx
cmp rcx, rsi
jb 0x1400626d0
mov rcx, qword [r13 + 0x30]
mov rax, qword [r13 + 0x18]
and rcx, r8
add rcx, rcx
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [r13 + 8]
je 0x140062752
mov qword [rsp + 0x20], r14
mov r14, qword [rax + rcx*8]
nop word [rax + rax]
cmp qword [rbx + 0x28], 0xf
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
jbe 0x140062722
mov rdx, qword [rdx]
mov rcx, rdi
cmp r12, 0xf
jbe 0x14006272e
mov rcx, qword [rdi]
cmp rsi, rax
jne 0x14006273f
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14006274a
cmp rbx, r14
je 0x14006274d
mov rbx, qword [rbx + 8]
jmp 0x140062710
mov rbp, rbx
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
test rbp, rbp
je 0x14006277b
mov qword [r15], rbp
mov rax, r15
add rsp, 0x30
pop r15
pop r13
pop rbp
ret
mov rax, qword [r13 + 8]
mov qword [r15], rax
mov rax, r15
add rsp, 0x30
pop r15
pop r13
pop rbp
ret
Function at 0x140071ab0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x1402f8344], 0
lea rdi, [0x1402f8340]
mov r11d, r8d
mov r9d, edx
mov r10, rcx
jne 0x140071b88
mov qword [rsp + 0x10], rbx
xor edx, edx
mov rbx, rdi
nop dword [rax]
mov r8d, edx
lea rbx, [rbx + 4]
and r8d, 1
mov eax, edx
shr eax, 1
neg r8d
and r8d, 0xedb88320
inc edx
xor r8d, eax
mov eax, r8d
shr r8d, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, r8d
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rbx - 4], eax
cmp edx, 0x100
jb 0x140071ae0
mov rbx, qword [rsp + 0x10]
not r11d
mov eax, r11d
test r9d, r9d
jle 0x140071bbe
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
movzx edx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [rdi + rdx*4]
sub r9d, 1
jne 0x140071ba0
not eax
pop rdi
ret
movzx r9d, byte [r10]
lea r8, [r10 + 1]
test r9b, r9b
je 0x140071bff
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x140071be3
cmp byte [r8], r9b
jne 0x140071be3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rdi + rdx*4]
test r9b, r9b
jne 0x140071bd0
not eax
pop rdi
ret
Function at 0x140071de0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
test r8, r8
je 0x140071df9
mov qword [r8], 0
lea rdx, [0x1402cf188]
call fcn.140071c10
mov rbx, rax
test rax, rax
jne 0x140071e18
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140071ed8
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140071ed8
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140071ed8
mov rax, qword [0x1402f7fd0]
mov rbp, rsi
test rax, rax
je 0x140071e75
inc dword [rax + 0x3c8]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140071ed8
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x140071ec5
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1402f7fd0]
test rax, rax
je 0x140071eba
dec dword [rax + 0x3c8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140071ee1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140071ed3
mov qword [rdi], rbp
mov rax, rsi
jmp 0x140071ee3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140081a60
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [0x1402f7fd0]
xor esi, esi
mov r15, rcx
mov dword [rdi + 0x2d9c], esi
test rcx, rcx
je 0x140081b7a
mov qword [rsp + 0x40], rbx
lea rbx, [rdi + 0x2da0]
mov dword [rdi + 0x2d9c], esi
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x48], rbp
test ecx, ecx
jns 0x140081aba
mov eax, ecx
cdq
sub eax, edx
mov edx, esi
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.140082a90
mov dword [rbx], esi
cmp dword [rbx + 4], esi
jne 0x140081ace
mov edx, 8
mov rcx, rbx
call fcn.140082a90
movsxd rcx, dword [rbx]
mov ebp, esi
mov rax, qword [rbx + 8]
mov byte [rcx + rax], sil
inc dword [rbx]
cmp dword [rdi + 0x2db0], esi
jle 0x140081b1a
mov qword [rsp + 0x50], r14
mov r14, rsi
nop dword [rax]
mov r9, qword [rdi + 0x2db8]
mov r8, rbx
add r9, r14
mov rcx, rdi
mov rdx, r9
call qword [r9 + reloc.WLDAP32.dll_Ordinal_32]
inc ebp
add r14, 0x30
cmp ebp, dword [rdi + 0x2db0]
jl 0x140081af0
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
cmp qword [rbx + 8], rsi
je 0x140081b29
mov esi, dword [rbx]
dec esi
mov rax, qword [rdi + 0x2da8]
lea rdx, [0x1402cf18c]
test rax, rax
movsxd rsi, esi
lea rdi, [0x1402f7fc8]
mov rcx, r15
cmovne rdi, rax
call fcn.140071c10
mov rbx, rax
test rax, rax
je 0x140081b75
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x14008e370
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x14008e527
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14008e406
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14008dce0
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14008d2f0
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x14008e3f7
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.140082710
mov dword [rbx + 0x80], 0
jmp 0x14008e513
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.14008c1e0
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14009e010
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rsi, rdx
mov rbp, rcx
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
xor ebx, ebx
mov eax, dword [rcx + rax]
cmp dword [0x1402f8920], eax
jle 0x14009e0ed
lea rcx, [0x1402f8920]
call fcn.140235640
cmp dword [0x1402f8920], 0xffffffff
jne 0x14009e0ed
mov dword [0x1402f88e0], ebx
mov qword [0x1402f88e8], rbx
mov qword [0x1402f88f0], rbx
lea ecx, [rbx + 0x30]
call fcn.1402352e0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x1402f88e8], rax
mov qword [0x1402f88f8], rbx
xorps xmm0, xmm0
movdqa xmmword [0x1402f8900], xmm0
mov qword [0x1402f8910], 7
mov qword [0x1402f8918], 8
mov dword [0x1402f88e0], 0x3f800000
mov r8, rax
lea edx, [rbx + 0x10]
lea rcx, [0x1402f88f8]
call fcn.1400619d0
nop
lea rcx, [0x14023dcf0]
call fcn.140235544
nop
lea rcx, [0x1402f8920]
call fcn.1402355d4
mov edi, ebp
mov eax, ebp
shr eax, 8
movzx edx, al
movzx eax, bpl
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs r8, 0x100000001b3
imul rax, r8
xor rdx, rax
imul rdx, r8
mov eax, ebp
shr eax, 0x10
movzx ecx, al
xor rdx, rcx
imul rdx, r8
mov eax, ebp
shr rax, 0x18
xor rdx, rax
imul rdx, r8
and rdx, qword [0x1402f8910]
add rdx, rdx
mov rcx, qword [0x1402f88f8]
mov rax, qword [rcx + rdx*8 + 8]
mov r8, qword [0x1402f88e8]
cmp rax, r8
je 0x14009e175
mov rcx, qword [rcx + rdx*8]
cmp edi, dword [rax + 0x10]
je 0x14009e172
cmp rax, rcx
je 0x14009e175
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x14009e164
mov rbx, rax
mov rax, r8
test rbx, rbx
cmovne rax, rbx
cmp rax, r8
je 0x14009e19a
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsi], xmm0
movsd xmm1, qword [rax + 0x28]
movsd qword [rsi + 0x10], xmm1
jmp 0x14009e21b
mov rcx, rbp
call fcn.14009df70
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movsd qword [rsp + 0x30], xmm0
mov rcx, qword [0x1402f80f0]
add rcx, rax
mov r8d, Ordinal_27
lea rdx, [rsp + 0x30]
call fcn.14009d7c0
mov dword [rsp + 0x60], edi
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x20]
lea rcx, [0x1402f88e0]
call fcn.1400b8c80
mov rcx, qword [rax]
movsd xmm0, qword [rsp + 0x30]
movsd qword [rcx + 0x18], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x20], xmm1
movsd xmm0, qword [rsp + 0x40]
movsd qword [rcx + 0x28], xmm0
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm1
movsd xmm0, qword [rsp + 0x40]
movsd qword [rsi + 0x10], xmm0
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14009e240
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rsi, rdx
mov rbp, rcx
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
xor ebx, ebx
mov eax, dword [rcx + rax]
cmp dword [0x1402f8924], eax
jle 0x14009e31d
lea rcx, [0x1402f8924]
call fcn.140235640
cmp dword [0x1402f8924], 0xffffffff
jne 0x14009e31d
mov dword [0x1402f88a0], ebx
mov qword [0x1402f88a8], rbx
mov qword [0x1402f88b0], rbx
lea ecx, [rbx + 0x30]
call fcn.1402352e0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x1402f88a8], rax
mov qword [0x1402f88b8], rbx
xorps xmm0, xmm0
movdqa xmmword [0x1402f88c0], xmm0
mov qword [0x1402f88d0], 7
mov qword [0x1402f88d8], 8
mov dword [0x1402f88a0], 0x3f800000
mov r8, rax
lea edx, [rbx + 0x10]
lea rcx, [0x1402f88b8]
call fcn.1400619d0
nop
lea rcx, [0x14023dce0]
call fcn.140235544
nop
lea rcx, [0x1402f8924]
call fcn.1402355d4
cmp byte [0x1402f815a], 0
je 0x14009e3d2
mov edi, ebp
mov eax, ebp
shr eax, 8
movzx edx, al
movzx eax, bpl
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs r8, 0x100000001b3
imul rax, r8
xor rdx, rax
imul rdx, r8
mov eax, ebp
shr eax, 0x10
movzx ecx, al
xor rdx, rcx
imul rdx, r8
mov eax, ebp
shr rax, 0x18
xor rdx, rax
imul rdx, r8
and rdx, qword [0x1402f88d0]
add rdx, rdx
mov rcx, qword [0x1402f88b8]
mov rax, qword [rcx + rdx*8 + 8]
mov r8, qword [0x1402f88a8]
cmp rax, r8
je 0x14009e3b2
mov rcx, qword [rcx + rdx*8]
cmp edi, dword [rax + 0x10]
je 0x14009e3af
cmp rax, rcx
je 0x14009e3b2
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x14009e3a1
mov rbx, rax
test rbx, rbx
je 0x14009e3d4
cmp rbx, r8
je 0x14009e3d4
movups xmm0, xmmword [rbx + 0x18]
movups xmmword [rsi], xmm0
movsd xmm1, qword [rbx + 0x28]
movsd qword [rsi + 0x10], xmm1
jmp 0x14009e455
mov edi, ebp
mov rcx, rbp
call fcn.14009df70
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movsd qword [rsp + 0x30], xmm0
mov rcx, qword [0x1402f80f0]
add rcx, rax
mov r8d, Ordinal_27
lea rdx, [rsp + 0x30]
call fcn.14009d7c0
mov dword [rsp + 0x70], edi
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x20]
lea rcx, [0x1402f88a0]
call fcn.1400b8c80
mov rcx, qword [rax]
movsd xmm0, qword [rsp + 0x30]
movsd qword [rcx + 0x18], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x20], xmm1
movsd xmm0, qword [rsp + 0x40]
movsd qword [rcx + 0x28], xmm0
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm1
movsd xmm0, qword [rsp + 0x40]
movsd qword [rsi + 0x10], xmm0
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400afb10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x13f0
call fcn.140235da0
sub rsp, rax
mov rax, qword [0x1402f3440]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov ebp, edx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
lea ecx, [rdi + 0x20]
call fcn.1402352e0
mov rsi, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], reloc.WLDAP32.dll_Ordinal_26
mov qword [rsp + 0x48], Ordinal_33
movups xmm0, xmmword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZ]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1402cf970]
movsd qword [rax + 0x10], xmm0
movzx eax, word [0x1402cf978]
mov word [rsi + 0x18], ax
mov byte [rsi + 0x1a], dil
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dil
mov edi, 1
mov dword [rsp + 0x20], edi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ecx, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
nop dword [rax]
nop dword [rax + rax]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edi
mov dword [rsp + rdi*4 + 0x54], ecx
inc rdi
cmp rdi, 0x270
jb 0x1400afbe0
mov dword [rsp + 0x50], 0x270
test ebp, ebp
jle 0x1400afc80
mov rdi, rbp
nop
lea rcx, [rsp + 0x50]
call fcn.1400b9cd0
mov ecx, eax
imul rax, rcx, 0x1a
cmp eax, 0x15
ja 0x1400afc3a
lea rcx, [rsp + 0x50]
call fcn.1400b9cd0
mov ecx, eax
imul rax, rcx, 0x1a
cmp eax, 0x16
jb 0x1400afc25
shr rax, 0x20
movsxd rcx, eax
movzx r9d, byte [rcx + rsi]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1400afc72
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x1400afc67
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400afc7a
mov rcx, rbx
call fcn.140062d50
sub rdi, 1
jne 0x1400afc10
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov rcx, rsi
call fcn.140235564
mov rax, rbx
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.1402352c0
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400b7410
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x1402f7fe0]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x1402f8318]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x1402f8150]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x1402f8298]
call qword [0x1402f8838]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400b74d7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400b74d7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x139bb0f8
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400b74d2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1400b74b0
cmp r8d, 0xafe90e4d
je 0x1400b74dc
test r9d, r9d
jne 0x1400b7490
mov rax, qword [rax]
jmp 0x1400b7460
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [0x1402f3d38]
add rax, r10
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rcx, qword [0x1402f3d38]
xor edx, edx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
Function at 0x1400b90e0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1400b9111
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1402f82a8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1402f82b8]
lea rdx, [rdi + rdi]
call fcn.1400619d0
mov rax, qword [0x1402f82a8]
lea r9, [rdi - 1]
mov qword [0x1402f82d0], r9
mov qword [0x1402f82d8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1400b9284
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1402f82b8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1400b91d0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1400b9245
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1400b920d
mov r10, qword [rdx]
cmp r10, rax
je 0x1400b9207
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1400b9245
cmp r9, rdx
je 0x1400b9221
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1400b9259
cmp r9, rdx
jne 0x1400b9212
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1400b927f
mov r9, qword [0x1402f82d0]
jmp 0x1400b9181
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400b9245
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret