joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140185d60
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
lea rax, vtable.cVQxq::RxQueue.0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
xor ebp, ebp
mov qword [rcx + 0x10], rbp
mov dword [rcx + 0x18], ebp
mov qword [rcx + 0x20], rbp
mov qword [rcx + 0x28], rbp
mov qword [rcx + 0x30], rbp
mov dword [rcx + 0x38], ebp
add rcx, 0x40
call fcn.14035d63c
nop
lea rcx, [rsi + 0x88]
lea edx, [rbp + 2]
call fcn.14035cc94
nop
mov qword [rsi + 0xd8], rbp
mov qword [rsi + 0xe0], rbp
xorps xmm0, xmm0
movups xmmword [rsi + 0xe8], xmm0
mov qword [rsi + 0xf8], rbp
mov qword [rsi + 0x100], rbp
mov qword [rsi + 0x108], rbp
lea ecx, [rbp + 0x18]
call fcn.14035e1d0
mov rdi, rax
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_obj2_class_cVQxq::Async_.0
mov qword [rdi], rax
lea rbx, [rdi + 0x10]
mov rdx, rsi
mov rcx, rbx
call fcn.140015ff0
nop
mov qword [rsi + 0xd8], rbx
mov rbx, qword [rsi + 0xe0]
mov qword [rsi + 0xe0], rdi
test rbx, rbx
je 0x140185e65
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140185e65
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140185e65
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov ecx, reloc.WS2_32.dll_recv
call fcn.14035e1d0
mov qword [rax], rsi
lea rcx, [0x140186380]
mov qword [rax + 8], rcx
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x140071610]
xor edx, edx
xor ecx, ecx
call fcn.14036c220
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140185ed8
cmp dword [rsi + 0xf0], 0
jne 0x140185ed2
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi + 0xe8], xmm0
mov rax, rsi
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
call fcn.14036957c
nop
mov dword [rsp + 0x38], ebp
mov ecx, 6
call fcn.14035c9f4
int3
Function at 0x140188340
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x14050c618]
xor rax, rsp
mov qword [rbp + 0xb0], rax
movups xmm0, xmmword [0x140475ca0]
mov rbx, r8
mov r8, rdx
movups xmm1, xmmword [0x140475cb0]
mov rdx, rcx
lea rcx, [rsp + 0x20]
lea r9, [rbp - 0x70]
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x30], xmm1
mov qword [rsp + 0x40], 0
call fcn.140188130
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
shr rax, 3
lea rdx, [0x140475c60]
and eax, 0x3f
add rcx, rax
cmp rax, 0x38
jae 0x1401883cf
mov r8d, gethostname
sub r8, rax
call fcn.140360840
jmp 0x140188410
mov r8d, 0x40
sub r8, rax
call fcn.140360840
lea r9, [rbp + 0x90]
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x20]
call fcn.140187250
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x78], rax
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
mov rdx, qword [rsp + 0x40]
lea r9, [rbp + 0x90]
movzx eax, byte [rsp + 0x40]
lea r8, [rbp - 0x70]
mov byte [rbp - 0x79], al
lea rcx, [rsp + 0x20]
mov rax, rdx
shr rax, 8
mov byte [rbp - 0x7a], al
mov rax, rdx
shr rax, 0x10
mov byte [rbp - 0x7b], al
mov rax, rdx
shr rax, 0x18
mov byte [rbp - 0x7c], al
mov rax, rdx
shr rax, 0x20
mov byte [rbp - 0x7d], al
mov rax, rdx
shr rax, 0x28
mov byte [rbp - 0x7e], al
mov rax, rdx
shr rdx, 0x38
mov byte [rbp - 0x80], dl
lea rdx, [rsp + 0x48]
shr rax, 0x30
mov byte [rbp - 0x7f], al
call fcn.140187250
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140186f00
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.14035e1b0
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1c0
pop rbp
ret
Function at 0x1401898a0
Capabilities:
Encode data using xor

Disassembly:
test r9d, r9d
je 0x1401899cc
mov qword [rsp + 0x20], rbx
push rdi
xor eax, eax
mov r10d, r8d
mov r11d, r9d
mov rdi, rdx
mov rbx, rcx
cmp r9d, 0x40
jb 0x14018999e
dec r9d
mov edx, r9d
add rdx, rdi
lea r8d, [r9 + r10]
add r8, rcx
add rcx, r10
cmp rcx, rdx
ja 0x1401898e8
cmp r8, rdi
jae 0x14018999e
mov qword [rsp + 0x10], rsi
mov esi, r11d
mov qword [rsp + 0x18], r14
and esi, 0xffffffc0
mov qword [rsp + 0x20], r15
mov r14d, 0xfffffff0
lea r9d, [r10 + 0x20]
sub r14d, r10d
mov r15d, reloc.WS2_32.dll_recv
sub r15d, r10d
movdqu xmm1, xmmword [rax + rdi]
lea ecx, [r9 - 0x20]
add eax, 0x40
movdqu xmm0, xmmword [rcx + rbx]
lea r8d, [r9 - 0x10]
pxor xmm1, xmm0
movdqu xmmword [rcx + rbx], xmm1
lea ecx, [r14 + r9]
movdqu xmm0, xmmword [r8 + rbx]
movdqu xmm1, xmmword [rcx + rdi]
mov ecx, r9d
sub ecx, r10d
pxor xmm1, xmm0
movdqu xmmword [r8 + rbx], xmm1
lea r8d, [r9 + 0x10]
movdqu xmm0, xmmword [r9 + rbx]
movdqu xmm1, xmmword [rcx + rdi]
lea ecx, [r15 + r9]
pxor xmm1, xmm0
movdqu xmmword [r9 + rbx], xmm1
add r9d, 0x40
movdqu xmm0, xmmword [r8 + rbx]
movdqu xmm1, xmmword [rcx + rdi]
pxor xmm1, xmm0
movdqu xmmword [r8 + rbx], xmm1
cmp eax, esi
jb 0x140189913
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x10]
cmp eax, r11d
jae 0x1401899c6
mov r8d, eax
add r8, rdi
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [r8]
lea edx, [rax + r10]
xor byte [rdx + rbx], cl
lea r8, [r8 + 1]
inc eax
cmp eax, r11d
jb 0x1401899b0
mov rbx, qword [rsp + 0x28]
pop rdi
ret
Function at 0x1401899d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea r13, [0x140475d20]
mov qword [rsp + 0x28], send
mov qword [rsp + 0x20], r13
mov rbx, rcx
mov rcx, rbx
call fcn.140189b20
mov rcx, rbx
call fcn.140189cd0
mov rcx, rbx
call fcn.140189e30
xor r13d, r13d
nop
mov eax, 0xcccccccd
lea r10d, [r13*4]
mul r13d
mov r8d, r13d
add r10d, r13d
shr edx, 2
inc r13d
lea eax, [rdx + rdx*4]
sub r8d, eax
lea r9d, [r8 + r8*4]
lea eax, [r9 + 2]
mov r12, qword [rbx + rax*8]
lea ecx, [r9 + 1]
mov rsi, qword [rbx + rcx*8]
lea eax, [r8 + r8*4]
mov r15, qword [rbx + rax*8]
lea r14, [rbx + rax*8]
lea eax, [r9 + 3]
not rsi
mov rdi, qword [rbx + rax*8]
and rsi, r12
imul eax, edx, 0x19
xor rsi, r15
not r12
and r12, rdi
not rdi
sub r10d, eax
lea eax, [r10 + 1]
xor r12, qword [rbx + rax*8]
lea r11, [rbx + rax*8]
lea eax, [r9 + 4]
mov r9, qword [rbx + rax*8]
lea eax, [r10 + 2]
and rdi, r9
lea r8, [rbx + rax*8]
xor rdi, qword [r8]
lea eax, [r10 + 3]
lea rdx, [rbx + rax*8]
not r9
and r9, r15
lea eax, [r10 + 4]
xor r9, qword [rdx]
not r15
and r15, qword [rbx + rcx*8]
xor r15, qword [rbx + rax*8]
mov qword [r14], rsi
mov qword [r11], r12
mov qword [r8], rdi
mov qword [rdx], r9
mov qword [rbx + rax*8], r15
cmp r13d, 5
jb 0x140189a20
mov r13, qword [rsp + 0x20]
mov rax, qword [r13]
add r13, 8
xor qword [rbx], rax
sub qword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
jne 0x140189a04
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140189b20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14050c618]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edi, edi
lea rsi, [rsp]
mov r11d, edi
mov rbx, rcx
nop word [rax + rax]
mov ecx, 4
lea rsi, [rsi + 8]
mov r10d, r11d
mov eax, 0xcccccccd
mul r11d
mov r9d, edx
shr r9d, 2
sub ecx, r9d
lea eax, [r9 + r9*4]
lea r8d, [r11 + rcx*4]
sub r10d, eax
add r8d, ecx
mov ecx, 3
sub ecx, r9d
mov rdx, qword [rbx + r8*8]
lea eax, [r11 + rcx*4]
add ecx, eax
xor rdx, qword [rbx + rcx*8]
mov ecx, 2
sub ecx, r9d
lea eax, [r11 + rcx*4]
inc r11d
add ecx, eax
lea eax, [r10 + 5]
xor rdx, qword [rbx + rcx*8]
xor rdx, qword [rbx + rax*8]
xor rdx, qword [rbx + r10*8]
mov qword [rsi - 8], rdx
cmp r11d, 5
jb 0x140189b50
mov r9, qword [rsp + 0x20]
mov r11, qword [rsp + 8]
mov r10, qword [rsp + 0x10]
mov rcx, r11
mov rdx, qword [rsp]
mov r8, qword [rsp + 0x18]
shr rcx, 0x3f
lea rax, [r11 + r11]
xor rcx, rax
lea rax, [r10 + r10]
xor rcx, r9
mov qword [rsp + 0x28], rcx
mov rcx, r10
shr rcx, 0x3f
xor rcx, rax
lea rax, [r8 + r8]
xor rcx, rdx
mov qword [rsp + 0x30], rcx
mov rcx, r8
shr rcx, 0x3f
xor rcx, rax
lea rax, [r9 + r9]
xor rcx, r11
mov qword [rsp + 0x38], rcx
mov rcx, r9
shr rcx, 0x3f
lea r9, [rsp + 0x28]
xor rcx, rax
lea rax, [rdx + rdx]
xor rcx, r10
mov qword [rsp + 0x40], rcx
mov rcx, rdx
shr rcx, 0x3f
xor rcx, rax
xor rcx, r8
mov qword [rsp + 0x48], rcx
nop dword [rax + rax]
mov r8, qword [r9]
lea r9, [r9 + 8]
mov ecx, edi
mov eax, 0xcccccccd
mul edi
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
mov eax, ecx
add eax, 5
xor qword [rbx + rcx*8], r8
mov ecx, 2
sub ecx, edx
xor qword [rbx + rax*8], r8
lea eax, [rdi + rcx*4]
add ecx, eax
xor qword [rbx + rcx*8], r8
mov ecx, 3
sub ecx, edx
lea eax, [rdi + rcx*4]
add ecx, eax
xor qword [rbx + rcx*8], r8
mov ecx, 4
sub ecx, edx
lea eax, [rdi + rcx*4]
inc edi
add ecx, eax
xor qword [rbx + rcx*8], r8
cmp edi, 5
jb 0x140189c50
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14035e1b0
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x14018a010
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
sub rsp, 0x28
mov ebp, dword [rcx + 0xc8]
mov r12, r8
shr ebp, 3
mov rsi, rdx
cmp dword [rcx + 0xd0], 0
mov rdi, rcx
je 0x14018a044
mov eax, 1
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x58], r13
xor r13d, r13d
mov qword [rsp + 0x20], r15
mov r15d, r13d
test r12, r12
je 0x14018a1dd
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], r14
nop word [rax + rax]
mov r8d, dword [rdi + 0xcc]
test r8d, r8d
jne 0x14018a183
lea rax, [r15 + rbp]
mov r14d, ebp
cmp r12, rax
jb 0x14018a183
mov rbx, r12
sub rbx, r15
cmp rbx, r14
jb 0x14018a17b
nop
mov r8d, r13d
test ebp, ebp
je 0x14018a164
cmp ebp, 0x40
jb 0x14018a13f
lea eax, [rbp - 1]
lea rdx, [rax + rdi]
add rax, rsi
cmp rdi, rax
ja 0x14018a0c8
cmp rdx, rsi
jae 0x14018a13f
mov edx, ebp
and edx, 0xffffffc0
mov r9d, 0x20
mov eax, r8d
add r8d, 0x40
movdqu xmm0, xmmword [rax + rdi]
movdqu xmm1, xmmword [rax + rsi]
pxor xmm1, xmm0
movdqu xmmword [rax + rdi], xmm1
lea eax, [r9 - 0x10]
movdqu xmm0, xmmword [rax + rdi]
movdqu xmm1, xmmword [rax + rsi]
pxor xmm1, xmm0
movdqu xmmword [rax + rdi], xmm1
mov eax, r9d
movdqu xmm0, xmmword [rax + rdi]
movdqu xmm1, xmmword [rax + rsi]
pxor xmm1, xmm0
movdqu xmmword [rax + rdi], xmm1
lea eax, [r9 + 0x10]
add r9d, 0x40
movdqu xmm0, xmmword [rax + rdi]
movdqu xmm1, xmmword [rax + rsi]
pxor xmm1, xmm0
movdqu xmmword [rax + rdi], xmm1
cmp r8d, edx
jb 0x14018a0d3
cmp r8d, ebp
jae 0x14018a164
mov eax, r8d
mov ecx, ebp
lea rdx, [rax + rsi]
add rax, rdi
sub ecx, r8d
mov r8d, ecx
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
xor byte [rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x14018a151
mov rcx, rdi
call fcn.1401899d0
add rsi, r14
sub rbx, r14
cmp rbx, r14
jae 0x14018a0a0
mov r15, r12
sub r15, rbx
jmp 0x14018a1ca
mov edx, r12d
mov ecx, ebp
sub edx, r15d
sub ecx, r8d
lea eax, [rdx + r8]
cmp eax, ebp
cmovbe ecx, edx
mov rdx, rsi
mov ebx, ecx
mov r9d, ecx
mov rcx, rdi
add r15, rbx
call fcn.1401898a0
add dword [rdi + 0xcc], ebx
add rsi, rbx
cmp dword [rdi + 0xcc], ebp
jne 0x14018a1ca
mov rcx, rdi
call fcn.1401899d0
mov dword [rdi + 0xcc], r13d
cmp r15, r12
jb 0x14018a070
mov r14, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x20]
xor eax, eax
mov r13, qword [rsp + 0x58]
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140199990
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov esi, r8d
mov ebp, edx
mov r13, rcx
call fcn.14035cd2c
mov rbx, rax
call fcn.14035cd10
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rcx, rax
movabs rax, 0x431bde82d7b634db
imul rcx
mov rbx, rdx
sar rbx, 0x12
mov rax, rbx
shr rax, 0x3f
add rbx, rax
xor r12d, r12d
mov rax, qword [r13 + 0x30]
mov rax, qword [rax]
cmp byte [rax + 0x19], r12b
jne 0x140199a62
mov rcx, qword [rax + 0x28]
cmp qword [rcx + 0x10], 0
je 0x140199a11
mov r12d, dword [rax + 0x20]
mov rcx, qword [rax + 0x10]
cmp byte [rcx + 0x19], 0
je 0x140199a3d
mov rcx, qword [rax + 8]
cmp byte [rcx + 0x19], 0
jne 0x140199a38
cmp rax, qword [rcx + 0x10]
jne 0x140199a38
mov rax, rcx
mov rcx, qword [rcx + 8]
cmp byte [rcx + 0x19], 0
je 0x140199a25
mov rax, rcx
jmp 0x140199a5c
mov rax, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
jne 0x140199a5c
nop dword [rax]
mov rax, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x140199a50
cmp byte [rax + 0x19], 0
je 0x140199a02
mov edx, r12d
mov rcx, r13
call fcn.140199410
mov rdi, rax
mov qword [rsp + 0x70], rax
lea rdx, [r13 + 0x18]
mov r9d, esi
mov r8d, ebp
mov rcx, rax
call fcn.1401853c0
mov rdx, rbx
mov ecx, r12d
call fcn.140199380
cmp qword [r13 + 0x38], 1
jbe 0x140199bde
mov rbx, qword [r13 + 0x30]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x140199bd6
lea rdx, [0x14019a240]
nop word [rax + rax]
lea rsi, [rbx + 0x20]
cmp dword [rsi], r12d
je 0x140199b7f
mov rcx, rdi
call fcn.1401857e0
mov rbp, rax
mov qword [rsp + 0x88], rax
mov r14, qword [r13 + 0x48]
cmp r14, qword [r13 + 0x50]
je 0x140199b4e
mov ecx, 0x20
call fcn.14035e1d0
mov qword [rax], rbp
mov ecx, dword [rsi]
mov dword [rax + 8], ecx
mov rcx, qword [rsi + 8]
mov qword [rax + 0x10], rcx
lea rcx, [0x14019a240]
mov qword [rax + 0x18], rcx
mov qword [rsp + 0x88], rax
lea rcx, [r14 + 8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14019ad30]
xor edx, edx
xor ecx, ecx
call fcn.14036c220
mov qword [r14], rax
test rax, rax
je 0x140199bf8
add qword [r13 + 0x48], 0x10
jmp 0x140199b73
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsi + 8]
mov r8, rdx
mov rdx, r14
lea rcx, [r13 + 0x40]
call fcn.14019aa40
lea rdx, [0x14019a240]
mov rdi, qword [rsp + 0x70]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x140199bab
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140199ba6
cmp rbx, qword [rax + 0x10]
jne 0x140199ba6
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140199b93
mov rbx, rax
jmp 0x140199bcc
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x140199bcc
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140199bc0
cmp byte [rbx + 0x19], 0
je 0x140199ac0
mov rcx, r13
call fcn.14019a2f0
mov byte [r13 + 1], 1
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [r14 + 8], 0
mov ecx, 6
call fcn.14035c9f4
int3
Function at 0x14019a700
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, r9
mov rbx, rdx
mov r14, rcx
mov rdx, qword [rcx]
mov rdi, rbx
sub rdi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r9, 0xfffffffffffffff
cmp rax, r9
je 0x14019a929
lea r8, [rax + 1]
mov qword [rsp + 0x30], r8
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r9
sub rax, rdx
cmp rcx, rax
jbe 0x14019a86e
mov rsi, r9
mov qword [rsp + 0x98], r9
mov rcx, rsi
shl rcx, 4
call fcn.1400042d0
mov r15, rax
mov qword [rsp + 0x40], rax
and rdi, 0xfffffffffffffff0
lea r12, [rdi + rax]
lea rdi, [r12 + 0x10]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x90], rdi
mov ecx, 0x18
call fcn.14035e1d0
mov r9, rax
mov rax, qword [rsp + 0xc0]
movzx ecx, byte [rax]
mov byte [r9], cl
mov rax, qword [rsp + 0xb8]
movzx ecx, byte [rax]
mov byte [r9 + 1], cl
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rax]
mov dword [r9 + 4], ecx
mov rax, qword [r13]
mov qword [r9 + 8], rax
mov rax, qword [rsp + 0xa0]
mov qword [r9 + 0x10], rax
mov qword [rsp + 0x48], r9
lea r13, [r12 + 8]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0
lea r8, [0x14019acf0]
xor edx, edx
xor ecx, ecx
call fcn.14036c220
mov qword [r12], rax
test rax, rax
je 0x14019a916
mov qword [rsp + 0x90], r12
mov rcx, qword [r14 + 8]
mov rax, qword [r14]
mov rdx, r15
cmp rbx, rcx
jne 0x14019a892
cmp rax, rcx
je 0x14019a8f0
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x14019a850
jmp 0x14019a8f0
lea rax, [rdx + rcx]
mov rsi, r8
cmp rax, r8
cmovae rsi, rax
mov qword [rsp + 0x98], rsi
cmp rsi, r9
ja 0x14019a92f
jmp 0x14019a778
cmp rax, rbx
je 0x14019a8bd
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x14019a8a0
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x90], r15
cmp rbx, rcx
je 0x14019a8f0
sub rdi, rbx
nop dword [rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rbx + rdi], xmm1
add rbx, 0x10
cmp rbx, rcx
jne 0x14019a8d0
nop word [rax + rax]
mov r9, rsi
mov r8, qword [rsp + 0x30]
mov rdx, r15
mov rcx, r14
call fcn.14017d450
mov rax, r12
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r13], 0
mov ecx, 6
call fcn.14035c9f4
nop
call fcn.140014490
int3
call fcn.1400040c0
int3
Function at 0x14019aa40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, r9
mov rbx, rdx
mov r14, rcx
mov rdx, qword [rcx]
mov rdi, rbx
sub rdi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r9, 0xfffffffffffffff
cmp rax, r9
je 0x14019ac59
lea r8, [rax + 1]
mov qword [rsp + 0x30], r8
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r9
sub rax, rdx
cmp rcx, rax
jbe 0x14019ab9e
mov rsi, r9
mov qword [rsp + 0x98], r9
mov rcx, rsi
shl rcx, 4
call fcn.1400042d0
mov r15, rax
mov qword [rsp + 0x40], rax
and rdi, 0xfffffffffffffff0
lea r12, [rdi + rax]
lea rdi, [r12 + 0x10]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x90], rdi
mov ecx, 0x20
call fcn.14035e1d0
mov r9, rax
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rax]
mov qword [r9], rcx
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rax]
mov dword [r9 + 8], ecx
mov rax, qword [r13]
mov qword [r9 + 0x10], rax
mov rax, qword [rsp + 0xa0]
mov qword [r9 + 0x18], rax
mov qword [rsp + 0x48], r9
lea r13, [r12 + 8]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0
lea r8, [0x14019ad30]
xor edx, edx
xor ecx, ecx
call fcn.14036c220
mov qword [r12], rax
test rax, rax
je 0x14019ac46
mov qword [rsp + 0x90], r12
mov rcx, qword [r14 + 8]
mov rax, qword [r14]
mov rdx, r15
cmp rbx, rcx
jne 0x14019abc2
cmp rax, rcx
je 0x14019ac20
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x14019ab80
jmp 0x14019ac20
lea rax, [rdx + rcx]
mov rsi, r8
cmp rax, r8
cmovae rsi, rax
mov qword [rsp + 0x98], rsi
cmp rsi, r9
ja 0x14019ac5f
jmp 0x14019aab8
cmp rax, rbx
je 0x14019abed
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x14019abd0
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x90], r15
cmp rbx, rcx
je 0x14019ac20
sub rdi, rbx
nop dword [rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rbx + rdi], xmm1
add rbx, 0x10
cmp rbx, rcx
jne 0x14019ac00
nop word [rax + rax]
mov r9, rsi
mov r8, qword [rsp + 0x30]
mov rdx, r15
mov rcx, r14
call fcn.14017d450
mov rax, r12
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r13], 0
mov ecx, 6
call fcn.14035c9f4
nop
call fcn.140014490
int3
call fcn.1400040c0
int3
Function at 0x14019ae90
Capabilities:
Delete service
Stop service

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14050c618]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x14019aeb8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jne 0x14019aed6
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14035e1b0
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 0x68], rsi
xor esi, esi
mov qword [rsp + 0x70], rdi
mov dil, 1
cmp byte [rbx], sil
jne 0x14019af31
lea r8, [rsp + 0x20]
lea edx, [rsi + 1]
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rbx + 0x18]
test eax, eax
movzx edi, dil
cmove edi, esi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x14019af31
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.e_43_1me_1_37m_msr_____e_0m
lea rdx, str._s_e_0_31mfailed_to_remove_WinRing0_driver__error__ue_0m
lea ecx, [rsi + 3]
call fcn.140026700
xor dil, dil
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, dil
mov qword [rbx + 0x18], rsi
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14035e1b0
add rsp, 0x50
pop rbx
ret
Function at 0x14019d1b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov esi, dword [rcx + 8]
mov r14, rcx
mov eax, dword [rcx + 0xc]
lea ebx, [rsi + 4]
cmp ebx, eax
ja 0x14019d1f6
nop dword [rax]
mov rax, qword [r14]
mov edx, esi
mov r9, qword [r14 + 0x10]
mov ecx, esi
shl rcx, 6
add rcx, qword [rax + 0x18]
call fcn.1401abd94
mov eax, dword [r14 + 0xc]
add esi, 4
add ebx, 4
cmp ebx, eax
jbe 0x14019d1d0
cmp esi, eax
jae 0x14019d3d3
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r15
mov r15d, dword [0x14050c620]
nop dword [rax]
nop dword [rax + rax]
mov rdi, qword [r14 + 0x10]
mov r9d, 0x40
mov rax, qword [r14]
mov ecx, esi
mov ebx, esi
mov rbp, qword [rdi]
mov edx, dword [rdi + 0x20]
add rdx, rcx
shl rbx, 6
add rbx, qword [rax + 0x18]
movzx ecx, byte [rdi + 0x24]
mov r8, rbx
mov eax, dword [rdi + 0x1c]
imul rdx, rax
mov dword [rsp + 0x28], 0x40
shr rdx, cl
mov ecx, esi
imul edx, dword [rdi + 0x18]
mov qword [rsp + 0x20], rbx
sub ecx, edx
shl rcx, 6
movups xmm0, xmmword [rcx + rbp]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rcx + rbp + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [rcx + rbp + 0x20]
movups xmmword [rbx + 0x20], xmm0
movups xmm1, xmmword [rcx + rbp + 0x30]
mov ecx, 0x200
movups xmmword [rbx + 0x30], xmm1
xor dword [rbx], esi
call fcn.140015ec0
xor r10d, r10d
xor r11d, r11d
movzx ecx, byte [rdi + 0x24]
mov rdx, r11
and edx, 0xf
mov eax, r10d
xor eax, esi
imul r8d, eax, 0x1000193
mov eax, dword [rdi + 0x1c]
xor r8d, dword [rbx + rdx*4]
mov edx, dword [rdi + 0x20]
add rdx, r8
imul rdx, rax
shr rdx, cl
imul edx, dword [rdi + 0x18]
sub r8d, edx
mov edx, r8d
shl rdx, 6
add rdx, rbp
cmp r15d, 2
jl 0x14019d35a
lea rax, [rdx + 0x3c]
lea rcx, [rbx + 0x3c]
cmp rbx, rax
ja 0x14019d2f3
cmp rcx, rdx
jae 0x14019d35a
movdqu xmm1, xmmword [rbx]
movdqa xmm2, xmmword [0x1404d1950]
movdqu xmm0, xmmword [rdx]
pmulld xmm1, xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rdx + 0x10]
movdqu xmmword [rbx], xmm1
movdqu xmm1, xmmword [rbx + 0x10]
pmulld xmm1, xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rdx + 0x20]
movdqu xmmword [rbx + 0x10], xmm1
movdqu xmm1, xmmword [rbx + 0x20]
pmulld xmm1, xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rdx + 0x30]
movdqu xmmword [rbx + 0x20], xmm1
movdqu xmm1, xmmword [rbx + 0x30]
pmulld xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rbx + 0x30], xmm1
jmp 0x14019d387
mov rax, rbx
sub rdx, rbx
mov r9d, reloc.WS2_32.dll_recv
nop word [rax + rax]
imul ecx, dword [rax], 0x1000193
lea rax, [rax + 4]
xor ecx, dword [rdx + rax - 4]
mov dword [rax - 4], ecx
sub r9, 1
jne 0x14019d370
inc r10d
inc r11
cmp r10d, 0x200
jne 0x14019d2a0
mov dword [rsp + 0x28], 0x40
mov r9d, 0x40
mov r8, rbx
mov qword [rsp + 0x20], rbx
mov ecx, r10d
call fcn.140015ec0
inc esi
cmp esi, dword [r14 + 0xc]
jb 0x14019d220
mov r15, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret