joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ec2d0
Capabilities:
Move file

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rdi, r8
mov rsi, rcx
mov rax, qword [0x1403a1f58]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea r15, [0x1402c8de0]
mov qword [rsp + 0x40], r15
lea rbx, [rsp + 0x40]
mov qword [rsp + 0x78], rbx
lea rcx, [rsp + 0x30]
mov r8b, 1
mov r9, rbx
call fcn.1400eb170
mov r14, qword [rsp + 0x38]
mov rdx, r14
xor r8d, r8d
call fcn.1400ebe90
test eax, eax
je 0x1400ec344
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x1400ec461
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x78], rbx
lea rcx, [rsp + 0x30]
mov rdx, rdi
mov r8b, 1
mov r9, rbx
call fcn.1400eb170
mov rbx, qword [rsp + 0x38]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r15, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call r15
movsxd r12, eax
lea rcx, [r12 + r12]
call fcn.140023d60
mov rdi, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call r15
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, 0xffffffff
call r15
movsxd r12, eax
lea rcx, [r12 + r12]
call fcn.140023d60
mov r14, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, 0xffffffff
call r15
mov rcx, rsi
mov rdx, rbx
call fcn.1400e57e0
cmp eax, 1
jne 0x1400ec439
mov rdx, rbx
xor r8d, r8d
call fcn.1400ebe90
cmp eax, 2
jne 0x1400ec439
mov rdx, rbx
call fcn.1400ec1c0
test al, al
je 0x1400ec484
mov rcx, rdi
mov rdx, r14
mov r8d, 9
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne sil
mov rcx, r14
call fcn.140265df4
mov rcx, rdi
call fcn.140265df4
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14025cd50
mov eax, esi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor esi, esi
jmp 0x1400ec451
Function at 0x1400ec490
Capabilities:
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rbx, r8
mov rdi, rcx
mov rax, qword [0x1403a1f58]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea r13, [0x1402c8de0]
mov qword [rsp + 0x40], r13
lea r14, [rsp + 0x40]
mov qword [rsp + 0x78], r14
lea rcx, [rsp + 0x30]
mov r8b, 1
mov r9, r14
call fcn.1400eb170
mov r15, qword [rsp + 0x38]
mov rdx, r15
xor r8d, r8d
call fcn.1400ebe90
cmp eax, 2
jne 0x1400ec61c
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r12, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, 0xfde9
xor edx, edx
mov r8, r15
mov r9d, 0xffffffff
call r12
movsxd rbp, eax
lea rcx, [rbp*2]
call fcn.140023d60
mov rsi, rax
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, r15
mov r9d, 0xffffffff
call r12
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x78], r14
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8b, 1
mov r9, r14
call fcn.1400eb170
mov r14, qword [rsp + 0x38]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call r12
movsxd r15, eax
lea rcx, [r15 + r15]
call fcn.140023d60
mov rbx, rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call r12
mov rcx, rdi
mov rdx, r14
call fcn.1400e57e0
cmp eax, 1
jne 0x1400ec5f2
mov rdx, r14
xor r8d, r8d
call fcn.1400ebe90
cmp eax, 2
jne 0x1400ec5f2
mov rdx, r14
call fcn.1400ec1c0
test al, al
je 0x1400ec64f
mov rcx, rsi
mov rdx, rbx
mov r8d, 9
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
mov rcx, rbx
call fcn.140265df4
mov rcx, rsi
call fcn.140265df4
jmp 0x1400ec629
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14025cd50
mov eax, edi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor edi, edi
jmp 0x1400ec60a
Function at 0x1400ee560
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rsi, rdx
mov ebx, ecx
mov rax, qword [0x1403a1f58]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
test rax, rax
je 0x1400ee647
mov eax, dword [rsp + 0x44]
cmp eax, ebx
jle 0x1400ee5b6
mov dword [rsp + 0x44], ebx
mov eax, ebx
test eax, eax
jle 0x1400ee63e
xor r12d, r12d
xorps xmm6, xmm6
mov r13, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop dword [rax + rax]
mov rbx, qword [rdi + r12*8]
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, 0xffffffff
call r13
movsxd r14, eax
mov rcx, r14
call fcn.140023d60
mov r15, rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, 0xffffffff
call r13
mov qword [rsi + r12*8], r15
inc r12
movsxd rax, dword [rsp + 0x44]
cmp r12, rax
jl 0x1400ee5d0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14025cd50
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140104470
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x2040
call fcn.14025d030
sub rsp, rax
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1403a1f58]
xor rax, rsp
mov qword [rsp + 0x2038], rax
cmp qword [0x1403a46f0], 0
jne 0x1401044c1
mov ecx, 8
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [0x1403a46f0], rax
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x410
xor edx, edx
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x14010454e
mov rbx, rax
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov rcx, rax
mov r8d, 0x2000
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x14010452f
cmp dword [rsp + 0x2c], 8
jb 0x14010452f
xor r14d, r14d
mov r15, qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax]
mov rcx, qword [rsp + r14*8 + 0x30]
mov rdx, rdi
call r15
test rax, rax
jne 0x140104584
inc r14
mov eax, dword [rsp + 0x2c]
shr eax, 3
cmp r14, rax
jb 0x140104510
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.None_of_the_loaded_modules_contained_the_requested_symbol__s.
xor r14d, r14d
xor ecx, ecx
mov r8, rdi
call fcn.140186870
jmp 0x14010455f
lea rdx, str.Failed_to_open_current_process.
xor r14d, r14d
xor ecx, ecx
call fcn.140186870
mov qword [rsi], rax
mov rcx, qword [rsp + 0x2038]
xor rcx, rsp
call fcn.14025cd50
mov rax, r14
add rsp, 0x2040
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov r14, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140104562
Function at 0x140128cd0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov eax, dword [0x1403a95e8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rsi, qword [rax + 8]
test rsi, rsi
je 0x140128d38
mov rcx, qword [rsi + 0x698]
lea rax, [0x1403a49f8]
test rcx, rcx
je 0x140128d9a
mov rdx, qword [0x1403a49e8]
test rdx, rdx
je 0x140128d63
mov rcx, qword [rcx + 0x380]
mov rcx, qword [rcx + 8]
mov rdi, rax
call fcn.140260ae0
mov rcx, rax
mov rax, rdi
test rcx, rcx
jne 0x140128d92
jmp 0x140128d9a
mov ecx, dword [0x14039fef0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140128d5c
cmp byte [rax + 8], 0
jne 0x140128d96
mov rcx, rax
call fcn.1400498c0
test rax, rax
jne 0x140128d96
call fcn.140185a40
jmp 0x140128d96
mov rdx, qword [0x1403a4760]
test rdx, rdx
je 0x140128d7a
mov rdx, qword [rdx + 0x50]
cmp rdx, rcx
jne 0x140128d81
jmp 0x140128d92
xor edx, edx
cmp rdx, rcx
je 0x140128d92
mov rdi, rax
call fcn.1401226c0
mov ecx, eax
mov rax, rdi
test cl, cl
jne 0x140128d9a
mov rax, qword [rsi + 0x10]
mov rax, qword [rax + 0x38]
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14013f190
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 7]
sar rax, 1
mov rdx, qword [rcx - 1]
and edx, 0xfffff000
cmp edx, 0x5d000
je 0x14013f1bb
mov rdx, qword [rcx - 1]
and edx, 0xfffff000
cmp edx, 0x5f000
jne 0x14013f1f4
mov rdx, qword [rcx - 1]
and edx, 0xfffff000
cmp edx, 0x5d000
jne 0x14013f1d8
add rcx, 0xf
test rax, rax
jg 0x14013f1e1
jmp 0x14013f217
mov rcx, qword [rcx + 0xf]
test rax, rax
jle 0x14013f217
mov edx, eax
and edx, 3
cmp rax, 4
jae 0x14013f21e
xor r8d, r8d
jmp 0x14013f2a9
mov rdx, qword [rcx - 1]
and edx, 0xfffff000
cmp edx, 0x5e000
jne 0x14013f2e9
add rcx, 0xf
test rax, rax
jg 0x14013f2f6
xor eax, eax
jmp 0x14013f3c8
movabs r8, 0x7ffffffffffffffc
and rax, r8
xor r8d, r8d
nop
movzx r9d, byte [rcx]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, byte [rcx + 1]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
movzx r9d, byte [rcx + 2]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, byte [rcx + 3]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
add rcx, 4
add rax, 0xfffffffffffffffc
jne 0x14013f230
test rdx, rdx
je 0x14013f3c4
xor eax, eax
nop word cs:[rax + rax]
movzx r9d, byte [rcx + rax]
add r9d, r8d
mov r10d, r9d
shl r10d, 0xa
add r10d, r9d
mov r8d, r10d
shr r8d, 6
xor r8d, r10d
inc rax
cmp rdx, rax
jne 0x14013f2c0
jmp 0x14013f3c4
mov rcx, qword [rcx + 0xf]
test rax, rax
jle 0x14013f217
mov edx, eax
and edx, 3
cmp rax, 4
jae 0x14013f309
xor r8d, r8d
jmp 0x14013f399
movabs r8, 0x7ffffffffffffffc
and rax, r8
xor r8d, r8d
nop dword [rax]
movzx r9d, word [rcx]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, word [rcx + 2]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
movzx r9d, word [rcx + 4]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, word [rcx + 6]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
add rcx, 8
add rax, 0xfffffffffffffffc
jne 0x14013f320
test rdx, rdx
je 0x14013f3c4
xor eax, eax
movzx r9d, word [rcx + rax*2]
add r9d, r8d
mov r10d, r9d
shl r10d, 0xa
add r10d, r9d
mov r8d, r10d
shr r8d, 6
xor r8d, r10d
inc rax
cmp rdx, rax
jne 0x14013f3a0
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
and eax, 0x3fffffff
cmp eax, 1
adc eax, 0
ret
Function at 0x14015a3a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x1403a1f58]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [0x1403a95e8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
mov rcx, qword [rax + 0x698]
mov rcx, qword [rcx + 0x20]
mov rdx, qword [rcx + 0x4e0]
mov rcx, qword [rax + 0x18]
call fcn.14015a680
mov qword [rsp + 0x20], r14
mov rcx, qword [r14 + 8]
test byte [rcx + 7], 2
cmove rax, r14
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
pcmpeqd xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0xffffffffffffffff
lea rcx, [rsp + 0x20]
call fcn.14015a550
test al, al
je 0x14015a52c
lea r15, [rsp + 0x20]
lea r12, [0x1402a7d99]
lea r13, [0x140300b9e]
nop dword [rax + rax]
mov r8d, dword [rsp + 0x38]
add r8, rdi
mov rcx, rbx
lea rdx, str.0x_.8llx:
call fcn.1400245c0
mov rbp, qword [rsp + 0x48]
test rbp, rbp
js 0x14015a4a0
add rbp, qword [rsp + 0x50]
jg 0x14015a4b4
jmp 0x14015a510
mov rcx, r15
call fcn.140176cb0
mov rbp, qword [rsp + 0x48]
add rbp, qword [rsp + 0x50]
jle 0x14015a510
xor r14d, r14d
jmp 0x14015a4d0
mov rcx, rbx
call fcn.140024730
inc r14
cmp rbp, r14
je 0x14015a510
cmp qword [rsp + 0x48], 0
jns 0x14015a4e0
mov rcx, r15
call fcn.140176cb0
mov rax, r14
shr rax, 3
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
add rcx, qword [rsp + 0x58]
movzx eax, byte [rax + rcx + 0xb]
mov ecx, r14d
and ecx, 7
bt eax, ecx
mov rdx, r12
jae 0x14015a4c0
mov rdx, r13
jmp 0x14015a4c0
mov rcx, r15
call fcn.14015a550
test al, al
je 0x14015a52c
mov rcx, rbx
mov rdx, rsi
call fcn.140024730
jmp 0x14015a470
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14025cd50
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14015bf00
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, r8
mov r8, rdx
mov qword [rsp + 0x48], rcx
mov rsi, qword [rsp + 0xd8]
mov ecx, dword [rsp + 0xe0]
mov rdx, qword [0x1403a1f58]
xor rdx, rsp
mov qword [rsp + 0x60], rdx
mov edx, dword [0x1403a95e8]
mov r10, qword gs:[0x58]
mov rdx, qword [r10 + rdx*8]
mov rdx, qword [rdx + 8]
mov r15, qword [rdx + 0x18]
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x20], r9
lea rcx, [rsp + 0x58]
mov rdx, r15
mov r9, rax
call fcn.14015bce0
mov rdx, qword [rsp + 0x58]
mov rcx, r15
call fcn.14015be20
mov rdi, rax
lea rbx, [rsi + 2]
lea r8, [rsi*2 + 4]
lea rcx, [rsp + 0x50]
mov edx, 0x59
mov r9d, 1
call fcn.14016bfd0
mov rdx, qword [rsp + 0x50]
mov rcx, r15
call fcn.1400f0ef0
mov r14, rax
mov rcx, r15
call fcn.1400f5db0
test rsi, rsi
jle 0x14015c00c
mov r15, rax
mov rbp, qword [rsp + 0xe8]
xor r13d, r13d
mov r12, rsi
nop word cs:[rax + rax]
mov rax, qword [rbp + 0x10]
mov r8, qword [rax + r13]
add r8, r8
mov qword [r15 + 8], r8
mov rcx, qword [r14 + 8]
lea rdx, [rcx + r13]
add rdx, 0x17
dec rcx
call fcn.1400ef220
add r13, 8
dec r12
jne 0x14015bfe0
mov r15, qword [rsp + 0xf0]
mov rax, qword [r15 + 8]
mov rcx, qword [rax + 0x3f]
call fcn.1401164b0
mov rcx, qword [r14 + 8]
mov r8, qword [rax + 8]
lea rdx, [rcx + rsi*8]
add rdx, 0x1f
dec rcx
call fcn.1400ef220
mov rcx, qword [r14 + 8]
mov r8, qword [r15 + 8]
lea rdx, [rcx + rsi*8]
add rdx, 0x17
dec rcx
call fcn.1400ef220
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.14015af90
mov rdx, qword [rdi + 8]
lea rcx, [rdx - 1]
mov r8, qword [r14 + 8]
add rdx, 0x17
call fcn.1400eeb50
mov rax, qword [rdi + 8]
mov rsi, qword [rsp + 0x48]
mov qword [rsi], rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14025cd50
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140166ee0
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1403a1f58]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [0x1403a95e8]
mov rcx, qword gs:[0x58]
mov r14, qword [rcx + rax*8]
mov rdi, qword [r14 + 8]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 8
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
mov edx, 0x3c
mov r8d, reloc.WS2_32.dll_recv
mov r9d, 1
call fcn.140142f20
mov rcx, qword [rsp + 0x40]
call fcn.140167a80
mov rcx, qword [rax + 8]
mov qword [rcx + 7], rbx
mov rdx, qword [rax + 8]
mov rcx, qword [rdi + 0x18]
call fcn.140167ab0
mov rbx, rax
mov r8d, 0x430
add r8, qword [rdi + 0x698]
mov rdx, qword [r14 + 8]
lea r14, [rsp + 0x40]
mov rcx, r14
call fcn.1401285c0
mov rax, qword [rbx]
lea rdx, [rsp + 0x38]
mov rcx, rbx
mov r8, rdi
call qword [rax + 0x2d8]
lea rax, [0x1402feaf0]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x58]
call fcn.14009cf50
mov rcx, r14
call fcn.140105bd0
mov rax, qword [rsp + 0x38]
mov qword [rbx + 8], rax
mov qword [rsi], rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14025cd50
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140167d30
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
movaps xmm6, xmm1
mov rsi, rcx
mov rax, qword [0x1403a1f58]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov eax, dword [0x1403a95e8]
mov rcx, qword gs:[0x58]
mov r14, qword [rcx + rax*8]
mov rdi, qword [r14 + 8]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 8
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0x48]
mov edx, 0x3d
mov r8d, reloc.WS2_32.dll_recv
mov r9d, 1
call fcn.140142f20
mov rcx, qword [rsp + 0x48]
call fcn.140167d00
mov rcx, qword [rax + 8]
movsd qword [rcx + 7], xmm6
mov rdx, qword [rax + 8]
mov rcx, qword [rdi + 0x18]
call fcn.140167e50
mov rbx, rax
mov r8d, 0x430
add r8, qword [rdi + 0x698]
mov rdx, qword [r14 + 8]
lea r14, [rsp + 0x48]
mov rcx, r14
call fcn.1401285c0
mov rax, qword [rbx]
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov r8, rdi
call qword [rax + 0x2d8]
lea rax, [0x1402feaf0]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x60]
call fcn.14009cf50
mov rcx, r14
call fcn.140105bd0
mov rax, qword [rsp + 0x40]
mov qword [rbx + 8], rax
mov qword [rsi], rax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14025cd50
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1401683e0
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
jle 0x1401683f8
mov eax, edx
and eax, 3
cmp rdx, 4
jae 0x1401683ff
xor r8d, r8d
jmp 0x140168489
xor eax, eax
jmp 0x1401684b8
movabs r8, 0x7ffffffffffffffc
and rdx, r8
xor r8d, r8d
nop
movzx r9d, byte [rcx]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, byte [rcx + 1]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
movzx r9d, byte [rcx + 2]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, byte [rcx + 3]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
add rcx, 4
add rdx, 0xfffffffffffffffc
jne 0x140168410
test rax, rax
je 0x1401684b4
xor edx, edx
movzx r9d, byte [rcx + rdx]
add r9d, r8d
mov r10d, r9d
shl r10d, 0xa
add r10d, r9d
mov r8d, r10d
shr r8d, 6
xor r8d, r10d
inc rdx
cmp rax, rdx
jne 0x140168490
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
and eax, 0x3fffffff
cmp eax, 1
adc eax, 0
ret

Function at 0x1401684e0
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
jle 0x1401684f8
mov eax, edx
and eax, 3
cmp rdx, 4
jae 0x1401684ff
xor r8d, r8d
jmp 0x140168589
xor eax, eax
jmp 0x1401685b8
movabs r8, 0x7ffffffffffffffc
and rdx, r8
xor r8d, r8d
nop
movzx r9d, word [rcx]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, word [rcx + 2]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
movzx r9d, word [rcx + 4]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, word [rcx + 6]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
add rcx, 8
add rdx, 0xfffffffffffffffc
jne 0x140168510
test rax, rax
je 0x1401685b4
xor edx, edx
movzx r9d, word [rcx + rdx*2]
add r9d, r8d
mov r10d, r9d
shl r10d, 0xa
add r10d, r9d
mov r8d, r10d
shr r8d, 6
xor r8d, r10d
inc rdx
cmp rax, rdx
jne 0x140168590
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
and eax, 0x3fffffff
cmp eax, 1
adc eax, 0
ret
Function at 0x1401694e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
movdqa xmmword [rsp + 0x90], xmm11
movdqa xmmword [rsp + 0x80], xmm10
movdqa xmmword [rsp + 0x70], xmm9
movdqa xmmword [rsp + 0x60], xmm8
movdqa xmmword [rsp + 0x50], xmm7
movdqa xmmword [rsp + 0x40], xmm6
mov rax, r8
mov r8, rdx
mov rsi, rcx
mov rcx, qword [0x1403a1f58]
xor rcx, rsp
mov qword [rsp + 0x38], rcx
test rax, rax
jle 0x1401696e4
xor ecx, ecx
cmp rax, 4
jae 0x14016954e
mov r11b, 1
xor r10d, r10d
mov rdx, rax
jmp 0x1401696a0
movabs r10, 0x7ffffffffffffffc
and r10, rax
movq xmm2, rax
movdqa xmm0, xmmword [0x140308530]
pxor xmm1, xmm1
xor edx, edx
movdqa xmm3, xmmword [0x1402ae630]
movdqa xmm4, xmmword [0x140308540]
movdqa xmm5, xmmword [0x140308550]
movdqa xmm6, xmmword [0x140308560]
movdqa xmm7, xmmword [0x1402ae650]
movdqa xmm8, xmm0
nop dword [rax + rax]
movdqa xmm10, xmm8
movdqa xmm8, xmm0
movq xmm11, qword [r8 + rdx*4]
movq xmm9, qword [r8 + rdx*4 + 8]
movdqa xmm0, xmm11
pxor xmm0, xmm3
pcmpgtd xmm0, xmm4
packssdw xmm0, xmm0
packsswb xmm0, xmm0
pandn xmm0, xmm8
movdqa xmm8, xmm9
pxor xmm8, xmm3
pcmpgtd xmm8, xmm4
packssdw xmm8, xmm8
packsswb xmm8, xmm8
pandn xmm8, xmm10
paddd xmm11, xmm5
paddd xmm9, xmm5
pxor xmm11, xmm3
movdqa xmm10, xmm6
pcmpgtd xmm10, xmm11
pshufd xmm10, xmm10, 0xd4
pand xmm10, xmm7
paddq xmm2, xmm10
pxor xmm9, xmm3
movdqa xmm10, xmm6
pcmpgtd xmm10, xmm9
pshufd xmm9, xmm10, 0xd4
pand xmm9, xmm7
paddq xmm1, xmm9
add rdx, 4
cmp r10, rdx
jne 0x1401695a0
paddq xmm1, xmm2
pshufd xmm2, xmm1, 0xee
paddq xmm2, xmm1
movq rdx, xmm2
movdqa xmm1, xmmword [0x140308530]
pcmpeqb xmm0, xmm1
pcmpeqd xmm2, xmm2
pxor xmm0, xmm2
pcmpeqb xmm8, xmm1
pxor xmm8, xmm2
por xmm8, xmm0
punpcklbw xmm8, xmm8
pshuflw xmm0, xmm8, 0x50
pshufd xmm0, xmm0, 0x50
movmskpd r11d, xmm0
test r11d, r11d
sete r11b
cmp r10, rax
je 0x1401696ca
nop word [rax + rax]
mov edi, dword [r8 + r10*4]
cmp edi, 0x100
movzx r11d, r11b
cmovae r11d, ecx
add edi, 0xffff0000
cmp edi, 0x100000
adc rdx, 0
inc r10
cmp rax, r10
jne 0x1401696a0
test r11b, 1
jne 0x1401696e4
mov dword [rsp + 0x20], r9d
lea rcx, [rsp + 0x30]
mov r9, rax
call fcn.1401698f0
jmp 0x1401696f4
lea rcx, [rsp + 0x30]
mov rdx, r8
mov r8, rax
call fcn.140169740
mov rax, qword [rsp + 0x30]
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14025cd50
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm8, xmmword [rsp + 0x60]
movaps xmm9, xmmword [rsp + 0x70]
movaps xmm10, xmmword [rsp + 0x80]
movaps xmm11, xmmword [rsp + 0x90]
add rsp, 0xa8
pop rdi
pop rsi
ret