joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004844
Capabilities:
Get socket status

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x240
mov rdx, qword [rcx + 8]
mov r8, qword [rcx + 0x18]
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x38], rdx
lea edi, [rdx + 1]
mov dword [rsp + 0x30], 1
mov dword [r11 + 8], eax
mov dword [r11 + 0xc], r8d
lea rax, [rsp + 0x250]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
mov ecx, edi
call qword [sym.imp.WS2_32.dll_select]
mov ebx, eax
test eax, eax
jns 0x1400048a7
call fcn.140077fd8
cmp dword [rax], 4
je 0x140004877
test ebx, ebx
mov rbx, qword [rsp + 0x258]
setg al
add rsp, 0x240
pop rdi
ret

Function at 0x1400048c0
Capabilities:
Get socket status

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [rcx + 8]
mov ebx, 1
mov r8, qword [rcx + 0x28]
mov rdi, rcx
mov rdx, qword [rcx + 0x20]
mov qword [rsp + 0x38], rax
lea ebp, [rax + 1]
mov dword [rsp + 0x30], ebx
mov dword [r11 + 8], edx
mov dword [r11 + 0xc], r8d
lea rax, [rsp + 0x250]
xor r9d, r9d
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, ebp
call qword [sym.imp.WS2_32.dll_select]
mov esi, eax
test eax, eax
jns 0x14000492e
call fcn.140077fd8
cmp dword [rax], 4
je 0x1400048ff
test esi, esi
jle 0x14000493f
mov rcx, qword [rdi + 8]
call fcn.1400035c4
test al, al
jne 0x140004941
xor bl, bl
lea r11, [rsp + 0x240]
mov al, bl
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000bc5c
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x80
movups xmm0, xmmword [str._vdq_ag_noya_xv.]
movzx eax, word [0x1400a8e18]
lea r8, [rsp + 0x40]
xor r9d, r9d
mov word [rsp + 0x50], ax
mov rbx, rcx
movups xmmword [rsp + 0x40], xmm0
lea ecx, [r9 + 0x12]
mov rax, r9
movabs r10, 0x50850631d17d
cqo
inc r9
idiv r10
add dl, 3
xor byte [r8], dl
inc r8
sub rcx, 1
jne 0x14000bc8c
lea rax, [rsp + 0x40]
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x14000bcb9
mov rdx, qword [0x1400b4e28]
movabs rax, 0x7fffffffffffffff
sub rax, rdx
cmp rax, rcx
jb 0x14000bd6c
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
lea rax, [0x1400b4e18]
mov qword [rsp + 0x30], rdx
lea r9, [rsp + 0x40]
cmova rax, qword [0x1400b4e18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x58]
call fcn.140018274
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.14000bbb0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14000bd5a
mov rcx, qword [rsp + 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bd55
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bd66
call fcn.14006f96c
mov rax, rbx
add rsp, 0x80
pop rbx
ret
call fcn.140075b5c
int3
call fcn.1400014b4
int3

Function at 0x14000bd74
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov eax, dword [0x1400a8e98]
lea r8, [rsp + 0x40]
movsd xmm0, qword [str._vdq_mo4ei3]
xor r9d, r9d
mov dword [rsp + 0x48], eax
mov rbx, rcx
mov al, byte [reloc.WS2_32.dll_ntohs]
movsd qword [rsp + 0x40], xmm0
lea ecx, [r9 + 0xd]
mov byte [rsp + 0x4c], al
mov rax, r9
movabs r10, 0x50850631d17d
cqo
inc r9
idiv r10
add dl, 3
xor byte [r8], dl
inc r8
sub rcx, 1
jne 0x14000bdab
lea rax, [rsp + 0x40]
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x14000bdd8
mov rdx, qword [0x1400b4e28]
movabs rax, 0x7fffffffffffffff
sub rax, rdx
cmp rax, rcx
jb 0x14000be88
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
lea rax, [0x1400b4e18]
mov qword [rsp + 0x30], rdx
lea r9, [rsp + 0x40]
cmova rax, qword [0x1400b4e18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x50]
call fcn.140018274
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14000bbb0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000be79
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000be74
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000be82
call fcn.14006f96c
mov rax, rbx
add rsp, 0x70
pop rbx
ret
call fcn.140075b5c
int3
call fcn.1400014b4
int3
Function at 0x14000cf0c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x18], 0xf
mov rbx, rcx
jbe 0x14000cf2d
mov rbx, qword [rcx]
mov rdi, qword [0x1400b8e80]
xor edx, edx
mov rcx, rbx
mov r8, qword [rdi + 0x3928]
movsxd rax, dword [r8 + 0xf0]
mov r8, qword [r8 + 0xf8]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.14002505c
mov ecx, eax
xor edx, edx
call fcn.140030de8
test al, al
jne 0x14000cf71
and dword [rdi + 0x3e70], 0
jmp 0x14000d06b
mov edx, dword [rdi + 0x3e70]
mov esi, 4
test dl, 1
jne 0x14000cfdf
mov rax, qword [rdi + 0x3f70]
or edx, 1
mov rcx, qword [rax]
mov eax, 0x3f000000
movss xmm2, dword [rcx + 0xc]
movss xmm1, dword [rcx + 0x10]
mulss xmm2, dword [0x1400a9e90]
mulss xmm1, dword [0x1400a9e90]
addss xmm2, dword [rcx + 4]
addss xmm1, dword [rcx + 8]
mov dword [rdi + 0x3e70], edx
mov dword [rdi + 0x3e88], eax
movss dword [rdi + 0x3e80], xmm2
mov dword [rdi + 0x3e8c], eax
movss dword [rdi + 0x3e84], xmm1
mov dword [rdi + 0x3e74], esi
xor edx, edx
mov r8d, 0xc000061
mov rcx, rbx
call fcn.14002c274
test al, al
je 0x14000d066
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
lea rcx, [0x1400b4e58]
cmova rcx, qword [0x1400b4e58]
call fcn.140035bdc
and dword [rsp + 0x30], 0
lea rcx, [rsp + 0x38]
and dword [rsp + 0x34], 0
mov eax, dword [0x1400a85e8]
xor r8d, r8d
mov dword [rsp + 0x38], eax
mov rax, r8
movabs r9, 0x50850631d17d
cqo
inc r8
idiv r9
add dl, 3
xor byte [rcx], dl
inc rcx
sub rsi, 1
jne 0x14000d02b
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140036298
test al, al
je 0x14000d066
call fcn.14003116c
call fcn.140031218
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14000d580
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x70
mov r8, qword [0x1400b8e80]
mov rsi, rcx
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
cmp byte [r8 + 0xc98], 0
je 0x14000d7bf
movss xmm1, dword [0x1400a9fa4]
call fcn.14002f188
test al, al
je 0x14000d7bf
cmp byte [r8 + 0xc98], 0
movss xmm1, dword [r8 + 0x24]
jne 0x14000d5df
cmp byte [r8 + 0x31de], 0
je 0x14000d62a
movss xmm0, dword [r8 + 0x3218]
mulss xmm1, xmm1
comiss xmm0, xmm1
jb 0x14000d62a
lea r9, [r8 + 0xc90]
mov rcx, r9
call fcn.14002f1b0
test al, al
je 0x14000d62a
lea rcx, [r8 + 0x316c]
call fcn.14002f1b0
test al, al
je 0x14000d62a
movss xmm6, dword [r9]
movss xmm7, dword [r9 + 4]
subss xmm6, dword [rcx]
subss xmm7, dword [rcx + 4]
jmp 0x14000d630
xorps xmm6, xmm6
xorps xmm7, xmm7
mov rax, qword [0x1400b8d80]
test rax, rax
jne 0x14000d6da
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14000d6b6
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x14000d6b6
mov edi, dword [r9 + 0x20]
dec edx
mov r11d, 0xd44543ec
lea rcx, [rdi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x14000d6b2
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x37d89a
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x14000d692
cmp r11d, 0x80b6cd2c
je 0x14000d6bb
test edx, edx
jne 0x14000d675
mov rax, qword [rax]
jmp 0x14000d651
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
mov qword [0x1400b8d80], rax
mov rcx, qword [rsi + 0x70]
lea rdx, [rsp + 0x40]
call rax
mov rax, qword [0x1400b8d88]
test rax, rax
jne 0x14000d791
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14000d76c
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x14000d76c
mov edi, dword [r9 + 0x20]
dec r10d
mov r11d, 0x40beba4e
lea rcx, [rdi + r10*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x14000d767
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x37d89a
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14000d748
cmp r11d, 0xc729d112
je 0x14000d771
test r10d, r10d
jne 0x14000d72b
mov rax, qword [rax]
jmp 0x14000d706
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
mov qword [0x1400b8d88], rax
mov rcx, qword [rsi + 0x70]
xor edx, edx
cvttss2si r9d, xmm7
mov dword [rsp + 0x30], 5
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
cvttss2si r8d, xmm6
add r9d, dword [rsp + 0x44]
add r8d, dword [rsp + 0x40]
call rax
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
movaps xmm7, xmmword [rsp + 0x50]
mov rsp, r11
pop rdi
ret
Function at 0x1400190f4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor r9d, r9d
movabs r8, 0xcbf29ce484222325
test rdx, rdx
je 0x140019124
movzx eax, byte [rcx + r9]
movabs r10, 0x100000001b3
xor r8, rax
inc r9
imul r8, r10
cmp r9, rdx
jb 0x140019106
mov rax, r8
ret

Function at 0x14001bc8c
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
jmp 0x14001bcf9
cmp ecx, 0x29
jne 0x14001bd0e
cmp dword [rbx + 0x1c], 0
jne 0x14001bd03
test dword [rbx + 0x80], 0x10000000
je 0x14001be3e
cmp ecx, 0x5d
jne 0x14001bcd0
test dword [rbx + 0x80], 0x10000000
je 0x14001be49
mov dl, byte [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.14001d664
mov dil, 1
mov rcx, rbx
call fcn.14001bc40
test dil, dil
je 0x14001bcf4
mov rcx, rbx
call fcn.14001d51c
mov ecx, dword [rbx + 0x7c]
mov al, 1
cmp ecx, 0xffffffff
je 0x14001bd03
cmp ecx, 0x7c
jne 0x14001bca0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp ecx, 0x2e
jne 0x14001bd2b
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.14001bf3c
mov rcx, rbx
call fcn.14001bc40
jmp 0x14001bcec
cmp ecx, 0x5c
jne 0x14001bd89
mov rcx, rbx
call fcn.14001bc40
test byte [rbx + 0x80], 0x80
je 0x14001bd7c
mov al, byte [rbx + 0x78]
cmp al, 0x62
jne 0x14001bd60
mov edx, 4
lea rcx, [rbx + 0x40]
call fcn.14001bf3c
mov rcx, rbx
call fcn.14001bc40
jmp 0x14001bcf4
cmp al, 0x42
jne 0x14001bd7c
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.14001bf3c
mov rax, qword [rbx + 0x48]
xor dword [rax + 0xc], 1
jmp 0x14001bd56
mov rcx, rbx
call fcn.14001d2a8
jmp 0x14001bcec
cmp ecx, 0x5b
jne 0x14001bda9
mov rcx, rbx
call fcn.14001bc40
mov rcx, rbx
call fcn.14001d158
cmp dword [rbx + 0x7c], 0x5d
jne 0x14001be1d
jmp 0x14001bd21
cmp ecx, 0x28
jne 0x14001bdcc
mov rcx, rbx
call fcn.14001bc40
mov rcx, rbx
call fcn.14001d3e4
cmp dword [rbx + 0x7c], 0x29
mov dil, al
jne 0x14001be28
jmp 0x14001bcdf
cmp ecx, 0x5e
jne 0x14001bdd9
lea edx, [rcx - 0x5c]
jmp 0x14001bd4d
cmp ecx, 0x24
jne 0x14001bde6
lea edx, [rcx - 0x21]
jmp 0x14001bd4d
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x14001be12
cmp ecx, 0x3f
je 0x14001be12
cmp ecx, 0x7b
je 0x14001be12
cmp ecx, 0x7d
jne 0x14001bcbb
test dword [rbx + 0x80], 0x10000000
je 0x14001be33
jmp 0x14001bcd0
mov edx, 0xa
call fcn.14001a5ac
int3
mov edx, 4
call fcn.14001a5ac
int3
mov edx, 5
call fcn.14001a5ac
int3
mov edx, 6
call fcn.14001a5ac
int3
mov edx, 5
call fcn.14001a5ac
int3
mov edx, 4
call fcn.14001a5ac
int3
Function at 0x14002501c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rcx
not r8d
movzx eax, byte [r9]
dec rdx
inc r9
mov r10d, 8
xor r8d, eax
mov ecx, r8d
shr ecx, 1
mov eax, ecx
xor eax, 0xedb88320
test r8b, 1
cmove eax, ecx
mov r8d, eax
sub r10, 1
jne 0x140025035
test rdx, rdx
jne 0x140025022
not eax
ret

Function at 0x14002505c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x1400250ca
mov r11b, 0x23
movzx eax, byte [r10]
dec rdx
inc r10
cmp al, r11b
jne 0x14002509d
cmp rdx, 2
jb 0x14002509d
cmp byte [r10], r11b
jne 0x14002509d
cmp byte [r10 + 1], r11b
jne 0x14002509d
add r10, 2
mov r9d, r8d
sub rdx, 2
xor r9d, eax
mov ebx, 8
mov ecx, r9d
mov eax, r9d
shr ecx, 1
mov r9d, ecx
xor r9d, 0xedb88320
test al, 1
cmove r9d, ecx
sub rbx, 1
jne 0x1400250a5
test rdx, rdx
jne 0x140025072
jmp 0x140025120
mov al, byte [rcx]
inc r10
test al, al
je 0x140025120
mov r11b, 0x23
cmp al, r11b
jne 0x1400250ed
cmp byte [r10], r11b
jne 0x1400250ed
cmp byte [r10 + 1], r11b
jne 0x1400250ed
mov r9d, r8d
add r10, 2
movzx eax, al
mov edx, 8
xor r9d, eax
mov ecx, r9d
mov eax, r9d
shr ecx, 1
mov r9d, ecx
xor r9d, 0xedb88320
test al, 1
cmove r9d, ecx
sub rdx, 1
jne 0x1400250f8
mov al, byte [r10]
inc r10
test al, al
jne 0x1400250d6
mov rbx, qword [rsp + 8]
not r9d
mov eax, r9d
ret
Function at 0x140027880
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub rsp, 0x38
mov eax, dword [0x1400a9c38]
lea r8, [rsp + 0x20]
movsd xmm0, qword [str._Ggdcnxdycj]
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov al, byte [reloc.WS2_32.dll_ntohs]
movsd qword [rsp + 0x20], xmm0
lea r10d, [r9 + 0xd]
mov byte [rsp + 0x2c], al
mov rax, r9
movabs r11, 0x50850631d17d
cqo
inc r9
idiv r11
add dl, 3
xor byte [r8], dl
inc r8
sub r10, 1
jne 0x1400278b2
lea r8, [rsp + 0x20]
xor edx, edx
call fcn.14002773c
add rsp, 0x38
ret

Function at 0x1400278e8
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub rsp, 0x38
mov eax, dword [0x1400a9c58]
lea r8, [rsp + 0x20]
movsd xmm0, qword [str._Ciumnxdycj]
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov al, byte [reloc.WS2_32.dll_ntohs]
movsd qword [rsp + 0x20], xmm0
lea r10d, [r9 + 0xd]
mov byte [rsp + 0x2c], al
mov rax, r9
movabs r11, 0x50850631d17d
cqo
inc r9
idiv r11
add dl, 3
xor byte [r8], dl
inc r8
sub r10, 1
jne 0x14002791a
lea r8, [rsp + 0x20]
lea edx, [r10 + 1]
call fcn.14002773c
add rsp, 0x38
ret
Function at 0x140030bcc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r14
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400b8e80]
xor edi, edi
lea r14d, [rdi + 1]
cmp byte [rbx + 0x411d], dil
jne 0x140030c06
cmp byte [rbx + 0x411e], dil
je 0x140030c6e
movss xmm1, dword [rbx + 0x3334]
movaps xmm0, xmm1
mulss xmm1, dword [0x1400a9f34]
mulss xmm0, dword [0x1400a9f40]
addss xmm1, dword [rbx + 0xc94]
addss xmm0, dword [rbx + 0xc90]
mov qword [rbx + 0x3e88], rdi
mov dword [rbx + 0x3e74], r14d
movss dword [rbx + 0x3e84], xmm1
movss dword [rbx + 0x3e80], xmm0
movss xmm0, dword [rbx + 0x3390]
mulss xmm0, dword [0x1400a9e94]
or dword [rbx + 0x3e70], 0x41
movss dword [rbx + 0x3ed0], xmm0
mov eax, dword [0x1400a9c28]
lea rcx, [rbp - 0x20]
movsd xmm0, qword [str._QihdcS__t]
mov esi, reloc.WS2_32.dll_ntohs
movsx r9d, word [rbx + 0x5a32]
mov r8, rdi
mov dword [rbp - 0x18], eax
mov r10d, esi
movzx eax, word [0x1400a9c2c]
movabs r12, 0x50850631d17d
mov word [rbp - 0x14], ax
mov al, byte [0x1400a9c2e]
mov byte [rbp - 0x12], al
movsd qword [rbp - 0x20], xmm0
mov rax, r8
add r8, r14
cqo
idiv r12
add dl, 3
xor byte [rcx], dl
add rcx, r14
sub r10, r14
jne 0x140030cb9
lea r8, [rbp - 0x20]
lea edx, [r10 + 0x10]
lea rcx, [rbp - 0x10]
call fcn.140024f18
lea rcx, [rbp - 0x10]
call fcn.140029e10
test rax, rax
je 0x140030d78
cmp byte [rax + 0xb6], dil
je 0x140030d78
movsd xmm0, qword [str._QihdcS__t]
lea rcx, [rbp - 0x20]
mov byte [rax + 0xbb], r14b
mov byte [rax + 0xbd], r14b
mov byte [rax + 0xd8], r14b
mov eax, dword [0x1400a9c28]
add word [rbx + 0x5a32], r14w
movsx r9d, word [rbx + 0x5a32]
mov dword [rbp - 0x18], eax
movzx eax, word [0x1400a9c2c]
mov word [rbp - 0x14], ax
mov al, byte [0x1400a9c2e]
mov byte [rbp - 0x12], al
movsd qword [rbp - 0x20], xmm0
mov rax, rdi
add rdi, r14
cqo
idiv r12
add dl, 3
xor byte [rcx], dl
add rcx, r14
sub rsi, r14
jne 0x140030d50
lea r8, [rbp - 0x20]
lea edx, [rsi + 0x10]
lea rcx, [rbp - 0x10]
call fcn.140024f18
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0x20c0347
call fcn.14002c274
mov rbx, qword [rsp + 0x60]
mov al, r14b
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r12
pop rbp
ret
Function at 0x1400340a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
test dword [rcx + 0x14], 0x4000000
je 0x1400340c0
mov rax, qword [0x1400b8e80]
mov rcx, qword [rax + 0x5ab0]
jmp 0x14003415f
test dword [rcx + 0x14], 0x400
je 0x140034151
mov eax, dword [0x1400a9cc0]
lea r8, [rsp]
movsd xmm0, qword [str._HgnfDoeyOo]
xor r9d, r9d
mov dword [rsp + 8], eax
movzx eax, word [0x1400a9cc4]
movsd qword [rsp], xmm0
lea r10d, [r9 + 0xe]
mov word [rsp + 0xc], ax
mov rax, r9
movabs r11, 0x50850631d17d
cqo
inc r9
idiv r11
add dl, 3
xor byte [r8], dl
inc r8
sub r10, 1
jne 0x1400340fb
mov rax, qword [rcx + 8]
lea r8, [rsp]
sub r8, rax
movzx ecx, byte [rax]
movzx edx, byte [rax + r8]
sub ecx, edx
jne 0x14003413d
inc rax
test edx, edx
jne 0x14003412a
test ecx, ecx
jne 0x140034151
mov rax, qword [0x1400b8e80]
mov rcx, qword [rax + 0x5aa8]
jmp 0x14003415f
mov rax, qword [0x1400b8e80]
mov rcx, qword [rax + 0x5ab8]
test rcx, rcx
lea rax, [0x1400a7ef2]
cmovne rax, rcx
add rsp, 0x18
ret
Function at 0x140034174
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rbx, qword [0x1400b8e80]
movss xmm0, dword [0x1400a9e70]
comiss xmm0, dword [rbx + 0x40f8]
ja 0x1400343a7
cmp qword [rbx + 0x40f0], 0
mov edi, setsockopt
movups xmm0, xmmword [str._Hfcehbyfvzga]
mov eax, dword [0x1400a9cb0]
movabs rsi, 0x50850631d17d
mov dword [rbp - 0x10], eax
movups xmmword [rbp - 0x20], xmm0
jne 0x140034207
lea rcx, [rbp - 0x20]
xor r8d, r8d
mov r9d, edi
mov rax, r8
inc r8
cqo
idiv rsi
add dl, 3
xor byte [rcx], dl
inc rcx
sub r9, 1
jne 0x1400341de
lea rcx, [rbp - 0x20]
call fcn.140029e10
mov qword [rbx + 0x40f0], rax
mov rax, qword [rbx + 0x3f70]
lea rdx, [rbp + 0x10]
mov dword [rbp - 0x28], 0x7f7fffff
mov dword [rbp - 0x24], 0x7f7fffff
mov rcx, qword [rax]
mov eax, dword [rbx + 0x3e70]
or eax, 0x10
movss xmm2, dword [rcx + 0xc]
movss xmm1, dword [rcx + 0x10]
mulss xmm1, dword [0x1400a9e74]
and qword [rbx + 0x3ec0], 0
and qword [rbx + 0x3ec8], 0
mulss xmm2, dword [0x1400a9e74]
mov dword [rbx + 0x3e70], eax
or eax, 1
movss dword [rbp - 0x2c], xmm1
movss dword [rbp - 0x30], xmm2
movups xmm1, xmmword [rbp - 0x30]
movdqu xmmword [rbx + 0x3eac], xmm1
movss xmm1, dword [rcx + 0x10]
movss xmm2, dword [rcx + 0xc]
mulss xmm1, dword [0x1400a9e90]
mulss xmm2, dword [0x1400a9e90]
addss xmm1, dword [rcx + 8]
addss xmm2, dword [rcx + 4]
mov dword [rbx + 0x3e70], eax
mov eax, 0x3f000000
mov dword [rbx + 0x3e88], eax
movss dword [rbx + 0x3e84], xmm1
mov dword [rbx + 0x3e8c], eax
movss dword [rbx + 0x3e80], xmm2
mov dword [rbx + 0x3e74], 1
movss xmm0, dword [rbx + 0x3270]
movss xmm1, dword [rbx + 0x3274]
addss xmm0, xmm0
addss xmm1, xmm1
movss dword [rbp + 0x10], xmm0
movss dword [rbp + 0x14], xmm1
call fcn.140025714
lea rcx, [rbp - 0x20]
xor r8d, r8d
mov rax, r8
inc r8
cqo
idiv rsi
add dl, 3
xor byte [rcx], dl
inc rcx
sub rdi, 1
jne 0x1400342f8
xor edx, edx
lea rcx, [rbp - 0x20]
mov r8d, 0xc1347
call fcn.14002c274
mov eax, dword [rbx + 0x38d8]
sub eax, 1
movsxd rsi, eax
js 0x140034398
mov rax, qword [rbx + 0x38e0]
mov rdi, qword [rax + rsi*8]
cmp byte [rdi + 0xb7], 0
je 0x140034392
cmp rdi, qword [rdi + 0x378]
jne 0x140034392
test dword [rdi + 0x14], 0x80000
jne 0x140034392
mov r10, qword [rdi + 8]
xor edx, edx
mov rcx, r10
call fcn.140025800
cmp r10, rax
jne 0x140034374
mov rcx, rdi
call fcn.1400340a0
mov r10, rax
and dword [rbp + 0x10], 0
lea r9, [rbp + 0x10]
and dword [rbp + 0x14], 0
mov rcx, r10
cmp qword [rbx + 0x40e0], rdi
sete dl
call fcn.14003a8c4
sub rsi, 1
jns 0x140034330
call fcn.14002e1d4
mov ecx, 1
call fcn.140025774
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x140036a88
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
xor r8d, r8d
mov r10, rcx
test edx, edx
jne 0x140036ab7
movsd xmm0, qword [str._WFTHDER_v]
lea rcx, [rsp + 0x20]
mov al, byte [0x1400a9d70]
movsd qword [rsp + 0x20], xmm0
mov byte [rsp + 0x28], al
jmp 0x140036ad4
movsd xmm0, qword [str._WFTHDES_v]
lea rcx, [rsp + 0x29]
mov al, byte [0x1400a9d80]
movsd qword [rsp + 0x29], xmm0
mov byte [rsp + 0x31], al
mov r9, rcx
mov r11d, 9
mov rax, r8
movabs rbx, 0x50850631d17d
cqo
inc r8
idiv rbx
add dl, 3
xor byte [r9], dl
inc r9
sub r11, 1
jne 0x140036add
movsxd rax, dword [r10 + 0xf0]
xor edx, edx
mov r8, qword [r10 + 0xf8]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.14002505c
add rsp, 0x40
pop rbx
ret
Function at 0x1400481b4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400481ee
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400481f3
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14004823c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14009b5c0]
cmp byte [rcx + rax], 0
je 0x14004823c
dec r8
sub rdx, 1
jne 0x140048222
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400657c4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x140051f1e
movzx eax, byte [rcx + rdx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x140051f01
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x140051eec

Function at 0x14006f2ec
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
call fcn.14007ee24
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x14006f33e
and dword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
mov r9d, 2
lea edx, [r9 + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
sub ecx, 0x30
je 0x14006f33e
sub ecx, 1
je 0x14006f337
cmp ecx, 1
je 0x14006f330
xor eax, eax
jmp 0x14006f343
mov eax, 3
jmp 0x14006f343
mov eax, 1
jmp 0x14006f343
mov eax, 2
add rsp, 0x28
ret

Function at 0x140070590
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400705da
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400705da
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400705da
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400705da
cmp dword [rcx + 0x84], 0xe
jbe 0x1400705da
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400705dc
xor al, al
add rsp, 0x28
ret