joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005c60
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push r13
push r15
mov eax, 0x1070
call fcn.1400263e0
sub rsp, rax
mov rax, qword [0x1400d7060]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rdx, qword [rsp + 0x10b0]
xor ebp, ebp
mov qword [rsp + 0x38], r9
mov r15, r8
mov qword [rsp + 0x30], rdx
mov r13, rcx
test r8, r8
jne 0x140005cac
mov rdx, rbp
jmp 0x140005dba
mov r9d, 0x1000
lea rdx, [rsp + 0x40]
call fcn.140004990
test al, al
je 0x140005ca4
mov qword [rsp + 0x1068], rsi
lea rdx, str.PAGE
mov qword [rsp + 0x1060], rdi
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x1058], r12
mov qword [rsp + 0x1050], r14
nop
inc rdi
cmp byte [rdx + rdi], bpl
jne 0x140005cf0
movsxd rax, dword [rsp + 0x7c]
lea rcx, [rsp + 0x40]
add rcx, rax
mov qword [rsp + 0x1098], rbx
mov esi, ebp
movzx eax, word [rcx + 0x14]
lea r12, [rcx + 0x18]
movzx r14d, word [rcx + 6]
add r12, rax
test r14d, r14d
je 0x140005d8f
nop word [rax + rax]
mov eax, esi
mov r8, rdi
lea rcx, [rax + rax*4]
lea rbx, [r12 + rcx*8]
mov rcx, rbx
call fcn.140070000
test eax, eax
jne 0x140005d5e
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], bpl
jne 0x140005d50
cmp rdi, rax
je 0x140005d6e
inc esi
cmp esi, r14d
jae 0x140005d8f
lea rdx, str.PAGE
jmp 0x140005d30
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x140005d8f
mov ecx, dword [rbx + 8]
mov edx, eax
lea rax, [rsp + 0x40]
add rax, rdx
je 0x140005d8f
test ecx, ecx
je 0x140005d8f
mov ebp, ecx
add rdx, r15
jmp 0x140005d92
mov rdx, rbp
mov rbx, qword [rsp + 0x1098]
mov rdi, qword [rsp + 0x1060]
mov rsi, qword [rsp + 0x1068]
mov r12, qword [rsp + 0x1058]
mov r14, qword [rsp + 0x1050]
mov rax, qword [rsp + 0x30]
mov rcx, r13
mov r9, qword [rsp + 0x38]
mov r8d, ebp
mov qword [rsp + 0x20], rax
call fcn.140005b50
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140025840
add rsp, 0x1070
pop r15
pop r13
pop rbp
ret
Function at 0x140006840
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140006862
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x1400068dc
mov rdi, r14
mov rcx, rbx
call fcn.140007dd0
test rax, rax
jle 0x1400068b4
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.14006f710
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400068cc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x1400068d4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140006876
sub r14, rdi
jmp 0x1400069c9
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400068f3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400068f5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000692a
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14006f710
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400069c6
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x140006965
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x1400069a1
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14007583c
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x1400069df
cmp rbp, rax
ja 0x140006971
mov r8, rdi
test rdi, rdi
je 0x1400069c6
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14007583c
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x1400069c9
Function at 0x140006df0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400d7060]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140006e1d
xor eax, eax
jmp 0x140006f63
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140006e57
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140006e57
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140006f63
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140006f56
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140006e9a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140006ea9
movsx ecx, dil
jmp 0x140006efd
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + gethostname]
test eax, eax
je 0x140006f17
sub eax, 1
je 0x140006f17
cmp eax, 2
jne 0x140006f56
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.1400743f4
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140006f5b
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140006f44
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.140074f54
cmp rsi, rax
jne 0x140006f56
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x140006f5b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140025840
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14000aea0
Capabilities:
Parse pe header

Disassembly:
push rbx
push rbp
push rdi
push r12
push r14
sub rsp, 0x60
mov r12, qword [0x1400dc700]
mov eax, 0x5a4d
mov r14, rdx
cmp word [rdx], ax
jne 0x14000b082
movsxd rdi, dword [rdx + 0x3c]
add rdi, rdx
cmp dword [rdi], 0x4550
jne 0x14000b082
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x14000b082
mov ebx, dword [rdi + 0x50]
xor ecx, ecx
mov edx, ebx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
je 0x14000b082
movzx ecx, word [rdi + 0x14]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x90], rsi
xor esi, esi
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0xa8], r15
mov eax, dword [rcx + rdi + 0x24]
sub ebx, eax
mov edx, ebx
mov rcx, r12
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], rsi
mov r13d, ebx
call fcn.14000aa20
mov r15, rax
test rax, rax
je 0x14000afea
mov r8d, dword [rdi + 0x54]
mov rdx, r14
mov rcx, rbp
call fcn.14006f710
movzx ebx, word [rdi + 0x14]
xor eax, eax
add rbx, 0x28
cmp ax, word [rdi + 6]
jae 0x14000afa1
add rbx, rdi
test dword [rbx + 0x14], 0x80
ja 0x14000af93
mov edx, dword [rbx + 4]
mov ecx, dword [rbx - 4]
add rdx, r14
mov r8d, dword [rbx]
add rcx, rbp
call fcn.14006f710
movzx eax, word [rdi + 6]
inc esi
add rbx, 0x28
cmp esi, eax
jl 0x14000af76
mov r14d, dword [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov rsi, r15
mov rdx, rbp
sub r15, r14
mov rbx, r15
sub rbx, qword [rdi + 0x30]
call fcn.14000e1e0
mov rdx, rbx
mov rcx, rax
call fcn.14000b090
mov rdx, rbp
lea rcx, [rsp + 0x40]
call fcn.14000e330
mov rdx, rax
mov rcx, r12
call fcn.14000b190
test al, al
jne 0x14000b02c
mov r15, rsi
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, r15
mov rcx, r12
call fcn.140004cd0
xor eax, eax
mov r13, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x90]
mov r15, qword [rsp + 0xa8]
add rsp, 0x60
pop r14
pop r12
pop rdi
pop rbp
pop rbx
ret
lea r8, [r14 + rbp]
mov r9, r13
mov rdx, rsi
mov rcx, r12
call fcn.140004990
test al, al
je 0x14000afe7
mov r8d, dword [rdi + 0x28]
lea rdx, [rsp + 0x30]
xor eax, eax
add r8, r15
xor r9d, r9d
mov dword [rsp + 0x30], eax
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.14000b630
test al, al
je 0x14000afe7
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rsi
jmp 0x14000b008
xor eax, eax
add rsp, 0x60
pop r14
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x14000d5f0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x50
mov rax, qword [0x1400d7060]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
lea r9, [rsp + 0x20]
mov r14, rcx
mov dword [rsp + 0x20], ebp
xor r8d, r8d
xor edx, edx
mov ebx, ebp
lea ecx, [rbp + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000d67e
nop dword [rax]
test rbx, rbx
je 0x14000d646
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, reloc.WS2_32.dll_inet_addr
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14000d630
test eax, eax
jns 0x14000d69f
test rbx, rbx
je 0x14000d6a4
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x14000d795
test rbx, rbx
jne 0x14000d6ab
xor eax, eax
jmp 0x14000d795
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rdi
mov edi, ebp
cmp dword [rbx], ebp
jbe 0x14000d775
mov esi, edi
lea rdx, [rbx + 0x30]
imul rax, rsi, 0x128
mov qword [rsp + 0x28], rbp
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
add rdx, rcx
inc r8
cmp byte [rdx + r8], bpl
jne 0x14000d6f4
lea rcx, [rsp + 0x28]
call fcn.140001910
cmp qword [r14 + 0x18], 0x10
mov rdx, r14
jb 0x14000d714
mov rdx, qword [r14]
cmp qword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
call fcn.1400752d0
test eax, eax
je 0x14000d7ab
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000d76b
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d766
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d806
call fcn.140025aec
inc edi
cmp edi, dword [rbx]
jb 0x14000d6c2
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140025840
add rsp, 0x50
pop r14
pop rbp
pop rbx
ret
imul rax, rsi, 0x128
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
mov rdi, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000d801
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d7fc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d806
call fcn.140025aec
mov rax, rdi
jmp 0x14000d788
call fcn.14007407c
int3
Function at 0x14000e1e0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400d7060]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14000e2f3
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000e2f3
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
xor edx, edx
mov qword [rsp + 0x50], rdx
mov ecx, dword [rax + rsi + 0xb0]
test ecx, ecx
jne 0x14000e258
mov qword [rdi], rdx
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rdx
jmp 0x14000e300
lea rbx, [rsi + rcx]
mov ebp, dword [rax + rsi + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x48]
cmp rbx, rbp
jae 0x14000e2e1
mov r8d, dword [rbx + 4]
test r8d, r8d
je 0x14000e2e1
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [r8 - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, rdx
je 0x14000e2ba
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x48], rcx
jmp 0x14000e2d6
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.14000e920
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rbp
jb 0x14000e270
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rdx
jmp 0x14000e300
xor edx, edx
mov qword [rcx], rdx
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], rdx
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140025840
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140012cf0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1400d7060]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov rsi, rdx
mov r15, rcx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x20], rdx
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x38], xmm1
movups xmmword [rsp + 0x48], xmm1
movups xmmword [rsp + 0x58], xmm1
movups xmmword [rsp + 0x68], xmm1
movups xmmword [rsp + 0x78], xmm1
movups xmmword [rbp - 0x78], xmm1
movups xmmword [rbp - 0x68], xmm1
movups xmmword [rbp - 0x58], xmm1
mov dword [rbp - 0x48], 0x6a09e667
mov dword [rbp - 0x44], 0xbb67ae85
mov dword [rbp - 0x40], 0x3c6ef372
mov dword [rbp - 0x3c], 0xa54ff53a
mov dword [rbp - 0x38], 0x510e527f
mov dword [rbp - 0x34], 0x9b05688c
mov dword [rbp - 0x30], 0x1f83d9ab
mov dword [rbp - 0x2c], 0x5be0cd19
xor eax, eax
mov qword [rsp + 0x30], rax
mov r14d, dword [rdx + 0x10]
mov r12, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x140012dad
mov r12, qword [rdx]
mov ebx, 0x40
cmp r14d, ebx
cmovb ebx, r14d
mov r8d, ebx
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.14006f710
mov ecx, dword [rsp + 0x34]
add ecx, r14d
cmp ecx, 0x40
jae 0x140012ddb
mov dword [rsp + 0x34], ecx
jmp 0x140012e3a
sub r14d, ebx
mov edi, r14d
shr edi, 6
add rbx, r12
mov r8d, 1
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.140012460
mov r8d, edi
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140012460
and r14d, 0x3f
mov r8d, r14d
mov edx, edi
shl edx, 6
add rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.14006f710
mov dword [rsp + 0x34], r14d
shl edi, 6
mov ecx, dword [rsp + 0x30]
add ecx, 0x40
add ecx, edi
mov dword [rsp + 0x30], ecx
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.140012ab0
mov byte [rbp + 0x40], 0
lea rbx, [rbp - 0x20]
lea rdi, [rbp]
mov r14d, 0x20
nop word [rax + rax]
movzx r8d, byte [rbx]
lea rdx, str._02x
mov rcx, rdi
call fcn.140012400
add rdi, 2
lea rbx, [rbx + 1]
sub r14, 1
jne 0x140012e60
xor ebx, ebx
mov qword [r15], rbx
mov qword [r15 + 0x10], rbx
mov qword [r15 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r15], bl
lea rax, [rbp]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], bl
jne 0x140012ea0
lea rdx, [rbp]
mov rcx, r15
call fcn.140001910
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x140012eec
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140012ee7
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140012f25
mov rcx, r8
call fcn.140025aec
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rax, r15
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.140025840
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14007407c
int3
Function at 0x140012f40
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r14
push r15
sub rsp, 0x20
mov rsi, rcx
cmp rcx, 0xfffffffffffbffff
jb 0x140012f80
call fcn.140077b04
mov dword [rax], ntohl
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
lea r15, [rcx + 0x10]
mov r8d, 0x3000
xor ecx, ecx
lea rbp, [r15 + 0xffff]
and rbp, 0xffffffffffff0000
lea r9d, [rcx + 4]
lea rdx, [rbp + 0x30000]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
test rax, rax
je 0x140012f6a
mov qword [rsp + 0x48], rdi
lea rcx, [rax + 0x10000]
lea r9, [rsp + 0x40]
mov edx, 0x10000
mov r8d, 1
lea rdi, [rax + 0x20000]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rdi + rbp]
mov edx, 0x10000
lea r9, [rsp + 0x40]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualLock]
movups xmm0, xmmword [0x1400dc708]
mov rbx, rbp
lea r9, [rsp + 0x40]
sub rbx, r15
mov edx, 0x10000
add rbx, rdi
mov r8d, 2
mov rcx, r14
movups xmmword [rbx], xmm0
mov qword [r14], rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdi, qword [rsp + 0x48]
add rbx, 0x10
je 0x140012f6a
mov r8, rsi
mov edx, reloc.WLDAP32.dll_Ordinal_219
mov rcx, rbx
call fcn.14006fde0
mov rax, rbx
jmp 0x140012f6c

Function at 0x140013060
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
test rcx, rcx
je 0x140013154
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x28], rdi
lea rdi, [rcx - 0x10]
mov rbx, rdi
and rbx, 0xffffffffffff0000
cmp rbx, 0x20000
jbe 0x140013159
mov qword [rsp + 0x38], rbp
lea r9, [rsp + 0x58]
mov rbp, qword [rbx - 0x20000]
lea rcx, [rbx - 0x20000]
mov r8d, 4
mov qword [rsp + 0x30], rsi
lea rdx, [rbp + 0x30000]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [rsp + 0x68], rdi
lea rax, [0x1400dc708]
mov qword [rsp + 0x60], rax
xor edi, edi
mov byte [rsp + 0x50], 0
nop word [rax + rax]
mov rax, qword [rsp + 0x60]
movzx edx, byte [rax + rdi]
mov rax, qword [rsp + 0x68]
movzx ecx, byte [rax + rdi]
inc rdi
movzx eax, byte [rsp + 0x50]
xor ecx, edx
or al, cl
mov byte [rsp + 0x50], al
cmp rdi, 0x10
jb 0x1400130e0
movzx eax, byte [rsp + 0x50]
dec eax
bt eax, 8
jae 0x14001315f
xor eax, eax
mov rdi, rbx
mov rcx, rbp
mov rdx, rbp
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualUnlock]
xor edx, edx
lea rcx, [rbx - 0x20000]
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x28]
add rsp, 0x48
ret
call fcn.1400154a0
int3
call fcn.140012f30
int3
Function at 0x140013170
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm2, xmmword [rcx + 0x10]
movdqu xmm0, xmmword [rcx]
movdqu xmmword [rdx + 0x10], xmm2
movdqu xmmword [rdx], xmm0
movdqa xmm1, xmm0
pslldq xmm1, 4
pxor xmm1, xmm0
aeskeygenassist xmm0, xmm2, 1
movdqa xmm3, xmm1
pslldq xmm3, 8
pxor xmm3, xmm1
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm0, xmm2
pslldq xmm0, 4
pxor xmm0, xmm2
movdqu xmmword [rdx + 0x20], xmm3
movdqa xmm2, xmm0
pslldq xmm2, 8
pxor xmm2, xmm0
aeskeygenassist xmm0, xmm3, 1
pshufd xmm1, xmm0, 0xaa
movdqa xmm0, xmm3
pslldq xmm0, 4
pxor xmm2, xmm1
pxor xmm0, xmm3
movdqu xmmword [rdx + 0x30], xmm2
movdqa xmm3, xmm0
pslldq xmm3, 8
pxor xmm3, xmm0
aeskeygenassist xmm0, xmm2, 2
pshufd xmm1, xmm0, 0xff
movdqa xmm0, xmm2
pslldq xmm0, 4
pxor xmm3, xmm1
pxor xmm0, xmm2
movdqu xmmword [rdx + 0x40], xmm3
movdqa xmm2, xmm0
pslldq xmm2, 8
pxor xmm2, xmm0
aeskeygenassist xmm0, xmm3, 2
pshufd xmm1, xmm0, 0xaa
movdqa xmm0, xmm3
pslldq xmm0, 4
pxor xmm2, xmm1
pxor xmm0, xmm3
movdqu xmmword [rdx + 0x50], xmm2
movdqa xmm3, xmm0
pslldq xmm3, 8
pxor xmm3, xmm0
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
movdqa xmm0, xmm2
pslldq xmm0, 4
pxor xmm3, xmm1
pxor xmm0, xmm2
movdqu xmmword [rdx + 0x60], xmm3
movdqa xmm2, xmm0
pslldq xmm2, 8
pxor xmm2, xmm0
aeskeygenassist xmm0, xmm3, 4
pshufd xmm1, xmm0, 0xaa
movdqa xmm0, xmm3
pxor xmm2, xmm1
pslldq xmm0, 4
pxor xmm0, xmm3
movdqu xmmword [rdx + 0x70], xmm2
movdqa xmm3, xmm0
pslldq xmm3, 8
pxor xmm3, xmm0
aeskeygenassist xmm0, xmm2, 8
pshufd xmm1, xmm0, 0xff
movdqa xmm0, xmm2
pslldq xmm0, 4
pxor xmm3, xmm1
pxor xmm0, xmm2
movdqu xmmword [rdx + 0x80], xmm3
movdqa xmm2, xmm0
pslldq xmm2, 8
pxor xmm2, xmm0
aeskeygenassist xmm0, xmm3, 8
pshufd xmm1, xmm0, 0xaa
movdqa xmm0, xmm3
pslldq xmm0, 4
pxor xmm2, xmm1
pxor xmm0, xmm3
movdqu xmmword [rdx + 0x90], xmm2
movdqa xmm3, xmm0
pslldq xmm3, 8
pxor xmm3, xmm0
aeskeygenassist xmm0, xmm2, 0x10
pshufd xmm1, xmm0, 0xff
movdqa xmm0, xmm2
pslldq xmm0, 4
pxor xmm3, xmm1
pxor xmm0, xmm2
movdqu xmmword [rdx + 0xa0], xmm3
movdqa xmm2, xmm0
pslldq xmm2, 8
pxor xmm2, xmm0
aeskeygenassist xmm0, xmm3, 0x10
pshufd xmm1, xmm0, 0xaa
movdqa xmm0, xmm3
pxor xmm2, xmm1
pslldq xmm0, 4
pxor xmm0, xmm3
movdqu xmmword [rdx + 0xb0], xmm2
movdqa xmm4, xmm0
pslldq xmm4, 8
pxor xmm4, xmm0
aeskeygenassist xmm0, xmm2, 0x20
pshufd xmm1, xmm0, 0xff
movdqa xmm0, xmm2
pslldq xmm0, 4
pxor xmm4, xmm1
pxor xmm0, xmm2
movdqu xmmword [rdx + 0xc0], xmm4
movdqa xmm3, xmm0
pslldq xmm3, 8
pxor xmm3, xmm0
aeskeygenassist xmm0, xmm4, 0x20
pshufd xmm1, xmm0, 0xaa
movdqa xmm0, xmm4
pxor xmm3, xmm1
pslldq xmm0, 4
pxor xmm0, xmm4
movdqu xmmword [rdx + 0xd0], xmm3
movdqa xmm2, xmm0
pslldq xmm2, 8
pxor xmm2, xmm0
aeskeygenassist xmm0, xmm3, 0x40
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqu xmmword [rdx + 0xe0], xmm2
ret
Function at 0x1400133f0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x38
movdqu xmm2, xmmword [rcx]
lea rax, [rcx + 0x10]
movaps xmmword [rsp + 0x20], xmm6
movdqa xmm3, xmm2
pxor xmm3, xmmword [r9]
movdqa xmm4, xmm2
pxor xmm4, xmmword [r9 + 0x10]
movdqa xmm5, xmm2
pxor xmm5, xmmword [r9 + 0x20]
movdqa xmm6, xmm2
pxor xmm6, xmmword [r9 + 0x30]
mov r10, rcx
movaps xmmword [rsp + 0x10], xmm7
mov ecx, reloc.WS2_32.dll_listen
movaps xmmword [rsp], xmm8
movdqa xmm7, xmm2
pxor xmm7, xmmword [r9 + 0x40]
movdqa xmm8, xmm2
pxor xmm8, xmmword [r9 + 0x50]
pxor xmm2, xmmword [r9 + 0x60]
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
lea rax, [rax + 0x10]
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm2, xmm0
sub rcx, 1
jne 0x140013460
movdqu xmm1, xmmword [r10 + 0xe0]
movdqu xmm0, xmmword [r8]
aesenclast xmm6, xmm1
aesenclast xmm7, xmm1
aesenclast xmm8, xmm1
aesenclast xmm3, xmm1
pxor xmm3, xmm0
movdqu xmm0, xmmword [r8 + 0x10]
aesenclast xmm4, xmm1
pxor xmm4, xmm0
movdqu xmm0, xmmword [r8 + 0x20]
aesenclast xmm5, xmm1
pxor xmm5, xmm0
movdqu xmm0, xmmword [r8 + 0x30]
aesenclast xmm2, xmm1
pxor xmm6, xmm0
movdqu xmm0, xmmword [r8 + 0x40]
pxor xmm7, xmm0
movdqu xmm0, xmmword [r8 + 0x50]
pxor xmm8, xmm0
movdqu xmm0, xmmword [r8 + 0x60]
movdqu xmmword [rdx], xmm3
movdqu xmmword [rdx + 0x10], xmm4
movdqu xmmword [rdx + 0x20], xmm5
movdqu xmmword [rdx + 0x30], xmm6
movaps xmm6, xmmword [rsp + 0x20]
pxor xmm2, xmm0
movdqu xmmword [rdx + 0x40], xmm7
movaps xmm7, xmmword [rsp + 0x10]
movdqu xmmword [rdx + 0x50], xmm8
movaps xmm8, xmmword [rsp]
movdqu xmmword [rdx + 0x60], xmm2
add rsp, 0x38
ret