joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140096b80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15, rdx
lea r14, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov rsi, r12
mov rbp, r12
test r14, r14
je 0x140096d96
mov rdx, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + 0xff]
shl rsi, cl
add rsi, rsi
nop dword [rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x140096c44
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x140096c00
mov ecx, dword [r10]
jmp 0x140096d27
cmp ecx, 0x4e0
jb 0x140096d27
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [r11 + 0x634]
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140096c60
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140096cb0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
mov r8, qword [rdi + 0x10]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
cmp rax, r8
ja 0x140096be0
mov rdx, qword [rdi + 8]
or rsi, rax
lea ecx, [rdx + 0xff]
shl rbp, cl
add rbp, rbp
or rbp, r8
cmp rbp, r14
jb 0x140096bd0
xor edx, edx
mov rax, rbp
div r15
mov rcx, rax
mov r8, rdx
xor edx, edx
mov rax, rsi
div r15
cmp rax, rcx
jb 0x140096dba
cmp r8, r14
jne 0x140096bb0
mov rbx, qword [rsp + 0x20]
mov rax, rsi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15
mov rax, rdx
pop r15
pop r14
pop r12
ret
Function at 0x140097100
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1400972e3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.14007ba50
mov rcx, qword [rsi + 8]
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1400972a8
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x14]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x15]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x16]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x17]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rbx
jne 0x14009721c
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x140097297
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x140097259
mov r10, qword [rax]
cmp r10, rcx
je 0x140097253
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x140097297
mov r8, rax
cmp r10, rax
je 0x140097273
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x1400972bd
cmp r10, rax
jne 0x140097261
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x1400971a0
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x140097297
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x14009abc0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
lea rsi, [rcx + 0x20]
mov qword [rsp + 0x40], rsi
mov byte [rsp + 0x48], 0
mov rcx, rsi
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x14009ad0e
mov byte [rsp + 0x48], 1
cmp dword [rdi + 0x18], eax
jne 0x14009ad16
lea rcx, [rdi + 0xf8]
cmp rcx, rbx
je 0x14009ac2e
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14009ac25
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
call fcn.14000e9c0
mov dword [rdi + 0x18], 2
lea rcx, [rdi + 0x588]
call fcn.1400b0c60
lea rax, [0x140097920]
mov qword [rsp + 0x50], rax
xor ebx, ebx
mov dword [rsp + 0x58], ebx
lea ecx, [rbx + 0x20]
call fcn.14018bbb8
test rax, rax
je 0x14009ac72
mov qword [rax], rbp
mov qword [rax + 8], rdi
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rax + 0x10], xmm0
jmp 0x14009ac75
mov rax, rbx
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140092e10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14009acff
cmp dword [rsp + 0x38], 0
je 0x14009ad4e
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14009acf7
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov rcx, rsi
call sub.MSVCP140.dll__Mtx_unlock
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov edx, 2
lea rcx, [rsp + 0x60]
call fcn.14009b150
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.140085aa0
lea rdx, [0x140240118]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14009bd50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
movzx esi, r9b
movzx ebp, r8b
mov r14, rdx
mov rbx, rcx
cmp byte [rcx + 0x130], 0
je 0x14009bdc0
mov dword [rsp + 0x40], reloc.WS2_32.dll_ntohl
lea rax, [0x140246550]
mov qword [rsp + 0x48], rax
add rcx, 0x628
lea r8, [rsp + 0x40]
lea rdx, [fcn.140086f60]
call fcn.1400957e0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
lea rdi, [rcx + 0x20]
mov qword [rsp + 0x40], rdi
mov byte [rsp + 0x48], 0
mov rcx, rdi
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x14009beb4
mov byte [rsp + 0x48], 1
cmp dword [rbx + 0x18], 1
jne 0x14009bebc
mov dword [rbx + 0x18], 3
mov rcx, rdi
call sub.MSVCP140.dll__Mtx_unlock
lea rcx, [rbx + 0x588]
call fcn.1400b0c60
lea rax, [0x140098350]
mov qword [rsp + 0x40], rax
xor edi, edi
mov dword [rsp + 0x48], edi
lea ecx, [rdi + 0x28]
call fcn.14018bbb8
test rax, rax
je 0x14009be41
mov byte [rax], sil
mov byte [rax + 1], bpl
mov qword [rax + 8], r14
mov qword [rax + 0x10], rbx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + 0x18], xmm0
jmp 0x14009be44
mov rax, rdi
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140092e50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14009bea5
cmp dword [rsp + 0x38], 0
je 0x14009bef4
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14009be9d
jmp 0x14009bda8
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov dword [rsp + 0x38], edi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov edx, 3
lea rcx, [rsp + 0x60]
call fcn.14009b150
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.140085aa0
lea rdx, [0x140240118]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14009ee90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp qword [rdx + 0x18], 0x10
mov r8, rdx
jb 0x14009ee9d
mov r8, qword [rdx]
mov r9, qword [rdx + 0x10]
movabs rax, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x14009eed4
movabs r10, 0x100000001b3
nop dword [rax]
movzx ecx, byte [rdx + r8]
inc rdx
xor rax, rcx
imul rax, r10
cmp rdx, r9
jb 0x14009eec0
ret
Function at 0x1400b7210
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov edi, r14d
mov ebp, r14d
mov rsi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl rdi, cl
add rdi, rdi
nop dword [rax]
mov r10, qword [rsi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x1400b72b4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x1400b7270
mov ecx, dword [r10]
jmp 0x1400b7397
cmp ecx, 0x4e0
jb 0x1400b7397
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400b72d0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400b7320
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov ecx, edx
mov dword [r10], eax
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rdx, rcx
shr rdx, 0x12
xor rdx, rcx
cmp rdx, qword [rsi + 0x10]
ja 0x1400b7250
mov rax, qword [rsi + 8]
or rdi, rdx
add rbp, rax
cmp rbp, 0x40
jb 0x1400b7240
mov rbx, qword [rsp + 0x10]
mov rax, rdi
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop r14
ret
Function at 0x140129900
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x430
mov rax, qword gs:[0x58]
mov edi, ecx
mov r9d, dword [0x140256fa0]
mov rsi, r8
mov qword [rsp + 0x450], rbx
mov rbp, rdx
mov ecx, socket
mov rbx, qword [rax + r9*8]
add rbx, rcx
mov eax, dword [rbx]
cmp dword [0x140256288], eax
jg 0x140129a19
mov rbx, qword [rsp + 0x450]
test rsi, rsi
je 0x14012997a
mov rdx, qword [0x140256280]
nop dword [rax]
movzx eax, dil
shr edi, 8
xor al, byte [rbp]
lea rbp, [rbp + 1]
movzx ecx, al
xor edi, dword [rdx + rcx*4]
sub rsi, 1
jne 0x140129960
mov eax, edi
add rsp, 0x430
pop rdi
pop rsi
pop rbp
ret
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rax + 0x30], xmm1
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rax + 0x50], xmm1
movups xmm1, xmmword [rdx + 0x70]
add rdx, r14
movups xmmword [rax + 0x60], xmm0
add rax, r14
movups xmmword [rax - 0x10], xmm1
sub rbx, 1
je 0x140129a03
jmp 0x140129990
lea r15, [0x140256290]
lea rcx, [0x140256288]
mov qword [0x140256280], r15
call fcn.14018c054
mov r15, qword [rsp + 0x420]
jmp 0x140129945
lea rcx, [0x140256690]
call fcn.14018c054
mov r14, qword [rsp + 0x428]
jmp 0x1401299e3
lea rcx, [0x140256288]
call fcn.14018c0b4
cmp dword [0x140256288], 0xffffffff
jne 0x140129945
mov eax, dword [rbx]
cmp dword [0x140256690], eax
mov qword [rsp + 0x420], r15
jle 0x1401299dc
lea rcx, [0x140256690]
call fcn.14018c0b4
cmp dword [0x140256690], 0xffffffff
jne 0x1401299dc
mov qword [rsp + 0x458], r12
xor r12d, r12d
mov qword [rsp + 0x460], r13
movzx r11d, r12w
mov qword [rsp + 0x428], r14
mov r13d, 0x100
lea ebx, [r12 + 8]
lea r14d, [rbx + 0x78]
lea r15d, [r12 + 1]
nop dword [rax]
mov r10d, r12d
movzx r9d, r11w
movzx eax, r15w
movzx ecx, r14w
nop
movzx r8d, cx
or r8w, ax
movzx edx, r8w
and dx, r9w
cmp dx, cx
je 0x140129aba
cmp dx, ax
jne 0x140129abe
xor r9w, r8w
shr cx, 1
add ax, ax
cmp cx, ax
ja 0x140129aa0
mov ecx, ebx
nop dword [rax + rax]
movzx eax, r9w
shl eax, 0x1f
xor eax, r10d
shr r9w, 1
mov r10d, eax
add eax, eax
sar r10d, 0x1f
and r10d, 0x4c11db7
xor r10d, eax
sub ecx, r15d
jne 0x140129ad0
mov eax, r15d
mov ecx, 0x80000000
nop
mov r8d, ecx
or r8d, eax
mov edx, r8d
and edx, r10d
cmp edx, ecx
je 0x140129b14
cmp edx, eax
jne 0x140129b17
xor r10d, r8d
shr ecx, 1
add eax, eax
cmp ecx, eax
ja 0x140129b00
movzx r9d, r11w
movzx eax, r15w
movzx ecx, r14w
nop dword [rax + rax]
movzx r8d, cx
or r8w, ax
movzx edx, r8w
and dx, r9w
cmp dx, cx
je 0x140129b4a
cmp dx, ax
jne 0x140129b4e
xor r9w, r8w
shr cx, 1
add ax, ax
cmp cx, ax
ja 0x140129b30
movzx eax, r9w
inc r11w
mov dword [rsp + rax*4 + 0x20], r10d
cmp r11w, r13w
jb 0x140129a90
mov r13, qword [rsp + 0x460]
lea r15, [0x140256290]
mov r12, qword [rsp + 0x458]
lea rdx, [rsp + 0x20]
mov rax, r15
jmp 0x140129990
Function at 0x140170140
Capabilities:
Encode data using xor

Disassembly:
mov r9d, 0xc8
jmp fcn.14016fe40
Function at 0x14017c6b0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm0, xmmword [rcx]
movdqu xmmword [rdx + 0x10], xmm3
movdqa xmm2, xmm0
movdqu xmmword [rdx], xmm0
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
movdqa xmm4, xmm2
pxor xmm4, xmm1
pslldq xmm2, 4
pxor xmm4, xmm2
aeskeygenassist xmm0, xmm3, 1
pshufd xmm1, xmm0, 0xff
pxor xmm4, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x20], xmm4
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm4, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x30], xmm2
pslldq xmm1, 4
pxor xmm0, xmm4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 2
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x40], xmm3
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x50], xmm2
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x60], xmm3
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x70], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm4, xmm1
pxor xmm0, xmm3
pslldq xmm1, 4
pxor xmm4, xmm0
pxor xmm4, xmm1
aeskeygenassist xmm0, xmm2, 8
pshufd xmm1, xmm0, 0xff
pxor xmm4, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x80], xmm4
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm4, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm3, xmm1
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x90], xmm3
pslldq xmm1, 4
pxor xmm0, xmm4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0x10
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqu xmmword [rdx + 0xa0], xmm2
ret
Function at 0x14017e1b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
mov edx, 0x201000
xor ecx, ecx
mov r9d, 4
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx], rax
test rax, rax
je 0x14017e1e3
mov rax, rbx
add rsp, 0x40
pop rbx
ret
lea rcx, [rsp + 0x20]
call fcn.14017e180
lea rdx, [0x140240498]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1401896f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Resolve dns

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1350]
mov eax, 0x1450
call fcn.14018c250
sub rsp, rax
mov rax, qword [0x140248318]
xor rax, rsp
mov qword [rbp + 0x1340], rax
mov rdi, r8
mov rsi, rdx
mov rcx, qword [rcx]
call fcn.140188030
test al, al
jne 0x1401898cf
movdqa xmm0, xmmword [0x140200790]
movdqu xmmword [rsp + 0x40], xmm0
xor ebx, ebx
mov qword [rsp + 0x50], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rbx
cmp qword [rdi + 0x18], 0x10
jb 0x140189761
mov rdi, qword [rdi]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x14018988f
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x14018979c
nop dword [rax + rax]
inc rbx
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x140189790
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov r8d, 0xffffffff
mov dword [rbp + 0x1334], r8d
mov dword [rbp - 0x4c], eax
mov edx, 1
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 - 0x4c], eax
inc rdx
cmp rdx, 0x270
jb 0x1401897c0
mov dword [rbp - 0x50], 0x270
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov ecx, 0x40
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
dec rcx
shr rax, 1
cmp rax, r8
ja 0x140189800
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x20]
test rbx, rbx
jne 0x140189826
call fcn.1400b7210
jmp 0x14018982e
mov rdx, rbx
call fcn.140096b80
mov rbx, qword [rsp + 0x38]
test rax, rax
je 0x14018984a
nop dword [rax + rax]
mov rbx, qword [rbx + 0x28]
sub rax, 1
jne 0x140189840
mov rcx, qword [rbx + 0x20]
mov ecx, dword [rcx + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov edx, eax
mov rcx, rsi
call fcn.14018b350
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rax, rsi
mov rcx, qword [rbp + 0x1340]
xor rcx, rsp
call fcn.14018bc90
mov rbx, qword [rsp + 0x1488]
add rsp, 0x1450
pop rdi
pop rsi
pop rbp
ret
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.14018ad80
nop
mov r8, rax
lea rdx, str.Ipv4Resolver::resolve__getaddrinfo_failed_
lea rcx, [rbp - 0x70]
call fcn.14000f6b0
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140019dc0
lea rdx, [0x14023dac0]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
call fcn.140186ce0
lea rdx, [0x1402404d0]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3