joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400488cc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
movzx ebx, cx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, rbx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x14004893b
mov r14, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor ecx, ecx
call r14
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
xor ecx, ecx
call r14
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov eax, eax
mov qword [rsi], rbx
mov qword [rsi + 8], rax
test rdi, rdi
setne al
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140051820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rcx
pxor xmm0, xmm0
movdqu xmmword [rcx], xmm0
lea r9, [rcx + 0x20]
mov r8, qword [rdx]
mov ecx, 0x38
lea r10, str.000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff
mov r11, r8
shr r11, cl
movzx r11d, r11b
movzx r11d, word [r10 + r11*2]
mov word [r9], r11w
add rcx, 0xfffffffffffffff8
add r9, 2
cmp rcx, 0xfffffffffffffff8
jne 0x14005183e
lea r9, [rax + 0x30]
or r8, 1
bsr rcx, r8
xor ecx, 0x3c
shr ecx, 2
mov r8d, 0x10
sub r8d, ecx
movzx ecx, byte [rdx + 8]
cmp r8d, ecx
jae 0x1400518c5
movzx ecx, byte [rdx + 9]
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
movdqu xmmword [rax + 0x10], xmm0
mov r10, r9
sub r10, r8
movzx ecx, byte [rdx + 9]
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
movdqu xmmword [r10 - 0x10], xmm0
movzx r8d, byte [rdx + 8]
sub r9, r8
mov qword [rax], r9
mov qword [rax + 8], r8
ret
Function at 0x140053358
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov edi, edx
mov rsi, rcx
mov rax, qword [0x14030c028]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebx, ebx
xor edx, edx
call fcn.140051014
mov dword [rsi + 0x120], ebx
mov dword [rsi + 0x124], edi
movaps xmm0, xmmword [0x14029de10]
lea rdi, [rsp + 0x20]
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov ecx, dword [rdi + 0x28]
cmp eax, ecx
cmova ecx, eax
mov qword [rsi + 0x128], rcx
mov qword [rsi + 0x130], 0x20
mov qword [rsi + 0x138], 0x40
mov dword [rsi + 0x140], ebx
lea rax, [rsi + 8]
mov qword [rsi + 8], 0
xor rax, 0xffffffffb37cc16a
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rsi
mov dword [rsi + 0x28], ebx
lea rcx, [rsi + 0x30]
mov r8d, 0xf0
xor edx, edx
call fcn.140259320
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140257200
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret

Function at 0x140053e41
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
rdtsc
mov rcx, qword [0x14030cf00]
mov r8, qword [0x14030cf10]
mov r10, qword [0x14030cf18]
mov r9, qword [0x14030cf20]
mov r11, qword [0x14030cf28]
mov rsi, qword [0x14030cf00]
test cl, 1
jne 0x140053e97
cmp rcx, rsi
jne 0x140053e97
shl rdx, 0x20
or rdx, rax
sub rdx, r10
cmp rdx, r11
jae 0x140053e97
imul rdx, r9
shr rdx, 0x1e
add rdx, r8
mov rax, rdx
pop rsi
ret
pop rsi
jmp fcn.14028e7ef

Function at 0x140054a0a
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + rdx]
test rdx, rdx
jle 0x140054a47
movdqa xmm0, xmmword [0x1402aca30]
movdqa xmm1, xmmword [0x1402aca40]
mov rdx, rcx
movdqu xmm2, xmmword [rdx]
pxor xmm3, xmm3
pcmpgtb xmm3, xmm2
pand xmm3, xmm0
pxor xmm3, xmm1
movdqu xmmword [rdx], xmm3
add rdx, 0x10
cmp rdx, rax
jb 0x140054a26
mov rdx, qword [rcx]
mov rcx, qword [rcx + 7]
mov qword [rax + 8], rcx
mov qword [rax + 1], rdx
mov byte [rax], 0xff
ret
Function at 0x1400790a0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov eax, dword [0x140320d98]
mov ecx, dword [0x14031d424]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400790e1
lea rcx, [0x140320d88]
xor edx, edx
test bl, bl
cmovne rdx, rcx
add rsp, 0x20
pop rbx
jmp fcn.140105e90
lea rcx, [0x140320d98]
call fcn.140255ea0
cmp dword [0x140320d98], 0xffffffff
jne 0x1400790c8
xorps xmm0, xmm0
movups xmmword [0x140320d88], xmm0
lea rcx, [0x140320d88]
xor edx, edx
call fcn.140105ee0
lea rcx, [0x140320d98]
call fcn.140255f38
jmp 0x1400790c8

Function at 0x140094620
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140320de0]
cmp rsi, 1
ja 0x14009467f
lea rcx, [0x140320de0]
call fcn.1400f5910
test al, al
je 0x140094678
xorps xmm0, xmm0
movups xmmword [0x140320de8], xmm0
lea rdi, [0x140320de0]
lea rsi, [0x140320de8]
mov rcx, rsi
xor edx, edx
call fcn.140105ee0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.1400f59c0
jmp 0x14009467f
mov rsi, qword [0x140320de0]
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140105e50

Function at 0x140096550
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
lea rdx, [0x1402ae052]
call fcn.140141b00
lea rax, fcn.1400978a0
mov qword [rsi], rax
mov qword [rsi + 0x10], rbx
and dil, 1
xorps xmm0, xmm0
movups xmmword [rsi + 0x18], xmm0
movups xmmword [rsi + 0x28], xmm0
mov byte [rsi + 0x38], dil
mov word [rsi + 0x39], 0
movups xmmword [rsi + 0x40], xmm0
movups xmmword [rsi + 0x50], xmm0
movups xmmword [rsi + 0x60], xmm0
mov qword [rsi + 0x70], 0
movups xmm0, xmmword [0x1402b6298]
movups xmmword [rsi + 0x78], xmm0
mov eax, dword [0x140320e08]
mov ecx, dword [0x14031d424]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400965e5
lock inc dword [0x140320dfc]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140320e08]
call fcn.140255ea0
cmp dword [0x140320e08], 0xffffffff
jne 0x1400965d3
lea rax, str.pz_t_
mov qword [0x140320e00], rax
lea rdi, [0x140320e00]
call fcn.140117ac0
lea r8, str.MojoMessages
mov rcx, rax
mov rdx, rdi
xor r9d, r9d
call fcn.140117c60
lea rcx, [0x140320e08]
call fcn.140255f38
jmp 0x1400965d3
Function at 0x1400970a0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov r14, r9
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov r15, qword [rsp + 0x90]
movaps xmm6, xmmword [rsp + 0x80]
lea rdx, [0x1402ae052]
call fcn.140141b00
lea rax, fcn.1400978a0
mov qword [rsi], rax
mov qword [rsi + 0x10], rbx
xorps xmm0, xmm0
movups xmmword [rsi + 0x18], xmm0
mov qword [rsi + 0x28], 0
mov rax, qword [rdi]
mov qword [rdi], 0
mov qword [rsi + 0x30], rax
mov word [rsi + 0x38], 0x100
mov byte [rsi + 0x3a], 1
mov qword [rsi + 0x40], r14
movups xmmword [rsi + 0x48], xmm6
mov qword [rsi + 0x58], r15
movups xmmword [rsi + 0x60], xmm0
mov qword [rsi + 0x70], 0
movups xmm0, xmmword [0x1402b6298]
movups xmmword [rsi + 0x78], xmm0
mov eax, dword [0x140320e08]
mov ecx, dword [0x14031d424]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14009718c
lock inc dword [0x140320dfc]
mov rcx, qword [rdi]
mov qword [rdi], 0
test rcx, rcx
je 0x140097178
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [case.0x140112150.0]
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [0x140320e08]
call fcn.140255ea0
cmp dword [0x140320e08], 0xffffffff
jne 0x140097151
lea rax, str.pz_t_
mov qword [0x140320e00], rax
lea rbx, [0x140320e00]
call fcn.140117ac0
lea r8, str.MojoMessages
mov rcx, rax
mov rdx, rbx
xor r9d, r9d
call fcn.140117c60
lea rcx, [0x140320e08]
call fcn.140255f38
jmp 0x140097151
Function at 0x14009b660
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x288
mov edi, r8d
mov rax, rdx
mov rsi, rcx
mov rcx, qword [0x14030c028]
xor rcx, rsp
mov qword [rsp + 0x280], rcx
movaps xmm0, xmmword [0x14029de10]
movaps xmmword [rsp + 0x270], xmm0
movaps xmmword [rsp + 0x260], xmm0
movaps xmmword [rsp + 0x250], xmm0
movaps xmmword [rsp + 0x240], xmm0
movaps xmmword [rsp + 0x230], xmm0
movaps xmmword [rsp + 0x220], xmm0
movaps xmmword [rsp + 0x210], xmm0
movaps xmmword [rsp + 0x200], xmm0
movaps xmmword [rsp + 0x1f0], xmm0
movaps xmmword [rsp + 0x1e0], xmm0
movaps xmmword [rsp + 0x1d0], xmm0
movaps xmmword [rsp + 0x1c0], xmm0
movaps xmmword [rsp + 0x1b0], xmm0
movaps xmmword [rsp + 0x1a0], xmm0
movaps xmmword [rsp + 0x190], xmm0
movaps xmmword [rsp + 0x180], xmm0
mov dword [rsp + 0x17c], 0
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x180]
lea r9, [rsp + 0x17c]
mov rcx, rax
mov r8d, 0x100
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14009b7b0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], rax
mov r8d, dword [rsp + 0x17c]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x180]
xor r9d, r9d
call fcn.14006ab40
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14009b82a
call fcn.14006b2a0
cmp rax, 7
jbe 0x14009b82a
mov rcx, qword [rsp + 0x30]
call fcn.14006b230
cmp dword [rax], edi
jne 0x14009b894
mov rax, qword [rsp + 0x30]
mov qword [rsi], rax
jmp 0x14009b80d
mov ecx, 2
call fcn.1400f6360
test al, al
je 0x14009b806
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....mojocore_broker_win.cc
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov r8d, 0x38
mov r9d, 2
call fcn.1400f7550
lea rcx, [rsp + 0x48]
lea rdx, str.Error_reading_broker_pipe
mov r8d, 0x19
call fcn.14001eb4a
mov rcx, rdi
call fcn.1400f7640
mov qword [rsi], 0
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140257200
mov rax, rsi
add rsp, 0x288
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400f6360
test al, al
je 0x14009b877
lea rdx, str.....mojocore_broker_win.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r8d, 0x40
mov r9d, 2
call fcn.1400f6410
lea rcx, [rsp + 0x48]
lea rdx, str.Invalid_broker_message
mov r8d, 0x16
call fcn.14001eb4a
mov rcx, rsi
call fcn.1400f68f0
lea rcx, [rsp + 0x180]
call fcn.140019da0
lea rcx, [rsp + 0x17c]
call fcn.140019da0
int3
mov ecx, 2
call fcn.1400f6360
test al, al
je 0x14009b8e1
lea rdx, str.....mojocore_broker_win.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r8d, 0x4b
mov r9d, 2
call fcn.1400f6410
lea rcx, [rsp + 0x48]
lea rdx, str.Unexpected_broker_message_type
mov r8d, 0x1e
call fcn.14001eb4a
mov rcx, rsi
call fcn.1400f68f0
lea rcx, [rsp + 0x180]
call fcn.140019da0
lea rcx, [rsp + 0x17c]
call fcn.140019da0
int3
Function at 0x14009ba70
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1f8
mov r12, r8
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x14030c028]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
lea r15, [rcx + 0x20]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14009bd2f
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x1b0], rdi
xor ebx, ebx
lea rcx, [rsp + 0x1b0]
mov edx, 0xc
xor r8d, r8d
call fcn.14006a510
mov rcx, qword [rsp + 0x1b0]
call fcn.14006b070
mov qword [rax], 1
mov rcx, r12
shr rcx, 0x20
jne 0x14009bd3c
mov ebx, r12d
mov dword [rax + 8], ebx
mov dword [rsp + 0x1ac], 0
mov rcx, qword [rsp + 0x1b0]
mov ebp, dword [rcx + 8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140112150.0]
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x1ac]
mov rdx, rax
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14009bbc9
mov eax, dword [rsp + 0x1ac]
mov rcx, qword [rsp + 0x1b0]
cmp qword [rcx + 8], rax
jne 0x14009bbc9
movaps xmm0, xmmword [0x14029de10]
movaps xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call fcn.140136ed0
mov qword [rsp + 0x58], rdi
mov rdx, qword [rsi + 8]
lea rcx, [rsp + 0x58]
mov r8d, 2
call fcn.14009b660
mov rsi, qword [rsp + 0x58]
test rsi, rsi
je 0x14009bc2c
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.14009b900
test al, al
je 0x14009bbbc
mov rcx, rsi
call fcn.14006b2a0
cmp rax, 0x17
ja 0x14009bc39
mov rcx, r14
call fcn.1400faa80
jmp 0x14009bcb7
mov ecx, 2
call fcn.1400f6360
test al, al
je 0x14009bc1f
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....mojocore_broker_win.cc
lea rsi, [rsp + 0x60]
mov rcx, rsi
mov r8d, 0x8e
mov r9d, 2
call fcn.1400f7550
lea rcx, [rsp + 0x70]
lea rdx, str.Error_sending_sync_broker_message
mov r8d, 0x21
call fcn.14001eb4a
mov rcx, rsi
call fcn.1400f7640
mov rcx, r14
call fcn.1400faa80
jmp 0x14009bcd5
mov rcx, r14
call fcn.1400faa80
jmp 0x14009bccb
mov rcx, rsi
call fcn.14006b070
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
lea rdi, [rsp + 0x1b8]
mov rcx, rdi
call fcn.140057200
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.140136ed0
lea rbp, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.140136ee2
lea r13, [rsp + 0x50]
mov rcx, r13
mov rdx, rbp
mov r8, rbx
call fcn.140093c90
mov qword [rsp + 0x20], rdi
lea rbp, [rsp + 0x1c8]
mov rcx, rbp
mov rdx, r13
mov r8d, 1
mov r9, r12
call fcn.140115d20
mov rcx, r14
mov rdx, rbp
call fcn.1400fb680
mov rax, qword [rsi]
mov rax, qword [rax]
mov rcx, rsi
mov edx, 1
call qword [case.0x140112150.0]
lea rcx, [rsp + 0x60]
call fcn.140136f70
mov rcx, qword [rsp + 0x1b0]
mov qword [rsp + 0x1b0], 0
test rcx, rcx
je 0x14009bcff
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [case.0x140112150.0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.140257200
mov rax, r14
add rsp, 0x1f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r15
call fcn.140111020
jmp 0x14009bab3
int3
Function at 0x14009d070
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov r14, rcx
mov rax, qword [0x14030c028]
xor rax, rsp
mov qword [rsp + 0x50], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [0x14029de10]
movaps xmmword [rsp + 0x30], xmm0
mov rax, qword [rdx]
mov rax, qword [rax + 0x38]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [case.0x140112150.0]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
cmp rbx, rsi
je 0x14009d0e1
nop dword [rax]
mov rcx, rbx
call fcn.140093860
add rbx, 0x28
cmp rbx, rsi
jne 0x14009d0d0
lea rsi, [r14 + 0xe0]
mov ebx, dword [rdi + 8]
mov rax, qword [rdi]
mov rax, qword [rax + 0x10]
mov rcx, rdi
call qword [case.0x140112150.0]
mov rcx, qword [r14 + 0x78]
mov qword [rsp + 0x20], rsi
mov rdx, rax
mov r8d, ebx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14009d124
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x14009d136
mov byte [r14 + 0x12a], 1
lock inc dword [r14 + 8]
mov sil, 1
jmp 0x14009d138
xor esi, esi
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x14009d170
mov rdi, qword [rsp + 0x38]
mov rcx, rbx
cmp rdi, rbx
je 0x14009d166
nop
add rdi, 0xffffffffffffffd8
mov rcx, rdi
call fcn.1400937b0
cmp rdi, rbx
jne 0x14009d150
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rbx
call fcn.140255d7c
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140257200
mov eax, esi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400bfe50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqu xmm4, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
movd xmm0, r8d
pxor xmm0, xmm4
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x40
jb 0x1400bff4f
movabs rax, 0x154442bd4
movq xmm9, rax
movdqa xmm8, xmmword [0x1402af1b0]
nop word [rax + rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm9, 0
movdqa xmm7, xmm3
pclmulqdq xmm7, xmm9, 0
movdqa xmm5, xmm2
pclmulqdq xmm5, xmm9, 0
movdqa xmm10, xmm1
pclmulqdq xmm10, xmm9, 0
pclmulqdq xmm0, xmm8, 0x11
pclmulqdq xmm3, xmm8, 0x11
pclmulqdq xmm2, xmm8, 0x11
pclmulqdq xmm1, xmm8, 0x11
movdqu xmm4, xmmword [rcx]
pxor xmm4, xmm6
pxor xmm0, xmm4
movdqu xmm4, xmmword [rcx + 0x10]
pxor xmm4, xmm7
pxor xmm3, xmm4
movdqu xmm4, xmmword [rcx + 0x20]
pxor xmm4, xmm5
pxor xmm2, xmm4
movdqu xmm4, xmmword [rcx + 0x30]
pxor xmm4, xmm10
pxor xmm1, xmm4
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x3f
ja 0x1400bfec0
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x1402af1c0]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp rdx, 0x10
jb 0x1400bffea
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rcx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add rcx, 0x10
add rdx, 0xfffffffffffffff0
cmp rdx, 0xf
ja 0x1400bffc0
movdqa xmm1, xmmword [0x1402af1c0]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
psrldq xmm0, 4
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
pxor xmm3, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm3, 3
pclmulqdq xmm0, xmmword [0x1402af1d0], 0x10
pblendw xmm0, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm3
pextrd eax, xmm1, 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x1400c33d0
Capabilities:
Receive http response

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rdi, r8
mov rax, qword [0x14030c028]
xor rax, rsp
mov qword [rsp + 0x168], rax
lea r9, [rsp + 0x164]
mov dword [r9], 0
mov r8d, dword [r8]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov esi, eax
test eax, eax
je 0x1400c341c
mov eax, dword [rsp + 0x164]
mov dword [rdi], eax
jmp 0x1400c3481
mov ecx, 2
call fcn.1400f6360
test al, al
je 0x1400c3481
lea rdx, str.....chromechrome_cleanerhttphttp_agent_impl.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x1d7
mov r9d, 2
call fcn.1400f6410
lea rcx, [rsp + 0x38]
lea rdx, str.Failed_to_read_response_body:
mov r8d, 0x1e
call fcn.14001eb4a
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x20]
mov dword [rdx], eax
mov rcx, rbx
call fcn.1400c0b7f
mov rcx, rdi
call fcn.1400f68f0
test esi, esi
setne bl
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140257200
mov eax, ebx
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400c34ce
Capabilities:
Read http header

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, r8
mov rax, qword [0x14030c028]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rcx, qword [rcx + 0x18]
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
xor r8d, r8d
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x1400c3518
mov byte [rsi], 1
jmp 0x1400c3528
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2f76
jne 0x1400c3547
mov byte [rsi], 0
mov sil, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140257200
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400f6360
test al, al
je 0x1400c35ac
lea rdx, str.....chromechrome_cleanerhttphttp_agent_impl.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r8d, 0x1f0
mov r9d, 2
call fcn.1400f6410
lea rcx, [rsp + 0x48]
lea rdx, str.WinHttpQueryHeaders_failed:
mov r8d, 0x1b
call fcn.14001eb4a
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x30]
mov dword [rdx], eax
mov rcx, rdi
call fcn.1400c0b7f
mov rcx, rsi
call fcn.1400f68f0
xor esi, esi
jmp 0x1400c352b
Function at 0x1400da485
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r12, r9
mov r14, r8
mov rdi, rdx
mov r15, rcx
call fcn.1400e6c2a
mov ebx, eax
test rdi, rdi
je 0x1400da4ba
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x1400da4cd
movzx eax, word [rax]
jmp 0x1400da4dd
xor esi, esi
mov eax, 6
test bl, bl
jne 0x1400da566
xor edi, edi
jmp 0x1400da4f3
mov rax, qword [rdi]
mov rax, qword [rax + 0x40]
mov rcx, rdi
call qword [case.0x140112150.0]
xor esi, esi
cmp ax, 0xffff
sete cl
cmove rdi, rsi
mov eax, 6
cmp bl, cl
je 0x1400da566
mov rcx, qword [r15]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x1400da505
movzx esi, word [rax]
jmp 0x1400da514
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [case.0x140112150.0]
mov esi, eax
mov rax, qword [r12]
mov rax, qword [rax + 0x18]
mov rcx, r12
mov dx, 4
mov r8d, esi
call qword [case.0x140112150.0]
test al, al
je 0x1400da55f
mov rax, qword [r12]
mov rax, qword [rax + 0x68]
mov rcx, r12
mov edx, esi
xor r8d, r8d
call qword [case.0x140112150.0]
mov ebx, eax
mov rcx, qword [r15]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x1400da57a
add rax, 2
mov qword [rcx + 0x18], rax
jmp 0x1400da587
xor esi, esi
mov eax, 4
or dword [r14], eax
mov eax, esi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x140112150.0]
mov ebp, dword [rsp + 0x80]
movsx esi, bl
mov rcx, r15
call fcn.1400e6c2a
mov ebx, eax
test rdi, rdi
je 0x1400da5af
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x1400da5b3
movzx eax, word [rax]
jmp 0x1400da5c3
mov al, 1
jmp 0x1400da5cc
mov rax, qword [rdi]
mov rax, qword [rax + 0x40]
mov rcx, rdi
call qword [case.0x140112150.0]
cmp ax, 0xffff
sete al
jne 0x1400da5ce
xor edi, edi
add esi, 0xffffffd0
cmp bl, al
je 0x1400da66f
cmp ebp, 2
jl 0x1400da66f
mov rcx, qword [r15]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x1400da5f4
movzx ebx, word [rax]
jmp 0x1400da603
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [case.0x140112150.0]
mov ebx, eax
mov rax, qword [r12]
mov rax, qword [rax + 0x18]
mov rcx, r12
mov dx, 4
mov r8d, ebx
call qword [case.0x140112150.0]
test al, al
je 0x1400da569
mov rax, qword [r12]
mov rax, qword [rax + 0x68]
mov rcx, r12
mov edx, ebx
xor r8d, r8d
call qword [case.0x140112150.0]
mov ebx, eax
mov rcx, qword [r15]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x1400da652
add rax, 2
mov qword [rcx + 0x18], rax
jmp 0x1400da65f
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x140112150.0]
lea eax, [rsi + rsi*4]
movsx ecx, bl
lea esi, [rcx + rax*2]
dec ebp
jmp 0x1400da591
mov rcx, r15
call fcn.1400e6c2a
mov ebx, eax
test rdi, rdi
je 0x1400da68d
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x1400da69f
movzx eax, word [rax]
jmp 0x1400da6af
mov eax, 2
test bl, bl
jne 0x1400da566
jmp 0x1400da569
mov rax, qword [rdi]
mov rax, qword [rax + 0x40]
mov rcx, rdi
call qword [case.0x140112150.0]
cmp ax, 0xffff
sete al
xor bl, al
mov eax, 2
je 0x1400da566
jmp 0x1400da569