joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14033f3e6
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop r14w
push dx
xchg byte [rsp + 4], r12b
add rsp, 0
mov dword [rsp + 2], r14d
jmp 0x14033f431
push word [rsp + 7]
rdtsc
pop r11
mov qword [rsp], r13
jmp 0x14033f44a
sub rsp, 3
sub rsp, 5
mov r11d, dword [rsp + 0xf]
neg cx
ror r12, cl
btr ax, bx
jmp 0x14033f41b
shr r14w, cl
neg r10b
push qword [rsp + 3]
mov dl, al
jmp 0x14033f478
mov r13w, sp
rdtsc
pop qword [rsp]
push qword [rsp + 2]
xchg r15d, edi
mov ax, 0x70a3
jmp 0x14033f4ee
mov r12b, byte [rsp + 0xa]
bsr r13d, esp
push word [rsp + 0x13]
rdtsc
jmp 0x14033f51d
mov r13d, eax
pushfq
add rsp, 0
xchg r11b, r15b
mov r10w, word [rsp + 0x16]
xchg dword [rsp + 0x16], eax
jmp 0x14033f4bd
mov r14, rsi
mov byte [rsp + 1], cl
neg r12w
ror cx, 0xc
rol r14, cl
mov r11w, 0xfe75
jmp 0x14033f4d3
xchg word [rsp + 7], dx
lea r11, [rcx + riz + 0x25]
mov ecx, 0x11c1fa35
jmp 0x14033f550
mov rbp, qword [rsp + 6]
mov al, 0xa1
clc
mov r15, 0xffffffff81db3ed1
sub rsp, 0x12
not r10w
jmp 0x14033f507
bswap r11
xchg dword [rsp + 0x10], ebp
call fcn.14033f536
xchg r13w, r15w
neg r13w
mov r10b, 0xd9
mov rcx, qword [rsp + 0x30]
jmp 0x14033f59c
rcl r14d, cl
mov rdx, qword [rsp + 0x38]
bswap ebp
jmp 0x14033f8d5
stc
mov r11w, 0x7d5a
neg r10
setb al
rdtsc
xchg rdx, rax
jmp 0x14033f586
mov rbp, 0x7d545220
mov rax, 0xffffffffed577ce3
jmp 0x14033f636
shr ebp, cl
mov r11b, 0xf8
sbb r13, r11
mov r15, qword [rsp + 0x50]
mov r12, qword [rsp]
mov r14, r10
jmp 0x14033f5cf
adc r12b, 0xa7
mov r11b, 0x9e
mov rdi, qword [rsp + 0x48]
mov r14d, r15d
mov ebp, dword [rsp]
dec ax
jmp 0x14033f5e5
mov r12d, 0xedaf53ed
or r13b, 0x26
xchg r12, rax
mov r13, qword [rsp + 0x60]
jmp 0x14033f64f
bsr r12, r11
mov ax, dx
mov r14, qword [rsp + 0x58]
mov r12d, dword [rsp]
lea r12, [r14 + r14]
cmp r11d, r15d
jmp 0x14033f61d
mov ebp, r9d
btc r12w, r9w
setg r11b
lea rbp, [rsi + riz]
mov r12b, 0x99
mov bpl, 0xb6
jmp 0x14033f84e
cmc
setns r12b
mov r10, qword [rsp + 0x40]
add r12, rdx
lea rax, [rdx*4]
mov di, word [rsp]
jmp 0x14033f606
mov r11, qword [rsp]
mov r11b, byte [rsp]
mov rax, qword [rsp + 0x81]
bswap r11
rol r11d, 0x11
cmc
jmp 0x14033f78a
lea rbp, [rax + r14]
xchg bp, ax
mov rbp, qword [rsp + 0x70]
bt r11d, ecx
mov r11, qword [rsp]
mov r11, rbx
jmp 0x14033f693
popfq
jmp 0x14033fcc1
lea r11, [rsi + r14]
mov r11w, 0x71d5
bswap r11d
not r11w
mov r11, qword [rsp + 0x8b]
lea rsp, [rsp + 0xa0]
jmp 0x14033f6e3
mov bp, 0xb201
mov r12, qword [rsp + 0x68]
lea rax, [rbx + r11]
mov r11, qword [rsp]
mov r11, qword [rsp]
bsf rax, r13
jmp 0x14033f6b4
lea rdi, [r11 + riz + 0x9791]
xchg r10d, r13d
bswap r14d
mov r12w, 0xfe27
xchg r10b, r14b
bsf rbp, rbx
jmp 0x14033f675
push word [rsp + 6]
push qword [rsp + 4]
mov word [rsp + 0xd], di
call 0x14033fcaa
pop rax
pop qword [rsp + 0xb]
call fcn.14033fd1b
mov edi, 0x39caaf3f
scasb al, byte [rdi]
xchg edi, eax
adc byte [rsi + 0xdf010e1], al
lea rax, [0x1401e87e9]
push r12
push word [rsp + 5]
push qword [rsp + 9]
pop qword [rsp]
jmp 0x14033fc95
Function at 0x14033f536
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r12w, bx
mov r11, r12
mov dword [rsp + 0x11], ebp
rdtsc
jmp 0x14033f572
bswap r13d
lea rsp, [rsp + 7]
neg ax
xor r11, r13
cld
bsf ebp, ebx
jmp 0x14033f55c

Function at 0x140342ad4
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcl edx, 0
setbe r12b
bts di, r14w
not r13w
mov dx, r10w
mov rcx, 0x113f031e
jmp 0x140342a65
mov r8d, r12d
lea rcx, [r13 + riz]
sbb r15d, 0xc444ff14
lea rsp, [rsp + 0x1a]
bswap rcx
mov byte [rsp], spl
jmp 0x140342a7b
pushfq
xchg edi, r13d
mov ecx, edi
jmp 0x140342aa8

Function at 0x140342d8b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [rsp]
xchg dword [rsp], r15d
jmp 0x140342df6
xchg dx, r11w
bswap rbp
mov r11, 0xffffffff894a6672
mov r13, rdx
pushfq
bswap r12d
jmp 0x140342db4
pop rdi
bswap r8d
and r11w, 0xf5a2
inc r11b
bswap edi
and cx, 0xeed5
jmp 0x140342dca

Function at 0x14034319d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop qword [rsp + 0x13]
mov word [rsp + 0x2e], ax
jmp 0x1403431c0

Function at 0x140343893
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, 0xade6f953
pop word [rsp + 7]
lea rdx, [r10 + r10]
xchg dword [rsp + 7], r15d
sub rsp, 0xc
std
jmp 0x1403437b1
std
xchg dword [rsp + 1], r12d
rdtsc
mov dl, 0x67
xchg r14d, r12d
mov r12, r15
jmp 0x1403437cf
bswap ecx
pop word [rsp + 0x1e]
add rsp, 0x17
lea rcx, [rcx + r11]
mov byte [rsp + 0xa], al
setl r12b
jmp 0x1403437fd
mov rcx, qword [rsp + 0x23]
mov r14d, eax
xchg r11w, r15w
jmp 0x140343860
Function at 0x140343af6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r13, 0xffffffffc07ee1f5
cpuid
jmp 0x140343b71
setb sil
mov edi, 0xd1cda87e
shr cx, 0xb
jmp 0x140343b84
mov r11d, 0x1ab1bf37
mov si, word [rsp + 0xd]
mov r13w, si
clc
xchg r8, rbp
mov al, dil
jmp 0x140343b37
lea r14, [rbp + riz]
mov eax, esp
mov edi, ecx
cld
mov dword [rsp + 9], r15d
rdtsc
jmp 0x140343b4d
mov edi, 0x4af32df9
mov cl, 0x5b
not r11d
lea rbp, [rdx*8]
lea rsp, [rsp + 0x10]
mov r11d, 0xc767aedb
jmp 0x140343bd9
std
mov bx, r14w
bswap eax
rol r11d, cl
xchg byte [rsp + 1], r14b
jmp 0x140343e38
mov di, 0x6c1
xchg r12d, ecx
mov dl, bl
cpuid
xchg esi, r14d
not r11w
jmp 0x140343bc3
mov eax, 0x49730dca
mov r15d, ebx
push r15
std
sub rsp, 8
jmp 0x140343cb5
xchg r14d, r12d
mov r8b, 0xba
lea r11, [r10 + riz + 0xaf]
mov ebp, r9d
mov r12w, word [rsp]
mov esi, 0xf4323684
jmp 0x140343bed
xchg r15, r14
pop word [rsp]
std
cmc
mov r12d, 0x9d1bae00
xchg word [rsp], r14w
jmp 0x140343c03
mov r13w, dx
pop r14
setp r8b
inc eax
dec di
jmp 0x140343c8a
mov r14w, sp
cld
bswap ebp
xchg r12b, al
mov r15b, 9
xchg qword [rsp + 0xe], r13
jmp 0x140343c4a
bt r12d, esi
pop word [rsp + 5]
mov byte [rsp + 4], cl
jmp 0x140343c9d
mov dil, r9b
xchg rsi, rdi
mov rcx, rbp
not edx
mov byte [rsp + 3], r15b
cld
jmp 0x140343c74
lea rsp, [rsp + 0xb]
bt r13d, r14d
add rsp, 2
cpuid
jmp 0x140343d24
rcl r12b, 4
mov rdx, r12
lea rsp, [rsp + 2]
mov bx, r9w
pushfq
bts r15, r14
jmp 0x140343c60
not edi
mov r14, qword [rsp + 8]
xchg r13d, r8d
xchg rbx, rdi
rdtsc
mov r11b, r13b
jmp 0x140343cfe
lea r12, [rcx*4]
dec r13b
bswap ecx
dec rbx
mov qword [rsp], r10
clc
jmp 0x140343ccc
mov r8w, r12w
mov edx, 0x85cfa3dd
mov esi, 0x7f93b8ea
mov r8, qword [rsp + 0x10]
lea rdi, [0x262107a9]
jmp 0x140343d55
cmp rbp, 0x6097beec
mov eax, dword [rsp]
add rsp, 0
lea rsp, [rsp + 1]
push r9
btr r8, r13
jmp 0x140343ce7
lea r12, [rdi*4]
mov ax, 0xc980
xchg rcx, rdi
cld
jmp 0x140343db2
lea rsi, [0xffffffff940933b4]
mov sil, 0x56
mov dl, byte [rsp]
mov ax, 0x30d5
xchg r13w, di
mov r15, qword [rsp + 0x18]
jmp 0x140343d3f
bswap rax
rcl ax, 9
mov rbx, qword [rsp + 0x3a]
mov bp, word [rsp]
bswap r12
xchg rdx, rax
call fcn.140343d72
cmp dh, byte [rcx + 0x5eb34021]
cmp al, 0xb2
and byte [rdi - 0x4e], al
pop rsp
xor ebp, dword [rdx]
hlt
lea rbp, [r15 + riz + 0x75]
rdtsc
mov rdi, qword [rsp + 0x26]
bts dx, r8w
mov bx, word [rsp]
mov ax, 0x9b90
jmp 0x140343d88
cpuid
mov r12w, 0xcb94
xchg rdi, rbp
btc r13w, sp
mov edi, 0x2c3f9987
xchg dword [rsp], r14d
jmp 0x140343c34
Function at 0x140002a50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140002aad
lea rbx, [0x1400cda70]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002a94
cmp r10, 2
jb 0x140002a94
cmp byte [r9], r8b
jne 0x140002a94
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002a70
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140002aef
lea rbx, [0x1400cda70]
cmp r8b, 0x23
jne 0x140002ad3
cmp byte [r9], r8b
jne 0x140002ad3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140002ac0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140002c30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140002c4a
mov qword [r8], 0
lea rdx, [0x1400cd4bc]
call fcn.140002b00
mov rbx, rax
test rax, rax
jne 0x140002c6a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140002d43
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002d43
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140002d43
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002d43
cmp rdi, 0xffffffffffffffff
je 0x140002d43
mov rax, qword [0x1400f6940]
test rax, rax
je 0x140002ce0
inc dword [rax + 0x3b0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140002d43
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140002d30
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1400f6940]
test rax, rax
je 0x140002d25
dec dword [rax + 0x3b0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140002d4c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140002d3e
mov qword [r14], rdi
mov rax, rsi
jmp 0x140002d4e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140010a40
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400f6940]
lea r11, [0x1400cda70]
mov r8d, ecx
mov r10, qword [rax + 0x1d18]
movsxd rdx, dword [r10 + 0x108]
mov rax, qword [r10 + 0x110]
mov r9d, dword [rax + rdx*4 - 4]
not r9d
movzx eax, cl
movzx edx, r9b
xor rdx, rax
shr r9d, 8
mov eax, ecx
shr eax, 8
xor r9d, dword [r11 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
mov eax, r8d
xor rdx, rcx
shr eax, 0x10
xor r9d, dword [r11 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
mov eax, r8d
xor rdx, rcx
shr rax, 0x18
lea rcx, [r10 + 0x108]
xor r9d, dword [r11 + rdx*4]
movzx edx, r9b
xor rdx, rax
shr r9d, 8
xor r9d, dword [r11 + rdx*4]
lea rdx, [rsp + 0x30]
not r9d
mov dword [rsp + 0x30], r9d
call fcn.140022970
add rsp, 0x28
ret

Function at 0x1400115e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400e6080]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400f6940]
mov edi, edx
cmp byte [rbx + 0x20d5], 0
jne 0x140011640
cmp byte [rbx + 0x20d6], 0
jne 0x140011640
mov r9d, dword [rbx + 0x3178]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.1400029d0
test dil, 1
je 0x140011767
jmp 0x1400116d1
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
mov r9d, dword [rbx + 0x3178]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400d3a10]
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1400d3a00]
addss xmm0, dword [rbx + 0x120]
addss xmm1, dword [rbx + 0x124]
mov qword [rbx + 0x1ddc], rax
mov dword [rbx + 0x1dc4], 1
movss dword [rbx + 0x1dd4], xmm0
mov byte [rbx + 0x1dfc], 1
movss dword [rbx + 0x1dd8], xmm1
movss xmm0, dword [rbx + 0x1748]
mulss xmm0, dword [0x1400d3958]
or dword [rbx + 0x1dc0], 0x41
movss dword [rbx + 0x1e20], xmm0
call fcn.1400029d0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140011721
lea r11, [0x1400cda70]
cmp r9b, 0x23
jne 0x140011704
cmp byte [r8], r9b
jne 0x140011704
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400116f1
not ecx
call fcn.14000a560
test rax, rax
je 0x140011767
cmp byte [rax + 0xcf], 0
je 0x140011767
mov byte [rax + 0xd6], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3178]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x3178]
call fcn.1400029d0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.14000cfe0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400ba1f0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140016480
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3260], 0
lea rbx, [rcx + 0x3268]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140016527
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x1400164da
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140023350
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140003170
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x3260]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x3270]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1400f6938]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001652f
mov rcx, rbx
call fcn.140003170
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140016970
Capabilities:
Hash data with crc32

Disassembly:
push rbx
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov rbx, rcx
mov eax, r10d
test r9b, r9b
je 0x1400169c2
lea r11, [0x1400cda70]
cmp r9b, 0x23
jne 0x1400169a5
cmp byte [r8], r9b
jne 0x1400169a5
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140016992
mov r11, qword [0x1400f6940]
xor r9d, r9d
not eax
mov r10, qword [r11 + 0x3228]
test r10, r10
lea rcx, [r10 + 4]
cmovne r9, rcx
test r9, r9
je 0x140016a0e
cmp dword [r9], eax
je 0x140016a17
movsxd r8, dword [r9 - 4]
movsxd rdx, dword [r11 + 0x3220]
add r8, r9
add rdx, 4
xor r9d, r9d
add rdx, r10
cmp r8, rdx
cmovne r9, r8
test r9, r9
jne 0x1400169e5
mov rcx, rbx
pop rbx
jmp fcn.140016880
test r9, r9
je 0x140016a0e
mov rax, r9
pop rbx
ret
Function at 0x140019e70
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x14001a0ae
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x1400e6080]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x1400cda70]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x14001a076
mov rcx, rbp
call fcn.1400194b0
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x140019f41
movsxd rdx, dword [rbp + 0x31c0]
mov r8, qword [rbp + 0x31c8]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x140019f31
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x140019f29
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x140019f2c
mov rdx, rcx
test rdx, rdx
jne 0x140019f00
cmp r8, r10
je 0x140019f41
cmp dword [r8], r9d
jne 0x140019f41
mov rcx, qword [r8 + 8]
jmp 0x140019f43
xor ecx, ecx
mov qword [rbx + 0x10], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x40], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x44], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xb8]
and eax, 0xfffffe49
movss dword [rbx + 0x50], xmm1
or eax, 0x49
mov dword [rbx + 0xb8], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
test rcx, rcx
je 0x140019fd7
cmp qword [rcx + 0x18], 0
jne 0x140019fcc
mov qword [rcx + 0x18], rbx
jmp 0x140019fd7
cmp qword [rcx + 0x20], 0
jne 0x140019fd7
mov qword [rcx + 0x20], rbx
mov eax, dword [rdi - 0xe]
mov r9, rbx
mov dword [rbx + 0xb0], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x58], eax
mov eax, dword [rdi - 6]
and eax, 0x61fc20
or dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14001a00c
nop
mov r9, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14001a000
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rsp + 0x20]
call fcn.1400029d0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x14001a068
cmp r9b, 0x23
jne 0x14001a04b
cmp byte [r8], r9b
jne 0x14001a04b
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x14001a038
not ecx
call fcn.14000a560
mov qword [rbx + 0x80], rax
add rdi, 0x24
sub rsi, 1
jne 0x140019ec0
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ba1f0
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x14004b450
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
mov eax, 0x13e0
call fcn.1400bad40
sub rsp, rax
mov rax, qword [0x1400e6080]
xor rax, rsp
mov qword [rsp + 0x13d0], rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13c4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x44], eax
nop dword [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x44], eax
inc rdx
cmp rdx, 0x270
jb 0x14004b490
mov dword [rsp + 0x40], 0x270
mov ebx, Ordinal_301
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0x40]
call fcn.140056050
mov ecx, eax
imul rax, rcx, 0x439
cmp eax, 0x319
ja 0x14004b4fa
nop
lea rcx, [rsp + 0x40]
call fcn.140056050
mov ecx, eax
imul rax, rcx, 0x439
cmp eax, 0x31a
jb 0x14004b4e0
shr rax, 0x20
lea rcx, [rsp + 0x40]
add eax, 0x80000000
xor eax, 0x80000000
movd xmm1, eax
cvtdq2ps xmm1, xmm1
call fcn.140056050
mov ecx, eax
imul rax, rcx, 0x781
cmp eax, 0x4ea
ja 0x14004b54a
nop dword [rax]
lea rcx, [rsp + 0x40]
call fcn.140056050
mov ecx, eax
imul rax, rcx, 0x781
cmp eax, 0x4eb
jb 0x14004b530
mov rdx, qword [0x1400f6d60]
shr rax, 0x20
add eax, 0x80000000
movss dword [rsp + 0x28], xmm1
xor eax, 0x80000000
cmp rdx, qword [0x1400f6d68]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x24], xmm0
je 0x14004b592
unpcklps xmm0, xmm1
movsd qword [rdx], xmm0
add qword [0x1400f6d60], 8
movsd qword [rsp + 0x24], xmm0
jmp 0x14004b5a3
lea r8, [rsp + 0x24]
lea rcx, [0x1400f6d58]
call fcn.140054890
lea rcx, [rsp + 0x40]
call fcn.140056050
sar eax, 0x1f
lea rcx, [rsp + 0x40]
and eax, 2
dec eax
movd xmm1, eax
cvtdq2ps xmm1, xmm1
call fcn.140056050
mov rdx, qword [0x1400f6d78]
sar eax, 0x1f
and eax, 2
dec eax
movss dword [rsp + 0x30], xmm1
cmp rdx, qword [0x1400f6d80]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x2c], xmm0
je 0x14004b608
unpcklps xmm0, xmm1
movsd qword [rdx], xmm0
add qword [0x1400f6d78], 8
movsd qword [rsp + 0x2c], xmm0
jmp 0x14004b619
lea r8, [rsp + 0x2c]
lea rcx, [0x1400f6d70]
call fcn.140054890
mov rdx, qword [0x1400f6d98]
cmp rdx, qword [0x1400f6da0]
je 0x14004b639
mov dword [rdx], 3
add qword [0x1400f6d98], 4
jmp 0x14004b643
lea r8, [rsp + 0x20]
call fcn.140054a30
sub rbx, 1
jne 0x14004b4c4
mov rcx, qword [rsp + 0x13d0]
xor rcx, rsp
call fcn.1400ba1f0
add rsp, 0x13e0
pop rbx
ret
Function at 0x14004c150
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0xf8
mov rax, qword [0x1400e6080]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0x70], WSAGetLastError
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xor edx, edx
cmp qword [rcx + 0x18], 0xf
movups xmmword [r11 - 0x50], xmm0
mov dword [r11 - 0x4c], 1
mov word [r11 - 0x48], dx
movups xmmword [r11 - 0x70], xmm0
movups xmmword [r11 - 0x60], xmm0
movups xmmword [r11 - 0x40], xmm0
movups xmmword [r11 - 0x30], xmm0
jbe 0x14004c1ae
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], edx
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14004c227
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400ba1f0
add rsp, 0xf8
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400ba1f0
add rsp, 0xf8
ret
Function at 0x140051f40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140051f74
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140051f60
ret

Function at 0x140056050
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1400560b1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140056070
mov ecx, dword [r9]
jmp 0x14005619b
cmp ecx, 0x4e0
jb 0x14005619b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1400560d0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140056120
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret