joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401390d0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov eax, dword [0x1403a6ee0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rdi, qword [rax + 8]
test rdi, rdi
je 0x14013912b
mov rcx, qword [rdi + 0x688]
lea rsi, [0x1403a24c0]
test rcx, rcx
je 0x140139174
mov rdx, qword [0x1403a24b0]
test rdx, rdx
je 0x140139156
mov rax, qword [rcx + 0x380]
mov rcx, qword [rax + 8]
call fcn.140269248
test rax, rax
jne 0x14013916c
jmp 0x140139174
mov ecx, dword [0x14039ddc0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14013914f
cmp byte [rax + 8], 0
jne 0x140139170
mov rcx, rax
call fcn.14006e790
test rax, rax
jne 0x140139170
call fcn.140195d30
jmp 0x140139170
mov rax, qword [0x1403a2230]
cmp qword [rax + 0x58], rcx
je 0x14013916c
call fcn.140132e80
test al, al
jne 0x140139174
mov rax, qword [rdi + 0x10]
mov rsi, qword [rax + 0x40]
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14014f0e0
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rcx + 7]
mov rax, rdx
sar rax, 1
mov r8, qword [rcx - 1]
and r8d, 0xfffff000
cmp r8d, 0x5e000
je 0x14014f112
mov r8, qword [rcx - 1]
and r8d, 0xfffff000
cmp r8d, 0x60000
jne 0x14014f178
mov r8, qword [rcx - 1]
and r8d, 0xfffff000
cmp r8d, 0x5e000
jne 0x14014f12c
add rcx, 0xf
jmp 0x14014f130
mov rcx, qword [rcx + 0xf]
xor r8d, r8d
cmp rdx, 2
jl 0x14014f1db
inc rax
xor edx, edx
nop word cs:[rax + rax]
movzx r8d, byte [rcx]
add r8d, edx
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov edx, r9d
shr edx, 6
xor edx, r9d
inc rcx
dec rax
cmp rax, 1
ja 0x14014f150
jmp 0x14014f1d7
mov r8, qword [rcx - 1]
and r8d, 0xfffff000
cmp r8d, 0x5f000
jne 0x14014f192
add rcx, 0xf
jmp 0x14014f196
mov rcx, qword [rcx + 0xf]
xor r8d, r8d
cmp rdx, 2
jl 0x14014f1db
inc rax
xor edx, edx
nop word cs:[rax + rax]
movzx r8d, word [rcx]
add r8d, edx
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov edx, r9d
shr edx, 6
xor edx, r9d
add rcx, 2
dec rax
cmp rax, 1
ja 0x14014f1b0
lea r8d, [rdx + rdx*8]
mov ecx, r8d
shr ecx, 0xb
xor ecx, r8d
mov eax, ecx
shl eax, 0xf
add eax, ecx
and eax, 0x3fffffff
cmp eax, 1
adc eax, 0
ret
Function at 0x14015d900
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rbx, r9
mov r15, r8
mov qword [rsp + 0x30], rdx
mov rdi, rcx
mov rax, qword [0x14039fd98]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [0x1403a6ee0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
mov rsi, qword [rax + 0x18]
mov rcx, rsi
call fcn.1400ff450
mov r12, rax
mov rcx, rsi
call fcn.1400ff450
mov r13, rax
mov rax, qword [rdi + 8]
add rdi, 8
cmp rax, qword [0x14039dc60]
je 0x14015dab8
mov rbp, qword [rax + 0xf]
cmp rbp, 2
jl 0x14015dab8
mov qword [rsp + 0x48], rsi
sar rbp, 1
xor esi, esi
xor r14d, r14d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], rbx
jmp 0x14015d9cd
test rsi, rsi
je 0x14015dab1
mov rcx, qword [rsi + 8]
mov r8, qword [r13 + 8]
lea rdx, [rcx + r14*8]
add rdx, 0x27
dec rcx
call fcn.1400f6ef0
inc r14
cmp r14, rbp
je 0x14015daba
mov rax, qword [rdi]
mov rdx, qword [rax + r14*8 + 0x27]
mov rcx, r12
call fcn.1400f6560
mov rax, qword [r12]
mov rcx, qword [rsp + 0xd8]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rsp + 0xd0]
mov dword [rsp + 0x20], ecx
mov rcx, r12
lea rdx, [rsp + 0x58]
mov r8, r15
mov r9, rbx
call qword [rax + 0x370]
mov rdx, qword [rsp + 0x58]
mov rcx, r13
call fcn.1400f6560
mov rax, qword [r12 + 8]
cmp rax, qword [r13 + 8]
je 0x14015d9a0
test rsi, rsi
jne 0x14015d9a0
lea rcx, [rsp + 0x50]
mov rdx, rbp
mov r8d, dword [rsp + 0xd0]
call fcn.140158ba0
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call fcn.1400f6550
mov rsi, rax
test r14, r14
je 0x14015d9a9
xor ebx, ebx
mov r15, r14
nop word [rax + rax]
mov rax, qword [rdi]
mov rdx, qword [rax + rbx + 0x27]
mov rcx, r12
call fcn.1400f6560
mov rcx, qword [rsi + 8]
mov r8, qword [r12 + 8]
lea rdx, [rcx + rbx]
add rdx, 0x27
dec rcx
call fcn.1400f6ef0
add rbx, 8
dec r15
jne 0x14015da70
mov rbx, qword [rsp + 0x38]
mov r15, qword [rsp + 0x40]
jmp 0x14015d9a9
xor esi, esi
jmp 0x14015d9c1
xor esi, esi
lea rax, [rsi + 8]
test rsi, rsi
cmove rax, rdi
mov rax, qword [rax]
mov rsi, qword [rsp + 0x30]
mov qword [rsi], rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140265fe0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140169aa0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14039fd98]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [0x1403a6ee0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
mov rcx, qword [rax + 0x688]
mov rcx, qword [rcx + 0x20]
mov rdx, qword [rcx + 0x4e0]
mov rcx, qword [rax + 0x18]
call fcn.140169d80
mov qword [rsp + 0x20], rbx
mov rcx, qword [rbx + 8]
test byte [rcx + 7], 2
cmove rax, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
pcmpeqd xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0xffffffffffffffff
lea rcx, [rsp + 0x20]
call fcn.140169c50
test al, al
je 0x140169c2c
lea rbx, str.0x_.8x:
lea r14, [rsp + 0x20]
lea r15, [0x1402dd0b0]
lea r12, [0x140300592]
nop dword [rax]
mov r8d, dword [rsp + 0x38]
mov rcx, rdi
mov rdx, rbx
call fcn.140023cb0
mov r13, qword [rsp + 0x48]
test r13, r13
js 0x140169ba0
add r13, qword [rsp + 0x50]
jg 0x140169bb4
jmp 0x140169c10
mov rcx, r14
call fcn.140187500
mov r13, qword [rsp + 0x48]
add r13, qword [rsp + 0x50]
jle 0x140169c10
xor ebp, ebp
jmp 0x140169bd0
mov rcx, rdi
call fcn.140023e20
inc rbp
cmp r13, rbp
je 0x140169c10
cmp qword [rsp + 0x48], 0
jns 0x140169be0
mov rcx, r14
call fcn.140187500
mov rax, rbp
shr rax, 3
add rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
movzx eax, byte [rcx + rax + 0xb]
mov ecx, ebp
and ecx, 7
bt eax, ecx
mov rdx, r15
jae 0x140169bc0
mov rdx, r12
jmp 0x140169bc0
mov rcx, r14
call fcn.140169c50
test al, al
je 0x140169c2c
mov rcx, rdi
mov rdx, rsi
call fcn.140023e20
jmp 0x140169b70
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140265fe0
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14016b880
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, r8
mov r8, rdx
mov rsi, rcx
mov rbx, qword [rsp + 0xd8]
mov ecx, dword [rsp + 0xe0]
mov rdx, qword [0x14039fd98]
xor rdx, rsp
mov qword [rsp + 0x60], rdx
mov edx, dword [0x1403a6ee0]
mov r10, qword gs:[0x58]
mov rdx, qword [r10 + rdx*8]
mov rdx, qword [rdx + 8]
mov r15, qword [rdx + 0x18]
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], r9
lea rcx, [rsp + 0x58]
mov rdx, r15
mov r9, rax
call fcn.14016b650
mov rdx, qword [rsp + 0x58]
mov rcx, r15
call fcn.14016b870
mov rdi, rax
lea rax, [rbx + 2]
mov qword [rsp + 0x48], rax
lea r8, [rbx*2 + 4]
lea rcx, [rsp + 0x50]
mov edx, 0x5a
mov r9d, 1
call fcn.14017b9b0
mov rdx, qword [rsp + 0x50]
mov rcx, r15
call fcn.1400f9980
mov r14, rax
mov rcx, r15
call fcn.140100270
test rbx, rbx
jle 0x14016b98c
mov r15, rax
mov rbp, qword [rsp + 0xe8]
xor r13d, r13d
mov r12, rbx
nop word [rax + rax]
mov rax, qword [rbp + 0x10]
mov r8, qword [rax + r13]
add r8, r8
mov qword [r15 + 8], r8
mov rcx, qword [r14 + 8]
lea rdx, [rcx + r13]
add rdx, 0x17
dec rcx
call fcn.1400f6ef0
add r13, 8
dec r12
jne 0x14016b960
mov r15, qword [rsp + 0xf0]
mov rax, qword [r15 + 8]
mov rcx, qword [rax + 0x3f]
call fcn.1401273c0
mov rcx, qword [r14 + 8]
mov r8, qword [rax + 8]
lea rdx, [rcx + rbx*8]
add rdx, 0x1f
dec rcx
call fcn.1400f6ef0
mov rcx, qword [r14 + 8]
mov r8, qword [r15 + 8]
lea rdx, [rcx + rbx*8]
add rdx, 0x17
dec rcx
call fcn.1400f6ef0
mov rcx, r14
mov rdx, qword [rsp + 0x48]
mov r8, rdi
call fcn.14016a900
mov rdx, qword [rdi + 8]
lea rcx, [rdx - 1]
mov r8, qword [r14 + 8]
add rdx, 0x17
call fcn.1401849a0
mov rax, qword [rdi + 8]
mov qword [rsi], rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140265fe0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140178020
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
movaps xmm6, xmm1
mov rsi, rcx
mov rax, qword [0x14039fd98]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1403a6ee0]
mov rcx, qword gs:[0x58]
mov r14, qword [rcx + rax*8]
mov rdi, qword [r14 + 8]
call fcn.140177ff0
mov rbx, rax
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0x38]
mov edx, 0x3e
mov r8d, reloc.WS2_32.dll_recv
mov r9d, 1
call fcn.1401526f0
mov rax, qword [rsp + 0x38]
mov qword [rbx + 8], rax
movsd qword [rax + 7], xmm6
mov rdx, qword [rbx + 8]
mov rcx, qword [rdi + 0x18]
call fcn.140178130
mov rbx, rax
mov r8d, 0x430
add r8, qword [rdi + 0x688]
mov rdx, qword [r14 + 8]
lea r14, [rsp + 0x38]
mov rcx, r14
call fcn.140138a80
mov rax, qword [rbx]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov r8, rdi
call qword [rax + 0x2e0]
lea rax, [0x1402fe4e0]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x50]
call fcn.1400a1310
mov rcx, r14
call fcn.1401169b0
mov rax, qword [rsp + 0x30]
mov qword [rbx + 8], rax
mov qword [rsi], rax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140265fe0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1401786c0
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
jle 0x1401786d8
mov eax, edx
and eax, 3
cmp rdx, 4
jae 0x1401786df
xor r8d, r8d
jmp 0x140178769
xor eax, eax
jmp 0x140178798
and rdx, 0xfffffffffffffffc
xor r8d, r8d
nop word cs:[rax + rax]
movzx r9d, byte [rcx]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, byte [rcx + 1]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
movzx r9d, byte [rcx + 2]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, byte [rcx + 3]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
add rcx, 4
add rdx, 0xfffffffffffffffc
jne 0x1401786f0
test rax, rax
je 0x140178794
xor edx, edx
movzx r9d, byte [rcx + rdx]
add r9d, r8d
mov r10d, r9d
shl r10d, 0xa
add r10d, r9d
mov r8d, r10d
shr r8d, 6
xor r8d, r10d
inc rdx
cmp rax, rdx
jne 0x140178770
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
and eax, 0x3fffffff
cmp eax, 1
adc eax, 0
ret

Function at 0x1401787c0
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
jle 0x1401787d8
mov eax, edx
and eax, 3
cmp rdx, 4
jae 0x1401787df
xor r8d, r8d
jmp 0x140178869
xor eax, eax
jmp 0x140178898
and rdx, 0xfffffffffffffffc
xor r8d, r8d
nop word cs:[rax + rax]
movzx r9d, word [rcx]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, word [rcx + 2]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
movzx r9d, word [rcx + 4]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, word [rcx + 6]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
add rcx, 8
add rdx, 0xfffffffffffffffc
jne 0x1401787f0
test rax, rax
je 0x140178894
xor edx, edx
movzx r9d, word [rcx + rdx*2]
add r9d, r8d
mov r10d, r9d
shl r10d, 0xa
add r10d, r9d
mov r8d, r10d
shr r8d, 6
xor r8d, r10d
inc rdx
cmp rax, rdx
jne 0x140178870
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
and eax, 0x3fffffff
cmp eax, 1
adc eax, 0
ret
Function at 0x140179640
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
movdqa xmmword [rsp + 0x80], xmm11
movdqa xmmword [rsp + 0x70], xmm10
movdqa xmmword [rsp + 0x60], xmm9
movdqa xmmword [rsp + 0x50], xmm8
movdqa xmmword [rsp + 0x40], xmm7
movdqa xmmword [rsp + 0x30], xmm6
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14039fd98]
xor rax, rsp
mov qword [rsp + 0x28], rax
test r8, r8
jle 0x1401798b3
xor eax, eax
cmp rdi, 4
jae 0x1401796b1
mov r8b, 1
xor ecx, ecx
mov rdx, rdi
jmp 0x140179810
mov rcx, rdi
and rcx, 0xfffffffffffffffc
movq xmm1, rdi
movdqa xmm2, xmmword [0x1403091f0]
pxor xmm0, xmm0
xor edx, edx
movdqa xmm3, xmmword [0x1402fee00]
movdqa xmm4, xmmword [0x140309200]
movdqa xmm5, xmmword [0x140309210]
movdqa xmm6, xmmword [0x140309220]
movdqa xmm7, xmmword [0x140309230]
movdqa xmm8, xmm2
nop dword [rax + rax]
movdqa xmm10, xmm8
movdqa xmm8, xmm2
movq xmm11, qword [rbx + rdx*4]
movq xmm9, qword [rbx + rdx*4 + 8]
movdqa xmm2, xmm11
pxor xmm2, xmm3
pcmpgtd xmm2, xmm4
packssdw xmm2, xmm2
packsswb xmm2, xmm2
pandn xmm2, xmm8
movdqa xmm8, xmm9
pxor xmm8, xmm3
pcmpgtd xmm8, xmm4
packssdw xmm8, xmm8
packsswb xmm8, xmm8
pandn xmm8, xmm10
paddd xmm11, xmm5
paddd xmm9, xmm5
pxor xmm11, xmm3
movdqa xmm10, xmm6
pcmpgtd xmm10, xmm11
pshufd xmm10, xmm10, 0xd4
pand xmm10, xmm7
paddq xmm1, xmm10
pxor xmm9, xmm3
movdqa xmm10, xmm6
pcmpgtd xmm10, xmm9
pshufd xmm9, xmm10, 0xd4
pand xmm9, xmm7
paddq xmm0, xmm9
add rdx, 4
cmp rcx, rdx
jne 0x140179700
movdqa xmm3, xmmword [0x1403091f0]
pcmpeqb xmm2, xmm3
pcmpeqd xmm4, xmm4
pxor xmm2, xmm4
punpcklbw xmm2, xmm2
pshuflw xmm2, xmm2, 0x60
pshufd xmm2, xmm2, 0x50
pcmpeqb xmm8, xmm3
pxor xmm8, xmm4
punpcklbw xmm3, xmm8
pshuflw xmm3, xmm3, 0x60
pshufd xmm3, xmm3, 0x50
por xmm3, xmm2
movmskpd edx, xmm3
test edx, edx
sete r8b
paddq xmm0, xmm1
pshufd xmm1, xmm0, 0xee
paddq xmm1, xmm0
movq rdx, xmm1
cmp rcx, rdi
je 0x14017983d
nop word cs:[rax + rax]
mov r10d, dword [rbx + rcx*4]
cmp r10d, 0x100
movzx r8d, r8b
cmovae r8d, eax
add r10d, 0xffff0000
cmp r10d, 0x100000
adc rdx, 0
inc rcx
cmp rdi, rcx
jne 0x140179810
test r8b, 1
jne 0x1401798b3
lea rcx, [rsp + 0x20]
mov r8d, r9d
call fcn.1401791f0
mov rcx, qword [rsp + 0x20]
call fcn.1400f72f0
mov r14, rax
test rdi, rdi
jle 0x1401798c3
xor r15d, r15d
xor r12d, r12d
jmp 0x14017988a
mov rax, qword [r14 + 8]
mov word [rax + r12*2 + 0xf], cx
mov eax, 1
add r12, rax
inc r15
cmp rdi, r15
je 0x1401798c3
mov ecx, dword [rbx + r15*4]
lea eax, [rcx - 0x10000]
cmp eax, 0xfffff
ja 0x140179870
mov rax, qword [r14 + 8]
lea rdx, [rax + r12*2]
add rdx, 0xf
call fcn.1400249b0
mov eax, 2
jmp 0x14017987f
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
call fcn.140179910
jmp 0x1401798ca
mov rax, qword [r14 + 8]
mov qword [rsi], rax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140265fe0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm9, xmmword [rsp + 0x60]
movaps xmm10, xmmword [rsp + 0x70]
movaps xmm11, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1401896a0
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14039fd98]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov qword [rcx], rdx
mov rax, qword [rdx + 0x18]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], r8
lea rdi, [rcx + 0x18]
mov rcx, qword [rdx + 0x18]
xorps xmm0, xmm0
movups xmmword [rsi + 0x18], xmm0
mov qword [rsi + 0x28], 0
mov qword [rsi + 0x30], rcx
mov qword [rsi + 0x20], 2
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
sub rdx, rax
cmp rdx, 0x10
jge 0x14018970a
mov edx, reloc.WS2_32.dll_recv
call fcn.1401d09d0
jmp 0x140189716
lea rdx, [rax + 0x10]
mov qword [rcx], rdx
add qword [rcx + 0x10], 0x10
mov qword [rsi + 0x28], rax
lea rcx, [rsp + 0x20]
mov edx, 2
xor r8d, r8d
call fcn.140154f10
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rsp + 0x20]
call fcn.140101540
mov qword [rsi + 0x38], rax
mov rax, qword [rbx + 0x18]
xorps xmm0, xmm0
movups xmmword [rsi + 0x40], xmm0
mov qword [rsi + 0x50], 0
mov qword [rsi + 0x58], rax
mov eax, dword [0x1403a6ee0]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
mov rax, qword [rbx + 8]
mov rax, qword [rax + 0x18]
movups xmmword [rsi + 0x60], xmm0
mov qword [rsi + 0x70], 0
mov qword [rsi + 0x78], rax
mov rax, qword [rbx + 8]
mov rax, qword [rax + 0x18]
movups xmmword [rsi + 0x80], xmm0
mov qword [rsi + 0x90], 0
mov qword [rsi + 0x98], rax
mov rax, qword [rbx + 8]
mov rax, qword [rax + 0x18]
movups xmmword [rsi + 0xa0], xmm0
mov qword [rsi + 0xb0], 0
mov qword [rsi + 0xb8], rax
mov rax, qword [rbx + 8]
mov rax, qword [rax + 0x18]
movups xmmword [rsi + 0xc0], xmm0
mov qword [rsi + 0xd0], 0
mov qword [rsi + 0xd8], rax
mov rax, qword [rbx + 8]
mov rax, qword [rax + 0x18]
movups xmmword [rsi + 0xe0], xmm0
mov qword [rsi + 0xf0], 0
mov qword [rsi + 0xf8], rax
movups xmmword [rsi + 0x100], xmm0
mov edx, 2
mov rcx, rdi
call fcn.1401015f0
mov rdi, qword [0x14039dc60]
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x18]
call fcn.140130c40
mov qword [rax + 8], rdi
mov qword [rax], 0
mov rcx, qword [rsi + 0x28]
mov qword [rcx], rax
mov rdi, qword [0x14039dc60]
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x18]
call fcn.140130c40
mov qword [rax + 8], rdi
mov qword [rax], 0
mov rcx, qword [rsi + 0x28]
mov qword [rcx + 8], rax
mov rcx, qword [rsi + 0x38]
mov rdx, qword [0x1403a2b48]
xor r8d, r8d
call fcn.1401551a0
mov rcx, qword [rsi + 0x38]
mov rdx, qword [0x1403a2b48]
xor r8d, r8d
call fcn.1401551a0
mov qword [rsi + 0x100], 2
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140265fe0
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140195f90
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14039fd98]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 0x18
call fcn.140266260
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rsi
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
lea r8, [0x140195ec0]
xor esi, esi
xor ecx, ecx
mov edx, 0x100000
mov r9, rax
call fcn.140285490
lea rcx, [rax + 1]
cmp rcx, 1
ja 0x140196001
call fcn.140278958
mov esi, dword [rax]
jmp 0x14019600a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140265fe0
mov eax, esi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x140196030
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rdi, rcx
mov rax, qword [0x14039fd98]
xor rax, rsp
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140196075
mov esi, eax
mov ecx, eax
mov rdx, rdi
call fcn.1401960b0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140265fe0
mov eax, esi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rax, str..._.._runtime_vm_os_thread_win.cc
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.TlsAlloc_failed__d
lea rcx, [rsp + 0x20]
mov r8d, eax
call fcn.1400235e0
int3

Function at 0x140196240
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14039fd98]
xor rax, rsp
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140196270
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140265fe0
nop
add rsp, 0x38
ret
lea rax, str..._.._runtime_vm_os_thread_win.cc
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0xe2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.TlsSetValue_failed__d
lea rcx, [rsp + 0x20]
mov r8d, eax
call fcn.1400235e0
int3
Function at 0x140199610
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xf0
movaps xmmword [rsp + 0xe0], xmm6
mov r14, r9
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14039fd98]
xor rax, rsp
mov qword [rsp + 0xd8], rax
mov byte [r8 + 8], 0
mov qword [rcx + 0x30], r8
mov eax, dword [0x1403a6ee0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x18]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x40]
mov qword [rdi + 0x20], rax
lea r15, [rsp + 0x30]
mov rcx, r15
call fcn.1401a8510
mov rcx, qword [rdi + 0x30]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + 0x128]
mov dword [rsp + 0xa6], 0
mov byte [rsp + 0xaa], 0
mov dword [rsp + 0xac], 0
mov byte [rsp + 0xb0], 0
mov dword [rsp + 0xb2], 0
mov byte [rsp + 0xb6], 0
mov qword [rsp + 0xb8], 0
mov byte [rsp + 0xc0], 0
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x90], xmm6
mov qword [rsp + 0x9d], 0
mov qword [rsp + 0xc8], WSAGetLastError
mov dword [rsp + 0xd0], 0xffffffff
mov rax, qword [r14]
lea r8, [rsp + 0x60]
mov rcx, r14
mov rdx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 0x30]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + 0x30]
mov rcx, qword [rdi + 0x30]
mov rax, qword [rcx]
call qword [rax + 0xc8]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x140199799
lea r14, [rsp + 0x60]
nop dword [rax + rax]
lea rcx, [rax - 1]
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rdx + rax*8 - 8]
mov rax, qword [rcx]
mov rdx, rdi
mov r8, r14
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [rsp + 0x40]
test rax, rax
jne 0x140199770
cmp byte [rdi + 0x39], 0
je 0x1401997b1
mov rcx, 0xffffffffffffffff
lea rdx, str.RegExp_too_big
xor eax, eax
jmp 0x1401997ce
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.1401aa1c0
mov rcx, qword [rsp + 0x28]
call fcn.140199810
mov rcx, qword [rdi + 8]
xor edx, edx
mov qword [rsi], rdx
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.140265fe0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14019a8d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r15, qword [rsp + 0xb0]
cmp qword [r15], 0
je 0x14019a9b3
mov rsi, r9
mov r12, r8
mov r14, rdx
mov rax, qword [rcx]
cmp dword [r9 + 0x70], 0
sete byte [rsp + 0x20]
xor r13d, r13d
mov rdx, r15
mov r8, r14
xor r9d, r9d
call qword [rax + 0x20]
cmp byte [r15 + 0x28], 0
jne 0x14019a9b6
movzx eax, byte [r14 + 0x38]
test al, al
mov ecx, 0xffff
mov edx, 0xff
cmove edx, ecx
mov qword [r15 + 0x20], 0
mov r9, qword [r15]
xor r13d, r13d
test r9, r9
jle 0x14019a9b6
xor ecx, ecx
test al, al
sete cl
lea r8, [r15 + 0xa]
lea r10d, [rcx*8 + 8]
mov r11d, 1
mov qword [rsp + 0x30], r9
mov rax, r9
xor edi, edi
xor ebp, ebp
xor ebx, ebx
movzx r9d, word [r8 - 2]
test r9b, r9b
movzx edi, dil
cmovne edi, r11d
and r9d, edx
mov ecx, r13d
shl r9d, cl
or ebp, r9d
mov dword [r15 + 0x20], ebp
movzx r9d, word [r8]
and r9d, edx
shl r9d, cl
or ebx, r9d
mov dword [r15 + 0x24], ebx
add r8, 6
add r13d, r10d
dec rax
jne 0x14019a970
test dil, 1
jne 0x14019a9ca
xor r13d, r13d
mov eax, r13d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r13, qword [r14 + 0x30]
mov rcx, qword [rsp + 0x30]
cmp qword [rsi + 0x28], rcx
je 0x14019aa03
movzx r9d, byte [rsp + 0xa0]
xor r9b, 1
mov r8, qword [r12 + 0x10]
mov rdx, qword [rsi]
mov rax, qword [r13]
mov qword [rsp + 0x20], rcx
mov rcx, r13
call qword [rax + 0x100]
mov rcx, qword [r15]
cmp rcx, 2
je 0x14019aa27
cmp rcx, 1
jne 0x14019aa34
cmp byte [r14 + 0x38], 0
mov eax, 0xffff
mov ecx, 0xff
cmove ecx, eax
and ebp, ecx
cmp ebp, ecx
jmp 0x14019aa37
cmp byte [r14 + 0x38], 0
je 0x14019aa34
cmp bp, 0xffff
jmp 0x14019aa37
cmp ebp, 0xffffffff
setne al
movzx ecx, byte [rsp + 0xb8]
test cl, cl
je 0x14019aa64
mov r10, qword [r13]
mov rcx, r13
mov edx, ebx
test al, al
je 0x14019aa81
mov r8d, ebp
mov r9, qword [rsp + 0xa8]
call qword [r10 + 0x48]
jmp 0x14019aa99
mov r9, qword [rsi + 0x10]
mov r10, qword [r13]
mov rcx, r13
mov edx, ebx
test al, al
je 0x14019aa8f
mov r8d, ebp
call qword [r10 + 0x88]
jmp 0x14019aa99
mov r8, qword [rsp + 0xa8]
call qword [r10 + 0x40]
jmp 0x14019aa99
mov r8, r9
call qword [r10 + 0x80]
mov r13b, 1
jmp 0x14019a9b6