joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400778d0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, edx
mov edx, r9d
mov edi, r8d
mov rsi, rcx
call fcn.140076f70
movzx eax, byte [rsp + 0x60]
mov dword [rsi + 0x38], ebx
mov dword [rsi + 0x40], edi
mov qword [rsi + 0x48], 0
mov byte [rsi + 0x3c], al
lea r11, [0x14019d248]
mov dword [rsp + 0x48], 4
mov qword [rsi], r11
mov rax, qword [0x14023bbd8]
mov rbx, qword [rax]
cmp rbx, rax
jne 0x14007792b
call fcn.14011ef50
mov ecx, dword [rbx + 0x1c]
sub ecx, 1
je 0x140077983
cmp ecx, 1
jne 0x1400779b2
movsxd rcx, dword [rsi + 0x38]
lea r9, [rsi + 0x50]
mov edx, 0xffff
mov r8d, 0x1001
mov dword [rsi + 0x50], 0x10000
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1400779b2
mov eax, dword [rsi + 0x50]
cdq
sub eax, edx
sar eax, 1
mov dword [rsi + 0x50], eax
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
movsxd rcx, dword [rsi + 0x38]
lea rax, [rsp + 0x48]
lea r9, [rsi + 0x50]
mov edx, 0xffff
mov r8d, 0x1001
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
jne 0x140077965
mov dword [rsi + 0x50], 0x10000
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400784e0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rdi, rcx
mov edx, 8
call fcn.140078770
nop
lea rax, [0x14019d5c8]
mov qword [rdi], rax
mov byte [rdi + 0x24], 0
lea rcx, [rdi + 0x40]
mov qword [rcx], 0
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14007859b
call fcn.1401219d0
lea rdx, str.RandomStream:_unable_to_acquire_context_n
lea rcx, [rax + 0x60]
call fcn.140122480
call fcn.1401219d0
lea rdx, str.RandomStream:_warning:_no_OS_supplied_random_source___using_rand___n
lea rcx, [rax + 0x60]
call fcn.140122480
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
imul ebx, ebx, 0xf1207
call fcn.14007bdc0
add ebx, eax
call fcn.140124b50
add eax, ebx
mov ecx, dword [0x14023bbf0]
add ecx, eax
mov dword [0x14023bbf0], ecx
call fcn.140124b30
nop
mov rax, rdi
jmp 0x14007859e
mov rax, rdi
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x1400864f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
lea rax, str.Pg_b_
xor r9d, r9d
mov rbx, rcx
mov dword [rcx + 0x5f8], 0
mov qword [rcx], rax
lea edx, [r9 + 1]
xor ecx, ecx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x600], rax
mov ecx, dword [0x14023bd08]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rbx
mov qword [rbx + 0x608], rax
mov ecx, dword [0x14023bd08]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140086560
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, qword [rcx + 0x608]
lea rax, str.Pg_b_
mov rbx, rcx
mov qword [rcx], rax
mov ecx, dword [0x14023bd08]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rbx + 0x600]
test rcx, rcx
je 0x140086598
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x600], 0
add rsp, 0x20
pop rbx
ret

Function at 0x1400865b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x140
mov rbx, rcx
mov ecx, dword [0x14023bd08]
mov rdi, r9
mov rsi, r8
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, rbx
je 0x14008660a
lea r8, str..winEventManager.cxx
lea rdx, str.threadInstanceOrNull____this
lea rcx, [rsp + 0x20]
mov r9d, 0x25
call fcn.140086ab0
mov rcx, rax
call fcn.140086a30
movsxd rax, dword [rbx + 0x5f8]
cmp eax, 0x3f
jl 0x14008661a
xor al, al
jmp 0x140086646
mov qword [rbx + rax*8 + 8], rbp
movsxd rax, dword [rbx + 0x5f8]
mov qword [rbx + rax*8 + 0x208], rsi
movsxd rax, dword [rbx + 0x5f8]
mov qword [rbx + rax*8 + 0x400], rdi
add dword [rbx + 0x5f8], 1
mov al, 1
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140086660
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x140
mov rbx, rcx
mov ecx, dword [0x14023bd08]
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, rbx
je 0x1400866aa
lea r8, str..winEventManager.cxx
lea rdx, str.threadInstanceOrNull____this
lea rcx, [rsp + 0x20]
mov r9d, gethostbyname
call fcn.140086ab0
mov rcx, rax
call fcn.140086a30
mov r8d, dword [rbx + 0x5f8]
xor edx, edx
test r8d, r8d
jle 0x14008673f
lea rax, [rbx + 8]
cmp qword [rax], rdi
je 0x1400866e2
add edx, 1
add rax, 8
cmp edx, r8d
jl 0x1400866c0
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret
lea eax, [r8 - 1]
movsxd rcx, edx
cmp edx, eax
jge 0x140086738
lea r8, [rbx + rcx*8 + 8]
nop
nop
nop
nop
mov rax, qword [r8 + 8]
add edx, 1
add r8, 8
mov qword [r8 - 8], rax
mov rax, qword [r8 + 0x200]
mov qword [r8 + 0x1f8], rax
mov rax, qword [r8 + 0x3f8]
mov qword [r8 + 0x3f0], rax
mov eax, dword [rbx + 0x5f8]
sub eax, 1
cmp edx, eax
jl 0x140086700
add dword [rbx + 0x5f8], 0xffffffff
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret

Function at 0x1400867c0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x228
mov ecx, dword [0x14023bd08]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140086823
lea r8, str.no_EventManager
lea rcx, [rsp + 0x20]
or r9d, 0xffffffff
mov edx, 0x100
mov byte [rsp + 0x20], al
call fcn.14007b3b0
lea rcx, [rsp + 0x120]
lea rdx, [rsp + 0x20]
mov r8d, 0x100
call fcn.14011e9b0
lea rdx, [0x14020b7d0]
lea rcx, [rsp + 0x120]
call fcn.14011f050
int3
mov ecx, dword [0x14023bd08]
add rsp, 0x228
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x140087b50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, rcx
lea rcx, [rsp + 0x48]
or r9d, 0xffffffff
mov r8d, 0xfde9
mov dword [rsp + 0x20], 0
call fcn.14007bc10
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call fcn.14011e950
cmp ebx, 0xffffffff
je 0x140087b9e
test bl, 0x10
je 0x140087b9e
mov al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x140087bb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, rcx
lea rcx, [rsp + 0x48]
or r9d, 0xffffffff
mov r8d, 0xfde9
mov dword [rsp + 0x20], 0
call fcn.14007bc10
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [rsp + 0x48]
cmp eax, 0xffffffff
setne bl
call fcn.14011e950
test bl, bl
setne al
add rsp, 0x30
pop rbx
ret

Function at 0x140087c80
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, rcx
lea rcx, [rsp + 0x48]
or r9d, 0xffffffff
mov r8d, 0xfde9
mov dword [rsp + 0x20], 0
call fcn.14007bc10
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x48]
test eax, eax
setne bl
call fcn.14011e950
mov al, bl
add rsp, 0x30
pop rbx
ret

Function at 0x140087cd0
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
lea rcx, [rsp + 0x50]
or r9d, 0xffffffff
mov r8d, 0xfde9
mov dword [rsp + 0x20], 0
call fcn.14007bc10
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140087d21
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140087d21
mov rcx, qword [rsp + 0x50]
call fcn.14011e950
xor al, al
add rsp, 0x30
pop rdi
ret
lea rcx, [rsp + 0x58]
or r9d, 0xffffffff
mov r8d, 0xfde9
mov rdx, rdi
mov qword [rsp + 0x40], rbx
mov rbx, qword [rsp + 0x50]
mov dword [rsp + 0x20], 0
call fcn.14007bc10
mov rcx, qword [rsp + 0x58]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov rcx, qword [rsp + 0x58]
test eax, eax
setne bl
call fcn.14011e950
mov rcx, qword [rsp + 0x50]
call fcn.14011e950
mov al, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400880a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rdi, rcx
mov rdx, rcx
lea rcx, [rsp + 0x258]
or r9d, 0xffffffff
mov r8d, 0xfde9
mov dword [rsp + 0x20], 0
call fcn.14007bc10
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [rsp + 0x258]
cmp eax, 0xffffffff
setne bl
call fcn.14011e950
test bl, bl
je 0x14008810a
mov al, 1
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140088165
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x140088165
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.fileExists__s_
lea rcx, [rsp + 0x134]
mov r8d, eax
mov r9, rdi
call fcn.140024950
lea rcx, [rsp + 0x30]
mov r8d, 0x104
mov rdx, rax
call fcn.14011e9b0
lea rdx, [0x14020ba18]
lea rcx, [rsp + 0x30]
call fcn.14011f050
int3
xor al, al
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret

Function at 0x140088270
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x240
mov rsi, rcx
lea rcx, [rsp + 0x260]
or r9d, 0xffffffff
mov r8d, 0xfde9
mov rdi, rdx
mov dword [rsp + 0x20], 0
call fcn.14007bc10
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400882ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400882ce
mov rcx, qword [rsp + 0x260]
call fcn.14011e950
jmp 0x14008833c
lea rcx, [rsp + 0x268]
or r9d, 0xffffffff
mov r8d, 0xfde9
mov rdx, rsi
mov qword [rsp + 0x250], rbx
mov rbx, qword [rsp + 0x260]
mov dword [rsp + 0x20], 0
call fcn.14007bc10
mov rcx, qword [rsp + 0x268]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov rcx, qword [rsp + 0x268]
test eax, eax
setne bl
call fcn.14011e950
mov rcx, qword [rsp + 0x260]
call fcn.14011e950
test bl, bl
mov rbx, qword [rsp + 0x250]
jne 0x140088386
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.fileRename__s__s_
lea rcx, [rsp + 0x134]
mov r9, rsi
mov r8d, eax
mov qword [rsp + 0x20], rdi
call fcn.140024950
lea rcx, [rsp + 0x30]
mov r8d, 0x104
mov rdx, rax
call fcn.14011e9b0
lea rdx, [0x14020ba18]
lea rcx, [rsp + 0x30]
call fcn.14011f050
int3
mov rsi, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret
Function at 0x1400883f0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x240
movzx ebp, dl
mov rdi, rcx
mov rdx, rcx
movzx esi, r8b
lea rcx, [rax + 0x20]
or r9d, 0xffffffff
mov r8d, 0xfde9
mov dword [rsp + 0x20], 0
call fcn.14007bc10
mov rcx, qword [rsp + 0x268]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [rsp + 0x268]
mov ebx, eax
call fcn.14011e950
test ebx, ebx
je 0x14008846d
mov al, 1
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea rcx, [rsp + 0x268]
or r9d, 0xffffffff
mov r8d, 0xfde9
mov rdx, rdi
mov dword [rsp + 0x20], 0
call fcn.14007bc10
mov rcx, qword [rsp + 0x268]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [rsp + 0x268]
mov ebx, eax
call fcn.14011e950
cmp ebx, 0xffffffff
je 0x1400884cd
test bl, 0x10
je 0x1400884cd
test bpl, bpl
je 0x1400884c9
test sil, sil
je 0x1400884c9
mov rcx, rdi
call fcn.1400883a0
int3
xor al, al
jmp 0x140088454
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.mkDir__s_
lea rcx, [rsp + 0x134]
mov r8d, eax
mov r9, rdi
call fcn.140024950
lea rcx, [rsp + 0x30]
mov r8d, 0x104
mov rdx, rax
call fcn.14011e9b0
lea rdx, [0x14020ba18]
lea rcx, [rsp + 0x30]
call fcn.14011f050
int3

Function at 0x140088780
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x148
mov rax, qword [0x14023bd60]
test rax, rax
je 0x1400887a0
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x1400887c6
lea r8, str..TimerManager.cxx
lea rdx, str.thrInst__thrInst__ptr__
lea rcx, [rsp + 0x20]
mov r9d, 0x46
call fcn.140086ab0
mov rcx, rax
call fcn.140086a30
mov rax, qword [0x14023bd60]
mov ecx, dword [rax]
add rsp, 0x148
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x14008aa50
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Encrypt data using des

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov r9d, dword [rcx]
mov r8d, dword [rcx + 4]
mov rbx, rcx
mov eax, r9d
mov rdi, rdx
mov esi, 8
shr eax, 4
lea rbp, [0x140000000]
xor eax, r8d
and eax, 0xf0f0f0f
xor r8d, eax
shl eax, 4
xor r9d, eax
mov eax, r9d
shr eax, 0x10
xor eax, r8d
movzx ecx, ax
xor r8d, ecx
shl ecx, 0x10
xor r9d, ecx
mov eax, r8d
shr eax, 2
xor eax, r9d
and eax, 0x33333333
xor r9d, eax
shl eax, 2
xor r8d, eax
mov r10d, r8d
shr r10d, 8
xor r10d, r9d
and r10d, 0xff00ff
xor r9d, r10d
shl r10d, 8
xor r10d, r8d
rol r10d, 1
mov r11d, r10d
xor r11d, r9d
and r11d, 0xaaaaaaaa
xor r10d, r11d
xor r11d, r9d
rol r11d, 1
nop
nop
nop
mov eax, r10d
add rdi, 0x10
ror eax, 4
xor eax, dword [rdi - 0x10]
mov edx, eax
mov ecx, eax
shr rax, 0x10
and eax, 0x3f
shr rcx, 0x18
and ecx, 0x3f
mov r9d, dword [rbp + rcx*4 + 0x19fab0]
or r9d, dword [rbp + rax*4 + 0x19fcb0]
mov rax, rdx
shr rax, 8
and eax, 0x3f
or r9d, dword [rbp + rax*4 + 0x19feb0]
mov al, dl
and eax, 0x3f
or r9d, dword [rbp + rax*4 + 0x1a00b0]
mov eax, dword [rdi - 0xc]
xor eax, r10d
mov ecx, eax
mov r8d, eax
shr rax, 0x10
and eax, 0x3f
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [rbp + rcx*4 + 0x19fbb0]
or edx, dword [rbp + rax*4 + 0x19fdb0]
mov rax, r8
shr rax, 8
and eax, 0x3f
or edx, dword [rbp + rax*4 + 0x19ffb0]
mov al, r8b
and eax, 0x3f
or edx, dword [rbp + rax*4 + 0x1a01b0]
or edx, r9d
xor r11d, edx
mov eax, r11d
ror eax, 4
xor eax, dword [rdi - 8]
mov ecx, eax
mov edx, eax
shr rax, 0x10
and eax, 0x3f
shr rcx, 0x18
and ecx, 0x3f
mov r9d, dword [rbp + rcx*4 + 0x19fab0]
or r9d, dword [rbp + rax*4 + 0x19fcb0]
mov rax, rdx
shr rax, 8
and eax, 0x3f
or r9d, dword [rbp + rax*4 + 0x19feb0]
mov al, dl
and eax, 0x3f
or r9d, dword [rbp + rax*4 + 0x1a00b0]
mov eax, dword [rdi - 4]
xor eax, r11d
mov ecx, eax
mov r8d, eax
shr rax, 0x10
and eax, 0x3f
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [rbp + rcx*4 + 0x19fbb0]
or edx, dword [rbp + rax*4 + 0x19fdb0]
mov rax, r8
shr rax, 8
and eax, 0x3f
or edx, dword [rbp + rax*4 + 0x19ffb0]
mov al, r8b
and eax, 0x3f
or edx, dword [rbp + rax*4 + 0x1a01b0]
or edx, r9d
xor r10d, edx
sub rsi, 1
jne 0x14008ab00
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ror r10d, 1
mov edx, r10d
xor edx, r11d
and edx, 0xaaaaaaaa
xor r10d, edx
xor edx, r11d
ror edx, 1
mov eax, edx
shr eax, 8
xor eax, r10d
and eax, 0xff00ff
xor r10d, eax
shl eax, 8
xor edx, eax
mov eax, edx
shr eax, 2
xor eax, r10d
and eax, 0x33333333
xor r10d, eax
shl eax, 2
xor edx, eax
mov eax, r10d
shr eax, 0x10
xor eax, edx
movzx ecx, ax
xor edx, ecx
shl ecx, 0x10
xor r10d, ecx
mov ecx, r10d
shr ecx, 4
xor ecx, edx
and ecx, 0xf0f0f0f
mov eax, ecx
xor ecx, edx
shl eax, 4
xor eax, r10d
mov dword [rbx], eax
mov dword [rbx + 4], ecx
mov rbx, qword [rsp + 8]
ret
Function at 0x14008c4f0
Capabilities:
Compute adler32 checksum

Disassembly:
movzx r9d, cx
shr ecx, 0x10
test rdx, rdx
mov r10, rdx
jne 0x14008c503
lea eax, [rdx + 1]
ret
test r8d, r8d
je 0x14008c643
nop
mov edx, 0x15b0
cmp r8d, edx
cmovb edx, r8d
sub r8d, edx
cmp edx, 0x10
jl 0x14008c5fd
mov r11d, edx
shr r11, 4
mov eax, r11d
neg eax
shl eax, 4
add edx, eax
nop
nop
movzx eax, byte [r10]
add r10, 0x10
add r9d, eax
movzx eax, byte [r10 - 0xf]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xe]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xd]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xc]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xb]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xa]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 9]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 8]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 7]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 6]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 5]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 4]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 3]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 2]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 1]
add ecx, r9d
add r9d, eax
add ecx, r9d
sub r11, 1
jne 0x14008c540
test edx, edx
je 0x14008c614
movzx eax, byte [r10]
add r10, 1
add r9d, eax
add ecx, r9d
sub edx, 1
jne 0x14008c601
mov eax, 0x80078071
mul r9d
mov eax, 0x80078071
shr edx, 0xf
imul edx, edx, 0xffff000f
add r9d, edx
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
test r8d, r8d
jne 0x14008c510
shl ecx, 0x10
or ecx, r9d
mov eax, ecx
ret
Function at 0x14008db60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
xor ecx, ecx
test edx, edx
mov qword [r8 + 0x40], rcx
mov qword [r8 + 0x48], rcx
mov qword [r8 + 0x20], rcx
mov qword [r8 + 0x28], rcx
mov qword [r8 + 0x30], rcx
mov qword [r8 + 0x38], rcx
mov ecx, reloc.WS2_32.dll_recv
mov rdi, r8
mov eax, edx
mov byte [r8 + 0x2f], 1
mov byte [r8 + 0x3f], 2
mov dword [r8 + 0x164], ecx
mov dword [r8 + 0x168], ecx
mov dword [r8 + 0x16c], ecx
je 0x14008dc5c
test eax, eax
mov rdx, rcx
je 0x14008dc07
mov qword [rsp + 0x30], rbp
mov rbp, rax
nop
cmp ecx, 0x10
jne 0x14008dbea
lea r8, [rdi + 0x70]
lea rdx, [rdi + 0x40]
lea rcx, [rdi + 0x40]
call fcn.14008e68c
xor ecx, ecx
xor edx, edx
movzx eax, byte [rsi]
add rdx, 1
add rsi, 1
xor byte [rdi + rdx + 0x3f], al
add ecx, 1
sub rbp, 1
jne 0x14008dbd0
mov rbp, qword [rsp + 0x30]
cmp ecx, 0x10
lea rdx, [rdi + 0x50]
jae 0x14008dc1b
mov eax, ecx
xor byte [rax + rdi + 0x40], 0x80
add rdx, 0x10
lea rcx, [rdi + 0x41]
add rdx, 1
mov r8d, 4
nop
nop
movzx eax, byte [rdx - 1]
add rcx, 4
add rdx, 4
xor byte [rcx - 5], al
movzx eax, byte [rdx - 4]
xor byte [rcx - 4], al
movzx eax, byte [rdx - 3]
xor byte [rcx - 3], al
movzx eax, byte [rdx - 2]
xor byte [rcx - 2], al
sub r8, 1
jne 0x14008dc30
jmp 0x14008dc6c
mov rax, qword [r8 + 0x50]
mov qword [r8 + 0x40], rax
mov rax, qword [r8 + 0x58]
mov qword [r8 + 0x48], rax
lea r8, [rdi + 0x70]
lea rdx, [rdi + 0x40]
lea rcx, [rdi + 0x40]
call fcn.14008e68c
mov rax, qword [rdi + 0x40]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rdi], rax
mov rax, qword [rdi + 0x48]
mov qword [rdi + 8], rax
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14008e4b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rbx, r8
lea rsi, [r8 + 0x50]
mov r13d, edx
cmp dword [rbx + 0x164], 0x10
mov r8, rsi
mov rdi, rcx
jae 0x14008e4f0
mov eax, dword [rbx + 0x164]
xor byte [rax + rbx + 0x20], 0x80
add r8, 0x10
mov ebp, 4
lea rcx, [rbx + 0x21]
add r8, 1
mov rdx, rbp
movzx eax, byte [r8 - 1]
xor byte [rcx - 1], al
movzx eax, byte [r8]
xor byte [rcx], al
movzx eax, byte [r8 + 1]
xor byte [rcx + 1], al
movzx eax, byte [r8 + 2]
add r8, rbp
xor byte [rcx + 2], al
add rcx, rbp
sub rdx, 1
jne 0x14008e500
lea rcx, [rbx + 0x20]
lea r12, [rbx + 0x70]
mov r8, r12
mov rdx, rcx
call fcn.14008e68c
cmp dword [rbx + 0x16c], 0x10
jae 0x14008e555
mov eax, dword [rbx + 0x16c]
xor byte [rax + rbx + 0x30], 0x80
add rsi, 0x10
lea rcx, [rbx + 0x31]
lea rdx, [rsi + 1]
nop
movzx eax, byte [rdx - 1]
add rcx, 4
add rdx, 4
xor byte [rcx - 5], al
movzx eax, byte [rdx - 4]
xor byte [rcx - 4], al
movzx eax, byte [rdx - 3]
xor byte [rcx - 3], al
movzx eax, byte [rdx - 2]
xor byte [rcx - 2], al
sub rbp, 1
jne 0x14008e560
add rbx, 0x30
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call fcn.14008e68c
test r13d, r13d
je 0x14008e5cb
mov rcx, r13
nop
nop
nop
movzx eax, byte [rbx - 0x10]
add rdi, 1
add rbx, 1
xor al, byte [rbx + 0xf]
xor al, byte [rbx - 1]
sub rcx, 1
mov byte [rdi - 1], al
jne 0x14008e5b0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x140091b30
Capabilities:
Get graphical window text

Disassembly:
push rdi
mov eax, 0x2070
call fcn.140187630
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x2088], rbx
mov qword [rsp + 0x2090], rsi
mov rax, qword [0x140229498]
xor rax, rsp
mov qword [rsp + 0x2060], rax
mov rbx, rcx
call fcn.14002ec10
mov rdi, rax
mov r8d, 0x1000
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x140091c37
mov r8d, 4
lea rdx, str.LOC:
lea rcx, [rsp + 0x60]
call fcn.1401286e0
test eax, eax
jne 0x140091c30
xor esi, esi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
or r9d, 0xffffffff
mov r8d, 0xfde9
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.14007ba40
nop
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call fcn.14002d000
mov dword [rsp + 0x20], esi
or r9d, 0xffffffff
mov r8d, 0xfde9
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14007bc10
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rsp + 0x48]
call fcn.14011e0c0
nop
mov rcx, qword [rsp + 0x40]
call fcn.14011e0c0
lea eax, [rsi + 1]
jmp 0x140091c3c
mov eax, 1
jmp 0x140091c3c
mov eax, 1
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.14011f1c0
lea r11, [rsp + 0x2070]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140091e00
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [0x14023bf14]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140091e3c
nop
mov rcx, qword [rax]
mov rbx, qword [rax + 8]
mov rdx, rdi
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x140091e49
test rbx, rbx
mov rax, rbx
jne 0x140091e20
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret