Function at 0x140001650
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x28
ret

Function at 0x140001680
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x28
ret

Function at 0x1400016b0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x28
ret

Function at 0x1400016f0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov qword [section..data], rax
cmp rax, 0x10
jae 0x140001715
call fcn.1400015f0
mov edx, 0x10
lea rcx, [0x1400aa0a0]
call fcn.140002fe0
xor eax, eax
add rsp, 0x58
ret

Function at 0x140001970
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rcx
xor r9d, r9d
mov qword [rsp + 0x10], rdx
mov r10, r8
mov byte [rsp + 8], 0
test r8, r8
je 0x1400019bb
nop word [rax + rax]
mov rax, qword [rsp + 0x10]
movzx ecx, byte [rax + r9]
mov rax, qword [rsp + 0x18]
movzx r8d, byte [rax + r9]
inc r9
movzx eax, byte [rsp + 8]
xor r8d, ecx
or al, r8b
mov byte [rsp + 8], al
cmp r9, r10
jb 0x140001990
movzx eax, byte [rsp + 8]
dec eax
sar eax, 8
and eax, 1
dec eax
ret

Function at 0x140001ca0
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r9d, dword [rcx + 0x20]
mov rbp, rdx
shr r9, 3
mov rbx, rcx
and r9d, 0x3f
mov edx, 0
cmp r9d, 0x38
jae 0x140001d14
mov r10d, 0x38
sub r10d, r9d
je 0x140001d07
lea r8, [0x1400314b0]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8]
lea ecx, [rdx + r9]
inc edx
mov byte [rcx + rbx + 0x28], al
lea r8, [r8 + 1]
cmp edx, r10d
jb 0x140001cf0
lea rsi, [rbp + 0x100]
lea rdi, [rbx + 0x28]
jmp 0x140001d77
mov r10d, 0x40
sub r10d, r9d
je 0x140001d47
lea r8, [0x1400314b0]
nop word [rax + rax]
movzx eax, byte [r8]
lea ecx, [rdx + r9]
inc edx
mov byte [rcx + rbx + 0x28], al
lea r8, [r8 + 1]
cmp edx, r10d
jb 0x140001d30
lea rsi, [rbp + 0x100]
mov r8, rbp
lea rdi, [rbx + 0x28]
mov r9, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.140001de0
xorps xmm2, xmm2
xor eax, eax
movups xmmword [rdi], xmm2
movups xmmword [rdi + 0x10], xmm2
movups xmmword [rdi + 0x20], xmm2
mov qword [rdi + 0x30], rax
mov rax, qword [rbx + 0x20]
mov r9, rsi
mov byte [rbx + 0x67], al
mov r8, rbp
shr rax, 8
mov rdx, rdi
mov byte [rbx + 0x66], al
mov rcx, rbx
shr rax, 8
mov byte [rbx + 0x65], al
shr rax, 8
mov byte [rbx + 0x64], al
shr rax, 8
mov byte [rbx + 0x63], al
shr rax, 8
mov byte [rbx + 0x62], al
shr rax, 8
mov byte [rbx + 0x61], al
shr rax, 8
mov byte [rbx + 0x60], al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.140001de0