joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400015c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
call section..text
test eax, eax
js 0x1400017fe
mov eax, dword [rbx + 0xf0]
xor r10d, r10d
shl eax, 2
movsxd r9, eax
test eax, eax
jle 0x14000164d
lea r8, [rbx + 8]
lea r8, [r8 + r9*4]
lea rax, [rbx + 8]
nop word [rax + rax]
mov edx, dword [rax - 8]
add r10, 4
mov ecx, dword [r8 - 8]
lea r8, [r8 - 0x10]
mov dword [rax - 8], ecx
lea rax, [rax + 0x10]
mov ecx, dword [r8 + 0xc]
sub r9, 4
mov dword [r8 + 8], edx
mov edx, dword [rax - 0x14]
mov dword [rax - 0x14], ecx
mov ecx, dword [r8 + 0x10]
mov dword [r8 + 0xc], edx
mov edx, dword [rax - 0x10]
mov dword [rax - 0x10], ecx
mov ecx, dword [r8 + 0x14]
mov dword [r8 + 0x10], edx
mov edx, dword [rax - 0xc]
mov dword [rax - 0xc], ecx
mov dword [r8 + 0x14], edx
cmp r10, r9
jl 0x140001600
mov r11d, 1
cmp dword [rbx + 0xf0], r11d
jle 0x1400017fc
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 2]
lea rdi, [0x140000000]
mov r8d, dword [r10 + 0xe]
lea r10, [r10 + 0x10]
mov eax, r8d
inc r11d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x6b640]
movzx eax, byte [r10 - 1]
mov r9d, dword [rdi + rdx*4 + 0x6ba40]
movzx ecx, byte [rdi + rax*4 + 0x6b640]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0x6c240]
movzx ecx, byte [rdi + rax*4 + 0x6b640]
movzx eax, byte [r10]
xor r9d, dword [rdi + rcx*4 + 0x6c640]
movzx ecx, byte [rdi + rax*4 + 0x6b640]
movzx eax, byte [r10 + 3]
xor r9d, dword [rdi + rcx*4 + 0x6be40]
movzx edx, byte [rdi + rax*4 + 0x6b640]
movzx eax, byte [r10 + 4]
mov dword [r10 - 2], r9d
mov r9d, dword [r10 + 2]
mov r8d, dword [rdi + rdx*4 + 0x6c240]
movzx ecx, byte [rdi + rax*4 + 0x6b640]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0x6be40]
movzx ecx, byte [rdi + rax*4 + 0x6b640]
movzx eax, r9b
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0x6ba40]
movzx ecx, byte [rdi + rax*4 + 0x6b640]
movzx eax, byte [r10 + 7]
xor r8d, dword [rdi + rcx*4 + 0x6c640]
movzx edx, byte [rdi + rax*4 + 0x6b640]
movzx eax, byte [r10 + 8]
mov dword [r10 + 2], r8d
mov r8d, dword [rdi + rdx*4 + 0x6c240]
movzx ecx, byte [rdi + rax*4 + 0x6b640]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0x6be40]
movzx ecx, byte [rdi + rax*4 + 0x6b640]
movzx eax, r9b
mov r9d, dword [r10 + 0xa]
xor r8d, dword [rdi + rcx*4 + 0x6ba40]
movzx ecx, byte [rdi + rax*4 + 0x6b640]
movzx eax, byte [r10 + 0xb]
xor r8d, dword [rdi + rcx*4 + 0x6c640]
movzx edx, byte [rdi + rax*4 + 0x6b640]
movzx eax, byte [r10 + 0xc]
mov dword [r10 + 6], r8d
mov r8d, dword [rdi + rdx*4 + 0x6c240]
movzx ecx, byte [rdi + rax*4 + 0x6b640]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0x6be40]
movzx ecx, byte [rdi + rax*4 + 0x6b640]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x6ba40]
movzx ecx, byte [rdi + rax*4 + 0x6b640]
xor r8d, dword [rdi + rcx*4 + 0x6c640]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x140001670
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140002980
Capabilities:
Hash data with md5

Disassembly:
push rdi
sub rsp, 0x90
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
mov qword [rsp + 0x50], rcx
xor edx, edx
lea r8d, [rdx + 0x5c]
add rcx, 4
call fcn.140045030
mov dword [rdi + 4], 0x67452301
mov dword [rdi + 8], 0xefcdab89
mov dword [rdi + 0xc], 0x98badcfe
mov dword [rdi + 0x10], 0x10325476
lea rax, [rdi + 0xa0]
mov qword [rax + 0x18], 0xf
xor ebx, ebx
mov qword [rax + 0x10], rbx
cmp qword [rax + 0x18], 0x10
jb 0x1400029fe
mov rax, qword [rax]
mov byte [rax], bl
lea rax, [rdi + 0xc0]
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], rbx
cmp qword [rax + 0x18], 0x10
jb 0x140002a1d
mov rax, qword [rax]
mov byte [rax], 0
mov word [rdi], 0x101
mov word [rsp + 0x21], 0x3332
mov byte [rsp + 0x23], 0
mov byte [rsp + 0x20], 0x31
mov qword [rsp + 0x78], 0xf
mov qword [rsp + 0x70], rbx
mov byte [rsp + 0x60], 0
lea rax, [rsp + 0x20]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140002a52
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.14002c510
nop
mov qword [rsp + 0x40], 0xf
mov qword [rsp + 0x38], rbx
mov byte [rsp + 0x28], 0
xor r8d, r8d
lea rdx, [0x14006d638]
lea rcx, [rsp + 0x28]
call fcn.14002c510
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140002b30
nop
mov rax, qword [rsp + 0x78]
cmp rax, 0x10
jb 0x140002aff
inc rax
mov rcx, qword [rsp + 0x60]
cmp rax, 0x1000
jb 0x140002af9
test cl, 0x1f
je 0x140002acc
call fcn.140045e90
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140002adb
call fcn.140045e90
int3
sub rcx, rax
cmp rcx, 8
jae 0x140002aea
call fcn.140045e90
int3
cmp rcx, 0x27
jbe 0x140002af6
call fcn.140045e90
int3
mov rcx, rax
call fcn.14003fbe8
nop
mov rax, rdi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14003ff20
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x140006010
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], 0
call fcn.140023d80
mov rcx, rax
lea r8, [rsp + 0x30]
mov edx, 0x20
call fcn.140022820
test eax, eax
je 0x1400060ab
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call fcn.140022720
test eax, eax
je 0x1400060a1
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
mov r9d, 0x10
mov qword [rsp + 0x28], 0
xor edx, edx
mov qword [rsp + 0x44], rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x4c], 2
mov qword [rsp + 0x20], 0
call fcn.140022610
mov rcx, qword [rsp + 0x30]
call fcn.140024730
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x68
ret

Function at 0x1400072c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rax, [rbp - 0x19]
mov dword [rbp + 0x39], 0x65727275
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x11]
lea rax, [rbp - 0x15]
mov dword [rbp + 0x31], 0x4e207377
lea r8, [rbp - 9]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x17]
mov word [rbp + 0x1f], 0x5c5c
mov rcx, 0xffffffff80000002
mov word [rbp + 0x22], 0x6369
xor bl, bl
mov word [rbp + 0x42], 0x6973
mov dword [rbp + 0x3e], 0x72655674
mov word [rbp + 0x2a], 0x5c5c
mov word [rbp + 0x1a], 0x5754
mov dword [rbp + 0x2d], 0x6f646e69
mov word [rbp + 0x45], 0x6e
mov dword [rbp + 0x25], 0x666f736f
mov byte [rbp + 0x24], 0x72
mov word [rbp + 0x36], 0x5c5c
mov word [rbp + 0x17], 0x4f53
mov byte [rbp + 0x3d], 0x6e
mov byte [rbp + 0x35], 0x54
mov word [rbp + 0x1d], 0x4552
mov byte [rbp + 0x29], 0x74
mov byte [rbp + 0x19], 0x46
mov byte [rbp + 0x21], 0x4d
mov byte [rbp + 0x44], 0x6f
mov byte [rbp + 0x1c], 0x41
mov byte [rbp + 0x2c], 0x57
mov byte [rbp + 0x38], 0x43
mov dword [rbp - 1], 0x726f6a61
mov word [rbp + 0xf], 0x72
mov word [rbp - 9], 0x7543
mov word [rbp - 6], 0x6572
mov word [rbp - 3], 0x4d74
mov word [rbp + 0xc], 0x626d
mov dword [rbp + 5], 0x6f697372
mov word [rbp + 9], 0x4e6e
mov byte [rbp - 4], 0x6e
mov word [rbp + 3], 0x6556
mov byte [rbp - 7], 0x72
mov byte [rbp + 0xb], 0x75
mov byte [rbp + 0xe], 0x65
mov dword [rbp - 0x11], 4
mov dword [rbp - 0x15], 0
mov dword [rbp - 0x19], 4
call fcn.14001ef10
test eax, eax
movzx ecx, bl
mov edx, 1
cmove ecx, edx
movzx eax, cl
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14003ff20
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rbp
ret
Function at 0x140007420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov r11, rsp
push rbp
push r12
push r14
push r15
lea rbp, [r11 - 0x1e8]
sub rsp, 0x2c8
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor r12b, r12b
mov r14d, edx
mov r15, rcx
test edx, edx
je 0x1400076b5
test rcx, rcx
je 0x1400076b5
mov qword [r11 - 0x28], rsi
lea rcx, [rsp + 0x30]
mov qword [r11 - 0x30], rdi
mov qword [r11 - 0x38], r13
xor r13d, r13d
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x44], r13d
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x30], 0xffffffff
call fcn.1400083b0
xor edx, edx
mov dword [rsp + 0x60], 0x130
mov esi, eax
lea ecx, [rdx + 2]
call fcn.14001eae0
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140007697
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.14001ea10
cmp eax, 1
jne 0x14000768f
mov qword [rsp + 0x300], rbx
nop word [rax + rax]
lea rdx, [rbp - 0x74]
mov word [rbp + 0x193], 0x6f6c
lea rcx, [rbp + 0x190]
mov dword [rbp + 0x199], 0x657865
mov word [rbp + 0x190], 0x7865
mov byte [rbp + 0x192], 0x70
mov dword [rbp + 0x195], 0x2e726572
call fcn.14004dbf0
test eax, eax
jne 0x1400075bb
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov ecx, 0x1fffff
call fcn.140022f00
mov rbx, rax
test rax, rax
je 0x1400075bb
lea r8, [rsp + 0x38]
mov edx, 8
mov rcx, rax
call fcn.140022820
test eax, eax
je 0x1400075b3
mov r9d, dword [rsp + 0x40]
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x44]
mov edx, 0xc
mov qword [rsp + 0x20], rax
call fcn.14001e750
test eax, eax
je 0x140007581
cmp esi, dword [rsp + 0x44]
je 0x1400075d6
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140007595
call fcn.140024730
mov qword [rsp + 0x38], r13
mov rcx, rbx
call fcn.140024730
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400075bb
call fcn.140024730
mov qword [rsp + 0x38], r13
jmp 0x1400075bb
mov rcx, rbx
call fcn.140024730
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.14001e940
cmp eax, 1
je 0x1400074e0
jmp 0x140007687
xor edx, edx
mov dword [rsp + 0x48], r13d
mov r8d, 0x100
lea rcx, [rbp + 0x90]
call fcn.140045030
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x48]
mov r9d, 0x100
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x90]
mov edx, 1
call fcn.14001e750
test eax, eax
je 0x14000766b
mov rcx, qword [rbp + 0x90]
lea rdx, [rsp + 0x50]
call fcn.140022fe0
test eax, eax
je 0x14000766b
mov rcx, qword [rsp + 0x50]
call fcn.1400251b0
cmp eax, r14d
jae 0x140007661
mov r9, qword [rsp + 0x50]
lea r8, [rsp + 0x30]
mov rdx, r14
mov word [rsp + 0x31], 0x73
mov rcx, r15
mov byte [rsp + 0x30], 0x25
call fcn.14003e4b0
mov r12b, 1
mov rcx, qword [rsp + 0x50]
call fcn.1400240a0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000767f
call fcn.140024730
mov qword [rsp + 0x38], r13
mov rcx, rbx
call fcn.140024730
mov rbx, qword [rsp + 0x300]
mov rcx, rdi
call fcn.140024730
mov r13, qword [rsp + 0x2b0]
movzx eax, r12b
mov rdi, qword [rsp + 0x2b8]
mov rsi, qword [rsp + 0x2c0]
jmp 0x1400076b7
xor al, al
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0x2c8
pop r15
pop r14
pop r12
pop rbp
ret
Function at 0x140007a50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
or eax, 0xffffffff
movzx ecx, byte [rcx]
test cl, cl
je 0x140007afa
movzx edx, cl
lea r8, [r8 + 1]
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x140007a61
not eax
ret
Function at 0x14000bb10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, rdx
mov r14, rcx
call fcn.140034030
mov rcx, rax
test rax, rax
jne 0x14000bb5e
mov ecx, 0x80004005
call fcn.140033340
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x11], rbx
mov word [rbp + 0x30], 0x6f6f
mov word [rbp + 0x39], 0x6d6f
mov word [rbp + 0x36], 0x6843
mov word [rbp + 0x3b], 0x65
mov word [rbp + 0x33], 0x656c
mov byte [rbp + 0x2f], 0x47
mov byte [rbp + 0x32], 0x67
mov byte [rbp + 0x35], 0x20
mov byte [rbp + 0x38], 0x72
mov word [rbp + 0x27], 0x6843
mov dword [rbp + 0x2a], 0x656d6f
mov byte [rbp + 0x29], 0x72
lea rdx, [rbp + 0x2f]
lea rcx, [rbp - 9]
call fcn.140031410
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x20], rcx
mov r9, rsi
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.14000b200
movzx edi, al
test al, al
jne 0x14000bcd0
lea rdx, [rbp + 0x2f]
lea rcx, [rbp - 1]
call fcn.140031410
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x20], rcx
mov r9, rsi
mov r8b, 1
xor edx, edx
mov rcx, rax
call fcn.14000b200
movzx edi, al
test al, al
jne 0x14000bcd0
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 7]
call fcn.140031410
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x20], rcx
mov r9, rsi
xor r8d, r8d
mov dl, 1
mov rcx, rax
call fcn.14000b200
movzx edi, al
test al, al
jne 0x14000bcd0
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 0xf]
call fcn.140031410
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x20], rcx
mov r9, rsi
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.14000b200
movzx edi, al
test al, al
jne 0x14000bcd0
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 0x17]
call fcn.140031410
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x20], rcx
mov r9, rsi
mov r8b, 1
xor edx, edx
mov rcx, rax
call fcn.14000b200
movzx edi, al
test al, al
jne 0x14000bcd0
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 0x19]
call fcn.140031410
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x20], rcx
mov r9, rsi
xor r8d, r8d
mov dl, 1
mov rcx, rax
call fcn.14000b200
movzx edi, al
test al, al
jne 0x14000bcd0
mov rcx, rsi
call fcn.14000a830
movzx edi, al
mov byte [r14], 1
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000bcee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
movzx eax, dil
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14003ff20
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000e780
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x78]
sub rsp, 0x170
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rsi, rcx
mov qword [rsp + 0x30], rcx
xor ebx, ebx
mov dword [rsp + 0x24], ebx
lea rdx, [0x14006d638]
call fcn.140031410
mov edi, 1
mov dword [rsp + 0x24], edi
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x50]
call fcn.140045030
mov dword [rsp + 0x44], 0x6b636954
mov dword [rsp + 0x40], 0x5f4f5353
mov word [rsp + 0x49], 0x74
mov byte [rsp + 0x48], 0x65
or r9, 0xffffffffffffffff
lea r8, str.5e5399be05004b61a31c45de7d4b854d
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.14004da40
or r9, 0xffffffffffffffff
lea r8, [rsp + 0x40]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.14004d950
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.14004dcec
mov rcx, rax
lea r8, [rsp + 0x50]
test rax, rax
je 0x14000e896
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8]
add edi, eax
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
lea r8, [r8 + 1]
add ebx, edi
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ebx, eax
sub rcx, 1
jne 0x14000e860
mov dword [rsp + 0x39], 0x25783830
mov byte [rsp + 0x38], 0x25
mov word [rsp + 0x3d], 0x73
mov dword [rsp + 0x20], 0x74745f
shl ebx, 0x10
lea r8d, [rdi + rbx]
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.140033b50
mov rax, rsi
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.14003ff20
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140015780
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x388]
sub rsp, 0x470
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp + 0x360], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x20], 0x312e35
lea rdx, [rsp + 0x20]
mov rcx, qword [rsi]
call fcn.14004e038
mov ebx, eax
mov dword [rsp + 0x24], 0x322e35
lea rdx, [rsp + 0x24]
mov rcx, qword [rsi]
call fcn.14004e038
test eax, eax
sete al
neg ebx
sbb ebx, ebx
and ebx, 8
mov ecx, 1
test al, al
cmovne ebx, ecx
mov dword [rsp + 0x28], 0x302e36
lea rdx, [rsp + 0x28]
mov rcx, qword [rsi]
call fcn.14004e038
test eax, eax
mov eax, 2
cmove ebx, eax
mov word [rsp + 0x2d], 0x312e
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x2c], VarI4FromI2
lea rdx, [rsp + 0x2c]
mov rcx, qword [rsi]
call fcn.14004e038
test eax, eax
mov eax, 3
cmove ebx, eax
mov word [rsp + 0x31], 0x322e
mov byte [rsp + 0x33], 0
mov byte [rsp + 0x30], VarI4FromI2
lea rdx, [rsp + 0x30]
mov rcx, qword [rsi]
call fcn.14004e038
test eax, eax
mov eax, 4
cmove ebx, eax
mov dword [rsp + 0x34], 0x332e36
lea rdx, [rsp + 0x34]
mov rcx, qword [rsi]
call fcn.14004e038
test eax, eax
mov eax, 5
cmove ebx, eax
mov word [rsp + 0x50], 0x3031
mov word [rsp + 0x53], 0x30
mov byte [rsp + 0x52], 0x2e
lea rdx, [rsp + 0x50]
mov rcx, qword [rsi]
call fcn.14004e038
mov r14d, 6
test eax, eax
jne 0x1400158c9
mov ebx, r14d
jmp 0x1400158ce
cmp ebx, 1
jbe 0x1400158d2
xor cl, cl
jmp 0x1400158d4
mov cl, 1
call fcn.140015040
cmp eax, 4
jne 0x1400158e5
cmp ebx, r14d
cmovne ebx, r14d
lea ebx, [rax + rbx*4]
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x60]
call fcn.140045030
mov word [rsp + 0x58], 0x3138
mov dword [rsp + 0x5b], 0x642531
mov byte [rsp + 0x5a], 0x33
lea r9d, [rbx + 0x27]
lea r8, [rsp + 0x58]
mov edx, 0x400
lea rcx, [rsp + 0x60]
call fcn.14003e4b0
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140031410
nop
mov rdx, qword [rsi]
sub rdx, 0x18
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140015952
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rax, rdi
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.14003ff20
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400177e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov esi, r8d
mov r15, rdx
mov rdi, rcx
xor eax, eax
mov r9, rcx
nop word [rax + rax]
mov byte [r9], al
lea r9, [r9 + 1]
inc eax
cmp eax, 0x100
jl 0x140017810
xor r11d, r11d
movzx ebp, sil
xor r8b, r8b
lea r14, [rcx + 0xff]
mov r10d, 0xff
nop word [rax + rax]
xor ebx, ebx
mov r9d, 1
cmp r10d, r9d
jbe 0x140017860
nop dword [rax]
lea r9d, [r9*2 + 1]
cmp r9d, r10d
jb 0x140017850
nop dword [rax]
movzx eax, r8b
movzx r8d, byte [r11 + r15]
inc r11d
add r8b, byte [rax + rdi]
cmp r11d, ebp
jb 0x14001787b
xor r11d, r11d
add r8b, sil
movzx eax, r8b
inc ebx
and eax, r9d
cmp ebx, 0xb
jbe 0x140017890
xor edx, edx
div r10d
mov eax, edx
cmp eax, r10d
ja 0x140017860
movzx edx, byte [r14]
movzx ecx, al
movzx eax, byte [rcx + rdi]
mov byte [r14], al
dec r14
mov byte [rcx + rdi], dl
sub r10d, 1
jne 0x140017840
movzx eax, byte [rdi + 1]
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov byte [rdi + 0x100], al
movzx eax, byte [rdi + 3]
mov byte [rdi + 0x101], al
movzx eax, byte [rdi + 5]
mov byte [rdi + 0x102], al
movzx eax, byte [rdi + 7]
mov byte [rdi + 0x103], al
movzx eax, r8b
movzx ecx, byte [rax + rdi]
mov rax, rdi
mov byte [rdi + 0x104], cl
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret

Function at 0x140017f10
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xa0
mov qword [r11 - 0x80], 0xfffffffffffffffe
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
xor ecx, ecx
mov dword [rsp + 0x20], ecx
lea rax, vtable.CMD5Checksum.0
mov qword [r11 - 0x78], rax
xor eax, eax
mov qword [r11 - 0x70], rax
mov qword [r11 - 0x68], rax
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rcx
mov dword [r11 - 0x28], 0x67452301
mov dword [r11 - 0x24], 0xefcdab89
mov dword [r11 - 0x20], 0x98badcfe
mov dword [r11 - 0x1c], 0x10325476
lea rcx, [r11 - 0x78]
call fcn.1400188a0
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140018970
nop
mov rax, rbx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14003ff20
add rsp, 0xa0
pop rbx
ret
Function at 0x14001bab0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rax, r8
xor ecx, ecx
mov rdi, rdx
mov dword [rsp + 0x20], ecx
mov r8, r9
mov rdx, rax
mov qword [rbx], rcx
mov qword [rbx + 8], rcx
mov rcx, rbx
mov dword [rbx + 0x50], 0x6a09e667
mov dword [rbx + 0x54], 0xbb67ae85
mov dword [rbx + 0x58], 0x3c6ef372
mov dword [rbx + 0x5c], 0xa54ff53a
mov dword [rbx + 0x60], 0x510e527f
mov dword [rbx + 0x64], 0x9b05688c
mov dword [rbx + 0x68], 0x1f83d9ab
mov dword [rbx + 0x6c], 0x5be0cd19
call fcn.14001bbd0
mov rdx, rdi
mov rcx, rbx
call fcn.14001bcb0
mov rbx, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x14001bcb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x1400970b0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov eax, dword [rcx + 0x50]
lea r14, [rcx + 0x50]
mov dword [rbp - 0x51], eax
xor ebx, ebx
mov eax, dword [rcx + 0x54]
mov rsi, rdx
mov dword [rbp - 0x4d], eax
mov rdi, rcx
mov eax, dword [rcx + 0x58]
mov dword [rbp - 0x49], eax
mov eax, dword [rcx + 0x5c]
mov dword [rbp - 0x45], eax
mov eax, dword [rcx + 0x60]
mov dword [rbp - 0x41], eax
mov eax, dword [rcx + 0x64]
mov dword [rbp - 0x3d], eax
mov eax, dword [rcx + 0x68]
mov dword [rbp - 0x39], eax
mov eax, dword [rcx + 0x6c]
mov dword [rbp - 0x35], eax
mov dword [rbp - 0x59], ebx
mov dword [rbp - 0x31], 0x33323130
mov dword [rbp - 0x2c], 0x38373635
mov word [rbp - 0x22], 0x66
mov dword [rbp - 0x27], 0x64636261
mov byte [rbp - 0x2d], 0x34
mov byte [rbp - 0x23], 0x65
mov byte [rbp - 0x28], VarI4FromI2
call fcn.14001dea0
lea r9, [rbp - 0x51]
mov edx, ebx
sub r9, rdi
lea r8d, [rbx + 8]
mov ecx, dword [r14]
lea r14, [r14 + 4]
mov eax, ecx
shr rax, 0x1c
movzx eax, byte [rbp + rax - 0x31]
mov byte [rbp + rdx - 0x19], al
mov eax, ecx
shr rax, 0x18
and eax, 0xf
movzx eax, byte [rbp + rax - 0x31]
mov byte [rbp + rdx - 0x18], al
mov eax, ecx
shr rax, 0x14
and eax, 0xf
movzx eax, byte [rbp + rax - 0x31]
mov byte [rbp + rdx - 0x17], al
mov eax, ecx
shr rax, 0x10
and eax, 0xf
movzx eax, byte [rbp + rax - 0x31]
mov byte [rbp + rdx - 0x16], al
mov eax, ecx
shr rax, 0xc
and eax, 0xf
movzx eax, byte [rbp + rax - 0x31]
mov byte [rbp + rdx - 0x15], al
mov eax, ecx
shr rax, 8
and eax, 0xf
movzx eax, byte [rbp + rax - 0x31]
mov byte [rbp + rdx - 0x14], al
mov eax, ecx
shr rax, 4
and ecx, 0xf
and eax, 0xf
movzx eax, byte [rbp + rax - 0x31]
mov byte [rbp + rdx - 0x13], al
movzx eax, byte [rbp + rcx - 0x31]
mov byte [rbp + rdx - 0x12], al
add rdx, 8
mov eax, dword [r9 + r14 - 0x54]
mov dword [r14 - 4], eax
sub r8, 1
jne 0x14001bd50
cmp rdx, 0x41
jae 0x14001be5f
mov byte [rbp + rdx - 0x19], bl
mov qword [rsi + 0x18], 0xf
mov qword [rsi + 0x10], rbx
mov byte [rsi], bl
cmp byte [rbp - 0x19], bl
je 0x14001be29
lea rax, [rbp - 0x19]
or rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14001be20
mov r8, rbx
lea rdx, [rbp - 0x19]
mov rcx, rsi
call fcn.14002c510
mov rax, rsi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14003ff20
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.14003fcf8
int3