joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140054c14
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x130
mov rax, qword [0x140141480]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rcx, qword [0x140142138]
add rcx, 0x8962128
call fcn.140043da8
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x140054d5a
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140059574
mov rax, qword [0x1401486e0]
lea rcx, [rdi + 3]
mov word [rax], 0xb848
call fcn.1400438a4
movsxd rdx, eax
mov rax, qword [0x1401486e0]
add rdx, 7
add rdx, rdi
mov qword [rax + 2], rdx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov r10, rbp
mov r8, qword [r10 + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140054d15
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x140054d15
mov esi, dword [r9 + 0x20]
dec edx
mov r11d, 0xe7367dd1
lea rax, [rsi + rdx*4]
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
inc rcx
test al, al
je 0x140054d11
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x140054cf2
cmp r11d, 0xa277b928
je 0x140054d28
test edx, edx
jne 0x140054cd6
mov rax, qword [r10]
mov r10, rax
cmp rax, rbp
je 0x140054d40
cmp qword [rax + 0x30], rbx
jne 0x140054cb2
jmp 0x140054d40
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov ebx, dword [rcx + rdx*4]
add rbx, r8
mov rcx, qword [0x1401486e0]
lea rdx, [rsp + 0x27]
add rcx, 0xa
mov r8d, 0xf6
call rbx
mov al, 1
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1400c1f80
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400558f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140141480]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x20], rdx
xor eax, eax
mov byte [rbp - 0x12], al
mov rbx, rdx
mov cl, 0x46
mov dword [rbp - 0x20], 0x27232246
mov dword [rbp - 0x1c], 0x34222e32
mov dword [rbp - 0x18], 0x322f3629
mov word [rbp - 0x14], 0x2b23
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xd
jae 0x140055950
mov cl, byte [rbp - 0x20]
jmp 0x14005593e
mov rdi, qword [rdx + 0x18]
mov rcx, rbx
mov byte [rbp - 0x12], 0
cmp rdi, 0xf
jbe 0x140055964
mov rcx, qword [rdx]
lea rdx, [rbp - 0x1f]
call fcn.14005b284
test rax, rax
setne sil
cmp rdi, 0xf
jbe 0x1400559a7
mov rcx, qword [rbx]
lea rdx, [rdi + 1]
cmp rdx, 0x1000
jb 0x1400559a2
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400559db
mov rcx, r8
call fcn.1400c1e64
and qword [rbx + 0x10], 0
mov al, sil
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c1f80
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x140055ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140141480]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x20], rdx
xor eax, eax
mov byte [rbp - 0x14], al
mov rbx, rdx
mov cl, 0x5d
mov dword [rbp - 0x20], 0x322f395d
mov dword [rbp - 0x1c], 0x39382d2d
mov dword [rbp - 0x18], 0x30382934
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xb
jae 0x140055b0a
mov cl, byte [rbp - 0x20]
jmp 0x140055af8
mov rdi, qword [rdx + 0x18]
mov rcx, rbx
mov byte [rbp - 0x14], 0
cmp rdi, 0xf
jbe 0x140055b1e
mov rcx, qword [rdx]
xor r8d, r8d
lea rdx, [rbp - 0x1f]
call fcn.140043f2c
mov sil, al
cmp rdi, 0xf
jbe 0x140055b60
mov rcx, qword [rbx]
lea rdx, [rdi + 1]
cmp rdx, 0x1000
jb 0x140055b5b
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
add rcx, 0xfffffffffffffff8
cmp rcx, 0x1f
ja 0x140055b94
mov rcx, r8
call fcn.1400c1e64
and qword [rbx + 0x10], 0
mov al, sil
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c1f80
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140055b9c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140141480]
xor rax, rsp
mov qword [rsp + 0x40], rax
movdqa xmm0, xmmword [0x1400d3410]
mov rbx, rdx
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rdx
xor ecx, ecx
mov word [rsp + 0x38], reloc.WLDAP32.dll_Ordinal_45
mov al, byte [rsp + 0x28]
xor byte [rsp + rcx + 0x29], al
inc rcx
cmp rcx, 0x10
jb 0x140055bd9
mov rdi, qword [rdx + 0x18]
mov rcx, rbx
mov byte [rsp + 0x39], 0
cmp rdi, 0xf
jbe 0x140055bff
mov rcx, qword [rdx]
xor r8d, r8d
lea rdx, [rsp + 0x29]
call fcn.140043f2c
mov sil, al
cmp rdi, 0xf
jbe 0x140055c42
mov rcx, qword [rbx]
lea rdx, [rdi + 1]
cmp rdx, 0x1000
jb 0x140055c3d
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
add rcx, 0xfffffffffffffff8
cmp rcx, 0x1f
ja 0x140055c72
mov rcx, r8
call fcn.1400c1e64
and qword [rbx + 0x10], 0
mov al, sil
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400c1f80
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140057c9c
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov rax, qword [0x140141480]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r15, rdx
mov dword [rbp - 0x39], 0x460520
mov dl, reloc.WLDAP32.dll_Ordinal_32
mov r12, r9
mov r14, rcx
xor eax, eax
xor byte [rbp + rax - 0x38], dl
inc rax
cmp rax, 2
jae 0x140057ce7
mov dl, byte [rbp - 0x39]
jmp 0x140057cd5
cvtss2sd xmm2, xmm2
lea rdx, [rbp - 0x38]
mov byte [rbp - 0x36], 0
lea rcx, [rbp - 0x31]
movq r8, xmm2
call fcn.14005b24c
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
mov rdx, rdi
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140057d7f
mov ecx, dword [r9 + 0x18]
test ecx, ecx
je 0x140057d7f
mov esi, dword [r9 + 0x20]
dec ecx
mov r11d, 0x674cc013
mov ebx, ecx
lea rax, [rsi + rcx*4]
mov r10d, dword [rax + r8]
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x140057d7b
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x140057d5b
cmp r11d, 0x17756557
je 0x140057df7
test ecx, ecx
jne 0x140057d3c
mov rax, qword [rdx]
mov rdx, rax
cmp rax, rdi
je 0x140057d91
cmp qword [rax + 0x30], 0
jne 0x140057d18
xor eax, eax
lea rdx, [r14 + 8]
cmp qword [rdx + 0x18], 0xf
jbe 0x140057da1
mov rdx, qword [rdx]
mov qword [rsp + 0x28], r12
lea r9, [rbp - 9]
lea r8, [rbp - 0x31]
mov dword [rsp + reloc.WLDAP32.dll_Ordinal_32], 0x20
mov rcx, r15
call rax
test eax, eax
lea rcx, [rbp - 9]
setne bl
xor edx, edx
call fcn.14005b304
movd xmm0, eax
mov al, bl
cvtdq2ps xmm0, xmm0
movss dword [r14], xmm0
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1400c1f80
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rbx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x140057d93
Function at 0x140057e14
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov rax, qword [0x140141480]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r15, rdx
mov dword [rbp - 0x39], 0x387451
mov dl, 0x51
mov r12, r9
mov r14, rcx
xor eax, eax
xor byte [rbp + rax - 0x38], dl
inc rax
cmp rax, 2
jae 0x140057e5f
mov dl, byte [rbp - 0x39]
jmp 0x140057e4d
lea rdx, [rbp - 0x38]
mov byte [rbp - 0x36], 0
lea rcx, [rbp - 0x31]
call fcn.14005b24c
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbx, qword [rax]
mov rdx, rbx
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140057eee
mov ecx, dword [r9 + 0x18]
test ecx, ecx
je 0x140057eee
mov esi, dword [r9 + 0x20]
dec ecx
mov r11d, 0xef9a4dee
mov edi, ecx
lea rax, [rsi + rcx*4]
mov r10d, dword [rax + r8]
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x140057eea
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x140057eca
cmp r11d, 0x8e25dc26
je 0x140057f5d
test ecx, ecx
jne 0x140057eab
mov rax, qword [rdx]
mov rdx, rax
cmp rax, rbx
je 0x140057f00
cmp qword [rax + 0x30], 0
jne 0x140057e87
xor eax, eax
lea rdx, [r14 + 8]
cmp qword [rdx + 0x18], 0xf
jbe 0x140057f10
mov rdx, qword [rdx]
mov qword [rsp + 0x28], r12
lea r9, [rbp - 9]
lea r8, [rbp - 0x31]
mov dword [rsp + reloc.WLDAP32.dll_Ordinal_32], 0x20
mov rcx, r15
call rax
test eax, eax
lea rcx, [rbp - 9]
setne bl
xor edx, edx
call fcn.14005b304
mov dword [r14], eax
mov al, bl
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1400c1f80
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdi*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x140057f02
Function at 0x140057f78
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140141480]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword gs:[0x60]
mov rdi, rcx
mov r14, rdx
mov r12, r9
mov r15, r8
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdx, rbp
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140058024
mov ecx, dword [r9 + 0x18]
test ecx, ecx
je 0x140058024
mov esi, dword [r9 + 0x20]
dec ecx
mov r11d, 0xc41f069b
mov ebx, ecx
lea rax, [rsi + rcx*4]
mov r10d, dword [rax + r8]
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x140058020
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x140057ffc
cmp r11d, 0x9e91a71f
je 0x1400580a5
test ecx, ecx
jne 0x140057fdd
mov rax, qword [rdx]
mov rdx, rax
cmp rax, rbp
je 0x140058036
cmp qword [rax + 0x30], 0
jne 0x140057fb9
xor eax, eax
lea rdx, [rdi + 0x20]
cmp qword [rdx + 0x18], 0xf
jbe 0x140058046
mov rdx, qword [rdx]
mov qword [rsp + 0x28], r12
lea r9, [rsp + 0x38]
mov r8, r15
mov dword [rsp + reloc.WLDAP32.dll_Ordinal_32], 0x20
mov rcx, r14
call rax
test eax, eax
lea rax, [rsp + 0x38]
setne bpl
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x14005806f
cmp rbx, qword [rdi + 0x18]
ja 0x1400580c2
cmp qword [rdi + 0x18], 0xf
mov rsi, rdi
jbe 0x14005808b
mov rsi, qword [rdi]
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x38]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], 0
jmp 0x1400580d7
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rbx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x140058038
mov r8b, byte [rsp + 0x30]
lea r9, [rsp + 0x38]
mov rdx, rbx
mov rcx, rdi
call fcn.140042214
mov al, bpl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400c1f80
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140059248
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140141480]
xor rax, rsp
mov qword [rbp - 8], rax
or esi, 0xffffffff
mov r14d, edx
mov rdi, rcx
cmp edx, esi
jne 0x140059282
xor eax, eax
jmp 0x1400593a1
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x1400592bb
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x1400592bb
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], r14b
mov eax, r14d
jmp 0x1400593a1
cmp qword [rdi + 0x80], 0
je 0x14005939f
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x1400592f5
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x140059316
movsx ecx, r14b
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, esi
jmp 0x14005939b
lea rax, [rbp - 0x38]
mov byte [rbp - 0x40], r14b
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x3f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x40]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140059364
sub eax, 1
je 0x140059364
cmp eax, 2
jne 0x14005939f
movsx ecx, byte [rbp - 0x40]
jmp 0x140059302
mov rbx, qword [rbp - 0x38]
lea rax, [rbp - 0x28]
sub rbx, rax
je 0x14005938f
mov r9, qword [rdi + 0x80]
lea rcx, [rbp - 0x28]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14005939f
lea rax, [rbp - 0x40]
mov byte [rdi + 0x71], 1
cmp qword [rbp - 0x30], rax
cmovne esi, r14d
mov eax, esi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400c1f80
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14005a578
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x140141480]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [rcx], 1
mov r12, r8
mov rax, qword gs:[0x60]
mov r15, rdx
mov r14, rcx
jne 0x14005a680
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x10]
mov r11, qword [rax]
mov rdx, r11
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14005a624
mov ecx, dword [r9 + 0x18]
test ecx, ecx
je 0x14005a624
mov esi, dword [r9 + 0x20]
dec ecx
mov ebx, 0x6d9e57e1
mov edi, ecx
lea rax, [rsi + rcx*4]
mov r10d, dword [rax + r8]
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x14005a620
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x14005a603
cmp ebx, 0x8647c014
je 0x14005a65c
test ecx, ecx
jne 0x14005a5e5
mov rax, qword [rdx]
mov rdx, rax
cmp rax, r11
je 0x14005a636
cmp qword [rax + 0x30], 0
jne 0x14005a5c1
xor r10d, r10d
mov cl, 0x18
mov dword [rbp - 0x10], 0x6d6a6c18
mov word [rbp - 0xc], 0x7d
xor eax, eax
xor byte [rbp + rax - 0xf], cl
inc rax
cmp rax, 4
jae 0x14005a677
mov cl, byte [rbp - 0x10]
jmp 0x14005a64a
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdi*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov r10d, dword [rcx + rdx*4]
add r10, r8
jmp 0x14005a639
mov byte [rbp - 0xb], 0
jmp 0x14005a74b
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r11, qword [rax]
mov rdx, r11
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14005a6f1
mov ecx, dword [r9 + 0x18]
test ecx, ecx
je 0x14005a6f1
mov esi, dword [r9 + 0x20]
dec ecx
mov ebx, 0xff279c5d
mov edi, ecx
lea rax, [r8 + rcx*4]
mov r10d, dword [rax + rsi]
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x14005a6ed
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x14005a6d0
cmp ebx, 0x4bff46f8
je 0x14005a72c
test ecx, ecx
jne 0x14005a6b2
mov rax, qword [rdx]
mov rdx, rax
cmp rax, r11
je 0x14005a703
cmp qword [rax + 0x30], 0
jne 0x14005a68e
xor r10d, r10d
xor eax, eax
mov dword [rbp - 0x10], 0x65686f09
mov byte [rbp - 0xa], al
mov cl, 9
mov word [rbp - 0xc], 0x6c7a
xor byte [rbp + rax - 0xf], cl
inc rax
cmp rax, 5
jae 0x14005a747
mov cl, byte [rbp - 0x10]
jmp 0x14005a71a
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdi*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov r10d, dword [rcx + rdx*4]
add r10, r8
jmp 0x14005a706
mov byte [rbp - 0xa], 0
lea rdx, [r14 + 8]
cmp qword [rdx + 0x18], 0xf
jbe 0x14005a759
mov rdx, qword [rdx]
mov r9, r12
lea r8, [rbp - 0xf]
mov rcx, r15
call r10
test eax, eax
setne al
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400c1f80
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14005a788
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140141480]
xor rax, rsp
mov qword [rbp - 0x10], rax
movss xmm2, dword [rcx]
mov r15, rdx
cvtps2pd xmm2, xmm2
mov r12, r8
mov dword [rbp - 0x40], 0x445b5075
mov r14, rcx
mov word [rbp - 0x3c], reloc.WS2_32.dll_send
mov dl, 0x75
xor eax, eax
xor byte [rbp + rax - 0x3f], dl
inc rax
cmp rax, 4
jae 0x14005a7db
mov dl, byte [rbp - 0x40]
jmp 0x14005a7c9
movq r8, xmm2
mov byte [rbp - 0x3b], 0
lea rdx, [rbp - 0x3f]
lea rcx, [rbp - 0x38]
call fcn.14005b24c
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
mov rdx, rdi
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14005a86f
mov ecx, dword [r9 + 0x18]
test ecx, ecx
je 0x14005a86f
mov esi, dword [r9 + 0x20]
dec ecx
mov r11d, 0xff837815
mov ebx, ecx
lea rax, [rsi + rcx*4]
mov r10d, dword [rax + r8]
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x14005a86b
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x14005a84b
cmp r11d, 0x6ea4740
je 0x14005a8bd
test ecx, ecx
jne 0x14005a82c
mov rax, qword [rdx]
mov rdx, rax
cmp rax, rdi
je 0x14005a881
cmp qword [rax + 0x30], 0
jne 0x14005a808
xor eax, eax
lea rdx, [r14 + 8]
cmp qword [rdx + 0x18], 0xf
jbe 0x14005a891
mov rdx, qword [rdx]
mov r9, r12
lea r8, [rbp - 0x38]
mov rcx, r15
call rax
test eax, eax
setne al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c1f80
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rbx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x14005a883
Function at 0x14005a8d8
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140141480]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, rdx
mov dword [rsp + 0x20], 0x7a3613
mov dl, reloc.WS2_32.dll_send
mov r15, r8
mov r14, rcx
xor eax, eax
xor byte [rsp + rax + 0x21], dl
inc rax
cmp rax, 2
jae 0x14005a91f
mov dl, byte [rsp + 0x20]
jmp 0x14005a90c
mov r8d, dword [rcx]
lea rdx, [rsp + 0x21]
lea rcx, [rsp + 0x28]
mov byte [rsp + 0x23], 0
call fcn.14005b24c
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbx, qword [rax]
mov rdx, rbx
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14005a9b4
mov ecx, dword [r9 + 0x18]
test ecx, ecx
je 0x14005a9b4
mov esi, dword [r9 + 0x20]
dec ecx
mov r11d, 0x6e7853f9
mov edi, ecx
lea rax, [rsi + rcx*4]
mov r10d, dword [rax + r8]
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x14005a9b0
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x14005a990
cmp r11d, 0x149157dc
je 0x14005aa09
test ecx, ecx
jne 0x14005a971
mov rax, qword [rdx]
mov rdx, rax
cmp rax, rbx
je 0x14005a9c6
cmp qword [rax + 0x30], 0
jne 0x14005a94d
xor eax, eax
lea rdx, [r14 + 8]
cmp qword [rdx + 0x18], 0xf
jbe 0x14005a9d6
mov rdx, qword [rdx]
mov r9, r15
lea r8, [rsp + 0x28]
mov rcx, rbp
call rax
test eax, eax
setne al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400c1f80
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdi*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x14005a9c8
Function at 0x14005aa24
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140141480]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [rcx + 0x18], 0xf
mov r15, r8
mov r8, rcx
mov rbp, rdx
mov rbx, rcx
jbe 0x14005aa59
mov r8, qword [rcx]
mov cl, 0x78
mov dword [rsp + 0x20], 0xb5d78
xor eax, eax
xor byte [rsp + rax + 0x21], cl
inc rax
cmp rax, 2
jae 0x14005aa78
mov cl, byte [rsp + 0x20]
jmp 0x14005aa65
lea rdx, [rsp + 0x21]
mov byte [rsp + 0x23], 0
lea rcx, [rsp + 0x28]
call fcn.14005b24c
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
mov rdx, rdi
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14005ab0a
mov ecx, dword [r9 + 0x18]
test ecx, ecx
je 0x14005ab0a
mov r14d, dword [r9 + 0x20]
dec ecx
mov r11d, 0x62528dbb
mov esi, ecx
lea rax, [r14 + rcx*4]
mov r10d, dword [rax + r8]
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x14005ab06
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x14005aae6
cmp r11d, 0xe42798b2
je 0x14005ab5f
test ecx, ecx
jne 0x14005aac7
mov rax, qword [rdx]
mov rdx, rax
cmp rax, rdi
je 0x14005ab1c
cmp qword [rax + 0x30], 0
jne 0x14005aaa3
xor eax, eax
lea rdx, [rbx + 0x20]
cmp qword [rdx + 0x18], 0xf
jbe 0x14005ab2c
mov rdx, qword [rdx]
mov r9, r15
lea r8, [rsp + 0x28]
mov rcx, rbp
call rax
test eax, eax
setne al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400c1f80
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rsi*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x14005ab1e