joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002c1b8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
mov rdi, rdx
movabs rcx, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r8 + r10 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 4
jb 0x14002c1d5
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14002c22d
cmp qword [rcx + rdx*8], r8
jne 0x14002c222
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x14002c226
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14002c23a
cmp qword [rcx + rdx*8], r8
jne 0x14002c23a
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov edx, 0x20
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r9 + 0x10]
call fcn.14002fd38
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14002c278
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r10]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x14002c2b0
mov r8, qword [r9 + 0x30]
and r8, rcx
mov rdi, qword [r9 + 8]
mov rax, r8
add rax, rax
mov rcx, qword [r9 + 0x18]
mov rdx, qword [rcx + rax*8]
cmp rdi, rdx
je 0x14002c33b
mov rdi, qword [rcx + rax*8 + 8]
mov rdi, qword [rdi]
cmp rdi, rdx
je 0x14002c33b
mov rdi, qword [rdi + 8]
mov eax, dword [rdi + 0x10]
cmp dword [r10], eax
jne 0x14002c2f5
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov edx, 0x20
mov rcx, rbx
call fcn.14002fd38
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14002c3d8
mov rax, qword [rbx]
cmp rdi, rax
je 0x14002c370
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov r10, r8
add r10, r10
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r10*8]
add r8, r8
cmp rax, qword [r9 + 8]
jne 0x14002c396
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14002c3c5
cmp rax, rdi
jne 0x14002c3a1
mov qword [rdx + r8*8], rbx
jmp 0x14002c3c5
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14002c3c5
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r10*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10*8 + 8], rcx
mov rcx, r9
call fcn.14002bfa4
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14002c950
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x140055910]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov ebx, dword [rcx + 0x24]
mov edi, 0x40
mov eax, ebx
mov rsi, rdx
and eax, 0x3f
mov r14, rcx
sub edi, eax
lea rcx, [rsp + 0x20]
cmp edi, 8
lea eax, [rdi + 0x40]
cmova eax, edi
xor edx, edx
mov edi, eax
lea r8d, [rax - 8]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov ecx, dword [r14 + 0x20]
lea rdx, [rsp + 0x20]
shl ecx, 3
mov eax, ebx
shr eax, 0x1d
mov r8d, edi
or ecx, eax
mov byte [rsp + 0x20], 0x80
bswap ecx
lea eax, [rbx*8]
mov dword [rsp + rdi + 0x18], ecx
bswap eax
mov rcx, r14
mov dword [rsp + rdi + 0x1c], eax
call fcn.14002c830
mov eax, dword [r14]
lea rdi, [r14 + 0x28]
bswap eax
mov dword [rsi], eax
mov ecx, 0x40
mov eax, dword [r14 + 4]
bswap eax
mov dword [rsi + 4], eax
mov eax, dword [r14 + 8]
bswap eax
mov dword [rsi + 8], eax
mov eax, dword [r14 + 0xc]
bswap eax
mov dword [rsi + 0xc], eax
mov eax, dword [r14 + 0x10]
bswap eax
mov dword [rsi + 0x10], eax
mov eax, dword [r14 + 0x14]
bswap eax
mov dword [rsi + 0x14], eax
mov eax, dword [r14 + 0x18]
bswap eax
mov dword [rsi + 0x18], eax
mov eax, dword [r14 + 0x1c]
bswap eax
mov dword [rsi + 0x1c], eax
xor eax, eax
mov dword [r14 + 0x24], eax
mov dword [r14], 0x6a09e667
mov dword [r14 + 4], 0xbb67ae85
mov dword [r14 + 8], 0x3c6ef372
mov dword [r14 + 0xc], 0xa54ff53a
mov dword [r14 + 0x10], 0x510e527f
mov dword [r14 + 0x14], 0x9b05688c
mov dword [r14 + 0x18], 0x1f83d9ab
mov qword [r14 + 0x1c], 0x5be0cd19
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14002fd10
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop r14
pop rdi
pop rsi
ret
Function at 0x14002d83c
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x140055910]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rsi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20a
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x105
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
nop dword [rax + rax]
test eax, eax
je 0x14002d95f
mov edx, 0x105
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchRemoveFileSpec]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jns 0x14002d8d8
mov edx, 0x267
mov rcx, qword [rsp + 0x248]
lea r8, str.onecoreenduserupgradeenablers_shellhelpers_servicehelpers.cpp
mov r9d, edi
call fcn.1400051e8
mov eax, edi
jmp 0x14002d964
mov r9, rsi
lea r8, [rsp + 0x20]
mov edx, 0x105
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombine]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jns 0x14002d903
mov edx, 0x268
jmp 0x14002d8ba
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFileExistsW]
nop dword [rax + rax]
test eax, eax
je 0x14002d944
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000d5fc
cmp qword [rbx + 0x18], 8
jb 0x14002d92f
mov rbx, qword [rbx]
mov r8, rbx
lea rdx, str.Found_existing_DLL:__s
xor ecx, ecx
call fcn.14000b12c
xor eax, eax
jmp 0x14002d964
cmp qword [rbx + 0x18], 8
jb 0x14002d94e
mov rbx, qword [rbx]
mov r8, rbx
lea rdx, str.Cound_not_find_DLL:__s
xor ecx, ecx
call fcn.14000b12c
mov eax, 2
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14002fd10
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14002ddbc
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
xor edi, edi
mov qword [rax - 0x40], rbx
mov r15, r9
mov r12, r8
mov r13, rdx
mov rbp, rcx
test rcx, rcx
jne 0x14002de02
mov ecx, 0x80070057
mov edi, ecx
call fcn.14000b750
jmp 0x14002df02
test r13, r13
je 0x14002ddf1
test r12, r12
je 0x14002ddf1
test r15, r15
je 0x14002ddf1
mov r14, qword [rsp + 0x90]
test r14, r14
je 0x14002ddf1
lea rdx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoSizeW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x14002de5b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
je 0x14002de5b
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
je 0x14002de5b
mov ecx, edi
jmp 0x14002ddf8
mov rdx, rsi
lea rcx, [rsp + 0x28]
call fcn.14002df38
mov rbx, qword [rsp + 0x28]
test rbx, rbx
jne 0x14002de79
mov edi, 0x8007000e
jmp 0x14002de57
mov r9, rbx
mov r8d, esi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoW]
nop dword [rax + rax]
test eax, eax
jne 0x14002debb
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14002deab
mov edi, 0x80004005
jmp 0x14002de57
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x14002de57
lea r9, [rsp + 0x20]
mov rcx, rbx
lea r8, [rsp + 0x30]
lea rdx, [0x140035e20]
call qword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
nop dword [rax + rax]
test eax, eax
je 0x14002de94
mov rdx, qword [rsp + 0x30]
movzx ecx, word [rdx + 0xa]
mov dword [r13], ecx
movzx ecx, word [rdx + 8]
mov dword [r12], ecx
movzx ecx, word [rdx + 0xe]
mov dword [r15], ecx
movzx ecx, word [rdx + 0xc]
mov dword [r14], ecx
mov ecx, edi
call fcn.14000b770
mov rcx, rbx
call fcn.14002fd38
lea r11, [rsp + 0x40]
mov eax, edi
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14002e39c
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x7f0]
sub rsp, 0x8f0
mov rax, qword [0x140055910]
xor rax, rsp
mov qword [rbp + 0x7e0], rax
mov rsi, rdx
lea rcx, [rsp + 0x74]
xor edx, edx
mov rdi, r8
lea r8d, [rdx + 0x64]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x68
xor eax, eax
lea rdx, str.ExecuteCommandLine:_started
xor ecx, ecx
mov qword [rsp + 0x68], rax
movups xmmword [rsp + 0x58], xmm0
call fcn.14000b12c
test rdi, rdi
jne 0x14002e415
mov ebx, 0x80070057
mov ecx, ebx
call fcn.14000b750
jmp 0x14002e517
mov r9, rsi
lea r8, [0x140045d50]
mov edx, 0x400
lea rcx, [rbp - 0x20]
call fcn.140003a5c
mov ebx, eax
test eax, eax
jns 0x14002e437
mov ecx, eax
jmp 0x14002e40b
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x20]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000020
and dword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
nop dword [rax + rax]
test eax, eax
jne 0x14002e4b3
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14002e409
mov rcx, qword [rsp + 0x58]
or edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeProcess]
nop dword [rax + rax]
test eax, eax
jne 0x14002e511
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
lea rdx, str.ExecuteCommandLine:_Failed_to_get_process_information
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14000afb0
mov ebx, eax
test eax, eax
js 0x14002e433
mov eax, dword [rsp + 0x50]
mov dword [rdi], eax
mov rcx, qword [rsp + 0x58]
cmp rcx, 0xffffffffffffffff
je 0x14002e52e
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
cmp rcx, 0xffffffffffffffff
je 0x14002e545
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
test ebx, ebx
jne 0x14002e54d
cmp dword [rdi], ebx
je 0x14002e55e
mov r8, rsi
lea rdx, str.ExecuteCommandLine:_There_was_a_problem_executing_the_command_line__s
mov ecx, ebx
call fcn.14000afb0
lea rdx, str.ExecuteCommandLine:_ended
mov ecx, ebx
call fcn.14000b12c
mov ecx, ebx
call fcn.14000b770
mov eax, ebx
mov rcx, qword [rbp + 0x7e0]
xor rcx, rsp
call fcn.14002fd10
mov rbx, qword [rsp + 0x910]
add rsp, 0x8f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002fd44
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140055f10], eax
call fcn.1400305f0
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140055f10], 0
jne case.default.0x14002fd9a
mov ecx, 1
call fcn.1400305f0
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
std
fsub qword [rdi]
and edi, dword [rdx - 0x51af3491]
or ecx, edi
invalid
sti
pushfq
jnp 0x1400889b7
stosd dword [rdi], eax
push rdx
mov ch, 0xb5
sbb ch, bh
xor ebp, dword [rdi + 0x227b66c]
popfq
jrcxz 0x1400889f3
xchg ecx, eax
mov eax, 0x91859103
sub ecx, esi
add edx, dword [rcx - 0xed66e7b]
invalid
Function at 0x14000c43c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140014c60], rbx
je 0x14000c4a3
cmp rax, rbx
jne 0x14000c496
mov ebx, 1
mov esi, ebx
jmp 0x14000c4a8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000c47b
mov ebx, 1
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c4c0
mov edi, 0x1f
mov ecx, edi
call fcn.140143000
jmp 0x14000c52c
mov eax, dword [0x140014c68]
test eax, eax
jne 0x14000c521
mov dword [0x140014c68], ebx
lea r15, [0x14000eba0]
lea rdi, [0x14000eb88]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000c513
test eax, eax
jne 0x14000c517
cmp qword [rdi], r14
je 0x14000c508
mov rax, qword [rdi]
mov rcx, qword [0x14000eb40]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000c4ea
test eax, eax
je 0x14000c527
mov eax, 0xff
jmp 0x14000c682
mov dword [0x1400143e4], ebx
mov edi, 0x1f
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c553
lea rdx, [0x14000eb80]
lea rcx, [0x14000eb48]
call sub.msvcrt.dll__initterm
mov dword [0x140014c68], 2
test esi, esi
jne 0x14000c561
mov rax, r14
xchg qword [0x140014c60], rax
cmp qword [0x140014c80], r14
je 0x14000c594
lea rcx, [0x140014c80]
call fcn.14000ca70
test eax, eax
je 0x14000c594
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140014c80]
mov r9, qword [0x14000eb40]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000c5ad
mov eax, 0xff
jmp 0x14000c682
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000c633
test ax, ax
je 0x14000c5c8
test edx, edx
jne 0x14000c633
sub ax, bx
cmp ax, di
ja 0x14000c5de
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000c5c8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001878
mov dword [0x1400143e0], eax
cmp dword [0x140014400], r14d
jne 0x14000c61c
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400143e4], r14d
jne 0x14000c631
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400143e0]
jmp 0x14000c682
cmp ax, 0x22
jne 0x14000c647
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c5b6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14000caf0
add rsp, 0x28
jmp 0x14000c43c
Function at 0x1400011a0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x870
mov rax, qword [0x14006a0d0]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov r13, qword [rsp + 0x8c8]
mov r14, rcx
mov dword [rsp + 0x24], r8d
xor ebp, ebp
mov dword [rsp + 0x28], edx
mov r8d, 0x401
mov qword [rsp + 0x38], rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov word [rsp + 0x20], r9w
mov r12d, ebp
call fcn.14002c2a0
xor edx, edx
lea rcx, [rsp + 0x450]
mov r8d, 0x401
call fcn.14002c2a0
lea rbx, [rsp + 0x40]
mov qword [rsp + 0x30], rbx
lea rdi, [rsp + 0x450]
lfence
mov r9d, 0x400
lea rcx, [rsp + 0x40]
mov r8, r14
lea edx, [r9 + 1]
call fcn.14003fd28
mov byte [rsp + 0x440], bpl
lea r15, [rbp - 1]
nop dword [rax]
nop dword [rax + rax]
mov rcx, r14
mov qword [r13], rbp
mov rsi, r13
mov byte [rdi], bpl
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov r14, rax
test rax, rax
je 0x1400013be
cmp word [rax + 0x10], 2
jne 0x1400012d7
cmp word [rax + 0x12], 4
jne 0x1400012d7
mov rbx, qword [rax + 0x18]
mov rax, qword [rbx]
test rax, rax
je 0x1400012d2
nop dword [rax]
mov r9d, dword [rax]
movzx r8d, word [rsp + 0x20]
mov edx, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x28]
call fcn.140001100
mov qword [rsi], rax
test rax, rax
je 0x1400013b7
add rbx, 8
lea rsi, [rax + 0x28]
mov rax, qword [rbx]
test rax, rax
jne 0x1400012a0
mov rbx, qword [rsp + 0x30]
lfence
mov r8, qword [r14]
mov r9d, 0x400
mov rcx, rdi
lea edx, [r9 + 1]
call fcn.14003fd28
mov byte [rdi + 0x400], bpl
cmp qword [r13], rbp
jne 0x140001360
mov rax, r15
nop
inc rax
cmp byte [rdi + rax], bpl
jne 0x140001300
test rax, rax
je 0x1400013d8
mov r8, rdi
mov rax, rbx
sub r8, rbx
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001333
inc rax
test ecx, ecx
jne 0x140001320
test edx, edx
je 0x1400013d8
inc r12d
cmp r12d, 0x10
je 0x1400013d8
mov r14, qword [rsp + 0x38]
mov rax, rbx
mov rbx, rdi
mov rdi, rax
mov qword [rsp + 0x30], rbx
jmp 0x140001260
cmp dword [rsp + 0x8c0], ebp
je 0x1400013eb
nop dword [rax]
cmp byte [rdi + r15 + 1], bpl
lea r15, [r15 + 1]
jne 0x140001370
lea rdx, [r15 + 1]
mov ecx, 1
call fcn.140030910
mov rbx, rax
test rax, rax
jne 0x140001396
mov rbx, rbp
jmp 0x1400013a5
mov r8, rdi
lea rdx, [r15 + 1]
mov rcx, rax
call fcn.140019be0
mov rax, qword [r13]
mov qword [rax + 0x18], rbx
mov rax, qword [r13]
cmp qword [rax + 0x18], rbp
jne 0x1400013eb
mov ebp, 8
jmp 0x1400013eb
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
sub ecx, 0x2af9
je 0x1400013e6
sub ecx, 1
je 0x1400013df
sub ecx, 1
jne 0x1400013e6
mov ebp, 0x2afb
jmp 0x1400013eb
mov ebp, 0x2afa
jmp 0x1400013eb
mov ebp, 0x2af9
mov eax, ebp
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.140029f00
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140001db0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov eax, dword [rdx]
mov rdi, r8
mov esi, r9d
mov r14, rdx
mov rbx, rcx
cmp eax, 0x14
jae 0x140001de2
mov eax, 0xfffffffc
jmp 0x140001e62
add eax, 0xfffffff4
lea rdx, [rsp + 0x48]
add rcx, 8
mov dword [rsp + 0x48], eax
mov r9d, esi
call fcn.14001a470
test eax, eax
jne 0x140001e62
xor eax, eax
xor r8d, r8d
mov qword [rbx], rax
mov edx, 0xffffffff
mov word [rbx + 8], ax
mov eax, 0x8b1f
mov word [rbx], ax
mov byte [rbx + 2], 8
test esi, esi
je 0x140001e4c
lea r10, [0x140060870]
nop word [rax + rax]
movzx ecx, byte [r8 + rdi]
mov eax, edx
xor rcx, rax
shr edx, 8
movzx eax, cl
inc r8
xor edx, dword [r10 + rax*4]
cmp r8, rsi
jb 0x140001e30
mov ecx, dword [rsp + 0x48]
not edx
mov dword [rcx + rbx + 4], edx
lea eax, [rcx + 0xc]
mov dword [rcx + rbx + 8], esi
mov dword [r14], eax
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140002440
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x100
mov rax, qword [0x14006a0d0]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
test r8, r8
je 0x1400025db
test rdx, rdx
je 0x1400025d7
lea rcx, str._Weve_all_heard_that_a_million_monkeys_banging_on_a_million_typewriters_will_eventually_reproduce_the_entire_works_of_Shakespeare._Now__thanks_to_the_Internet__we_know_this_is_not_true._____Robert_Wilensky
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x20]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
mov rax, qword [rcx + 0x40]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x10], xmm0
movups xmm0, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm1
movups xmm1, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm1
movups xmmword [rdx + 0x30], xmm0
mov qword [rdx + 0x40], rax
mov eax, dword [rcx + 0x48]
mov dword [rdx + 0x48], eax
movzx eax, word [rcx + 0x4c]
mov word [rdx + 0x4c], ax
movzx eax, byte [rcx + 0x4e]
mov rcx, 0xffffffffffffffff
mov byte [rdx + 0x4e], al
lea rax, [rsp + 0x20]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140002517
test r9d, r9d
je 0x1400025be
test rsi, rsi
je 0x1400025be
cmp dword [rsp + 0x148], 0
je 0x140002575
mov r10, qword [rsp + 0x140]
mov r8, rdi
sub r10, rdi
mov r9, rsi
nop dword [rax]
lea rax, [r10 + r8]
xor edx, edx
div rcx
movzx eax, byte [r8]
lea r8, [r8 + 1]
xor al, 0xa5
add al, 0x54
xor al, byte [rsp + rdx + 0x20]
mov byte [r8 - 1], al
sub r9, 1
jne 0x140002550
jmp 0x1400025be
mov qword [rsp + 0x138], rbx
mov r9, rdi
mov rbx, qword [rsp + 0x140]
mov r11, rsi
sub rbx, rdi
nop
movzx r10d, byte [r9]
lea rax, [r9 + rbx]
xor edx, edx
div rcx
movzx eax, byte [rsp + rdx + 0x20]
cmp r10b, al
je 0x1400025ad
xor al, r10b
mov byte [r9], al
inc r9
sub r11, 1
jne 0x140002590
mov rbx, qword [rsp + 0x138]
mov r8, rsi
mov rdx, rdi
mov rcx, rbp
call fcn.140017530
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
jmp 0x1400025e0
xor eax, eax
jmp 0x1400025e0
mov eax, 1
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140029f00
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret