joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007cf50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rsi, qword [rdx + 0x10]
xor edi, edi
mov rax, qword [rdx]
mov r15, r8
mov r14, rdx
mov rbx, rcx
lea rbp, [rsi + rax*8]
cmp rsi, rbp
je 0x14007cfc0
mov rdx, qword [rsi]
mov rcx, rbx
mov rax, qword [rbx]
mov r9, qword [rdx + 0x18]
mov r8, qword [rdx + 8]
mov rdx, qword [rdx]
call qword [rax + 0x18]
mov rdx, qword [rsi]
mov rcx, rbx
mov rax, qword [rbx]
mov qword [rsp + 0x20], rdi
movzx r9d, byte [rdx + 0x10]
mov r8, qword [rdx + 8]
mov rdx, qword [rdx]
call qword [rax + 0x20]
add rsi, 8
cmp rsi, rbp
jne 0x14007cf83
test byte [r15], 0x10
mov rsi, rdi
je 0x14007d11a
mov rax, qword [rbx]
xor r9d, r9d
mov rcx, rbx
lea edx, [r9 + 0x38]
lea r8d, [r9 + 0x40]
call qword [rax + ioctlsocket]
mov rsi, rax
rdtsc
mov rcx, qword [0x140143788]
shl rdx, 0x20
or rax, rdx
movabs rdx, 0x61c8864680b583eb
sub rcx, rdx
mov qword [0x140143788], rcx
lea rdx, [rcx + rax]
movabs rax, 0xbf58476d1ce4e5b9
mov rcx, rdx
shr rcx, 0x1e
xor rcx, rdx
imul rcx, rax
movabs rax, 0x94d049bb133111eb
mov rdx, rcx
shr rdx, 0x1b
xor rdx, rcx
imul rdx, rax
mov rax, rdx
shr rax, 0x1f
xor ax, dx
mov word [rsp + 0x30], ax
mov eax, dword [r15 + 8]
mov dword [rsp + 0x34], eax
mov eax, dword [r15 + 4]
mov dword [rsp + 0x38], eax
movabs rax, 0x19db1ded53e8000
mov rcx, qword [0x7ffe0014]
sub rcx, rax
movabs rax, 0xd6bf94d5e57a42bd
mul rcx
shr rdx, 0x17
mov qword [rsp + 0x48], rdx
mov rdx, rdi
mov eax, dword [0x7ffe0004]
imul rax, qword [0x7ffe0320]
shr rax, 0x18
mov qword [rsp + 0x40], rax
mov rax, qword [r14 + 0x38]
mov qword [rsp + 0x50], rax
mov rax, qword [r14 + 0x40]
mov qword [rsp + 0x58], rax
mov eax, dword [r14 + 0x48]
mov dword [rsp + 0x60], eax
mov rax, qword gs:[0x30]
mov dword [rsp + 0x90], 0x1b51ad56
mov ecx, dword [rax + 0x40]
mov dword [rsp + 0x64], ecx
nop word [rax + rax]
mov rcx, rdx
mov eax, 0x38
sub al, dil
and ecx, 3
inc edi
xor al, byte [rsp + rcx + 0x90]
xor byte [rsp + rdx + 0x30], al
inc rdx
cmp edi, 0x38
jb 0x14007d0e0
mov rax, qword [rbx]
lea r9, [rsp + 0x30]
mov r8d, 0x38
mov rdx, rsi
mov rcx, rbx
call qword [rax + 0x18]
mov rax, qword [rbx]
mov rcx, rbx
mov rdx, qword [r14 + 0x28]
call qword [rax + 0x48]
mov rdx, qword [r14 + 0x60]
test rdx, rdx
je 0x14007d139
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x58]
mov rdx, qword [r14 + 0x50]
test rdx, rdx
je 0x14007d14b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x60]
mov rdx, qword [r14 + 0x58]
test rdx, rdx
je 0x14007d15d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x68]
mov rdx, qword [r14 + 0x20]
test rdx, rdx
je 0x14007d176
mov rax, qword [rbx]
mov r9, rsi
mov r8, qword [r14 + 0x28]
mov rcx, rbx
call qword [rax + 0x30]
mov rax, qword [rbx]
mov rcx, rbx
mov rdx, qword [r14 + 0x28]
call qword [rax + 0x50]
lea r11, [rsp + 0x70]
mov al, 1
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14007d1a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push r12
sub rsp, 0x40
mov rdx, qword [0x140143910]
xor r8d, r8d
mov r12, rcx
mov eax, 0x80b0be80
test rdx, rdx
jne 0x14007d26f
mov r9, qword [0x1401436b0]
mov edx, r8d
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
test r9, r9
je 0x14007d220
mov rbx, qword [0x1401436a8]
nop word [rax + rax]
cmp dword [rbx + 0x20], 0x2489d460
je 0x14007d29c
inc edx
add rbx, 0x28
movsxd rax, edx
cmp rax, r9
jb 0x14007d200
mov eax, 0x80b0be80
mov dword [0x140143468], 0x12
mov byte [0x140143245], r8b
mov rdx, r8
mov qword [0x140143470], r8
mov qword [0x140143478], r8
mov r15, qword [rsp + 0x20]
xor rdx, rax
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov qword [0x140143910], rdx
xor rdx, rax
jne 0x14007d3b6
mov dword [0x140143468], 0x14
mov byte [0x140143245], r8b
mov qword [0x140143470], r8
mov qword [0x140143478], r8
jmp 0x14007d3b9
mov rsi, qword [rbx + 0x10]
mov edi, r8d
movsxd r15, dword [rsi + 0x3c]
add r15, rsi
mov r13d, dword [r15 + 0x88]
add r13, rsi
mov r14d, dword [r13 + 0x20]
mov ebp, dword [r13 + 0x18]
add r14, rsi
test ebp, ebp
je 0x14007d327
nop dword [rax]
nop word [rax + rax]
mov eax, edi
movsxd r9, dword [r14 + rax*4]
mov rax, r8
add r9, rsi
cmp byte [r9], al
je 0x14007d2ea
inc rax
cmp byte [rax + r9], r8b
jne 0x14007d2e1
mov r11d, r8d
mov r10d, r8d
test rax, rax
je 0x14007d321
mov rcx, r8
nop dword [rax + rax]
movsx edx, byte [rcx + r9]
inc r10d
imul ecx, r11d, 0x1f
add edx, ecx
mov ecx, r10d
mov r11d, edx
cmp rcx, rax
jb 0x14007d300
cmp edx, 0xa4396ae0
je 0x14007d33b
inc edi
cmp edi, ebp
jb 0x14007d2d0
mov dword [0x140143468], 0x13
mov eax, 0x80b0be80
jmp 0x14007d22a
cmp di, 0xffff
je 0x14007d327
mov eax, dword [r13 + 0x24]
add rax, rsi
movsx rcx, di
movsx rdx, word [rax + rcx*2]
mov ecx, dword [r13 + 0x1c]
add rcx, rsi
mov edx, dword [rcx + rdx*4]
add rdx, rsi
cmp rdx, r13
jb 0x14007d37c
mov eax, dword [r15 + 0x8c]
mov ecx, dword [r15 + 0x88]
add rax, rcx
add rax, rsi
cmp rdx, rax
jbe 0x14007d327
cmp rdx, rsi
jb 0x14007d327
mov eax, dword [r15 + 0x50]
add rax, rsi
cmp rdx, rax
ja 0x14007d327
test rdx, rdx
je 0x14007d327
mov rcx, qword [rbx + 0x18]
mov eax, 0x80b0be80
add rcx, rsi
cmp rdx, rcx
jbe 0x14007d242
mov dword [0x140143468], 0x15
jmp 0x14007d22a
mov r8, rdx
mov edx, dword [r12 + 0x28]
mov rcx, qword [r12 + 0x48]
call r8
test eax, eax
setne al
add rsp, 0x40
pop r12
ret
Function at 0x14007e1c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push r15
sub rsp, 0x40
cmp qword [rcx + 8], 0
mov r15, rcx
je 0x14007e3f4
mov rdx, qword [0x140143870]
xor r8d, r8d
test rdx, rdx
jne 0x14007e28e
mov r9, qword [0x1401436b0]
mov edx, r8d
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax - 0x10], rdi
mov qword [rax - 0x18], r12
mov qword [rax - 0x20], r13
mov qword [rax - 0x28], r14
test r9, r9
je 0x14007e23b
mov rbx, qword [0x1401436a8]
nop dword [rax]
cmp dword [rbx + 0x20], 0x2489d460
je 0x14007e2cd
inc edx
add rbx, 0x28
movsxd rax, edx
cmp rax, r9
jb 0x14007e220
mov dword [0x140143468], 0x12
mov byte [0x140143245], r8b
mov rdx, r8
mov qword [0x140143470], r8
mov qword [0x140143478], r8
mov r14, qword [rsp + 0x20]
xor rdx, 0x6ea5dc67
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov qword [0x140143870], rdx
xor rdx, 0x6ea5dc67
jne 0x14007e3de
mov dword [0x140143468], 0x14
mov byte [0x140143245], r8b
mov qword [0x140143470], r8
mov qword [0x140143478], r8
mov rcx, qword [r15 + 8]
call r8
test eax, eax
setne al
add rsp, 0x40
pop r15
ret
mov rsi, qword [rbx + 0x10]
mov edi, r8d
movsxd r13, dword [rsi + 0x3c]
add r13, rsi
mov r12d, dword [r13 + 0x88]
add r12, rsi
mov r14d, dword [r12 + 0x20]
mov ebp, dword [r12 + 0x18]
add r14, rsi
test ebp, ebp
je 0x14007e357
nop word [rax + rax]
mov eax, edi
movsxd r9, dword [r14 + rax*4]
mov rax, r8
add r9, rsi
cmp byte [r9], al
je 0x14007e31a
inc rax
cmp byte [rax + r9], r8b
jne 0x14007e311
mov r11d, r8d
mov r10d, r8d
test rax, rax
je 0x14007e351
mov rcx, r8
nop dword [rax + rax]
movsx edx, byte [rcx + r9]
inc r10d
imul ecx, r11d, 0x1f
add edx, ecx
mov ecx, r10d
mov r11d, edx
cmp rcx, rax
jb 0x14007e330
cmp edx, 0x4a2c0807
je 0x14007e366
inc edi
cmp edi, ebp
jb 0x14007e300
mov dword [0x140143468], 0x13
jmp 0x14007e245
cmp di, 0xffff
je 0x14007e357
mov eax, dword [r12 + 0x24]
add rax, rsi
movsx rcx, di
movsx rdx, word [rax + rcx*2]
mov ecx, dword [r12 + 0x1c]
add rcx, rsi
mov edx, dword [rcx + rdx*4]
add rdx, rsi
cmp rdx, r12
jb 0x14007e3a9
mov eax, dword [r13 + 0x8c]
mov ecx, dword [r13 + 0x88]
add rax, rcx
add rax, rsi
cmp rdx, rax
jbe 0x14007e357
cmp rdx, rsi
jb 0x14007e357
mov eax, dword [r13 + 0x50]
add rax, rsi
cmp rdx, rax
ja 0x14007e357
test rdx, rdx
je 0x14007e357
mov rcx, qword [rbx + 0x18]
add rcx, rsi
cmp rdx, rcx
jbe 0x14007e25d
mov dword [0x140143468], 0x15
jmp 0x14007e245
mov rcx, qword [r15 + 8]
mov r8, rdx
call r8
test eax, eax
setne al
add rsp, 0x40
pop r15
ret
movzx eax, byte [rcx + 0x2c]
add rsp, 0x40
pop r15
ret
Function at 0x14007f320
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
sub rsp, 0x48
mov rdx, qword [0x1401439d0]
xor r8d, r8d
mov eax, 0xdde3ebbc
test rdx, rdx
jne 0x14007f3f4
mov rdx, qword [0x1401436b0]
mov ecx, r8d
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 - 8], rdi
mov qword [r11 - 0x10], r12
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
test rdx, rdx
je 0x14007f3a0
mov rbx, qword [0x1401436a8]
nop word [rax + rax]
cmp dword [rbx + 0x20], 0x1a6c9752
je 0x14007f427
inc ecx
add rbx, 0x28
movsxd rax, ecx
cmp rax, rdx
jb 0x14007f380
mov eax, 0xdde3ebbc
mov dword [0x140143468], 0x12
mov byte [0x140143245], r8b
mov rdx, r8
mov qword [0x140143470], r8
mov qword [0x140143478], r8
mov r15, qword [rsp + 0x20]
xor rdx, rax
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov qword [0x1401439d0], rdx
xor rdx, rax
jne 0x14007f531
lea rcx, [rdx - 1]
mov dword [0x140143468], 0x14
mov byte [0x140143245], r8b
mov qword [0x140143470], r8
mov qword [0x140143478], r8
add rsp, 0x48
jmp r8
mov rsi, qword [rbx + 0x10]
mov edi, r8d
movsxd r15, dword [rsi + 0x3c]
mov r12d, dword [r15 + rsi + 0x88]
mov r14d, dword [r12 + rsi + 0x20]
lea r13, [r12 + rsi]
mov ebp, dword [r13 + 0x18]
add r14, rsi
test ebp, ebp
je 0x14007f4a7
nop
mov eax, edi
movsxd r9, dword [r14 + rax*4]
mov rax, r8
add r9, rsi
cmp byte [r9], al
je 0x14007f46a
inc rax
cmp byte [rax + r9], r8b
jne 0x14007f461
mov r11d, r8d
mov r10d, r8d
test rax, rax
je 0x14007f4a1
mov rcx, r8
nop dword [rax + rax]
movsx edx, byte [rcx + r9]
inc r10d
imul ecx, r11d, 0x1f
add edx, ecx
mov ecx, r10d
mov r11d, edx
cmp rcx, rax
jb 0x14007f480
cmp edx, 0xc78f7cee
je 0x14007f4bb
inc edi
cmp edi, ebp
jb 0x14007f450
mov dword [0x140143468], 0x13
mov eax, 0xdde3ebbc
jmp 0x14007f3aa
cmp di, 0xffff
je 0x14007f4a7
mov eax, dword [r13 + 0x24]
add rax, rsi
movsx rcx, di
movsx rdx, word [rax + rcx*2]
mov ecx, dword [r13 + 0x1c]
add rcx, rsi
mov edx, dword [rcx + rdx*4]
add rdx, rsi
cmp rdx, r13
jb 0x14007f4f6
mov eax, dword [r15 + rsi + 0x8c]
add rax, r12
add rax, rsi
cmp rdx, rax
jbe 0x14007f4a7
cmp rdx, rsi
jb 0x14007f4a7
mov eax, dword [r15 + rsi + 0x50]
add rax, rsi
cmp rdx, rax
ja 0x14007f4a7
test rdx, rdx
je 0x14007f4a7
mov rcx, qword [rbx + 0x18]
mov eax, 0xdde3ebbc
add rcx, rsi
cmp rdx, rcx
jbe 0x14007f3c2
mov dword [0x140143468], 0x15
jmp 0x14007f3aa
mov r8, rdx
xor edx, edx
lea rcx, [rdx - 1]
add rsp, 0x48
jmp r8
Function at 0x1400891f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x178]
sub rsp, 0x278
mov rsi, rcx
lea rcx, [0x1400c2820]
jmp 0x1406f8bc3

Function at 0x14008a020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push r12
sub rsp, 0x30
mov rbp, rdx
mov r12, rcx
test rdx, rdx
je 0x14008a277
mov r8, qword [0x140143798]
xor r9d, r9d
mov eax, 0xcff20a67
test r8, r8
jne 0x14008a0e6
mov r10, qword [0x1401436b0]
mov r8d, r9d
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
test r10, r10
je 0x14008a0a1
mov rbx, qword [0x1401436a8]
nop
cmp dword [rbx + 0x20], 0x2fb2e854
je 0x14008a113
inc r8d
add rbx, 0x28
movsxd rax, r8d
cmp rax, r10
jb 0x14008a080
mov eax, 0xcff20a67
mov dword [0x140143468], 0x12
mov byte [0x140143245], r9b
mov r8, r9
mov qword [0x140143470], r9
mov qword [0x140143478], r9
mov r15, qword [rsp + 0x20]
xor r8, rax
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov qword [0x140143798], r8
xor r8, rax
jne 0x14008a22d
mov dword [0x140143468], 0x14
mov byte [0x140143245], r9b
mov qword [0x140143470], r9
mov qword [0x140143478], r9
jmp 0x14008a230
mov rsi, qword [rbx + 0x10]
mov edi, r9d
movsxd r13, dword [rsi + 0x3c]
add r13, rsi
mov eax, dword [r13 + 0x88]
mov r15d, dword [rax + rsi + 0x20]
mov r14d, dword [rax + rsi + 0x18]
add r15, rsi
test r14d, r14d
je 0x14008a198
nop word [rax + rax]
mov eax, edi
movsxd r8, dword [r15 + rax*4]
mov rax, r9
add r8, rsi
cmp byte [r8], al
je 0x14008a15a
inc rax
cmp byte [rax + r8], r9b
jne 0x14008a151
mov r11d, r9d
mov r10d, r9d
test rax, rax
je 0x14008a191
mov rcx, r9
nop dword [rax + rax]
movsx edx, byte [rcx + r8]
inc r10d
imul ecx, r11d, 0x1f
add edx, ecx
mov ecx, r10d
mov r11d, edx
cmp rcx, rax
jb 0x14008a170
cmp edx, 0xe040e233
je 0x14008a1ac
inc edi
cmp edi, r14d
jb 0x14008a140
mov dword [0x140143468], 0x13
mov eax, 0xcff20a67
jmp 0x14008a0ab
cmp di, 0xffff
je 0x14008a198
mov r11d, dword [r13 + 0x88]
mov eax, dword [r11 + rsi + 0x24]
lea r10, [r11 + rsi]
add rax, rsi
movsx rcx, di
movsx rdx, word [rax + rcx*2]
mov ecx, dword [r10 + 0x1c]
add rcx, rsi
mov r8d, dword [rcx + rdx*4]
add r8, rsi
cmp r8, r10
jb 0x14008a1f3
mov eax, dword [r13 + 0x8c]
add rax, r11
add rax, rsi
cmp r8, rax
jbe 0x14008a198
cmp r8, rsi
jb 0x14008a198
mov eax, dword [r13 + 0x50]
add rax, rsi
cmp r8, rax
ja 0x14008a198
test r8, r8
je 0x14008a198
mov rcx, qword [rbx + 0x18]
mov eax, 0xcff20a67
add rcx, rsi
cmp r8, rcx
jbe 0x14008a0c3
mov dword [0x140143468], 0x15
jmp 0x14008a0ab
mov r9, r8
mov rax, qword gs:[0x30]
lea r8, [rbp + 1]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call r9
mov rbx, rax
test rax, rax
je 0x14008a277
mov rdx, qword [r12 + 8]
mov r8, rbp
mov rcx, rax
call fcn.1400a50b0
mov byte [rbx + rbp], 0
mov rax, rbx
add qword [r12 + 8], rbp
add rsp, 0x30
pop r12
pop rbp
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop r12
pop rbp
pop rbx
ret
Function at 0x14008acc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x30
mov rax, qword [rcx + 8]
xor r9d, r9d
mov r15, rcx
movzx r8d, byte [rax]
inc rax
mov qword [rcx + 8], rax
mov eax, 0xcff20a67
mov rdx, qword [0x140143798]
mov byte [rsp + 0x50], r8b
test rdx, rdx
jne 0x14008ad9b
mov r8, qword [0x1401436b0]
mov edx, r9d
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
test r8, r8
je 0x14008ad50
mov rbx, qword [0x1401436a8]
nop word [rax + rax]
cmp dword [rbx + 0x20], 0x2fb2e854
je 0x14008adc8
inc edx
add rbx, 0x28
movsxd rax, edx
cmp rax, r8
jb 0x14008ad30
mov eax, 0xcff20a67
mov dword [0x140143468], 0x12
mov byte [0x140143245], r9b
mov rdx, r9
mov qword [0x140143470], r9
mov qword [0x140143478], r9
movzx r8d, byte [rsp + 0x50]
xor rdx, rax
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov qword [0x140143798], rdx
xor rdx, rax
jne 0x14008aed8
mov dword [0x140143468], 0x14
mov byte [0x140143245], r9b
mov qword [0x140143470], r9
mov qword [0x140143478], r9
jmp 0x14008aedb
mov rsi, qword [rbx + 0x10]
mov edi, r9d
movsxd r13, dword [rsi + 0x3c]
add r13, rsi
mov r12d, dword [r13 + 0x88]
add r12, rsi
mov r14d, dword [r12 + 0x20]
mov ebp, dword [r12 + 0x18]
add r14, rsi
test ebp, ebp
je 0x14008ae47
mov eax, edi
movsxd r8, dword [r14 + rax*4]
mov rax, r9
add r8, rsi
cmp byte [r8], al
je 0x14008ae0b
inc rax
cmp byte [rax + r8], r9b
jne 0x14008ae02
mov r11d, r9d
mov r10d, r9d
test rax, rax
je 0x14008ae41
mov rcx, r9
nop dword [rax]
movsx edx, byte [rcx + r8]
inc r10d
imul ecx, r11d, 0x1f
add edx, ecx
mov ecx, r10d
mov r11d, edx
cmp rcx, rax
jb 0x14008ae20
cmp edx, 0xe040e233
je 0x14008ae5b
inc edi
cmp edi, ebp
jb 0x14008adf1
mov dword [0x140143468], 0x13
mov eax, 0xcff20a67
jmp 0x14008ad5a
cmp di, 0xffff
je 0x14008ae47
mov eax, dword [r12 + 0x24]
add rax, rsi
movsx rcx, di
movsx rdx, word [rax + rcx*2]
mov ecx, dword [r12 + 0x1c]
add rcx, rsi
mov edx, dword [rcx + rdx*4]
add rdx, rsi
cmp rdx, r12
jb 0x14008ae9e
mov eax, dword [r13 + 0x8c]
mov ecx, dword [r13 + 0x88]
add rax, rcx
add rax, rsi
cmp rdx, rax
jbe 0x14008ae47
cmp rdx, rsi
jb 0x14008ae47
mov eax, dword [r13 + 0x50]
add rax, rsi
cmp rdx, rax
ja 0x14008ae47
test rdx, rdx
je 0x14008ae47
mov rcx, qword [rbx + 0x18]
mov eax, 0xcff20a67
add rcx, rsi
cmp rdx, rcx
jbe 0x14008ad72
mov dword [0x140143468], 0x15
jmp 0x14008ad5a
mov r9, rdx
mov rax, qword gs:[0x30]
xor edx, edx
movzx edi, r8b
mov rcx, qword [rax + 0x60]
lea r8, [rdi + 1]
mov rcx, qword [rcx + 0x30]
call r9
mov rdx, qword [r15 + 8]
mov r8d, edi
mov rcx, rax
mov rbx, rax
call fcn.1400a50b0
mov byte [rdi + rbx], 0
mov rax, rbx
add qword [r15 + 8], rdi
add rsp, 0x30
pop r15
pop rdi
pop rbx
ret
Function at 0x14008af20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
mov r13, rdx
lea rcx, [0x1400c27e8]
jmp 0x1406fa260
Function at 0x1400911b0
Capabilities:
Check http status code
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x290]
sub rsp, 0x390
lea rcx, [0x1400c2680]
jmp 0x1406fb027

Function at 0x1400939e0
Capabilities:
Check for peb beingdebugged flag
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x500
lea rcx, [0x1400c26a0]
jmp 0x1406ffcd9
Function at 0x14009b2f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
sub rsp, 0x58
mov r8, qword [0x140143908]
xor r9d, r9d
mov rax, rdx
mov edx, 0x828bc562
test r8, r8
jne 0x14009b3ca
mov r10, qword [0x1401436b0]
mov r8d, r9d
mov qword [r11 + 0x18], rbx
mov qword [r11 - 8], rbp
mov qword [r11 - 0x10], rsi
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
test r10, r10
je 0x14009b36c
mov rbx, qword [0x1401436a8]
cmp dword [rbx + 0x20], 0x2489d460
je 0x14009b400
inc r8d
add rbx, 0x28
movsxd rax, r8d
cmp rax, r10
jb 0x14009b350
mov dword [0x140143468], 0x12
mov byte [0x140143245], r9b
mov r8, r9
mov qword [0x140143470], r9
mov qword [0x140143478], r9
mov rax, qword [rsp + 0x68]
xor r8, rdx
mov rcx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x70]
mov qword [0x140143908], r8
xor r8, rdx
jne 0x14009b512
mov dword [0x140143468], 0x14
mov rdx, rax
mov byte [0x140143245], r9b
mov qword [0x140143470], r9
mov qword [0x140143478], r9
mov rcx, qword [rcx + 8]
add rsp, 0x58
jmp r9
mov rsi, qword [rbx + 0x10]
mov edi, r9d
movsxd r15, dword [rsi + 0x3c]
mov r12d, dword [r15 + rsi + 0x88]
mov r14d, dword [r12 + rsi + 0x20]
lea r13, [r12 + rsi]
mov ebp, dword [r13 + 0x18]
add r14, rsi
test ebp, ebp
je 0x14009b48c
nop word [rax + rax]
mov eax, edi
movsxd r8, dword [r14 + rax*4]
mov rax, r9
add r8, rsi
cmp byte [r8], al
je 0x14009b44a
inc rax
cmp byte [rax + r8], r9b
jne 0x14009b441
mov r11d, r9d
mov r10d, r9d
test rax, rax
je 0x14009b481
mov rcx, r9
nop dword [rax + rax]
movsx edx, byte [rcx + r8]
inc r10d
imul ecx, r11d, 0x1f
add edx, ecx
mov ecx, r10d
mov r11d, edx
cmp rcx, rax
jb 0x14009b460
cmp edx, 0xa6021102
je 0x14009b49b
inc edi
cmp edi, ebp
jb 0x14009b430
mov edx, 0x828bc562
mov dword [0x140143468], 0x13
jmp 0x14009b376
cmp di, 0xffff
je 0x14009b487
mov eax, dword [r13 + 0x24]
add rax, rsi
movsx rcx, di
movsx rdx, word [rax + rcx*2]
mov ecx, dword [r13 + 0x1c]
add rcx, rsi
mov r8d, dword [rcx + rdx*4]
add r8, rsi
cmp r8, r13
jb 0x14009b4d7
mov eax, dword [r15 + rsi + 0x8c]
add rax, r12
add rax, rsi
cmp r8, rax
jbe 0x14009b487
cmp r8, rsi
jb 0x14009b487
mov eax, dword [r15 + rsi + 0x50]
add rax, rsi
cmp r8, rax
ja 0x14009b487
mov edx, 0x828bc562
test r8, r8
je 0x14009b48c
mov rcx, qword [rbx + 0x18]
add rcx, rsi
cmp r8, rcx
jbe 0x14009b38e
mov dword [0x140143468], 0x15
jmp 0x14009b376
mov rcx, qword [rcx + 8]
mov r9, r8
mov rdx, rax
add rsp, 0x58
jmp r9
Function at 0x14009b770
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x10], dl
mov r11, rsp
push r13
sub rsp, 0x40
cmp qword [rcx + 8], 0
movzx eax, dl
mov r13, rcx
mov byte [rcx + 0x2c], dl
je 0x14009b9ac
mov r8, qword [0x140143878]
xor r9d, r9d
mov ecx, 0x8ff80713
test r8, r8
jne 0x14009b850
mov rdx, qword [0x1401436b0]
mov r8d, r9d
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x18], r12
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
test rdx, rdx
je 0x14009b7fc
mov rbx, qword [0x1401436a8]
nop dword [rax + rax]
cmp dword [rbx + 0x20], 0x2489d460
je 0x14009b888
inc r8d
add rbx, 0x28
movsxd rax, r8d
cmp rax, rdx
jb 0x14009b7e0
mov dword [0x140143468], 0x12
mov byte [0x140143245], r9b
mov r8, r9
mov qword [0x140143470], r9
mov qword [0x140143478], r9
movzx eax, byte [rsp + 0x58]
xor r8, rcx
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov qword [0x140143878], r8
xor r8, rcx
jne 0x14009b999
mov dword [0x140143468], 0x14
mov byte [0x140143245], r9b
mov qword [0x140143470], r9
mov qword [0x140143478], r9
mov rcx, qword [r13 + 8]
movzx edx, al
add rsp, 0x40
pop r13
jmp r9
mov rsi, qword [rbx + 0x10]
mov edi, r9d
movsxd r15, dword [rsi + 0x3c]
add r15, rsi
mov r12d, dword [r15 + 0x88]
add r12, rsi
mov r14d, dword [r12 + 0x20]
mov ebp, dword [r12 + 0x18]
add r14, rsi
test ebp, ebp
je 0x14009b90c
mov eax, edi
movsxd r8, dword [r14 + rax*4]
mov rax, r9
add r8, rsi
cmp byte [r8], al
je 0x14009b8cb
inc rax
cmp byte [rax + r8], r9b
jne 0x14009b8c2
mov r11d, r9d
mov r10d, r9d
test rax, rax
je 0x14009b901
mov rcx, r9
nop dword [rax]
movsx edx, byte [rcx + r8]
inc r10d
imul ecx, r11d, 0x1f
add edx, ecx
mov ecx, r10d
mov r11d, edx
cmp rcx, rax
jb 0x14009b8e0
cmp edx, 0xab71d373
je 0x14009b91b
inc edi
cmp edi, ebp
jb 0x14009b8b1
mov ecx, 0x8ff80713
mov dword [0x140143468], 0x13
jmp 0x14009b806
cmp di, 0xffff
je 0x14009b907
mov eax, dword [r12 + 0x24]
add rax, rsi
movsx rcx, di
movsx rdx, word [rax + rcx*2]
mov ecx, dword [r12 + 0x1c]
add rcx, rsi
mov r8d, dword [rcx + rdx*4]
add r8, rsi
cmp r8, r12
jb 0x14009b95f
mov eax, dword [r15 + 0x8c]
mov ecx, dword [r15 + 0x88]
add rax, rcx
add rax, rsi
cmp r8, rax
jbe 0x14009b907
cmp r8, rsi
jb 0x14009b907
mov eax, dword [r15 + 0x50]
add rax, rsi
cmp r8, rax
ja 0x14009b907
test r8, r8
je 0x14009b907
mov rcx, qword [rbx + 0x18]
add rcx, rsi
cmp r8, rcx
mov ecx, 0x8ff80713
jbe 0x14009b81e
mov dword [0x140143468], 0x15
jmp 0x14009b806
mov rcx, qword [r13 + 8]
mov r9, r8
movzx edx, al
add rsp, 0x40
pop r13
jmp r9
add rsp, 0x40
pop r13
ret