joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov eax, edx
mov edi, 0x40
shl rax, 4
mov rbx, rcx
cmp rax, 0x400
cmovbe edi, edx
cmp edi, dword [rcx]
je 0x140021176
mov rax, qword [0x140182408]
test rax, rax
je 0x140021037
call rax
mov ecx, edi
shl rcx, 4
call fcn.14001c4a0
mov rcx, qword [0x140182410]
mov rdi, rax
test rcx, rcx
je 0x140021053
call rcx
test rdi, rdi
je 0x140021176
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x30], rsi
call fcn.14001c8f0
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [0x14017ebd0]
movsxd rsi, eax
xor edx, edx
shr rsi, 4
mov rcx, rdi
mov r8d, esi
shl r8, 4
mov dword [rbx], esi
call fcn.140139c15
mov rcx, qword [rbx + 8]
xor r10d, r10d
mov qword [rbx + 8], r10
test rcx, rcx
je 0x140021161
lea r11, [0x1401585e0]
nop dword [rax]
mov r9, qword [rcx + 0x18]
mov eax, r10d
movzx edx, byte [r9]
test dl, dl
je 0x1400210e1
nop
movzx edx, dl
lea r9, [r9 + 1]
movzx r8d, byte [rdx + r11]
lea edx, [rax*8]
xor r8d, edx
movzx edx, byte [r9]
xor eax, r8d
test dl, dl
jne 0x1400210c0
mov r9, qword [rcx]
xor edx, edx
div esi
mov r8d, edx
shl r8, 4
add r8, rdi
je 0x140021139
mov eax, dword [r8]
test eax, eax
je 0x140021101
mov rdx, qword [r8 + 8]
jmp 0x140021104
mov rdx, r10
inc eax
mov qword [r8 + 8], rcx
mov dword [r8], eax
test rdx, rdx
je 0x140021139
mov qword [rcx], rdx
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov rax, qword [rdx + 8]
test rax, rax
je 0x14002112f
mov qword [rax], rcx
mov qword [rdx + 8], rcx
jmp 0x140021155
mov qword [rbx + 8], rcx
mov qword [rdx + 8], rcx
jmp 0x140021155
mov rax, qword [rbx + 8]
mov qword [rcx], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x14002114d
mov qword [rax + 8], rcx
mov qword [rcx + 8], r10
mov qword [rbx + 8], rcx
mov rcx, r9
test r9, r9
jne 0x1400210b0
mov rsi, qword [rsp + 0x30]
mov eax, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140021190
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
xor r11d, r11d
lea rsi, [0x1401585e0]
mov rdi, rdx
mov r10, rcx
cmp qword [rcx + 0x10], r11
je 0x1400211fe
movzx eax, byte [rdx]
mov r9, rdx
test al, al
je 0x1400211e0
nop word [rax + rax]
movzx eax, al
lea r9, [r9 + 1]
movzx ecx, byte [rax + rsi]
lea eax, [r11*8]
xor ecx, eax
movzx eax, byte [r9]
xor r11d, ecx
test al, al
jne 0x1400211c0
mov eax, r11d
xor edx, edx
div dword [r10]
mov eax, edx
shl rax, 4
add rax, qword [r10 + 0x10]
mov r11d, edx
mov r9, qword [rax + 8]
mov r10d, dword [rax]
jmp 0x140021206
mov r9, qword [rcx + 8]
mov r10d, dword [rcx + 4]
mov dword [r8], r11d
test r10d, r10d
je 0x140021269
nop
mov rax, qword [r9 + 0x18]
dec r10d
mov r8, rdi
movzx edx, byte [rax]
test dl, dl
je 0x14002124e
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8]
movzx edx, dl
movzx ecx, byte [rcx + rsi]
cmp byte [rdx + rsi], cl
jne 0x14002124e
movzx edx, byte [rax + 1]
inc rax
inc r8
test dl, dl
jne 0x140021230
movzx ecx, byte [r8]
movzx edx, byte [rcx + rsi]
movzx ecx, byte [rax]
movzx eax, byte [rcx + rsi]
cmp eax, edx
je 0x140021276
mov r9, qword [r9]
test r10d, r10d
jne 0x140021210
xor eax, eax
mov rsi, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
mov rsi, qword [rsp + 8]
mov rax, r9
mov rdi, qword [rsp + 0x10]
ret
Function at 0x140021290
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rsi, rdx
lea r8, [rsp + 0x48]
mov rbx, rcx
call fcn.140021190
mov rcx, rax
test rax, rax
je 0x14002133b
mov rdi, qword [rax + 0x10]
test rbp, rbp
jne 0x14002132b
mov rdx, qword [rax + 8]
mov rax, qword [rax]
test rdx, rdx
je 0x1400212d9
mov qword [rdx], rax
jmp 0x1400212dd
mov qword [rbx + 8], rax
mov rdx, qword [rcx]
test rdx, rdx
je 0x1400212ed
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140021310
mov edx, dword [rsp + 0x48]
shl rdx, 4
add rdx, rax
cmp qword [rdx + 8], rcx
jne 0x14002130e
mov rax, qword [rcx]
mov qword [rdx + 8], rax
dec dword [rdx]
call fcn.14001c8f0
sub dword [rbx + 4], 1
jne 0x140021333
mov rcx, rbx
call fcn.140020f10
mov rax, rdi
jmp 0x140021440
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, rdi
jmp 0x140021440
test rbp, rbp
je 0x14002143e
mov ecx, 0x20
call fcn.14001c4a0
mov rdi, rax
test rax, rax
jne 0x14002135e
mov rax, rbp
jmp 0x140021440
mov qword [rax + 0x18], rsi
mov qword [rax + 0x10], rbp
mov edx, dword [rbx + 4]
inc edx
mov dword [rbx + 4], edx
cmp edx, 0xa
jb 0x1400213c4
mov eax, dword [rbx]
add eax, eax
cmp edx, eax
jbe 0x1400213c4
add edx, edx
mov rcx, rbx
call fcn.140021000
test eax, eax
je 0x1400213c4
movzx ecx, byte [rsi]
xor eax, eax
test cl, cl
je 0x1400213be
lea r8, [0x1401585e0]
nop dword [rax]
movzx ecx, cl
lea rsi, [rsi + 1]
movzx edx, byte [rcx + r8]
lea ecx, [rax*8]
xor edx, ecx
movzx ecx, byte [rsi]
xor eax, edx
test cl, cl
jne 0x1400213a0
xor edx, edx
div dword [rbx]
jmp 0x1400213c8
mov edx, dword [rsp + 0x48]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14002141e
mov ecx, edx
shl rcx, 4
add rcx, rax
je 0x14002141e
mov eax, dword [rcx]
test eax, eax
je 0x1400213e8
mov rdx, qword [rcx + 8]
jmp 0x1400213ea
xor edx, edx
inc eax
mov qword [rcx + 8], rdi
mov dword [rcx], eax
test rdx, rdx
je 0x14002141e
mov qword [rdi], rdx
mov rax, qword [rdx + 8]
mov qword [rdi + 8], rax
mov rax, qword [rdx + 8]
test rax, rax
je 0x140021414
mov qword [rax], rdi
mov qword [rdx + 8], rdi
jmp 0x14002143e
mov qword [rbx + 8], rdi
mov qword [rdx + 8], rdi
jmp 0x14002143e
mov rax, qword [rbx + 8]
mov qword [rdi], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x140021432
mov qword [rax + 8], rdi
mov qword [rdi + 8], 0
mov qword [rbx + 8], rdi
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14004f310
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x30
mov r14, rcx
mov qword [rcx], 0
mov ecx, 0x28
mov rbp, r8
mov r15, rdx
call fcn.14001c4a0
mov rbx, rax
test rax, rax
jne 0x14004f354
mov eax, 7
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
cmp dword [reloc.WS2_32.dll_accept], 0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
jne 0x14004f371
lea rdi, [rbx + 0x10]
lea rsi, [rbx + 8]
jmp 0x14004f3aa
lea rsi, [rax + 8]
mov qword [rax + 0x10], r15
lea rdi, [rax + 0x10]
mov qword [rsp + 0x28], rsi
mov r9, rbx
mov dword [rsp + 0x20], 0
lea r8, [0x14001f450]
mov qword [rax + 0x18], rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
jne 0x14004f3ba
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
cmp qword [rdi], 0
mov rdi, qword [rsp + 0x58]
jne 0x14004f3d7
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rbp
mov dword [rsi], eax
call r15
mov qword [rbx + 0x20], rax
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov qword [r14], rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
Function at 0x140059bb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x30
mov r14, qword [rcx + 0x10]
xor r10d, r10d
mov rbx, rcx
mov esi, r9d
add rcx, 0x88
mov ebp, r8d
nop dword [rax]
cmp dword [rcx + 0xc], 0
jle 0x140059bf2
cmp dword [rcx], esi
jne 0x140059bf2
movsx eax, word [rcx + 4]
cmp eax, ebp
je 0x140059c48
inc r10d
add rcx, 0x14
cmp r10d, 0xa
jl 0x140059be0
mov qword [rsp + 0x40], rdi
mov r9d, ebp
mov edi, dword [rsp + 0x60]
mov r8d, esi
mov rcx, r14
mov dword [rsp + 0x20], edi
call fcn.140059ac0
movzx r8d, byte [rsp + 0x68]
test r8b, r8b
je 0x140059cef
mov rdx, qword [r14 + 8]
test rdx, rdx
je 0x140059cff
movsxd rax, dword [r14 + 0x3c]
lea rcx, [rax + rax*2]
mov byte [rdx + rcx*8 - 0x15], r8b
jmp 0x140059cff
mov eax, dword [rbx + 0x74]
mov dword [rcx + 0x10], eax
inc dword [rbx + 0x74]
mov eax, dword [rcx + 0xc]
cmp dword [rbx + 0x94], eax
jne 0x140059c63
mov byte [rbx + 0x8e], 0
cmp dword [rbx + 0xa8], eax
jne 0x140059c72
mov byte [rbx + 0xa2], 0
cmp dword [rbx + 0xbc], eax
jne 0x140059c81
mov byte [rbx + 0xb6], 0
cmp dword [rbx + 0xd0], eax
jne 0x140059c90
mov byte [rbx + 0xca], 0
cmp dword [rbx + 0xe4], eax
jne 0x140059c9f
mov byte [rbx + 0xde], 0
cmp dword [rbx + 0xf8], eax
jne 0x140059cae
mov byte [rbx + 0xf2], 0
cmp dword [rbx + 0x10c], eax
jne 0x140059cbd
mov byte [rbx + 0x106], 0
cmp dword [rbx + 0x120], eax
jne 0x140059ccc
mov byte [rbx + 0x11a], 0
cmp dword [rbx + 0x134], eax
jne 0x140059cdb
mov byte [rbx + 0x12e], 0
cmp dword [rbx + 0x148], eax
jne 0x140059cea
mov byte [rbx + 0x142], 0
mov eax, dword [rcx + 0xc]
jmp 0x140059d06
mov r9d, edi
mov r8d, ebp
mov edx, esi
mov rcx, rbx
call fcn.1400594b0
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14005be80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x28
mov r12d, r8d
mov rdi, rdx
mov rsi, rcx
test rcx, rcx
je 0x14005c082
test rdx, rdx
je 0x14005c082
mov r11d, dword [rcx + 4]
mov r9d, dword [rdx + 4]
mov ecx, r9d
mov qword [rsp + 0x58], rbp
or ecx, r11d
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x50], ecx
bt ecx, 0xa
jae 0x14005bf0b
and r9d, r11d
bt r9d, 0xa
jae 0x14005bff1
mov eax, dword [rdx + 8]
cmp dword [rsi + 8], eax
jne 0x14005bff1
xor eax, eax
mov r14, qword [rsp + 0x68]
mov r13, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx r10d, byte [rsi]
cmp r10b, byte [rdx]
je 0x14005bf50
cmp r10b, 0x5f
jne 0x14005bf28
mov rcx, qword [rsi + 0x10]
call fcn.14005be80
cmp eax, 2
jl 0x14005bf49
cmp byte [rdi], 0x5f
jne 0x14005bff1
mov rdx, qword [rdi + 0x10]
mov r8d, r12d
mov rcx, rsi
call fcn.14005be80
cmp eax, 2
jge 0x14005bff1
mov eax, 1
jmp 0x14005beed
lea eax, [r10 + 0x66]
test al, 0xfd
je 0x14005bf9c
mov rax, qword [rsi + 8]
test rax, rax
je 0x14005bf9c
mov r8, qword [rdx + 8]
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14005bf83
inc rax
test ecx, ecx
jne 0x14005bf70
test edx, edx
je 0x14005bf98
xor ebx, ebx
cmp r10b, 0x5f
setne bl
lea eax, [rbx + 1]
jmp 0x14005beed
mov ecx, dword [rsp + 0x50]
xor r9d, r11d
test r9b, 0x10
jne 0x14005bff1
bt ecx, 0xe
jb 0x14005beeb
bt ecx, 0xb
jb 0x14005bff1
mov rdx, qword [rdi + 0x10]
mov r8d, r12d
mov rcx, qword [rsi + 0x10]
call fcn.14005be80
test eax, eax
jne 0x14005bff1
mov rdx, qword [rdi + 0x18]
mov r8d, r12d
mov rcx, qword [rsi + 0x18]
call fcn.14005be80
test eax, eax
jne 0x14005bff1
mov r15, qword [rsi + 0x20]
xor ebx, ebx
mov r13, qword [rdi + 0x20]
test r15, r15
jne 0x14005bffb
test r13, r13
je 0x14005c046
mov eax, 2
jmp 0x14005beed
test r13, r13
je 0x14005bff1
mov eax, dword [r15]
cmp eax, dword [r13]
jne 0x14005bff1
mov ebp, ebx
test eax, eax
jle 0x14005c046
mov r14, rbx
mov rdx, qword [r13 + 8]
mov rcx, qword [r15 + 8]
movzx eax, byte [rdx + r14 + 0x18]
cmp byte [rcx + r14 + 0x18], al
jne 0x14005bff1
mov rdx, qword [rdx + r14]
mov r8d, r12d
mov rcx, qword [rcx + r14]
call fcn.14005be80
test eax, eax
jne 0x14005bff1
inc ebp
add r14, 0x28
cmp ebp, dword [r15]
jl 0x14005c012
test dword [rsp + 0x50], 0x2000
jne 0x14005beeb
movzx eax, word [rdi + 0x30]
cmp word [rsi + 0x30], ax
jne 0x14005bff1
mov eax, dword [rsi + 0x2c]
mov ecx, dword [rdi + 0x2c]
cmp eax, ecx
je 0x14005beeb
cmp eax, r12d
jne 0x14005bff1
mov eax, 2
test ecx, ecx
cmovns ebx, eax
mov eax, ebx
jmp 0x14005beed
xor ebx, ebx
mov eax, 2
cmp rdi, rsi
cmove eax, ebx
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14005dc40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
xor esi, esi
movsxd r15, edx
mov r12d, r8d
mov rbx, rcx
test rdi, rdi
jne 0x14005dcae
call fcn.14003f730
mov qword [rbx + 0x10], rax
mov rdi, rax
test rax, rax
je 0x14005dc8f
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
mov edx, 0x99
mov rcx, rax
call fcn.14003f920
cmp qword [rbx + 0x1c0], rsi
jne 0x14005dca5
mov rax, qword [rbx]
test byte [rax + 0x4c], 8
jne 0x14005dca5
mov byte [rbx + 0x23], 1
test rdi, rdi
je 0x14005de4b
movzx eax, byte [rbx + 0x1f]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], r14
lea r14, [rbx + 0x54]
test al, al
jne 0x14005dcd4
mov ebp, dword [r14]
inc ebp
mov dword [r14], ebp
inc dword [r14]
mov r14d, dword [r14]
jmp 0x14005dcf7
sub al, 1
movzx ecx, al
mov byte [rbx + 0x1f], cl
mov ebp, dword [rbx + rcx*4 + 0x24]
jne 0x14005dcea
inc dword [r14]
mov r14d, dword [r14]
jmp 0x14005dcf7
dec cl
movzx eax, cl
mov byte [rbx + 0x1f], al
mov r14d, dword [rbx + rax*4 + 0x24]
mov r9d, ebp
mov dword [rsp + 0x20], 2
mov r8d, r15d
mov edx, 0x33
mov rcx, rdi
call fcn.14003f920
mov eax, dword [rdi + 0x94]
bts eax, r15d
mov dword [rdi + 0x94], eax
cmp r15d, 1
je 0x14005dd51
mov rax, qword [rdi]
mov rdx, r15
shl rdx, 5
mov rcx, qword [rax + 0x20]
mov rax, qword [rdx + rcx + 8]
cmp byte [rax + 0x11], sil
je 0x14005dd51
mov eax, dword [rdi + 0x98]
bts eax, r15d
mov dword [rdi + 0x98], eax
mov r9d, r14d
mov dword [rsp + 0x20], esi
mov r8d, r12d
mov edx, 0x19
mov rcx, rdi
call fcn.14003f920
xor r9d, r9d
mov dword [rsp + 0x20], ebp
mov r8d, r14d
mov edx, 0x53
mov rcx, rdi
call fcn.14003f920
mov r12d, eax
mov rax, qword [rdi + 8]
test rax, rax
je 0x14005dd98
movsxd rcx, dword [rdi + 0x3c]
lea rdx, [rcx + rcx*2]
mov byte [rax + rdx*8 - 0x15], 0x90
mov r9d, 2
mov dword [rsp + 0x20], r14d
mov r8d, r15d
mov edx, 0x34
mov rcx, rdi
call fcn.14003f920
mov edx, dword [rdi + 0x3c]
cmp edx, r12d
jbe 0x14005ddc7
mov rax, qword [rdi + 8]
lea rcx, [r12 + r12*2]
mov dword [rax + rcx*8 + 8], edx
mov ecx, dword [rdi + 0x3c]
mov rax, qword [rdi + 0x30]
dec ecx
mov dword [rax + 0x64], ecx
test ebp, ebp
je 0x14005de0d
movzx edx, byte [rbx + 0x1f]
cmp dl, 8
jae 0x14005de0d
mov ecx, esi
lea rax, [rbx + 0x88]
nop dword [rax]
cmp dword [rax + 0xc], ebp
je 0x14005de09
inc ecx
add rax, 0x14
cmp ecx, 0xa
jl 0x14005ddf0
mov dword [rbx + rdx*4 + 0x24], ebp
inc byte [rbx + 0x1f]
jmp 0x14005de0d
mov byte [rax + 6], 1
mov rbp, qword [rsp + 0x50]
test r14d, r14d
je 0x14005de46
movzx ecx, byte [rbx + 0x1f]
cmp cl, 8
jae 0x14005de46
lea rax, [rbx + 0x88]
cmp dword [rax + 0xc], r14d
je 0x14005de42
inc esi
add rax, 0x14
cmp esi, 0xa
jl 0x14005de27
mov dword [rbx + rcx*4 + 0x24], r14d
inc byte [rbx + 0x1f]
jmp 0x14005de46
mov byte [rax + 6], 1
mov r14, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r12
pop rdi
ret
Function at 0x140062670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov ebp, dword [rcx + 0x28]
xor r10d, r10d
xor ebx, ebx
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test ebp, ebp
jle 0x14006276e
mov qword [rsp + 0x48], r15
lea r15, [0x1401585e0]
nop word [rax + rax]
mov r9d, ebx
xor r9d, 1
cmp ebx, 2
cmovge r9d, ebx
test rdi, rdi
je 0x140062715
mov rcx, qword [rsi + 0x20]
mov rax, rdi
movsxd rdx, r9d
shl rdx, 5
mov r8, qword [rdx + rcx]
movzx edx, byte [rdi]
test dl, dl
je 0x140062700
nop dword [rax]
movzx ecx, byte [r8]
movzx edx, dl
movzx ecx, byte [rcx + r15]
cmp byte [rdx + r15], cl
jne 0x140062700
movzx edx, byte [rax + 1]
inc rax
inc r8
test dl, dl
jne 0x1400626e0
movzx ecx, byte [r8]
movzx edx, byte [rcx + r15]
movzx ecx, byte [rax]
movzx eax, byte [rcx + r15]
cmp eax, edx
jne 0x140062749
mov rax, qword [rsi + 0x20]
lea r8, [rsp + 0x40]
movsxd rcx, r9d
mov rdx, r14
shl rcx, 5
mov rcx, qword [rcx + rax + 0x18]
add rcx, 8
call fcn.140021190
test rax, rax
je 0x140062746
mov r10, qword [rax + 0x10]
test r10, r10
jne 0x140062753
jmp 0x140062749
xor r10d, r10d
inc ebx
cmp ebx, ebp
jl 0x1400626b0
mov r15, qword [rsp + 0x48]
mov rax, r10
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, r10
jmp 0x14006275b

Function at 0x140062890
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov esi, dword [rcx + 0x28]
xor r9d, r9d
xor ebx, ebx
mov rdi, r8
mov rbp, rdx
test esi, esi
jle 0x14006297d
mov qword [rsp + 0x48], r14
mov r14, qword [rcx + 0x20]
mov qword [rsp + 0x50], r15
lea r15, [0x1401585e0]
nop word [rax + rax]
mov eax, ebx
xor eax, 1
cmp ebx, 2
cmovge eax, ebx
movsxd r8, eax
shl r8, 5
mov r10, qword [r8 + r14 + 0x18]
test rdi, rdi
je 0x140062935
movzx edx, byte [rdi]
mov rax, rdi
mov r8, qword [r8 + r14]
test dl, dl
je 0x140062920
nop word [rax + rax]
movzx ecx, byte [r8]
movzx edx, dl
movzx ecx, byte [rcx + r15]
cmp byte [rdx + r15], cl
jne 0x140062920
movzx edx, byte [rax + 1]
inc rax
inc r8
test dl, dl
jne 0x140062900
movzx ecx, byte [r8]
movzx edx, byte [rcx + r15]
movzx ecx, byte [rax]
movzx eax, byte [rcx + r15]
cmp eax, edx
jne 0x140062959
lea rcx, [r10 + 0x20]
mov rdx, rbp
lea r8, [rsp + 0x40]
call fcn.140021190
test rax, rax
je 0x140062956
mov r9, qword [rax + 0x10]
test r9, r9
jne 0x140062963
jmp 0x140062959
xor r9d, r9d
inc ebx
cmp ebx, esi
jl 0x1400628d0
mov r14, qword [rsp + 0x48]
mov rax, r9
mov r15, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x58]
mov rax, r9
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x140077870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push r13
push r14
sub rsp, 0x38
mov r14, qword [rcx + 0x1b8]
mov rsi, rcx
mov rbx, qword [rcx + 0x10]
mov r13, qword [rcx]
test r14, r14
je 0x140077a71
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], r12
xor r12d, r12d
mov qword [rsp + 0x30], r15
nop dword [rax]
movsxd r9, dword [r14 + 0x10]
movzx eax, byte [rsi + 0x1f]
mov r15d, dword [r14 + 0x14]
shl r9, 5
add r9, qword [r13 + 0x20]
test al, al
jne 0x1400778d0
inc dword [rsi + 0x54]
mov ebp, dword [rsi + 0x54]
jmp 0x1400778dc
dec al
movzx eax, al
mov byte [rsi + 0x1f], al
mov ebp, dword [rsi + rax*4 + 0x24]
mov r9, qword [r9 + 0x18]
xor edx, edx
mov r8d, dword [r14 + 0x10]
mov rcx, rsi
mov dword [rsp + 0x20], gethostname
mov r9, qword [r9 + 0x68]
call fcn.1400771a0
xor r9d, r9d
mov dword [rsp + 0x20], r12d
lea r8d, [r15 + 1]
mov edx, 0x4d
mov rcx, rbx
call fcn.14003f920
lea r9d, [r15 + 1]
mov r12d, eax
xor r8d, r8d
mov dword [rsp + 0x20], 0
mov edx, 0x4a
mov rcx, rbx
call fcn.14003f920
mov edx, dword [rbx + 0x3c]
cmp edx, r12d
jbe 0x140077946
mov rax, qword [rbx + 8]
lea rcx, [r12 + r12*2]
mov dword [rax + rcx*8 + 8], edx
mov rax, qword [rbx + 0x30]
mov ecx, dword [rbx + 0x3c]
dec ecx
mov dword [rax + 0x64], ecx
mov rax, qword [rbx + 0x30]
movsxd rdi, dword [rbx + 0x3c]
cmp dword [rax + 0x60], edi
jg 0x14007796b
mov rcx, rbx
call fcn.14003f870
test eax, eax
jne 0x14007799f
mov rax, qword [rbx + 8]
lea rcx, [rdi + rdi*2]
inc dword [rbx + 0x3c]
xor r12d, r12d
mov word [rax + rcx*8], 0x31
mov byte [rax + rcx*8 + 3], 0
lea rdx, [rax + rcx*8]
lea eax, [r15 - 1]
mov dword [rdx + 8], 2
mov dword [rdx + 4], eax
mov dword [rdx + 0xc], ebp
mov qword [rdx + 0x10], r12
jmp 0x1400779a2
xor r12d, r12d
mov rax, qword [rbx + 0x30]
movsxd rdi, dword [rbx + 0x3c]
cmp dword [rax + 0x60], edi
jg 0x1400779bb
mov rcx, rbx
call fcn.14003f870
test eax, eax
jne 0x1400779e7
mov rax, qword [rbx + 8]
lea rcx, [rdi + rdi*2]
inc dword [rbx + 0x3c]
mov word [rax + rcx*8], 0x4b
mov byte [rax + rcx*8 + 3], 0
lea rdx, [rax + rcx*8]
lea eax, [r15 + 1]
mov dword [rdx + 4], r12d
mov dword [rdx + 0xc], eax
mov dword [rdx + 8], ebp
mov qword [rdx + 0x10], r12
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x1400779fd
movsxd rax, dword [rbx + 0x3c]
lea rcx, [rax + rax*2]
mov byte [rdx + rcx*8 - 0x15], 8
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
mov edx, 0x3d
mov rcx, rbx
call fcn.14003f920
test ebp, ebp
je 0x140077a51
cmp byte [rsi + 0x1f], 8
jae 0x140077a51
mov ecx, r12d
lea rax, [rsi + 0x88]
nop dword [rax]
cmp dword [rax + 0xc], ebp
je 0x140077a4d
inc ecx
add rax, 0x14
cmp ecx, 0xa
jl 0x140077a30
movzx eax, byte [rsi + 0x1f]
mov dword [rsi + rax*4 + 0x24], ebp
inc byte [rsi + 0x1f]
jmp 0x140077a51
mov byte [rax + 6], 1
mov r14, qword [r14]
test r14, r14
jne 0x1400778b0
mov r15, qword [rsp + 0x30]
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
add rsp, 0x38
pop r14
pop r13
pop rsi
pop rbx
ret
Function at 0x1400b74a0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r12
push r14
push r15
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
xor r12d, r12d
mov r10d, dword [rcx + 0x10]
mov r11d, r10d
mov r8, qword [rcx]
mov r9d, dword [rcx + 0x14]
cmp r10d, 4
jl 0x1400b7518
mov edx, r10d
shr rdx, 2
mov eax, edx
neg eax
lea r10d, [r10 + rax*4]
nop dword [rax]
imul eax, dword [r8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
imul r9d, r9d, 0x5bd1e995
xor r9d, eax
add r8, 4
sub rdx, 1
jne 0x1400b74f0
mov ecx, r12d
sub r10d, 1
je 0x1400b753f
sub r10d, 1
je 0x1400b7535
cmp r10d, 1
jne 0x1400b7545
movzx ecx, byte [r8 + 2]
shl ecx, 0x10
movzx eax, byte [r8 + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [r8]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r8d, ecx, 0x5bd1e995
imul eax, r11d, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul edx, ecx, 0x5bd1e995
imul eax, r9d, 0x5bd1e995
xor eax, r8d
imul ecx, eax, 0x5bd1e995
xor ecx, edx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r15d, ecx
shr r15d, 0xf
xor r15d, ecx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rbx, r14
nop word [rax + rax]
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
je 0x1400b75cf
lea rdx, [0x14015ce80]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400b75d4
cmp r14, rbx
jne 0x1400b75b0
mov dword [rsp + 0x20], 0xa
mov r9d, ntohs
mov r8d, 0x929d631a
mov rdx, qword [rbx + 0x30]
call fcn.14000bac0
mov rcx, qword [rdi + 8]
call rax
mov ecx, dword [rdi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.14000bac0
mov qword [rsp + 0x78], r12
mov qword [rsi + 0x38], r12
test rax, rax
je 0x1400b7663
lea rcx, vtable.std::_Func_impl_no_alloc_int____cdecl___struct_HWND______ptr64__char_const____ptr64__char_const____ptr64__unsigned_int___int__struct_HWND______ptr64__char_const____ptr64__char_const____ptr64__unsigned_int_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rsi + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400b7663
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rax, rsi
jmp 0x1400b7670
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret