joyce8/EMBER2024-capa huggingface dataset:
Function at 0x202358e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x258
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1d0], 0xfffffffffffffffe
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
mov ecx, 0xcb359193
call fcn.201fcbc0
mov r15, rax
mov ecx, 0xcb359193
call fcn.201fcbc0
mov r12, rax
mov ecx, 0xcb359193
call fcn.201fcbc0
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x30], 0xe9c9f63d
lea rcx, [rbp + 0xc8]
mov rdx, r14
mov r8, rsi
mov r9, rax
call fcn.201ffeb0
lea rax, [0x2037dca8]
mov qword [rbp + 0xc8], rax
lea rsi, [rbp + 0x1a0]
mov qword [rbp + 0x1b8], 0
mov qword [rbp + 0x1c0], 0xf
mov byte [rbp + 0x1a8], 0
movsxd r15, dword [0x203837e4]
mov r12d, dword [0x203837e0]
lea r14, [0x20370288]
mov qword [rbp + 0x1a0], r14
mov qword [rbp + 0x1c8], rbx
add rdi, 8
mov rcx, rsi
mov rdx, rdi
call fcn.201f8270
mov eax, dword [0x20472b60]
lea ecx, [rax + 1]
mov dword [0x20472b60], ecx
xor ecx, eax
not ecx
test ecx, eax
setne bl
or bl, byte [0x204a31f4]
xor edi, edi
mov r13d, 0
test bl, 1
jne 0x20235a23
xor eax, eax
mov edi, 0
mov r13d, 0
test r12d, r12d
jle 0x20235a23
lea rcx, [0x203837e4]
add r15, rcx
xor edi, edi
xor r13d, r13d
nop dword [rax]
cdqe
xor r13, qword [r15 + rax + 8]
xor rdi, qword [r15 + rax]
add eax, 0x10
cmp eax, r12d
jl 0x20235a10
lea rcx, [rbp - 0x40]
lea rdx, [rbp + 0xc8]
call fcn.20209200
mov rax, qword [0x203837d8]
mov rcx, qword [0x203837d0]
movzx edx, bl
mov r8d, edx
and r8d, 1
xor r9d, r9d
bt edx, 0
adc r9, 0xffffffffffffffff
dec r8
sub rcx, rdi
sbb rax, r13
and rax, r9
and rcx, r8
or rcx, rax
setne al
or al, byte [0x204a21a1]
and al, 1
mov byte [0x204a21a1], al
lea rax, [0x2037dca8]
mov qword [rbp - 0x40], rax
lea rcx, [rbp + 0x98]
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xb8], 0xf
mov byte [rbp + 0xa0], 0
mov qword [rbp + 0x98], r14
mov qword [rbp + 0xc0], 0
mov rdx, rsi
call fcn.201f8270
mov rax, qword [rbp + 0x1c8]
mov qword [rbp + 0xc0], rax
lea rdx, [0x203fe2b0]
lea rcx, [rbp - 0x40]
call fcn.203547bc
int3
Function at 0x202441f0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x158
mov rax, qword [0x20490f78]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov edi, dword [rcx + 0x10]
mov esi, dword [rcx + 0x14]
mov r11d, dword [rcx + 0x18]
mov r10d, dword [rcx + 0x1c]
mov r13d, dword [rcx + 0x20]
mov r14d, dword [rcx + 0x24]
mov ebp, dword [rcx + 0x28]
mov ebx, dword [rcx + 0x2c]
movups xmm0, xmmword [rcx + 0x30]
movups xmm1, xmmword [rcx + 0x40]
movups xmm2, xmmword [rcx + 0x50]
mov qword [rsp + 0x48], rcx
movups xmm3, xmmword [rcx + 0x60]
movaps xmmword [rsp + 0x80], xmm3
movaps xmmword [rsp + 0x70], xmm2
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
mov eax, 0x10
nop word cs:[rax + rax]
mov ecx, dword [rsp + rax*4 + 0x48]
mov edx, ecx
rol edx, 0xf
mov r8d, ecx
rol r8d, 0xd
xor r8d, edx
shr ecx, 0xa
xor ecx, r8d
add ecx, dword [rsp + rax*4 + 0x34]
mov edx, dword [rsp + rax*4 + 0x14]
mov r8d, edx
rol r8d, 0x19
mov r9d, edx
rol r9d, 0xe
xor r9d, r8d
shr edx, 3
xor edx, r9d
add ecx, dword [rsp + rax*4 + 0x10]
add ecx, edx
mov dword [rsp + rax*4 + 0x50], ecx
inc rax
cmp rax, 0x40
jne 0x20244270
xor r15d, r15d
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x3c], r14d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x34], r10d
mov r9d, r10d
mov dword [rsp + 0x30], r11d
mov r8d, r11d
mov dword [rsp + 0x2c], esi
mov dword [rsp + 0x28], edi
nop dword [rax + rax]
mov ecx, r13d
mov r12d, r14d
mov eax, ebp
mov edx, r13d
rol edx, 0x1a
mov r10d, r13d
rol r10d, 0x15
xor r10d, edx
mov edx, r13d
rol edx, 7
xor edx, r10d
mov r10d, r14d
and r10d, r13d
add r10d, ebx
mov ebx, r13d
not ebx
and ebx, ebp
add ebx, r10d
add ebx, edx
lea rdx, [0x20387450]
add ebx, dword [r15 + rdx]
add ebx, dword [rsp + r15 + 0x50]
mov r10d, edi
rol edi, 0x1e
mov edx, esi
mov esi, r10d
rol esi, 0x13
mov r11d, r8d
mov r8d, r10d
rol r8d, 0xa
xor esi, edi
xor r8d, esi
mov esi, r11d
or esi, edx
and esi, r10d
mov edi, r11d
and edi, edx
or edi, esi
add edi, r8d
mov r13d, r9d
add r13d, ebx
add edi, ebx
add r15, 4
mov ebx, ebp
mov ebp, r14d
mov r14d, ecx
mov r9d, r11d
mov r8d, edx
mov esi, r10d
cmp r15, 0x100
jne 0x202442f0
add edi, dword [rsp + 0x28]
mov r8, qword [rsp + 0x48]
mov dword [r8 + 0x10], edi
add r10d, dword [rsp + 0x2c]
mov dword [r8 + 0x14], r10d
add edx, dword [rsp + 0x30]
mov dword [r8 + 0x18], edx
add r11d, dword [rsp + 0x34]
mov dword [r8 + 0x1c], r11d
add r13d, dword [rsp + 0x38]
mov dword [r8 + 0x20], r13d
add ecx, dword [rsp + 0x3c]
mov dword [r8 + 0x24], ecx
add r12d, dword [rsp + 0x40]
mov dword [r8 + 0x28], r12d
add eax, dword [rsp + 0x44]
mov dword [r8 + 0x2c], eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.2032c180
nop
add rsp, 0x158
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x20294e50
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x2029504b
mov rsi, rcx
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov ebx, 1
shl rbx, cl
lea rax, [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, rdi
call fcn.2012f4c0
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
cmp byte [0x204a1d19], 0
jne 0x2029503f
mov rax, qword [rsi + 8]
mov r8, qword [rax]
cmp r8, rdi
je 0x2029503f
movabs rax, 0xcbf29ce484222325
movabs rcx, 0x100000001b3
jmp 0x20294f01
mov qword [r9 + r10*8], rdx
mov qword [r9 + r11*8], rdx
cmp r8, rdi
je 0x2029503f
mov rdx, r8
movzx r8d, byte [r8 + 0x10]
xor r8, rax
imul r8, rcx
movzx r9d, byte [rdx + 0x11]
xor r9, r8
imul r9, rcx
movzx r8d, byte [rdx + 0x12]
xor r8, r9
imul r8, rcx
movzx r9d, byte [rdx + 0x13]
xor r9, r8
imul r9, rcx
movzx r8d, byte [rdx + 0x14]
xor r8, r9
imul r8, rcx
movzx r9d, byte [rdx + 0x15]
xor r9, r8
imul r9, rcx
movzx r8d, byte [rdx + 0x16]
xor r8, r9
imul r8, rcx
movzx ebx, byte [rdx + 0x17]
xor rbx, r8
imul rbx, rcx
and rbx, qword [rsi + 0x30]
mov r8, qword [rdx]
mov r9, qword [rsi + 0x18]
lea r10, [rbx + rbx]
lea r11, [rbx + rbx]
inc r11
shl rbx, 4
mov r14, qword [r9 + rbx]
cmp r14, rdi
je 0x20294ef0
mov rbx, qword [r9 + r11*8]
mov r15, qword [rdx + 0x10]
cmp r15, qword [rbx + 0x10]
je 0x20294fe0
nop dword [rax + rax]
cmp r14, rbx
je 0x20295015
mov rbx, qword [rbx + 8]
cmp r15, qword [rbx + 0x10]
jne 0x20294fa0
mov r9, qword [rbx]
mov r10, qword [rdx + 8]
mov qword [r10], r8
mov r11, qword [r8 + 8]
mov qword [r11], r9
mov rbx, qword [r9 + 8]
mov qword [rbx], rdx
mov qword [r9 + 8], r11
mov qword [r8 + 8], r10
mov qword [rdx + 8], rbx
jmp 0x20294ef8
mov r10, qword [rbx]
cmp r10, rdx
je 0x20295009
mov rbx, qword [rdx + 8]
mov qword [rbx], r8
mov r14, qword [r8 + 8]
mov qword [r14], r10
mov r15, qword [r10 + 8]
mov qword [r15], rdx
mov qword [r10 + 8], r14
mov qword [r8 + 8], rbx
mov qword [rdx + 8], r15
add rdx, qword [0x204a2188]
jmp 0x20294ef4
mov r11, qword [rdx + 8]
mov qword [r11], r8
mov r14, qword [r8 + 8]
mov qword [r14], rbx
mov r15, qword [rbx + 8]
mov qword [r15], rdx
mov qword [rbx + 8], r14
mov qword [r8 + 8], r11
mov qword [rdx + 8], r15
mov qword [r9 + r10*8], rdx
jmp 0x20294ef8
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 1
xor r8d, r8d
mov r9d, 0x229b45c1
call fcn.20295630
mov rcx, rax
call fcn.2032dab4
int3
Function at 0x202b8cf0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
test rcx, rcx
je 0x202b8fc6
mov rsi, rcx
xor edi, edi
mov ecx, 1
mov edx, 1
xor r8d, r8d
mov r9d, 0x2aea9d31
call fcn.202bca20
test rax, rax
je 0x202b8fc8
mov r9, qword [rax + 0x10]
mov r10, qword [rax + 0x18]
movsxd rdx, dword [0x20398cc0]
movabs rcx, 0xb140a36ea99f14e3
mov r8b, 1
nop dword [rax + rax]
test r8b, r8b
je 0x202b8d50
test r8b, r8b
je 0x202b8d50
mov ebx, dword [0x20398c34]
xor edi, edi
test r9, r9
je 0x202b8fc8
test r10, r10
je 0x202b8fc8
add rdx, rcx
lea r14, [0x20398cc0]
add r14, rdx
sub r14, rcx
xor r15d, r15d
mov bpl, 1
xor edi, edi
mov r11, r9
xor r13d, r13d
mov qword [rsp + 0x28], rsi
jmp 0x202b8dc9
mov r9, qword [rsp + 0x20]
mov rcx, qword [r11]
test rcx, rcx
cmovne r11, rcx
movzx r13d, r13b
mov ecx, 1
cmove r13d, ecx
xor r15d, r15d
test r13b, 1
jne 0x202b8fc8
cmp r9, qword [rax + 0x10]
je 0x202b8e00
mov ecx, 1
mov edx, 1
xor r8d, r8d
mov r9d, 0x2aea9d31
call fcn.202bca20
test rax, rax
je 0x202b8fc8
mov r9, qword [rax + 0x10]
mov r10, qword [rax + 0x18]
mov r11, r9
nop dword [rax + rax]
test bpl, bpl
je 0x202b8e00
test bpl, bpl
je 0x202b8e00
mov r8d, dword [0x20487200]
lea ecx, [r8 + 1]
mov dword [0x20487200], ecx
xor ecx, r8d
not ecx
xor r12d, r12d
test ecx, r8d
jne 0x202b8e50
test r15b, r15b
jne 0x202b8e60
nop dword [rax]
test bpl, bpl
je 0x202b8e60
test ebx, ebx
jle 0x202b8e50
xor edx, edx
xor r12d, r12d
nop
movsxd rdx, edx
xor r12d, dword [r14 + rdx]
add edx, 4
cmp edx, ebx
jl 0x202b8e40
nop
test r15b, r15b
jne 0x202b8f30
jmp 0x202b8e70
test bpl, bpl
je 0x202b8e60
jmp 0x202b8e30
test bpl, bpl
je 0x202b8f30
test r13b, 1
jne 0x202b8dbf
mov qword [rsp + 0x20], r9
cmp r11, r10
movzx edx, r13b
mov r9d, 1
cmove edx, r9d
movzx r13d, byte [0x204a5150]
mov r15d, r13d
xor r15b, dl
and r13b, dl
add r13b, r13b
add r13b, r15b
mov r15, qword [r11 + 0x30]
cmp r15, rsi
ja 0x202b8da0
mov qword [rsp + 0x30], r10
add r15, qword [0x204a23f0]
mov rdx, qword [0x204a1f08]
add r15, rdx
mov r10, rsi
mov rsi, rdi
mov edi, dword [0x204a1fd4]
add edi, dword [r11 + 0x40]
add edi, dword [0x204a2244]
add rdi, r15
cmp rdi, r10
cmovae rsi, r15
movzx r13d, r13b
cmovae r13d, r9d
and ecx, r8d
cmp ecx, 1
mov ecx, 0
sbb ecx, ecx
mov r8d, dword [0x20398c5c]
sub r8d, r12d
and r8d, ecx
mov r15, r8
xor r15, rdx
and edx, r8d
add rdx, rdx
jmp 0x202b8f9f
test bpl, bpl
je 0x202b8f30
jmp 0x202b8e70
mov r8, r15
mov ecx, edx
shl r8, cl
sub r8, r15
mov r12, r15
mov ecx, r8d
shl r12, cl
sub r8d, r12d
mov rdi, r12
mov ecx, r8d
shl rdi, cl
mov rcx, r12
sub rcx, rdi
imul rcx, rdi
shl r12, cl
sub r12, rcx
imul r12, rcx
mov r8, r12
sub r8, rcx
imul r8, rcx
mov rcx, r12
sub rcx, r8
imul rcx, r8
sub rcx, r12
shl r12, cl
sub r12, rcx
imul r12, rcx
add r12, rcx
mov qword [0x204a1f08], r12
test bpl, bpl
je 0x202b8f40
lea rcx, [r15 + rdx]
mov qword [0x204a1f08], rcx
test bpl, bpl
je 0x202b8f40
mov rdi, rsi
mov rsi, qword [rsp + 0x28]
mov r10, qword [rsp + 0x30]
jmp 0x202b8da0
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x202c5250
Capabilities:
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rax, qword [0x20490f78]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
nop word [rax + rax]
movzx r8d, byte [0x204a1e5c]
add r8b, byte [rdx + rax*4]
movzx r9d, r8b
shl r9d, 0x18
movzx r8d, byte [rdx + rax*4 + 1]
shl r8d, 0x10
or r8d, r9d
movzx r9d, byte [rdx + rax*4 + 2]
shl r9d, 8
or r9d, r8d
movzx r8d, byte [rdx + rax*4 + 3]
or r8d, r9d
mov dword [rsp + rax*4 + 0x50], r8d
inc rax
cmp rax, 0x10
jne 0x202c5280
mov eax, dword [rcx]
mov edx, dword [rcx + 4]
mov r11d, dword [rcx + 8]
mov r13d, dword [rcx + 0xc]
mov r10d, dword [rcx + 0x10]
mov r14d, dword [rcx + 0x14]
mov ebp, dword [rcx + 0x18]
mov qword [rsp + 0x48], rcx
mov ebx, dword [rcx + 0x1c]
lea r15, [0x203998e0]
xor r12d, r12d
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x3c], r14d
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x34], r13d
mov dword [rsp + 0x24], r13d
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x2c], edx
mov dword [rsp + 0x28], eax
jmp 0x202c541b
lea eax, [r12 + 0xe]
and eax, 0xf
add rax, qword [0x204a3038]
mov r10d, dword [rsp + rax*4 + 0x50]
mov eax, r10d
rol eax, 0xf
mov edx, r10d
rol edx, 0xd
xor edx, eax
shr r10d, 0xa
xor r10d, edx
lea eax, [r12 + 9]
and eax, 0xf
add r10d, dword [rsp + rax*4 + 0x50]
lea eax, [r12 + 1]
and eax, 0xf
mov eax, dword [rsp + rax*4 + 0x50]
mov edx, eax
rol edx, 0x19
mov esi, r8d
mov r8d, r11d
mov r11d, eax
rol r11d, 0xe
xor r11d, edx
shr eax, 3
xor eax, r11d
mov r11d, r8d
mov r8d, esi
mov edx, r12d
and edx, 0xf
add r10d, dword [rsp + rdx*4 + 0x50]
add r10d, eax
mov dword [rsp + rdx*4 + 0x50], r10d
mov edi, dword [rsp + 0x24]
mov eax, r8d
rol eax, 0x1a
mov edx, r8d
rol edx, 0x15
xor edx, eax
mov eax, r8d
rol eax, 7
xor eax, edx
add eax, r10d
mov edx, ebp
xor edx, r13d
and edx, r8d
xor edx, ebp
add ebx, edx
add ebx, eax
add ebx, dword [r15]
mov eax, ecx
rol eax, 0x1e
mov edx, ecx
rol edx, 0x13
xor edx, eax
mov r10d, ecx
rol r10d, 0xa
xor r10d, edx
mov edx, r9d
and edx, ecx
mov eax, r9d
xor eax, ecx
and eax, r11d
or eax, edx
add eax, r10d
mov r10d, edi
add r10d, ebx
add eax, ebx
inc r12
add r15, 4
mov ebx, ebp
mov esi, ebp
mov ebp, r13d
mov r14d, r8d
mov dword [rsp + 0x24], r11d
mov edi, r8d
mov r8d, r11d
mov r11d, r9d
mov edx, ecx
cmp r12, 0x40
je 0x202c543a
mov ecx, eax
mov r9d, edx
mov r8d, r10d
mov r13d, r14d
cmp r12, 0xf
ja 0x202c5320
mov r10d, dword [rsp + r12*4 + 0x50]
jmp 0x202c5396
add eax, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x48]
mov dword [rdx], eax
add ecx, dword [rsp + 0x2c]
mov dword [rdx + 4], ecx
add r9d, dword [rsp + 0x30]
mov dword [rdx + 8], r9d
add r8d, dword [rsp + 0x34]
mov dword [rdx + 0xc], r8d
add r10d, dword [rsp + 0x38]
mov dword [rdx + 0x10], r10d
add edi, dword [rsp + 0x3c]
mov dword [rdx + 0x14], edi
add r13d, dword [rsp + 0x40]
mov dword [rdx + 0x18], r13d
add esi, dword [rsp + 0x44]
mov dword [rdx + 0x1c], esi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.2032c180
nop
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x202f67c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov ecx, edx
mov rax, qword [0x20490f78]
xor rax, rsp
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [0x203a17e0]
movaps xmmword [rsp + 0x20], xmm0
movabs rax, 0x1716151413121110
mov qword [rsp + 0x30], rax
mov word [rsp + 0x38], 0x1918
mov byte [rsp + 0x3a], 0x1a
mov r8d, 0x1b
nop word cs:[rax + rax]
mov eax, ecx
xor edx, edx
div r8d
movzx eax, byte [rsp + r8 + 0x1f]
movzx r9d, byte [rsp + rdx + 0x20]
mov byte [rsp + r8 + 0x1f], r9b
mov byte [rsp + rdx + 0x20], al
imul eax, ecx, 0x6255
add eax, 0x3619
movzx ecx, ax
dec r8
cmp r8, 1
ja 0x202f6810
xor eax, eax
lea rdx, [0x204a6890]
xor r8d, r8d
jmp 0x202f68a8
mov r10d, r8d
and r10b, 7
mov ecx, r8d
and ecx, 7
mov r11d, 0xffffffff
shl r11d, cl
lea edi, [r9 + r8]
add ecx, r9d
mov ebx, 0xffffffff
shl ebx, cl
xor ebx, r11d
shr r8d, 3
mov byte [rdx + rsi*4], r8b
mov byte [rdx + rsi*4 + 3], r10b
mov byte [rdx + rsi*4 + 1], bl
mov byte [rdx + rsi*4 + 2], bh
inc rax
mov r8d, edi
cmp rax, 0x1b
je 0x202f68f0
movzx esi, byte [rsp + rax + 0x20]
mov r9d, 6
cmp rsi, 0xf
ja 0x202f6860
mov r9d, 5
cmp sil, 7
ja 0x202f6860
mov r9d, 4
cmp sil, 3
ja 0x202f6860
mov r9d, 3
cmp sil, 1
ja 0x202f6860
cmp rsi, 1
mov r9d, 2
sbb r9d, 0
jmp 0x202f6860
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.2032c180
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x14014a596
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
jmp 0x1401e3340
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xd68
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x25a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xd88]
mov rax, qword [0x1404e30c0]
xor rax, rbp
mov qword [rbp + 0xd10], rax
mov dword [rbp + 0xce4], 0
lea rcx, [0x14052e063]
call fcn.140154dbb
lea rdx, str.None
mov rcx, qword [rbp + 0xd40]
call fcn.14014dad9
mov qword [rbp + 0xcf8], rax
mov eax, dword [rbp + 0xce4]
or eax, 1
mov dword [rbp + 0xce4], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.YourApp
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x1401e350a
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140416a5c]
lea rdx, [0x140416a60]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
je 0x1401e34ff
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x1401e34f5
xor edx, edx
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x1401e34f5
mov dword [rbp + 0x84], 0
lea rcx, [rbp + 0x8c8]
call fcn.140152692
nop
lea r9, [rbp + 0x84]
mov r8d, 0x800
lea rdx, [rbp + 0xb0]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x1401e34d5
cmp dword [rbp + 0x84], 0
jne 0x1401e34b7
jmp 0x1401e34d5
mov eax, dword [rbp + 0x84]
mov r8d, eax
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x8c8]
call fcn.14014de0d
jmp 0x1401e348a
lea rdx, [rbp + 0x8c8]
mov rcx, qword [rbp + 0xd40]
call fcn.140153e9d
nop
lea rcx, [rbp + 0x8c8]
call fcn.14015346b
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
nop
jmp 0x1401e350c
mov rax, qword [rbp + 0xd40]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14040a720]
call fcn.14015304c
mov rax, rdi
mov rcx, qword [rbp + 0xd10]
xor rcx, rbp
call fcn.14014f4b5
lea rsp, [rbp + 0xd28]
pop rdi
pop rbp
ret
Function at 0x14014af64
Capabilities:
Write file on windows

Disassembly:
jmp 0x1401f3390
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14052e009]
call fcn.140154dbb
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x1401f33e7
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1401f34f3
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x1401f348c
cmp qword [rbp + 0x28], 0
jle 0x1401f348c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x1401f342c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140154235
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x1401f34e2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x1401f34e2
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x14014bd9c
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1401c9f90
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x14052e073]
call fcn.140154dbb
mov qword [rbp + 8], 0
jmp 0x1401c9fce
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x1401ca024
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x1401c9fc3
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x14014beff
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x140354c70
push rdi
sub rsp, 0x10
mov dword [rsp], 0
jmp 0x140354c87
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
cmp dword [rsp], 0x100
jge 0x140354ea9
movsxd rax, dword [rsp]
lea rcx, [0x14047b180]
movzx eax, byte [rcx + rax]
mov byte [rsp + 4], al
movzx eax, byte [rsp + 4]
shl eax, 3
movzx ecx, byte [rsp + 4]
sar ecx, 5
and ecx, 1
imul ecx, ecx, 0x11b
xor eax, ecx
movzx ecx, byte [rsp + 4]
sar ecx, 5
and ecx, 2
imul ecx, ecx, 0x11b
xor eax, ecx
movzx ecx, byte [rsp + 4]
sar ecx, 5
and ecx, 4
imul ecx, ecx, 0x11b
xor eax, ecx
movzx ecx, byte [rsp + 4]
shl ecx, 2
movzx edx, byte [rsp + 4]
sar edx, 6
and edx, 1
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [rsp + 4]
sar edx, 6
and edx, 2
imul edx, edx, 0x11b
xor ecx, edx
xor eax, ecx
movzx ecx, byte [rsp + 4]
xor eax, ecx
shl eax, 8
movzx ecx, byte [rsp + 4]
shl ecx, 3
movzx edx, byte [rsp + 4]
sar edx, 5
and edx, 1
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [rsp + 4]
sar edx, 5
and edx, 2
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [rsp + 4]
sar edx, 5
and edx, 4
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [rsp + 4]
xor ecx, edx
shl ecx, 0x10
or eax, ecx
movzx ecx, byte [rsp + 4]
shl ecx, 3
movzx edx, byte [rsp + 4]
sar edx, 5
and edx, 1
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [rsp + 4]
sar edx, 5
and edx, 2
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [rsp + 4]
sar edx, 5
and edx, 4
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [rsp + 4]
shl edx, 2
movzx r8d, byte [rsp + 4]
sar r8d, 6
and r8d, 1
imul r8d, r8d, 0x11b
xor edx, r8d
movzx r8d, byte [rsp + 4]
sar r8d, 6
and r8d, 2
imul r8d, r8d, 0x11b
xor edx, r8d
xor ecx, edx
movzx edx, byte [rsp + 4]
shl edx, 1
movzx r8d, byte [rsp + 4]
sar r8d, 7
and r8d, 1
imul r8d, r8d, 0x11b
xor edx, r8d
xor ecx, edx
shl ecx, 0x18
or eax, ecx
mov dword [rsp + 8], eax
movzx eax, byte [rsp + 4]
shl eax, 3
movzx ecx, byte [rsp + 4]
sar ecx, 5
and ecx, 1
imul ecx, ecx, 0x11b
xor eax, ecx
movzx ecx, byte [rsp + 4]
sar ecx, 5
and ecx, 2
imul ecx, ecx, 0x11b
xor eax, ecx
movzx ecx, byte [rsp + 4]
sar ecx, 5
and ecx, 4
imul ecx, ecx, 0x11b
xor eax, ecx
movzx ecx, byte [rsp + 4]
shl ecx, 1
movzx edx, byte [rsp + 4]
sar edx, 7
and edx, 1
imul edx, edx, 0x11b
xor ecx, edx
xor eax, ecx
movzx ecx, byte [rsp + 4]
xor eax, ecx
mov ecx, dword [rsp + 8]
or ecx, eax
mov eax, ecx
mov eax, eax
shl rax, 0x20
mov ecx, dword [rsp + 8]
or rax, rcx
movzx ecx, byte [rsp + 4]
or rax, rcx
movsxd rcx, dword [rsp]
lea rdx, [0x1404f7e60]
mov qword [rdx + rcx*8], rax
jmp 0x140354c7f
mov byte [0x1404f8661], 1
add rsp, 0x10
pop rdi
ret