joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002b5a4
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x14002b5ce
cmp dword [rdx], 0
jne 0x14002b5e4
test rbx, rbx
je 0x14002b5d9
cmp dword [r8], 0
jne 0x14002b5e4
test rdi, rdi
je 0x14002b630
cmp dword [r9], 0
je 0x14002b630
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.140036908
test rdi, rdi
je 0x14002b5fd
cmp dword [rdi], 0
jne 0x14002b5ff
xor edi, edi
test rbx, rbx
je 0x14002b609
cmp dword [rbx], 0
jne 0x14002b60b
xor ebx, ebx
test rsi, rsi
je 0x14002b615
cmp dword [rsi], 0
jne 0x14002b617
xor esi, esi
lea ecx, [rbp + 1]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rbx
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_select]
jmp 0x14002b63a
mov rcx, qword [rsp + 0x60]
call fcn.14002b564
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x14002cadc
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r12, r9
xor edi, edi
and qword [r9], rdi
xor r15d, r15d
lea r9, [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebp, eax
test eax, eax
jne 0x14002cc1a
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x14002cc07
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x14002cb3c
or r14, 0xffffffffffffffff
inc r14
cmp byte [rax + r14], 0
jne 0x14002cb2d
inc r14
jmp 0x14002cb3f
xor r14d, r14d
cmp dword [rbx + 4], 2
jne 0x14002cbcf
cmp qword [rbx + 0x20], 0
je 0x14002cbcf
cmp qword [rbx + 0x10], 0x10
jb 0x14002cbcf
lea rcx, [r14 + 0x40]
call qword [section..data]
mov rsi, rax
test rax, rax
je 0x14002cbdd
mov ecx, dword [rbx]
mov dword [rax], ecx
mov ecx, dword [rbx + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rbx + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rbx + 0xc]
and qword [rax + 0x18], 0
and qword [rax + 0x28], 0
mov dword [rax + 0xc], ecx
lea rcx, [rax + 0x30]
mov qword [rax + 0x20], rcx
mov dword [rax + reloc.WS2_32.dll_recv], 0x10
mov rax, qword [rbx + 0x20]
movups xmm0, xmmword [rax]
movdqu xmmword [rcx], xmm0
test r14, r14
je 0x14002cbbc
add rcx, 0x10
mov r8, r14
mov qword [rsi + 0x18], rcx
mov rdx, qword [rbx + 0x18]
call fcn.14003c590
test rdi, rdi
cmove rdi, rsi
test r15, r15
je 0x14002cbcc
mov qword [r15 + 0x28], rsi
mov r15, rsi
mov rbx, qword [rbx + 0x28]
test rbx, rbx
je 0x14002cbe2
jmp 0x14002cb20
mov ebp, 8
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14002cbf2
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test ebp, ebp
je 0x14002cc02
mov rcx, rdi
call fcn.14002cab8
xor edi, edi
jmp 0x14002cc14
test rdi, rdi
jne 0x14002cc14
mov ebp, 0x2af9
mov ecx, ebp
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov qword [r12], rdi
mov eax, ebp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14002e8a8
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
and qword [rbp - 0x10], 0
mov rdi, r8
and qword [rbp - 0x18], 0
mov rbx, r9
and dword [rbp + 0x38], 0
mov rsi, rdx
mov r14, rcx
mov dword [rbp - 0x20], 4
mov rcx, rdi
mov dword [rbp - 0x1c], ebx
mov r8, r9
xor edx, edx
call fcn.14003c9f0
mov r9d, dword [rbp + 0x40]
lea rcx, [rbp - 0x10]
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000040
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14002e9ab
mov edx, dword [rbp + 0x48]
lea rax, [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14002e98b
mov rcx, qword [rbp - 0x18]
xor r9d, r9d
mov r8d, esi
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x14002e98b
mov rcx, qword [rbp - 0x18]
lea r9, [rbp - 0x20]
and dword [rsp + 0x20], 0
lea r8, [rbp + 0x38]
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x14002e98b
mov eax, dword [rbp + 0x38]
cmp rbx, rax
jb 0x14002e98b
and dword [rsp + 0x20], 0
lea r9, [rbp - 0x1c]
mov rcx, qword [rbp - 0x18]
mov r8, rdi
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14002e99a
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14002e9ab
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret

Function at 0x1400302c0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor ebp, ebp
mov r14, rcx
xor ecx, ecx
lea edi, [rbp + 1]
jmp 0x140030312
mov r8d, edi
mov rdx, rbx
mov rcx, r14
mov rbp, rbx
mov esi, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
test eax, eax
je 0x14003034e
cmp edi, esi
je 0x14003034e
cmp edi, 0x8000
ja 0x14003034e
cmp edi, esi
jb 0x140030349
mov rcx, rbx
mov rdx, rdi
call qword [fcn.14003f3d4]
mov rbx, rax
test rax, rax
jne 0x1400302e5
mov rcx, rbp
call qword [fcn.14003f3e4]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rbx
jmp 0x14003032e
mov rcx, rbx
jmp 0x140030326
jmp 0x1400302c0
Function at 0x140030354
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor ebp, ebp
mov r14, rcx
xor ecx, ecx
lea edi, [rbp + 1]
jmp 0x140030312
mov r8d, edi
mov rdx, rbx
mov rcx, r14
mov rbp, rbx
mov esi, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
test eax, eax
je 0x14003034e
cmp edi, esi
je 0x14003034e
cmp edi, 0x8000
ja 0x14003034e
cmp edi, esi
jb 0x140030349
mov rcx, rbx
mov rdx, rdi
call qword [fcn.14003f3d4]
mov rbx, rax
test rax, rax
jne 0x1400302e5
mov rcx, rbp
call qword [fcn.14003f3e4]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rbx
jmp 0x14003032e
mov rcx, rbx
jmp 0x140030326
jmp 0x1400302c0

Function at 0x140033dec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
mov rax, r8
mov r10, rdx
cmp ecx, 2
je 0x140033e0d
call fcn.14003f3b4
mov dword [rax], 0x273f
xor eax, eax
add rsp, 0x28
ret
mov r8, r9
mov rdx, rax
mov rcx, r10
add rsp, 0x28
jmp 0x140033e20
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14009d0d8]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx eax, byte [rcx + 3]
mov rbx, rdx
movzx edx, byte [rcx + 2]
mov rdi, r8
movzx r10d, byte [rcx + 1]
lea r8, str._d._d._d._d
movzx r9d, byte [rcx]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edx
mov edx, reloc.WS2_32.dll_recv
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x20], r10d
call fcn.14002b828
lea rcx, [rsp + 0x40]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140033e81
test rax, rax
je 0x140033eb6
cmp rax, rdi
jae 0x140033eb6
lea rax, [rsp + 0x40]
mov r8, rbx
sub r8, rax
lea rdx, [rsp + 0x40]
mov cl, byte [rdx]
mov byte [r8 + rdx], cl
inc rdx
test cl, cl
jne 0x140033ea4
mov rax, rbx
jmp 0x140033ec3
call fcn.14003f3b4
mov dword [rax], 0x1c
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14003b480
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140036ed8
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x14009d0d8]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x50], rcx
mov r15, r8
mov rcx, rdx
mov r12, rdx
xor esi, esi
xor edi, edi
call fcn.140052ee0
mov rbp, rax
test rax, rax
jne 0x140036f57
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.140032ec8
lea rdx, str.schannel:_invalid_path_name_for_CA_file__s:__s
mov r8, r12
mov r9, rax
mov rcx, r15
call fcn.140020ce4
mov ebx, 0x4d
jmp 0x14003709e
and qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, rbp
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140036fab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.140032ec8
lea rdx, str.schannel:_failed_to_open_CA_file__s:__s
jmp 0x140036f3f
lea rdx, [rsp + 0x48]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140036ff4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.140032ec8
lea rdx, str.schannel:_failed_to_determine_size_of_CA_file__s:__s
mov r8, r12
mov r9, rax
mov rcx, r15
call fcn.140020ce4
mov ebx, 0x4d
jmp 0x140037095
mov rbx, qword [rsp + 0x48]
mov eax, 0x100000
cmp rbx, rax
jle 0x140037017
mov r8d, eax
lea rdx, str.schannel:_CA_file_exceeds_max_size_of__u_bytes
mov rcx, r15
call fcn.140020ce4
jmp 0x140036fea
lea rcx, [rbx + 1]
call qword [section..data]
mov rsi, rax
test rax, rax
jne 0x14003702e
lea ebx, [rax + 0x1b]
jmp 0x140037095
test rbx, rbx
je 0x140037077
and dword [rsp + 0x40], 0
lea rdx, [rsi + rdi]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, ebx
mov r13d, edi
sub r8d, edi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400370e1
mov eax, dword [rsp + 0x40]
test eax, eax
jne 0x14003706e
mov ebx, r13d
jmp 0x140037070
add edi, eax
mov eax, edi
cmp rax, rbx
jb 0x140037033
mov rcx, qword [rsp + 0x50]
mov r9, r12
mov r8, rbx
mov byte [rbx + rsi], 0
mov rdx, rsi
mov qword [rsp + 0x20], r15
call fcn.140036cf8
mov ebx, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [fcn.14003f3e4]
test rbp, rbp
je 0x1400370b4
mov rcx, rbp
call fcn.14003f3e4
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14003b480
mov rbx, qword [rsp + 0x1c8]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.140032ec8
lea rdx, str.schannel:_failed_to_read_from_CA_file__s:__s
jmp 0x140036fdc
Function at 0x140038f48
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ecx, dword [rcx + 0x20]
mov r14, rdx
add rcx, 0x18
mov ebp, r8d
lea r9d, [rax + rax]
add rcx, r9
call qword [section..data]
xor esi, esi
mov rdi, rax
test rax, rax
je 0x140039051
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140038fca
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + ioctlsocket]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
test rbp, rbp
je 0x140039046
mov rsi, rbp
mov al, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + ioctlsocket]
mov al, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
mov r8d, 1
mov byte [rsp + 0x40], al
inc r14
mov rcx, qword [rdi + 0x10]
call qword [rbx + ioctlsocket]
sub rbp, 1
jne 0x140038fda
jmp 0x140039046
mov rcx, qword [rdi + 8]
lea rdx, [0x140079aa9]
mov r8d, 1
call qword [rbx + ioctlsocket]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x140079aaa]
mov r8d, 1
call qword [rbx + ioctlsocket]
inc rsi
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jb 0x14003901b
mov rax, rdi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140050b88
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400508ec
Function at 0x140057b58
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1400579f8
call fcn.14003f3b4
mov dword [rax], socket
call fcn.14003f264
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400579e0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1400579e0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x140057a2a
lock or dword [rax + 0x14], 0x10
jmp 0x1400579e0
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140057a47
mov rcx, qword [rbp + 0x10]
call fcn.14005f9e4
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400559a0
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140053488
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140057a9e
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1400579e0
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140057b0a
mov rcx, qword [rbp + 0x10]
call fcn.1400559a0
cmp eax, 0xffffffff
je 0x140057af1
mov rcx, qword [rbp + 0x10]
call fcn.1400559a0
cmp eax, 0xfffffffe
je 0x140057af1
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400559a0
movsxd rdi, eax
lea rsi, [0x14009f0c0]
mov rcx, rbx
sar rdi, 6
call fcn.1400559a0
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x140057af8
lea rax, [0x14009d590]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140057b0a
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x140057b40
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140057b3c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140057b3c
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1400579e3
jmp 0x1400579b0
Function at 0x14006309c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
call fcn.1400632dc
xor r10d, r10d
test eax, eax
js 0x1400632c9
mov ecx, dword [rbx + 0xf0]
mov eax, ecx
shl eax, 2
movsxd r9, eax
test eax, eax
jle 0x140063126
lea rdx, [rbx + 8]
lea rdx, [rdx + r9*4]
lea r8, [rbx + 8]
mov ecx, dword [r8 - 8]
add r10, 4
mov eax, dword [rdx - 8]
sub r9, 4
mov dword [r8 - 8], eax
mov eax, dword [rdx - 4]
mov dword [rdx - 8], ecx
mov ecx, dword [r8 - 4]
mov dword [r8 - 4], eax
mov eax, dword [rdx]
mov dword [rdx - 4], ecx
mov ecx, dword [r8]
mov dword [r8], eax
lea r8, [r8 + 0x10]
mov eax, dword [rdx + 4]
mov dword [rdx], ecx
lea rdx, [rdx - 0x10]
mov ecx, dword [r8 - 0xc]
mov dword [r8 - 0xc], eax
mov dword [rdx + 0x14], ecx
cmp r10, r9
jl 0x1400630d7
mov ecx, dword [rbx + 0xf0]
mov r11d, 1
cmp ecx, r11d
jle 0x1400632c7
lea r10, [rbx + 2]
lea rdi, [0x140000000]
lea r10, [r10 + 0x10]
inc r11d
mov r8d, dword [r10 - 2]
mov eax, r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x8b5a0]
movzx eax, byte [r10 - 1]
mov r9d, dword [rdi + rdx*4 + 0x8b1a0]
movzx ecx, byte [rdi + rax*4 + 0x8b5a0]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0x8a9a0]
movzx ecx, byte [rdi + rax*4 + 0x8b5a0]
movzx eax, byte [r10]
xor r9d, dword [rdi + rcx*4 + 0x8a5a0]
movzx ecx, byte [rdi + rax*4 + 0x8b5a0]
xor r9d, dword [rdi + rcx*4 + 0x8ada0]
mov dword [r10 - 2], r9d
mov r9d, dword [r10 + 2]
mov eax, r9d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x8b5a0]
movzx eax, byte [r10 + 3]
mov r8d, dword [rdi + rdx*4 + 0x8b1a0]
movzx ecx, byte [rdi + rax*4 + 0x8b5a0]
movzx eax, byte [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0x8a9a0]
movzx ecx, byte [rdi + rax*4 + 0x8b5a0]
movzx eax, r9b
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0x8ada0]
movzx ecx, byte [rdi + rax*4 + 0x8b5a0]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0x8a5a0]
movzx edx, byte [rdi + rax*4 + 0x8b5a0]
movzx eax, byte [r10 + 7]
mov dword [r10 + 2], r8d
mov r8d, dword [rdi + rdx*4 + 0x8b1a0]
movzx ecx, byte [rdi + rax*4 + 0x8b5a0]
movzx eax, byte [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0x8a9a0]
movzx ecx, byte [rdi + rax*4 + 0x8b5a0]
movzx eax, r9b
mov r9d, dword [r10 + 0xa]
xor r8d, dword [rdi + rcx*4 + 0x8ada0]
movzx ecx, byte [rdi + rax*4 + 0x8b5a0]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0x8a5a0]
movzx edx, byte [rdi + rax*4 + 0x8b5a0]
movzx eax, byte [r10 + 0xb]
mov dword [r10 + 6], r8d
mov r8d, dword [rdi + rdx*4 + 0x8b1a0]
movzx ecx, byte [rdi + rax*4 + 0x8b5a0]
movzx eax, byte [r10 + 0xc]
xor r8d, dword [rdi + rcx*4 + 0x8a9a0]
movzx ecx, byte [rdi + rax*4 + 0x8b5a0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x8ada0]
movzx ecx, byte [rdi + rax*4 + 0x8b5a0]
xor r8d, dword [rdi + rcx*4 + 0x8a5a0]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x140063140
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140069ea0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov al, byte [rcx]
mov r8, rcx
or edx, 0xffffffff
jmp 0x140069ed6
movzx eax, al
mov r9d, 7
xor edx, eax
mov ecx, edx
mov eax, edx
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov edx, ecx
xor edx, eax
sub r9d, 1
jns 0x140069eb5
inc r8
mov al, byte [r8]
test al, al
jne 0x140069eaa
not edx
mov eax, edx
ret
Function at 0x140072dd8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp byte [rcx + 8], 0
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x140072eea
test r9, r9
je 0x140072ec7
movsxd rcx, dword [rcx + 0x3d0]
xor edx, edx
mov rax, r9
div rcx
test rdx, rdx
jne 0x140072ec7
mov rax, r9
xor r15d, r15d
div rcx
test rax, rax
je 0x140072eae
lea r14, [rbx + 0x3f8]
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.140072728
cmp byte [rbx + 8], 0
mov rcx, rsi
je 0x140072f0d
mov eax, dword [rbx + 0x3d0]
xor r8d, r8d
test eax, eax
jle 0x140072e80
mov rdx, r14
sub rdx, rsi
mov al, byte [rdx + rcx]
inc r8d
xor byte [rcx], al
inc rcx
mov eax, dword [rbx + 0x3d0]
cmp r8d, eax
jl 0x140072e6a
movsxd r8, eax
mov rdx, rbp
mov rcx, r14
call fcn.14003c590
movsxd rcx, dword [rbx + 0x3d0]
xor edx, edx
mov rax, rdi
inc r15d
div rcx
add rbp, rcx
add rsi, rcx
movsxd rcx, r15d
cmp rcx, rax
jb 0x140072e3c
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
mov rdx, qword [0x14009f940]
lea rcx, [rsp + 0x20]
call fcn.140013b78
lea rdx, [0x14009ade0]
lea rcx, [rsp + 0x20]
call fcn.14003d0bc
int3
mov rdx, qword [0x14009f938]
lea rcx, [rsp + 0x20]
call fcn.140013b78
lea rdx, [0x14009ade0]
lea rcx, [rsp + 0x20]
call fcn.14003d0bc
int3
mov rdx, qword [0x14009f938]
lea rcx, [rsp + 0x20]
call fcn.140013b78
lea rdx, [0x14009ade0]
lea rcx, [rsp + 0x20]
call fcn.14003d0bc
int3

Function at 0x140072f30
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
and qword [rcx], 0
mov rax, r8
and qword [rcx + 8], 0
mov rdi, rdx
mov rdx, rax
mov dword [rcx + 0x50], 0x6a09e667
mov r8, r9
mov dword [rcx + 0x54], 0xbb67ae85
mov rbx, rcx
mov dword [rcx + 0x58], 0x3c6ef372
mov dword [rcx + 0x5c], 0xa54ff53a
mov dword [rcx + 0x60], 0x510e527f
mov dword [rcx + 0x64], 0x9b05688c
mov dword [rcx + 0x68], 0x1f83d9ab
mov dword [rcx + 0x6c], 0x5be0cd19
call fcn.140072fb0
mov rdx, rdi
mov rcx, rbx
call fcn.140008bc0
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x180670023
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x30], 0xffffffff9307c4bf
push 0xffffffffab3b0da5
inc r10b
ror r10b, 1
dec r10b
push 0xffffffff8184651e
rol r10b, 1
rol dword [rsp + 0xb], 0x82
jb 0x18065db93
Function at 0x4078b7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x00416040]
jne 0x4063ba
rol rcx, 0x10
test cx, 0xffff
jne 0x4063b6
repz ret
ror rcx, 0x10
jmp 0x407810
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x00417300]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x004173f8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x407895
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x00417300]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x4078b7
mov rax, qword [rsp + 0x88]
mov qword [0x004173f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x00417398], rax
mov rax, qword [0x004173f8]
mov qword [0x00417270], rax
mov rax, qword [rsp + 0x90]
mov qword [0x00417380], rax
mov dword [0x00417260], 0xc0000409
mov dword [0x00417264], 1
mov rax, qword [0x00416040]
mov qword [rsp + 0x68], rax
mov rax, qword [0x00416048]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x004172f8], eax
mov ecx, 1
call fcn.004080e0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x004112b8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x004172f8], 0
jne 0x40793e
mov ecx, 1
call fcn.004080e0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret