joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140054d40
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, qword [rcx]
movsxd r11, edx
mov r10, qword [rax + 0x1f8]
mov r9d, dword [r10 + r11*4 + 8]
cmp r8d, 1
jne 0x140054d96
test r9d, r9d
je 0x140054d80
sub r9d, 2
je 0x140054da8
cmp r9d, r8d
jne 0x140054dd6
cmp dword [r10 + r11*4 + 0x408], 0
jne 0x140054dd6
mov dword [r10 + r11*4 + 0x408], 1
ret
mov r8d, edx
mov dword [r10 + r11*4 + 8], 2
mov edx, 0xfb
jmp fcn.140054980
sub r9d, 1
je 0x140054dc0
sub r9d, 1
je 0x140054d68
cmp r9d, 1
jne 0x140054dd6
cmp dword [r10 + r11*4 + 0x408], 1
jne 0x140054dd6
mov dword [r10 + r11*4 + 0x408], 0
ret
mov r8d, edx
mov dword [r10 + r11*4 + 8], 3
mov edx, 0xfc
jmp fcn.140054980
ret

Function at 0x140054de0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, qword [rcx]
movsxd r11, edx
mov r10, qword [rax + 0x1f8]
mov r9d, dword [r10 + r11*4 + 0xc08]
cmp r8d, 1
jne 0x140054e3c
test r9d, r9d
je 0x140054e23
sub r9d, 2
je 0x140054e4e
cmp r9d, r8d
jne 0x140054e7f
cmp dword [r10 + r11*4 + 0x1008], 0
jne 0x140054e7f
mov dword [r10 + r11*4 + 0x1008], 1
ret
mov r8d, edx
mov dword [r10 + r11*4 + 0xc08], 2
mov edx, 0xfd
jmp fcn.140054980
sub r9d, 1
je 0x140054e66
sub r9d, 1
je 0x140054e0b
cmp r9d, 1
jne 0x140054e7f
cmp dword [r10 + r11*4 + 0x1008], 1
jne 0x140054e7f
mov dword [r10 + r11*4 + 0x1008], 0
ret
mov r8d, edx
mov dword [r10 + r11*4 + 0xc08], 3
mov edx, 0xfe
jmp fcn.140054980
ret
Function at 0x140056010
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x140099110]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0x760]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
lea rsi, [rbx + 0x168]
mov rdx, qword [rsi]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x1400560b4
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r9d, dword [rbx + 0x154]
cmp r9d, 4
jge 0x140056103
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.1400400c0
mov dword [rbx + 0xc], 7
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14006e6d0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rcx, rsi
call fcn.140055b50
movzx r8d, ax
mov dword [rbx + 0xc], r8d
sub r8d, 3
je 0x140056192
sub r8d, 1
je 0x140056201
sub r8d, 1
je 0x14005616a
cmp r8d, 1
je 0x14005614a
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x14007cc0c]
call fcn.1400400c0
jmp 0x140056201
mov rdx, qword [rsi]
lea r8d, [r9 - 2]
add rdx, 2
mov rcx, rbx
call fcn.140055d60
test eax, eax
je 0x140056201
jmp 0x1400560d9
mov rcx, rsi
call fcn.140055b30
movzx r8d, ax
lea rdx, [0x140077140]
mov dword [rbx + 8], r8d
mov rcx, rdi
mov r8, qword [rsi]
add r8, 4
call fcn.1400401d0
jmp 0x140056201
cmp r9d, 4
jle 0x140056201
mov rcx, rsi
call fcn.140055b30
movzx ecx, word [rbx + 0x48]
inc ecx
cmp cx, ax
jne 0x140056201
mov r8, qword [rsi]
lea eax, [r9 - 4]
movsxd r9, eax
add r8, 4
mov edx, 1
mov rcx, r14
call fcn.14003ff90
mov esi, eax
test eax, eax
je 0x1400561e0
mov edx, 5
mov rcx, rbx
call fcn.140056ae0
mov eax, esi
jmp 0x1400560d9
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.14004c550
mov rcx, r14
call fcn.14004c7a0
test eax, eax
je 0x1400560d7
mov edx, 5
mov rcx, rbx
call fcn.140056ae0
mov eax, Ordinal_46
jmp 0x1400560d9

Function at 0x140056230
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
mov rbx, rcx
mov rdi, qword [rax]
Function at 0x14005d930
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x140099110]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbp, qword [rcx + 0x240]
lea r8, [rsp + 0x20]
mov rsi, qword [rcx]
lea rdx, [rsp + 0x30]
mov rdi, rcx
mov dword [rsp + 0x20], 0x80
mov rcx, rbp
mov rbx, 0xffffffffffffffff
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x14005d9aa
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x80
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_accept]
mov rbx, rax
mov rdx, rbp
mov rcx, rdi
call fcn.140040cb0
mov rcx, rsi
cmp rbx, 0xffffffffffffffff
jne 0x14005d9cf
lea rdx, str.Error_accept__ing_server_connect
call fcn.1400400c0
lea eax, [rbx + 0x1f]
jmp 0x14005da48
lea rdx, str.Connection_accepted_from_server_n
call fcn.1400401d0
mov byte [rdi + 0x3b4], 0
mov edx, 1
mov rcx, rbx
mov qword [rdi + 0x240], rbx
call fcn.140064e00
mov byte [rdi + 0x259], 1
cmp qword [rsi + 0x2c8], 0
je 0x14005da46
mov dl, 1
mov rcx, rsi
call fcn.14002fcf0
mov rcx, qword [rsi + 0x2d0]
mov r8d, 1
mov rdx, rbx
call qword [rsi + 0x2c8]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call fcn.14002fcf0
test ebx, ebx
je 0x14005da46
mov rcx, rdi
call fcn.14005df40
mov eax, Ordinal_46
jmp 0x14005da48
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14006e6d0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14005eb30
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x7f2], 0
mov rbx, rcx
jne 0x14005ebd9
xor edx, edx
mov dword [rcx + 0x814], edx
mov rax, qword [rcx]
mov ecx, edx
cmp dword [rax + 0x724], 2
sete cl
mov dword [rbx + 0x818], ecx
mov rax, qword [rbx]
cmp dword [rax + 0x720], 2
jne 0x14005eb77
cmp dword [rbx + 0x7f4], edx
je 0x14005ebd6
cmp byte [rbx + 0x3aa], dl
je 0x14005eb93
mov r8, qword [rbx + 0x7d0]
test r8, r8
je 0x14005eb93
mov dword [rbx + 0x7f4], edx
jmp 0x14005ebaf
cmp dword [rbx + 0x7e0], edx
je 0x14005ebd6
mov r8, qword [rbx + 0x7d8]
mov dword [rbx + 0x7f4], 1
mov r8, qword [r8]
lea rdx, str.CWD__s
lea rcx, [rbx + 0x760]
call fcn.140069670
test eax, eax
jne 0x14005ebe3
lea edx, [rax + 0x10]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14005df30
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14005efb0
add rsp, 0x20
pop rbx
ret

Function at 0x14005efb0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
add rcx, 0x760
cmp byte [rax + 0x73a], 0
jne 0x14005efd5
cmp dword [rax + 0x598], 0
je 0x14005f001
mov r8, qword [rcx + 0x88]
test r8, r8
je 0x14005f001
lea rdx, str.MDTM__s
call fcn.140069670
test eax, eax
jne 0x14005f00e
lea edx, [rax + 0x12]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14005df30
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140060040
add rsp, 0x20
pop rbx
ret
Function at 0x14005f750
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx]
lea eax, [rdx - 0xc8]
mov rdi, rcx
cmp eax, 0x64
jb 0x14005f7d1
mov qword [rsp + 0x30], rbx
mov ebx, dword [rcx + 0x810]
test ebx, ebx
jne 0x14005f78f
lea rdx, str.disabling_EPRT_usage_n
mov rcx, rsi
call fcn.1400401d0
mov byte [rdi + 0x3bd], bl
inc ebx
cmp ebx, 2
jne 0x14005f7b8
lea rdx, str.Failed_to_do_PORT
mov rcx, rsi
call fcn.1400400c0
lea eax, [rbx + 0x1c]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140060410
lea rdx, str.Connect_data_stream_actively_n
mov rcx, rsi
call fcn.1400401d0
xor edx, edx
mov rcx, rdi
call fcn.14005df30
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14005e0a0
Function at 0x14005fb10
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
mov rdx, qword [rax + 0x1f8]
cmp dword [rdx + 0x18], 0
je 0x14005fb5d
cmp qword [rcx + 0x7e8], 0
je 0x14005fb5d
add rcx, 0x760
lea rdx, str.REST__d
xor r8d, r8d
call fcn.140069670
test eax, eax
jne 0x14005fb67
lea edx, [rax + 0x1a]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14005df30
add rsp, 0x20
pop rbx
jmp fcn.14005f800
add rsp, 0x20
pop rbx
ret

Function at 0x14005fe10
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
add rcx, 0x760
mov rax, qword [rbx]
mov rdx, qword [rax + 0x1f8]
cmp dword [rdx + 0x18], 1
jne 0x14005fe5c
mov r8, qword [rcx + 0x88]
test r8, r8
je 0x14005fe5c
lea rdx, str.SIZE__s
call fcn.140069670
test eax, eax
jne 0x14005fe69
lea edx, [rax + 0x17]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14005df30
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14005fb10
add rsp, 0x20
pop rbx
ret

Function at 0x140060040
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub rsp, 0x28
mov r10, qword [rcx]
mov r9, rcx
cmp byte [r10 + 0x749], 0
je 0x140060097
cmp qword [rcx + 0x7e8], 0
je 0x140060097
movzx edx, byte [r10 + 0x73c]
call fcn.14005e2f0
test eax, eax
je 0x140060097
mov rax, qword [r10 + 0x1f8]
mov r8d, reloc.WS2_32.dll_send
mov rcx, r9
mov dword [rax + 0x18], 1
movzx edx, byte [r10 + 0x73c]
add rsp, 0x28
jmp fcn.14005e260
mov rcx, r9
add rsp, 0x28
jmp fcn.14005fe10
Function at 0x14006dec0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14006df02
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x14006df49
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x14006dfa2
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x14006df60
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x14006dfe3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14008212a]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14008212b]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x14006dfb0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x140007de0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rcx, qword [0x1400420c0]
test rcx, rcx
je 0x140007e1b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140007e40
mov rcx, qword [0x1400420c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x1400430e0], 0
jne 0x140007e58
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [0x1400420c0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140007e0e
mov edx, 0x414
lea r12, [rsp + 0x20]
lea rsi, [0x14001e3fa]
mov qword [rsp + 0x20], 0
lea rdi, [0x140043100]
movq xmm0, rsi
mov rcx, r12
mov dword [rsp + 0x28], 3
movq xmm6, rdi
mov word [rsp + 0x40], dx
mov rbp, qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, 0x14
punpcklqdq xmm6, xmm0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rsi
movaps xmmword [rsp + 0x30], xmm6
call rbp
mov r13, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140007f24
test al, 0x10
je 0x140007e24
mov ecx, 0x64
call r14
mov eax, 0x414
mov qword [rsp + 0x50], rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
movaps xmmword [rsp + 0x30], xmm6
call rbp
sub ebx, 1
je 0x140007e24
mov rcx, rdi
call r13
cmp eax, 0xffffffff
jne 0x140007ed0
jmp 0x140007e24

Function at 0x14000e590
Capabilities:
Create directory

Disassembly:
push rdi
mov eax, 0x2020
push rsi
push rbx
call fcn.140015a50
sub rsp, rax
mov eax, dword [0x140047100]
mov rsi, rcx
test eax, eax
je 0x14000e630
xor ebx, ebx
lea rdi, [0x140045100]
test eax, eax
jg 0x14000e5cc
jmp 0x14000e5e0
add rbx, 1
cmp dword [0x140047100], ebx
jle 0x14000e5e0
mov rdx, qword [rdi + rbx*8]
mov rcx, rsi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14000e5c0
jmp 0x14000e617
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp rax, 2
jne 0x14000e5f5
cmp word [rsi + 2], 0x3a
je 0x14000e617
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000e680
movsxd rbx, dword [0x140047100]
cmp ebx, 0x3ff
jle 0x14000e698
mov eax, 1
add rsp, 0x2020
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
lea rbx, str.HOME
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rdi
call fcn.140007540
test al, al
je 0x14000e6ba
movsxd rbx, dword [0x140047100]
mov rcx, rdi
lea rdi, [0x140045100]
call sub.msvcrt.dll__wcsdup
mov qword [rdi + rbx*8], rax
mov eax, dword [0x140047100]
add eax, 1
mov dword [0x140047100], eax
jmp 0x14000e5b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000e604
xor eax, eax
jmp 0x14000e61c
mov rcx, rsi
call sub.msvcrt.dll__wcsdup
add dword [0x140047100], 1
mov rdx, rax
lea rax, [0x140045100]
mov qword [rax + rbx*8], rdx
jmp 0x14000e617
mov rcx, rbx
call fcn.140007d20
nop
nop word cs:[rax + rax]
nop
Function at 0x14013334a
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
add ecx, ecx
add al, byte [rax]
add byte [rdx], dh
mov ecx, 0x419d663f
rcr ebp, 0xf1
pop r14
call fcn.1401312d3
rol bh, 0x44
and al, 0x20
add byte [rax], dh
add byte [rax], al
ror byte [rdi], 0x85
xor ecx, dword [0x168fc1e6f]
cld
invalid
invalid
mov dword [rsp + 0x4b], 0x7c6f7d7f
mov dword [rsp + 0x44], 0xf6f6f6f6
jmp 0x140132600
mov word [rsp + 0x48], 0xf6f6
mov dword [rsp + 0x4f], 0x6e383c3d
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
jne 0x140132667
je 0x140132667
jb 0x140133139
and ecx, 0x9bc49f3b
jnp 0x140131691
call rax
int3
jmp 0x1401324fa
invalid
jmp 0xcb5bbffc
pushfq
or r11d, 0x94f020bf
add ebp, 0x439a2d53
push rbx
sub eax, 0xd1ff439a
je 0x140132f72
jne 0x140132f72
cmp r12, rbp
pause
jo 0x1401336e8
jmp 0x14013310b
add byte [rcx - 9], cl
add byte [rax], al
jmp 0x140133225
rcr ebp, 0x71
jmp 0x140133387
xor dword [rbx], eax
add byte [rax], al
jne 0x140132a8f
lea r9d, [rdi - 0x5359]
inc rdi
lea r9d, [rbx + 0x3ab5]
jmp rax
lea r11d, [rdx + 0x5953]
lea ecx, [rbp - 0xfb96]
lea r15d, [rdx - 0xc605]
xor esi, 0xa882d851
rcl r8d, 0xc2
pushfq
je 0x140133168
jne 0x140133168
jmp rax
int3
jmp 0x1401334ed
push rcx
call rax
mov r8d, 0x14d59cfc
cmp r14, rdi
ror ebp, 0x87
je 0x1401331eb
jne 0x1401331eb
movabs r13, 0x1bad31fffffd2ee9
div rbp
or esi, 0x56a704fb
rcl ebx, 2
lea ebp, [rdi - 0x1e7e]
cmp edx, 0xe55fb8c0
jbe 0x140132fbe
jmp 0x140132f1e
call fcn.140132d90
call rcx
cmp ebx, 0xed88e304
jmp rcx
cmp ebx, 0xa6f9ec51
jno 0x140132443
jo 0x140131726
jb 0x140132caf
mul r15
je 0x14013324e
jne 0x14013324e
call rax
jne 0x1401334b4
movabs r8, 0x100592000000eee9
popf
call fcn.140132633
jmp 0x140133341
cmp rcx, rcx
cmp r8d, 0x7b7e1a56
lea r14d, [rdi + 0x9241]
rol esi, 0xb8
cmp edx, 0xae8ac2be
cmp rdx, rdx
lea r11d, [rcx - 0x7695]
test r11, rbx
jmp 0x1401330e8
nop
rcl r12d, 0x1b
test rdi, rdx
call fcn.140131bac
call rcx
popf
jmp 0x140133303
lea esi, [rcx + 0xf36a]
test r13d, 0x65177f47
add dword [rax], 0
je 0x1401334cf
jne 0x1401334cf
cmp r11, rcx
jb 0x140133a3b
syscall
jne 0x140132678
push rbx
movabs rcx, 0x759df8fffffd02e9
ror r9d, 0x13
pop rsi
jg 0x14013302e
jmp 0x1401331d6
rcr r8d, 0xa3
cpuid
call fcn.140133f55
rcl r8d, 0x85
jo 0x1401318f4
or r12d, 0xdf8c5cf5
rcr edi, 0x40
je 0x140133532
jne 0x140133532
test r12d, 0xae9aa98a
rol ebp, 0x15
jmp rax
jmp 0x140133216
ret
jne 0x140133802
nop
lea ebx, [rbx - 0x2da0]
test r8d, 0x1a15c9e4
popf
jmp 0x1401338ca
test dil, dil
jne 0x140134476
mov eax, dword [rbx + 0x24]
test eax, eax
js 0x140133bf8
test al, 0x40
je 0x140133bf8
jmp 0x140133a07
dec rcx
add ebp, 0xd5eb398e
nop
jne 0x1401333aa
neg rcx
lea r13d, [rbx + 0x6636]
jmp 0x14013375b
xor esp, esi
invalid
Function at 0x140135359
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [rdi]
mov dh, 0x4c
adc al, 0x40
add cl, al
mov byte [rsp + rdx + 0x46], cl
mov byte [rsp + rdx + 0x40], r15b
inc rdx
jmp 0x1401353b0
cmp rdx, 5
jb 0x140135032
mov dword [rbp + 0x68], 0xf6f6f6f6
xchg r15, rdx
jmp 0x140134fbc
Function at 0x140003810
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000386d
lea rbx, [0x1400c7f40]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140003854
cmp r10, 2
jb 0x140003854
cmp byte [r9], r8b
jne 0x140003854
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140003830
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400038af
lea rbx, [0x1400c7f40]
cmp r8b, 0x23
jne 0x140003893
cmp byte [r9], r8b
jne 0x140003893
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003880
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1400039f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140003a0a
mov qword [r8], 0
lea rdx, [0x1400c7298]
call fcn.1400038c0
mov rbx, rax
test rax, rax
jne 0x140003a2a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140003b03
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003b03
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140003b03
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003b03
cmp rdi, 0xffffffffffffffff
je 0x140003b03
mov rax, qword [0x1400def30]
test rax, rax
je 0x140003aa0
inc dword [rax + 0xfc]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140003b03
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140003af0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1400def30]
test rax, rax
je 0x140003ae5
dec dword [rax + 0xfc]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140003b0c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140003afe
mov qword [r14], rdi
mov rax, rsi
jmp 0x140003b0e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140008520
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x128]
lea r8, [0x1400c7f40]
movsxd rcx, dword [rcx + 0x120]
mov r11d, edx
shr r11d, 0x18
mov r9d, edx
shr r9d, 8
mov r10d, edx
shr r10d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r10b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, r11
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
mov rcx, qword [0x1400def30]
not ebx
cmp dword [rcx + 0x4038], ebx
jne 0x1400085b5
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.140029490
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1400085c0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm0, dword [rcx + 0x140]
lea r10, [0x1400c7f40]
mov rax, qword [rcx + 0x128]
movss xmm1, dword [rcx + 0x144]
movss xmm2, dword [rdx]
movss xmm4, dword [rdx + 8]
subss xmm2, xmm0
movss xmm3, dword [rdx + 4]
subss xmm4, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm3, xmm1
movsxd rcx, dword [rcx + 0x120]
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp], xmm2
mov r9d, dword [rax + rcx*4 - 4]
movzx eax, byte [rsp]
not r9d
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
movss dword [rsp + 4], xmm3
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 8], xmm4
movss dword [rsp + 0xc], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x18
ret