joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140159c38
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rsi, r8
mov r11, r9
movdqa xmm0, xmmword [rsi]
movdqu xmm4, xmmword [rcx]
pxor xmm0, xmm4
movd ebx, xmm0
mov eax, 0xf0f0f0f0
and eax, ebx
shl ebx, 4
and ebx, 0xf0f0f0f0
movzx edi, ah
movdqa xmm5, xmmword [rsi + rdi + 0x420]
movzx edi, al
movdqa xmm4, xmmword [rsi + rdi + 0x420]
shr eax, 0x10
movzx edi, ah
movdqa xmm3, xmmword [rsi + rdi + 0x420]
movzx edi, al
movdqa xmm2, xmmword [rsi + rdi + 0x420]
psrldq xmm0, 4
movd eax, xmm0
and eax, 0xf0f0f0f0
movzx edi, bh
pxor xmm5, xmmword [rsi + rdi + 0x20]
movzx edi, bl
pxor xmm4, xmmword [rsi + rdi + 0x20]
shr ebx, 0x10
movzx edi, bh
pxor xmm3, xmmword [rsi + rdi + 0x20]
movzx edi, bl
pxor xmm2, xmmword [rsi + rdi + 0x20]
movd ebx, xmm0
shl ebx, 4
and ebx, 0xf0f0f0f0
movzx edi, ah
pxor xmm5, xmmword [rsi + rdi + 0x520]
movzx edi, al
pxor xmm4, xmmword [rsi + rdi + 0x520]
shr eax, 0x10
movzx edi, ah
pxor xmm3, xmmword [rsi + rdi + 0x520]
movzx edi, al
pxor xmm2, xmmword [rsi + rdi + 0x520]
psrldq xmm0, 4
movd eax, xmm0
and eax, 0xf0f0f0f0
movzx edi, bh
pxor xmm5, xmmword [rsi + rdi + 0x120]
movzx edi, bl
pxor xmm4, xmmword [rsi + rdi + 0x120]
shr ebx, 0x10
movzx edi, bh
pxor xmm3, xmmword [rsi + rdi + 0x120]
movzx edi, bl
pxor xmm2, xmmword [rsi + rdi + 0x120]
movd ebx, xmm0
shl ebx, 4
and ebx, 0xf0f0f0f0
movzx edi, ah
pxor xmm5, xmmword [rsi + rdi + 0x620]
movzx edi, al
pxor xmm4, xmmword [rsi + rdi + 0x620]
shr eax, 0x10
movzx edi, ah
pxor xmm3, xmmword [rsi + rdi + 0x620]
movzx edi, al
pxor xmm2, xmmword [rsi + rdi + 0x620]
psrldq xmm0, 4
movd eax, xmm0
and eax, 0xf0f0f0f0
movzx edi, bh
pxor xmm5, xmmword [rsi + rdi + 0x220]
movzx edi, bl
pxor xmm4, xmmword [rsi + rdi + 0x220]
shr ebx, 0x10
movzx edi, bh
pxor xmm3, xmmword [rsi + rdi + 0x220]
movzx edi, bl
pxor xmm2, xmmword [rsi + rdi + 0x220]
movd ebx, xmm0
shl ebx, 4
and ebx, 0xf0f0f0f0
movzx edi, ah
pxor xmm5, xmmword [rsi + rdi + 0x720]
movzx edi, al
pxor xmm4, xmmword [rsi + rdi + 0x720]
shr eax, 0x10
movzx edi, ah
pxor xmm3, xmmword [rsi + rdi + 0x720]
movzx edi, al
pxor xmm2, xmmword [rsi + rdi + 0x720]
movzx edi, bh
pxor xmm5, xmmword [rsi + rdi + 0x320]
movzx edi, bl
pxor xmm4, xmmword [rsi + rdi + 0x320]
shr ebx, 0x10
movzx edi, bh
pxor xmm3, xmmword [rsi + rdi + 0x320]
movzx edi, bl
pxor xmm2, xmmword [rsi + rdi + 0x320]
movdqa xmm0, xmm3
pslldq xmm3, 1
pxor xmm2, xmm3
movdqa xmm1, xmm2
pslldq xmm2, 1
pxor xmm5, xmm2
psrldq xmm0, 0xf
movq rdi, xmm0
movzx eax, word [r11 + rdi*2]
shl eax, 8
movdqa xmm0, xmm5
pslldq xmm5, 1
pxor xmm4, xmm5
psrldq xmm1, 0xf
movq rdi, xmm1
xor ax, word [r11 + rdi*2]
shl eax, 8
psrldq xmm0, 0xf
movq rdi, xmm0
xor ax, word [r11 + rdi*2]
movd xmm0, eax
pxor xmm0, xmm4
add rcx, 0x10
sub rdx, 1
jne 0x140159c46
movdqa xmmword [rsi], xmm0
pop rbx
pop rdi
pop rsi
ret
Function at 0x140159eb8
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
mov rsi, r8
movdqa xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rcx]
pxor xmm1, xmm0
pxor xmm0, xmm0
movd eax, xmm1
psrldq xmm1, 4
movzx edi, al
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0x20]
movzx edi, ah
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0x1020]
shr eax, 0x10
movzx edi, al
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0x2020]
movzx edi, ah
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0x3020]
movd eax, xmm1
psrldq xmm1, 4
movzx edi, al
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0x4020]
movzx edi, ah
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0x5020]
shr eax, 0x10
movzx edi, al
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0x6020]
movzx edi, ah
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0x7020]
movd eax, xmm1
psrldq xmm1, 4
movzx edi, al
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0x8020]
movzx edi, ah
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0x9020]
shr eax, 0x10
movzx edi, al
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0xa020]
movzx edi, ah
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0xb020]
movd eax, xmm1
psrldq xmm1, 4
movzx edi, al
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0xc020]
movzx edi, ah
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0xd020]
shr eax, 0x10
movzx edi, al
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0xe020]
movzx edi, ah
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0xf020]
add rcx, 0x10
sub rdx, 1
jne 0x140159ec2
movdqa xmmword [rsi], xmm0
pop rdi
pop rsi
ret

Function at 0x14015ba60
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xa238cebe
call fcn.1400ede74
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x14015baa0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xf7bfa98a
call fcn.1400ede74
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x14015bae0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xaabbb00c
call fcn.1400ede74
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x14015bb20
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x3c3b2381
call fcn.1400ede74
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x14015bb60
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xb117bdb3
call fcn.1400ede74
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x14015bba0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x219bf726
call fcn.1400ede74
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x14015bbe0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xdc573727
call fcn.1400ede74
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x1401656c0
Capabilities:
Hash data using djb2

Disassembly:
push rbp
push rsi
push r12
push r15
sub rsp, 0x28
mov r12d, r9d
mov r15, r8
mov rsi, rdx
mov rbp, rcx
test rcx, rcx
je 0x14016589b
test rdx, rdx
je 0x14016589b
movabs rax, 0x7fffffffffffffff
cmp r8, rax
ja 0x14016589b
cmp dword [rcx], 0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x20], r14
mov r14, qword [rsp + 0x70]
jne 0x14016572f
mov r8, r14
mov edx, 0x100
call fcn.140165cb0
test al, al
je 0x1401657c0
movzx eax, byte [rsi]
mov rcx, rsi
mov edi, 0x1505
test al, al
je 0x140165755
nop
imul rdi, rdi, 0x21
movzx eax, al
lea rcx, [rcx + 1]
add rdi, rax
movzx eax, byte [rcx]
test al, al
jne 0x140165740
xor edx, edx
mov eax, edi
div dword [rbp]
mov rax, qword [rbp + 0x10]
mov r13d, edx
mov rbx, qword [rax + rdx*8]
test rbx, rbx
je 0x1401657a0
nop dword [rax]
cmp dword [rbx + 0x20], edi
jne 0x140165797
mov r8, qword [rbx]
mov rax, rsi
sub r8, rsi
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140165793
inc rax
test ecx, ecx
jne 0x140165780
test edx, edx
je 0x1401657e1
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x140165770
mov ecx, Ordinal_41
call fcn.140186988
mov rbx, rax
test rax, rax
jne 0x140165802
xor r8d, r8d
lea edx, [rax + 0xe]
mov rcx, r14
call fcn.14015f720
xor al, al
mov r13, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop r15
pop r12
pop rsi
pop rbp
ret
test r12b, 8
je 0x1401657ee
cmp qword [rbx + 8], 0xffffffffffffffff
jne 0x1401657f9
cmp qword [rbx + 0x10], 0xffffffffffffffff
je 0x140165886
xor r8d, r8d
lea edx, [r8 + 0xa]
jmp 0x1401657b8
mov qword [rax], rsi
xorps xmm1, xmm1
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + r13*8]
mov qword [rbx + 0x18], rcx
mov rax, qword [rbp + 0x10]
mov qword [rax + r13*8], rbx
mov dword [rbx + 0x20], edi
mov qword [rbx + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rcx, qword [rbp + 8]
mov edx, dword [rbp]
test rcx, rcx
js 0x14016583e
cvtsi2sd xmm1, rcx
jmp 0x140165853
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm1, rax
addsd xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, rdx
mulsd xmm0, qword [0x1401d0538]
comisd xmm1, xmm0
jbe 0x140165886
cmp edx, 0x80000000
jae 0x140165886
add edx, edx
mov r8, r14
mov rcx, rbp
call fcn.140165cb0
test al, al
je 0x1401657c0
test r12b, 8
je 0x140165890
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov al, 1
jmp 0x1401657c2
mov rcx, qword [rsp + 0x70]
xor r8d, r8d
lea edx, [r8 + 0x12]
call fcn.14015f720
xor al, al
add rsp, 0x28
pop r15
pop r12
pop rsi
pop rbp
ret
Function at 0x1401658c0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rsi, r8
mov r11, rdx
mov rbx, rcx
test rcx, rcx
je 0x140165a31
test rdx, rdx
je 0x140165a31
cmp qword [rcx + 8], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r14
jbe 0x140165973
movzx eax, byte [rdx]
mov r8, rdx
mov r10d, 0x1505
test al, al
je 0x140165926
nop
imul r10, r10, 0x21
movzx eax, al
lea r8, [r8 + 1]
add r10, rax
movzx eax, byte [r8]
test al, al
jne 0x140165910
mov r14, qword [rcx + 0x10]
xor edx, edx
mov eax, r10d
xor edi, edi
div dword [rcx]
mov ebp, edx
mov r8, qword [r14 + rdx*8]
test r8, r8
je 0x140165973
nop
cmp dword [r8 + 0x20], r10d
jne 0x140165967
mov r9, qword [r8]
mov rax, r11
sub r9, r11
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x140165963
inc rax
test ecx, ecx
jne 0x140165950
test edx, edx
je 0x14016599e
mov rdi, r8
mov r8, qword [r8 + 0x18]
test r8, r8
jne 0x140165940
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 9]
call fcn.14015f720
xor al, al
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
cmp qword [r8 + 8], 0xffffffffffffffff
jne 0x140165a22
mov rax, qword [r8 + 0x18]
test rdi, rdi
je 0x1401659b4
mov qword [rdi + 0x18], rax
jmp 0x1401659b8
mov qword [r14 + rbp*8], rax
mov rcx, r8
call fcn.140186974
dec qword [rbx + 8]
xorps xmm1, xmm1
mov rcx, qword [rbx + 8]
mov edx, dword [rbx]
test rcx, rcx
js 0x1401659d9
cvtsi2sd xmm1, rcx
jmp 0x1401659ee
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm1, rax
addsd xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, rdx
mulsd xmm0, qword [0x1401d0530]
comisd xmm0, xmm1
jbe 0x140165a2a
cmp edx, 0x100
jbe 0x140165a2a
shr edx, 1
mov r8, rsi
mov rcx, rbx
call fcn.140165cb0
test al, al
jne 0x140165a2a
jmp 0x140165982
mov qword [r8 + 0x10], 0xffffffffffffffff
mov al, 1
jmp 0x140165984
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 0x12]
call fcn.14015f720
mov rbx, qword [rsp + 0x48]
xor al, al
add rsp, 0x20
pop rsi
ret
Function at 0x140165ac0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r9
mov esi, r8d
mov rbx, rdx
mov r11, rcx
test rcx, rcx
je 0x140165ba7
test rdx, rdx
je 0x140165ba7
cmp qword [rcx + 8], 0
jbe 0x140165ba0
movzx r8d, byte [rdx]
mov r10, rdx
mov eax, 0x1505
test r8b, r8b
je 0x140165b28
nop dword [rax]
imul rax, rax, 0x21
movzx ecx, r8b
lea r10, [r10 + 1]
movzx r8d, byte [r10]
add rax, rcx
test r8b, r8b
jne 0x140165b10
xor edx, edx
div dword [r11]
mov rax, qword [r11 + 0x10]
mov r9, qword [rax + rdx*8]
test r9, r9
je 0x140165ba0
nop word [rax + rax]
mov r8, qword [r9]
mov rax, rbx
sub r8, rbx
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140165b63
inc rax
test ecx, ecx
jne 0x140165b50
test edx, edx
je 0x140165b76
mov r9, qword [r9 + 0x18]
test r9, r9
jne 0x140165b40
lea edx, [r9 + 9]
jmp 0x140165bac
test sil, 8
je 0x140165b96
mov rax, qword [r9 + 8]
cmp rax, 0xffffffffffffffff
je 0x140165ba0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [r9 + 0x10]
cmp rax, 0xffffffffffffffff
jne 0x140165bbe
mov edx, 9
jmp 0x140165bac
mov edx, reloc.WS2_32.dll_select
xor r8d, r8d
mov rcx, rdi
call fcn.14015f720
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x20], rbp
push rsi
push r14
push r15
sub rsp, 0x20
mov r14, r9
mov ebp, r8d
mov r15, rdx
mov rsi, rcx
test rcx, rcx
je 0x140168f63
test rdx, rdx
jne 0x140168f79
xor r8d, r8d
lea edx, [r15 + 0x12]
mov rcx, r9
call fcn.14015f720
mov rax, 0xffffffffffffffff
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
test ebp, 0x1003
je 0x14016903e
mov qword [rsp + 0x40], rbx
lea rax, [0x140193884]
test bpl, 1
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
lea r12, [fcn.140190ae0]
cmovne r12, rax
xor ebx, ebx
cmp qword [rcx + 0x48], rbx
jbe 0x140168ffd
mov r9, r14
mov r8d, ebp
mov rdx, rbx
mov rcx, rsi
call fcn.140169f50
mov rdi, rax
test rax, rax
je 0x140168ff4
test bpl, 2
je 0x140168fe7
mov edx, Ordinal_50
mov rcx, rax
call fcn.1401756c8
test rax, rax
je 0x140168fe7
lea rdi, [rax + 1]
mov rdx, rdi
mov rcx, r15
call r12
test eax, eax
je 0x140169031
inc rbx
cmp rbx, qword [rsi + 0x48]
jb 0x140168fb2
xor r8d, r8d
mov rcx, r14
lea edx, [r8 + 9]
call fcn.14015f720
mov rax, 0xffffffffffffffff
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov rcx, r14
call fcn.14015f680
mov rax, rbx
jmp 0x140169013
mov rcx, qword [rcx + 0x70]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rsi
jmp 0x140165ac0
Function at 0x140168f30
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r9
mov esi, r8d
mov rbx, rdx
mov r11, rcx
test rcx, rcx
je 0x140165ba7
test rdx, rdx
je 0x140165ba7
cmp qword [rcx + 8], 0
jbe 0x140165ba0
movzx r8d, byte [rdx]
mov r10, rdx
mov eax, 0x1505
test r8b, r8b
je 0x140165b28
nop dword [rax]
imul rax, rax, 0x21
movzx ecx, r8b
lea r10, [r10 + 1]
movzx r8d, byte [r10]
add rax, rcx
test r8b, r8b
jne 0x140165b10
xor edx, edx
div dword [r11]
mov rax, qword [r11 + 0x10]
mov r9, qword [rax + rdx*8]
test r9, r9
je 0x140165ba0
nop word [rax + rax]
mov r8, qword [r9]
mov rax, rbx
sub r8, rbx
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140165b63
inc rax
test ecx, ecx
jne 0x140165b50
test edx, edx
je 0x140165b76
mov r9, qword [r9 + 0x18]
test r9, r9
jne 0x140165b40
lea edx, [r9 + 9]
jmp 0x140165bac
test sil, 8
je 0x140165b96
mov rax, qword [r9 + 8]
cmp rax, 0xffffffffffffffff
je 0x140165ba0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [r9 + 0x10]
cmp rax, 0xffffffffffffffff
jne 0x140165bbe
mov edx, 9
jmp 0x140165bac
mov edx, reloc.WS2_32.dll_select
xor r8d, r8d
mov rcx, rdi
call fcn.14015f720
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x20], rbp
push rsi
push r14
push r15
sub rsp, 0x20
mov r14, r9
mov ebp, r8d
mov r15, rdx
mov rsi, rcx
test rcx, rcx
je 0x140168f63
test rdx, rdx
jne 0x140168f79
xor r8d, r8d
lea edx, [r15 + 0x12]
mov rcx, r9
call fcn.14015f720
mov rax, 0xffffffffffffffff
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
test ebp, 0x1003
je 0x14016903e
mov qword [rsp + 0x40], rbx
lea rax, [0x140193884]
test bpl, 1
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
lea r12, [fcn.140190ae0]
cmovne r12, rax
xor ebx, ebx
cmp qword [rcx + 0x48], rbx
jbe 0x140168ffd
mov r9, r14
mov r8d, ebp
mov rdx, rbx
mov rcx, rsi
call fcn.140169f50
mov rdi, rax
test rax, rax
je 0x140168ff4
test bpl, 2
je 0x140168fe7
mov edx, Ordinal_50
mov rcx, rax
call fcn.1401756c8
test rax, rax
je 0x140168fe7
lea rdi, [rax + 1]
mov rdx, rdi
mov rcx, r15
call r12
test eax, eax
je 0x140169031
inc rbx
cmp rbx, qword [rsi + 0x48]
jb 0x140168fb2
xor r8d, r8d
mov rcx, r14
lea edx, [r8 + 9]
call fcn.14015f720
mov rax, 0xffffffffffffffff
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov rcx, r14
call fcn.14015f680
mov rax, rbx
jmp 0x140169013
mov rcx, qword [rcx + 0x70]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rsi
jmp 0x140165ac0
Function at 0x140169380
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
test r9, r9
je 0x14016949e
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x140169422
sub rsi, rdx
movzx eax, word [rbx + 8]
lea rdx, [rsp + 0x48]
or eax, 2
mov r8d, 1
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, byte [rsi + rdi]
mov byte [rdi], cl
mov byte [rsp + 0x48], cl
mov ecx, dword [rbx]
not ecx
call fcn.140169fe0
not eax
lea rdx, [rsp + 0x48]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x48], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.140169fe0
lea rdi, [rdi + 1]
not eax
mov dword [rbx + 8], eax
sub rbp, 1
jne 0x1401693b1
jmp 0x14016948a
xor edi, edi
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rbx]
lea rdx, [rsp + 0x48]
movzx eax, byte [rdi + rsi]
not ecx
mov r8d, 1
mov byte [rsp + 0x48], al
call fcn.140169fe0
not eax
lea rdx, [rsp + 0x48]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x48], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.140169fe0
inc rdi
not eax
mov dword [rbx + 8], eax
cmp rdi, rbp
jb 0x140169430
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1401694a0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
test r9, r9
je 0x1401695de
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x48], rdi
mov rbp, r9
mov r15, r8
mov r14, rdx
mov rbx, rcx
test rdx, rdx
je 0x140169562
mov qword [rsp + 0x40], rsi
sub r15, rdx
nop dword [rax]
mov ecx, dword [rbx]
lea rdx, [rsp + 0x58]
movzx esi, byte [r15 + r14]
not ecx
movzx edi, word [rbx + 8]
mov r8d, 1
or di, 2
mov byte [rsp + 0x58], sil
call fcn.140169fe0
not eax
lea rdx, [rsp + 0x58]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x58], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.140169fe0
not eax
lea r14, [r14 + 1]
mov dword [rbx + 8], eax
movzx eax, di
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, sil
mov byte [r14 - 1], cl
sub rbp, 1
jne 0x1401694e0
mov rsi, qword [rsp + 0x40]
jmp 0x1401695cb
xor edi, edi
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rbx]
lea rdx, [rsp + 0x58]
movzx eax, byte [rdi + r15]
not ecx
mov r8d, 1
mov byte [rsp + 0x58], al
call fcn.140169fe0
not eax
lea rdx, [rsp + 0x58]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x58], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.140169fe0
inc rdi
not eax
mov dword [rbx + 8], eax
cmp rdi, rbp
jb 0x140169570
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
Function at 0x140169600
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
sub rsp, 0x58
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x60]
xor r9d, r9d
mov dword [rsp + 0x48], r9d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], reloc.WS2_32.dll_recv
mov qword [rsp + 0x30], r8
lea r8d, [r9 + 0x10]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r9
call sub.bcrypt.dll_BCryptEncrypt
test eax, eax
setns al
add rsp, 0x58
ret

Function at 0x140169840
Capabilities:
Hash data via bcrypt

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x140169869
mov eax, 0xffffffff
cmp r8, rax
ja 0x140169869
mov rcx, qword [rcx + 8]
xor r9d, r9d
call sub.bcrypt.dll_BCryptHashData
test eax, eax
setns al
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x140169b90
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x28
movzx r8d, dx
mov r9d, 2
mov rdx, rcx
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
setns al
add rsp, 0x28
ret
Function at 0x140173cd0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x14017433c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140174386
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140174386
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140174386
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140174386
cmp dword [rcx + 0x84], 0xe
jbe 0x140174386
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140174388
xor al, al
add rsp, 0x28
ret

Function at 0x140183008
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140182e9b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140182e9b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140182e9b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140182e9b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140182e9b
cmp dword [rcx + 0x84], 0xe
jbe 0x140182e9b
cmp dword [rcx + 0xf8], 0
je 0x140182e9b
mov ecx, ebx
call fcn.140182f3c
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140182d2c
cmp dword [rbp + 0x20], 0
je 0x140182ee8
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140182ef0
int3
xor r8d, r8d
xor edx, edx
jmp 0x140182e34

Function at 0x1401a05b4
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1401a0591
call fcn.1401830cc
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
call fcn.14018271c
or eax, 0xffffffff
jmp 0x1401a05ae
sub dword [rcx + 0x10], 1
jns 0x1401a05a0
add rsp, 0x28
jmp fcn.14019efa8
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x1401a0570