joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401305d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x140713740]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], rdx
mov r13, rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [r11 - 0x58], xmm0
mov dword [r11 - 0x48], ebx
call fcn.1400fd420
mov rbp, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov r8d, 0x19
lea rdx, str.NtQueryInformationProcess
lea rcx, [rsp + 0x40]
call fcn.1400fe440
nop
mov dword [rsp + 0x30], 1
call fcn.14010e720
lea r12, [rbp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x40]
mov rsi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x58]
cmp r14, 0xf
cmova r8, rsi
movabs rdx, 0xcbf29ce484222325
mov ecx, ebx
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x1401306c4
movabs r9, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rdi
jb 0x1401306b0
mov rcx, qword [rbp + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r15, qword [rbp + 8]
cmp rbx, r15
je 0x14013072b
mov rbp, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x140130702
mov rdx, qword [rdx]
lea rcx, [rsp + 0x40]
cmp r14, 0xf
cmova rcx, rsi
cmp rdi, rax
jne 0x140130720
mov r8, rdi
call fcn.14041c7a0
test eax, eax
je 0x14013072d
cmp rbx, rbp
je 0x14013072b
mov rbx, qword [rbx + 8]
jmp 0x1401306f0
xor ebx, ebx
test rbx, rbx
cmove rbx, r15
mov rcx, r12
cmp rbx, r15
je 0x140130784
mov rdi, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x14013078a
lea rbx, [r13 + 8]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, gethostbyname
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rbx]
call rdi
mov rcx, rbx
mov rbp, qword [rsp + 0x38]
test eax, eax
js 0x140130793
test rbp, rbp
je 0x140130793
mov dil, 1
jmp 0x140130799
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [r13 + 8]
mov rbp, qword [rsp + 0x38]
xor dil, dil
mov rbx, rcx
cmp r14, 0xf
jbe 0x1401307cc
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1401307c4
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140130821
mov rcx, rsi
call fcn.1403e5198
test dil, dil
je 0x1401307f1
mov qword [rsp + 0x20], 0
mov r9d, 0x250
mov r8, rbp
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1403e5550
mov rbx, qword [rsp + 0xf0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1403eb834
int3
Function at 0x140130850
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x140713740]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r13, r8
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x68], xmm0
mov qword [r11 - 0x60], rax
mov dword [r11 - 0x58], eax
mov dword [r11 - 0x50], ebx
call fcn.1400fd420
mov rbp, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov r8d, 0x18
lea rdx, str.NtQueryInformationThread
lea rcx, [rsp + 0x38]
call fcn.1400fe440
nop
mov dword [rsp + 0x30], 1
call fcn.14010e720
lea r12, [rbp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x38]
mov rsi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x50]
cmp r14, 0xf
cmova r8, rsi
movabs rdx, 0xcbf29ce484222325
mov ecx, ebx
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x140130944
movabs r9, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rdi
jb 0x140130930
mov rcx, qword [rbp + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r15, qword [rbp + 8]
cmp rbx, r15
je 0x1401309ab
mov rbp, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x140130982
mov rdx, qword [rdx]
lea rcx, [rsp + 0x38]
cmp r14, 0xf
cmova rcx, rsi
cmp rdi, rax
jne 0x1401309a0
mov r8, rdi
call fcn.14041c7a0
test eax, eax
je 0x1401309ad
cmp rbx, rbp
je 0x1401309ab
mov rbx, qword [rbx + 8]
jmp 0x140130970
xor ebx, ebx
test rbx, rbx
cmove rbx, r15
mov rcx, r12
cmp rbx, r15
je 0x1401309f9
mov rbx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x1401309ff
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x1c
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call rbx
test eax, eax
js 0x1401309ff
test r13, r13
je 0x1401309ff
mov bl, 1
jmp 0x140130a01
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor bl, bl
cmp r14, 0xf
jbe 0x140130a34
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140130a2c
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140130a8c
mov rcx, rsi
call fcn.1403e5198
test bl, bl
je 0x140130a5d
mov edx, dword [rsp + 0x6c]
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, r13
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rsp + 0x6c]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1403e5550
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1403eb834
int3
Function at 0x140139e70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 7
mov rsi, r8
mov r10, qword [rdx + 0x10]
mov r8, rdx
mov rbx, rcx
jbe 0x140139e8f
mov rdx, qword [rdx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
add r10, r10
je 0x140139ec3
movabs r11, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
xor r9, rax
imul r9, r11
cmp rcx, r10
jb 0x140139eb0
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x40]
call fcn.140107a90
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x140139ede
mov rcx, qword [rbx + 0x48]
cmp rcx, qword [rbx + 0x48]
je 0x140139ef8
mov eax, dword [rcx + 0x30]
add rax, qword [rbx + 0x18]
mov qword [rsi], rax
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov eax, 0x806d0013
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x14013d890
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14013da6b
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1400fdf60
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14013da34
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14013d9ac
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14013da23
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x14013d9e9
mov r10, qword [rdx]
cmp r10, rax
je 0x14013d9e3
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14013da23
cmp r9, rdx
je 0x14013d9ff
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x14013da45
cmp r9, rdx
jne 0x14013d9f0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x14013d930
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14013da23
lea rcx, str.invalid_hash_bucket_count
call fcn.1403e20fc
int3

Function at 0x14013dca0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140713740]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1403e5550
add rsp, 0x68
ret
Function at 0x140165ad0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x168
mov rax, qword [0x140713740]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x38], 0x101
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x140165b67
mov eax, dword [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x28], rax
movzx edx, byte [rsp + 0x24]
mov rcx, qword [rsp + 0x28]
call fcn.1400fe420
nop
mov r8, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x170]
call fcn.1400fe440
nop
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x170]
jmp 0x140165b8e
lea rdx, [0x140426658]
mov rcx, qword [rsp + 0x170]
call fcn.1400fde20
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1403e5550
add rsp, 0x168
ret
Function at 0x14017a730
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [0x140713740]
xor rax, rsp
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0xa0], 0
jg 0x14017a767
xor eax, eax
jmp 0x14017a9d1
mov rax, qword [rsp + 0x90]
cmp qword [rax + 0x68], 0
je 0x14017a798
mov r8, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.14017a9f0
jmp 0x14017a9d1
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x38]
cmp qword [rax], 0
je 0x14017a7d8
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x50]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
jmp 0x14017a7e0
mov dword [rsp + 0x20], 0
movsxd rax, dword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
jbe 0x14017a8ba
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call fcn.1400fea80
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x98]
call fcn.1400fe1b0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x50]
mov ecx, dword [rsp + 0x28]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx + 0x50]
mov dword [rcx], eax
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx + 0x38]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx + 0x38]
mov qword [rcx], rax
mov rax, qword [rsp + 0x90]
cmp qword [rax + 0x80], 0
je 0x14017a9c1
mov rcx, qword [rsp + 0x90]
call fcn.14016a9c0
mov qword [rsp + 0x60], 0xfff
cmp qword [rsp + 0x68], 0xfff
jbe 0x14017a96f
mov rax, qword [rsp + 0x90]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x98]
call fcn.1403f1ee4
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x30], 0xfff
je 0x14017a96a
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
jmp 0x14017a9d1
jmp 0x14017a8e6
cmp qword [rsp + 0x68], 0
jbe 0x14017a9c1
mov rax, qword [rsp + 0x90]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x68]
mov edx, 1
mov rcx, qword [rsp + 0x98]
call fcn.1403f1ee4
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1403e5550
add rsp, 0x88
ret
Function at 0x14017ca30
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xb0
mov rax, qword [0x140713740]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor edi, edi
mov dword [rcx], 0x2298
mov dword [rsp + 0x38], edi
lea r9, [rsp + 0x68]
mov qword [rsp + 0x30], rdi
mov rbx, rcx
mov qword [rcx + 8], rdi
xor r8d, r8d
mov qword [rcx + 0x10], rdi
xor edx, edx
mov byte [rcx + 0x18], dil
lea rcx, [0x14042880c]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x14017cbc1
mov r8d, dword [rsp + 0x68]
lea r10, [rsp + 0x9a]
nop word [rax + rax]
sub r10, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r10], r8w
mov r8d, edx
test edx, edx
jne 0x14017cab0
lea r9, [rsp + 0x40]
mov rdx, r10
lea r8, [rsp + 0x9a]
lea rcx, [rsp + 0x48]
call fcn.1401117c0
cmp qword [rsp + 0x60], 7
lea rcx, [rsp + 0x48]
mov eax, dword [rbx]
mov r8d, 4
cmova rcx, qword [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
xor edx, edx
mov rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdx, qword [rsp + 0x60]
mov qword [rbx + 8], rax
cmp rdx, 7
jbe 0x14017cb70
mov rcx, qword [rsp + 0x48]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017cb6b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14017cbbb
call fcn.1403e5198
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14017cb97
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov edx, 0xf001f
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x10], rax
mov byte [rbx + 0x18], 1
mov rax, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1403e5550
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb0
pop rdi
ret
call fcn.1403eb834
int3
lea rdx, [0x140428810]
lea rcx, [rsp + 0x70]
call fcn.14015fce0
lea rdx, [0x14056b9b0]
lea rcx, [rsp + 0x70]
call fcn.1403e65b8
int3
Function at 0x140197220
Capabilities:
Reference http user-agent string

Disassembly:
xor eax, eax
mov dword [rcx + 0x18], eax
mov qword [rcx], rax
lea rax, [0x14042e274]
mov qword [rcx + 8], rax
lea rax, str.Mozilla_5.0__compatible__MSIE_9.0__Windows_NT_6.1__Trident_5.0_
mov qword [rcx + 0x10], rax
mov rax, rcx
ret

Function at 0x1401979d0
Capabilities:
Initialize winhttp library

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx], 0
mov rbx, rcx
je 0x1401979e7
xor al, al
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rcx + 0x10]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
test rax, rax
mov qword [rbx], rax
setne al
add rsp, 0x30
pop rbx
ret

Function at 0x140197eb0
Capabilities:
Receive http response

Disassembly:
push rbp
push rsi
sub rsp, 0x48
mov rax, qword [0x140713740]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, rdx
mov rbp, rcx
test rcx, rcx
jne 0x140197edb
mov eax, 0xffffffff
jmp 0x140197fb1
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r14
xor r14d, r14d
mov qword [rsp + 0x30], r15
mov edi, r14d
mov r15, 0xffffffffffffffff
mov qword [rsp + 0x70], rbx
nop dword [rax]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x24], r14d
mov rcx, rbp
mov dword [rsp + 0x20], r14d
call qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x140197f9b
mov eax, dword [rsp + 0x20]
test eax, eax
je 0x140197f9b
add eax, 1
mov ecx, eax
cmovb rcx, r15
call fcn.1403f9484
mov r8d, dword [rsp + 0x20]
xor edx, edx
inc r8d
mov rcx, rax
mov rbx, rax
call fcn.14041cf40
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x24]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x140197f8e
mov r9d, dword [rsp + 0x20]
mov r8, rbx
mov rdx, qword [rsi + 8]
mov rcx, rsi
call fcn.140196f50
add edi, dword [rsp + 0x24]
mov rcx, rbx
call fcn.1403ebe18
cmp dword [rsp + 0x20], r14d
ja 0x140197f00
jmp 0x140197f9b
test rbx, rbx
je 0x140197f9b
mov rcx, rbx
call fcn.1403ebe18
mov r15, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1403e5550
add rsp, 0x48
pop rsi
pop rbp
ret
Function at 0x14019e610
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140713740]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140716940]
mov edi, edx
mov esi, ecx
cmp byte [rbx + 0x4a7d], 0
jne 0x14019e678
cmp byte [rbx + 0x4a7e], 0
jne 0x14019e678
movsx r9d, word [rbx + 0x5ba2]
lea r8, [0x140431c70]
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.1401a4960
test sil, 1
je 0x14019e7b0
jmp 0x14019e711
movss xmm1, dword [rbx + 0x389c]
lea r8, [0x140431c70]
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x140432ae0]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x140432ad4]
addss xmm0, dword [rbx + 0xe08]
addss xmm1, dword [rbx + 0xe0c]
or dword [rbx + 0x47d0], 1
mov qword [rbx + 0x47e8], rax
movss dword [rbx + 0x47e0], xmm0
mov dword [rbx + 0x47d4], 1
movss dword [rbx + 0x47e4], xmm1
movss xmm0, dword [rbx + 0x3904]
mov rax, qword [0x140716940]
mulss xmm0, dword [0x140432a84]
or dword [rax + 0x47d0], 0x40
movss dword [rax + 0x4830], xmm0
movsx r9d, word [rbx + 0x5ba2]
call fcn.1401a4960
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14019e761
lea r11, [0x140432090]
cmp r9b, 0x23
jne 0x14019e744
cmp byte [r8], r9b
jne 0x14019e744
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14019e731
not ecx
call fcn.1401a3020
test rax, rax
je 0x14019e7b0
cmp byte [rax + 0xb6], 0
je 0x14019e7b0
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, reloc.WS2_32.dll_recv
inc word [rbx + 0x5ba2]
movsx r9d, word [rbx + 0x5ba2]
call fcn.1401a4960
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.14019b880
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1403e5550
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1401a2f70
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140716940]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x1401a2fd3
mov qword [rsp], rbx
lea rbx, [0x140432090]
nop dword [rax]
cmp r9b, 0x23
jne 0x1401a2fb3
cmp byte [r8], r9b
jne 0x1401a2fb3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1401a2fa0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5c00]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x1401a3007
mov r10, qword [r10 + 0x5c08]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x1401a300e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x1401a2ff4
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x1401a30a0
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rax]
lea r8, [rax + 1]
test r9b, r9b
je 0x1401a30f0
lea r11, [0x140432090]
cmp r9b, 0x23
jne 0x1401a30d3
cmp byte [r8], r9b
jne 0x1401a30d3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1401a30c0
not ecx
jmp fcn.1401a3020

Function at 0x1401a3b50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov r11, rcx
lea rdi, [0x140432090]
movsxd rcx, dword [rcx + 0xf0]
mov r10d, edx
shr r10d, 0x18
mov r8d, edx
shr r8d, 8
mov r9d, edx
mov rax, qword [r11 + 0xf8]
shr r9d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r8b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, r10
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
mov rcx, qword [r11]
not ebx
cmp dword [rcx + 0x3f40], ebx
jne 0x1401a3be7
movsxd r8, edx
xor r9d, r9d
mov edx, 4
mov ecx, ebx
call fcn.1401a0db0
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret