joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000f1a0
Capabilities:
Encrypt data using rc6

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x1f0
xor r9d, r9d
mov rdi, rcx
mov r10d, r9d
mov r11d, r9d
mov r8d, r9d
movzx eax, byte [rdx]
shl r8d, 8
inc r11d
or r8d, eax
inc rdx
test r11b, 3
jne 0x18000f1e8
mov eax, r10d
inc r10d
mov dword [rsp + rax*4 + 0xf0], r8d
mov r8d, r9d
cmp r11d, 0x10
jb 0x18000f1c1
mov dword [rsp + 0x20], 0xb7e15163
lea rcx, [rsp + 0x24]
lea rdx, [rsp + 0x20]
mov r8d, 0x2b
mov eax, dword [rdx]
lea rdx, [rdx + 4]
sub eax, 0x61c88647
mov dword [rcx], eax
lea rcx, [rcx + 4]
dec r8
jne 0x18000f206
lea ecx, [r8 + 0x2c]
mov eax, r10d
mov r11d, r9d
cmp r10d, ecx
mov r8d, r9d
mov ebx, r9d
cmovb eax, ecx
lea ecx, [rax + rax*2]
test ecx, ecx
je 0x18000f290
mov esi, ecx
mov ecx, r11d
mov edx, r9d
mov eax, dword [rsp + rcx*4 + 0x20]
add eax, r8d
add ebx, eax
mov eax, 0xba2e8ba3
ror ebx, 3
mov dword [rsp + rcx*4 + 0x20], ebx
lea ecx, [r8 + rbx]
add r8d, dword [rsp + rdx*4 + 0xf0]
add r8d, ebx
ror r8d, cl
inc r11d
mov dword [rsp + rdx*4 + 0xf0], r8d
mul r11d
shr edx, 5
lea eax, [r9 + 1]
imul edx, edx, 0x2c
sub r11d, edx
xor edx, edx
div r10d
mov r9d, edx
dec rsi
jne 0x18000f23b
lea rdx, [rsp + 0x20]
mov r8d, 0xb0
mov rcx, rdi
call fcn.18000f2be
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140001b00
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x460
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rsi, r9
mov rdi, r8
cmp byte [0x140029a20], 1
jne 0x140001b3a
xor al, al
jmp 0x140001ca5
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
mov rdx, rsi
lea rcx, str.chat_data
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
mov rbx, 0xffffffffffffffff
test eax, eax
jne 0x140001b92
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x140001b70
test rax, rax
je 0x140001b92
mov r8, rdi
lea rdx, str.SELECT__FROM_chat_data_WHERE_message__s
lea rcx, [rsp + 0x50]
call fcn.140001010
mov rdx, rsi
lea rcx, str.latest_news
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140001bd2
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x140001bb0
test rax, rax
je 0x140001bd2
mov r8, rdi
lea rdx, str.SELECT__FROM_latest_news_WHERE_region__s
lea rcx, [rsp + 0x50]
call fcn.140001010
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rsp + 0x50]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001bf0
mov r8, rbx
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.140004630
nop
mov rcx, qword [0x140029a28]
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + 0x30]
mov rbx, rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140001c61
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c5c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e37c
movdqa xmm0, xmmword [0x140022f70]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x170]
test al, al
setne dil
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x30]
mov r8, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r8]
movzx eax, dil
jmp 0x140001ca5
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14001e250
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140003020
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x460
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rcx
cmp byte [0x140029a20], 1
jne 0x140003052
xor al, al
jmp 0x140003148
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
mov r8, rbx
lea rdx, str.SELECT__FROM_offline_WHERE_role_name__s
lea rcx, [rsp + 0x50]
call fcn.140001010
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140003095
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.140004630
nop
mov rcx, qword [0x140029a28]
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + 0x30]
mov rbx, rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140003104
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400030ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400030ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e37c
movdqa xmm0, xmmword [0x140022f70]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x170]
test al, al
setne dil
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x30]
mov r8, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r8]
movzx eax, dil
jmp 0x140003148
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14001e250
mov rbx, qword [rsp + 0x478]
add rsp, 0x460
pop rdi
ret
Function at 0x14001c400
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14001c58c
mov rdx, qword [rdi + 0x10]
mov ecx, 2
mov qword [rsp + 0x38], rbx
add rdx, 4
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp qword [rdi + 0x18], 0xf
mov rbp, rdi
mov rsi, rax
jbe 0x14001c44b
mov rbp, qword [rdi]
mov rbx, qword [rdi + 0x10]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea r8, [rbx + 4]
mov rdx, rbp
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rsi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp qword [0x140029a38], 0
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
je 0x14001c52f
mov ecx, socket
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x11
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x56
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
mov cl, 0x56
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
mov cl, 0x11
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
mov cl, reloc.WS2_32.dll_listen
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0x2d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [0x140029a40]
test rbx, rbx
je 0x14001c587
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x480
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x302
call qword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x1e
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4cc
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageA]
mov rbx, qword [rsp + 0x38]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x14001c5c2
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14001c5bd
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001c5db
mov rcx, r8
call fcn.14001e37c
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14001d790
Capabilities:
Get hostname
Initialize winsock library
Resolve dns
Terminate process

Disassembly:
sub rsp, 0x308
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
lea rcx, str._n
call fcn.140004fc0
lea rcx, str.Method_One:
call fcn.140004fc0
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x14001d7df
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x310], rbx
lea rcx, [rsp + 0x1d0]
mov qword [rsp + 0x318], rsi
mov edx, 0x100
mov qword [rsp + 0x300], rdi
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rsp + 0x1d0]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rcx, qword [rax + 0x18]
mov rdi, qword [rcx]
mov ebx, dword [rdi]
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [0x140022d48]
call fcn.140004fc0
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov ecx, dword [rdi + 4]
mov rsi, rax
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [0x140022d60]
call fcn.140004fc0
mov ecx, dword [rdi + 8]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [0x140022d78]
call fcn.140004fc0
mov ecx, dword [rdi + 0xc]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [0x140022d90]
call fcn.140004fc0
mov ecx, dword [rdi + 0x10]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [0x140022da8]
call fcn.140004fc0
lea rcx, str._n_n
call fcn.140004fc0
lea rcx, str._n
call fcn.140004fc0
lea rcx, str.Method_Two:
call fcn.140004fc0
xor edx, edx
lea rcx, [rsp + 0x1f0]
mov r8d, 0x100
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.WS2_32.dll_gethostbyname]
xor edx, edx
lea rcx, [rsp + 0x1f0]
mov r8d, 0x100
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov edx, 0x100
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.WS2_32.dll_gethostname]
mov rcx, qword [rdi + 0x18]
mov rdx, qword [rcx]
test rdx, rdx
je 0x14001d969
xor ebx, ebx
nop dword [rax]
nop word [rax + rax]
movsx r8, word [rdi + 0x12]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [0x140022e10]
call fcn.140004fc0
mov rax, qword [rdi + 0x18]
lea rbx, [rbx + 8]
mov rdx, qword [rbx + rax]
test rdx, rdx
jne 0x14001d930
lea rcx, str._n
call fcn.140004fc0
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rdi, qword [rsp + 0x300]
mov rax, rsi
mov rsi, qword [rsp + 0x318]
mov rbx, qword [rsp + 0x310]
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.14001e250
add rsp, 0x308
ret
Function at 0x14001ed10
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001ed5a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001ed5a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001ed5a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001ed5a
cmp dword [rcx + 0x84], 0xe
jbe 0x14001ed5a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001ed5c
xor al, al
add rsp, 0x28
ret
Function at 0x140001800
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
call fcn.140001a70
test eax, eax
js 0x140001a64
mov ecx, dword [rbx + 0xf0]
lea eax, [rcx*4]
movsxd r9, eax
test eax, eax
jle 0x140001893
lea r8, [rbx + 8]
xor r10d, r10d
lea r8, [r8 + r9*4]
lea rax, [rbx + 8]
nop dword [rax]
mov edx, dword [rax - 8]
add r10, 4
mov ecx, dword [r8 - 8]
lea r8, [r8 - 0x10]
mov dword [rax - 8], ecx
lea rax, [rax + 0x10]
mov ecx, dword [r8 + 0xc]
sub r9, 4
mov dword [r8 + 8], edx
mov edx, dword [rax - 0x14]
mov dword [rax - 0x14], ecx
mov ecx, dword [r8 + 0x10]
mov dword [r8 + 0xc], edx
mov edx, dword [rax - 0x10]
mov dword [rax - 0x10], ecx
mov ecx, dword [r8 + 0x14]
mov dword [r8 + 0x10], edx
mov edx, dword [rax - 0xc]
mov dword [rax - 0xc], ecx
mov dword [r8 + 0x14], edx
cmp r10, r9
jl 0x140001840
mov ecx, dword [rbx + 0xf0]
mov r11d, 1
cmp ecx, r11d
jle 0x140001a62
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 4]
lea rdi, [0x140000000]
nop dword [rax]
nop word [rax + rax]
mov r9d, dword [r10 + 0x10]
lea r10, [r10 + 0x10]
mov edx, dword [r10 - 4]
inc r11d
movzx eax, byte [r10 - 3]
movzx ecx, byte [rdi + rax*4 + 0xfe550]
mov eax, edx
shr rax, 0x18
mov r8d, dword [rdi + rcx*4 + 0xff150]
movzx eax, byte [rdi + rax*4 + 0xfe550]
xor r8d, dword [rdi + rax*4 + 0xfe950]
movzx eax, dl
movzx ecx, byte [rdi + rax*4 + 0xfe550]
movzx eax, byte [r10 - 2]
xor r8d, dword [rdi + rcx*4 + 0xff550]
movzx ecx, byte [rdi + rax*4 + 0xfe550]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0xfed50]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10 - 4], r8d
movzx edx, byte [rdi + rcx*4 + 0xfe550]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0xfed50]
movzx eax, byte [rdi + rcx*4 + 0xfe550]
xor r8d, dword [rdi + rax*4 + 0xff150]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0xfe550]
movzx eax, r9b
mov r9d, dword [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0xfe950]
movzx ecx, byte [rdi + rax*4 + 0xfe550]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0xff550]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10], r8d
movzx edx, byte [rdi + rcx*4 + 0xfe550]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0xfed50]
movzx eax, byte [rdi + rcx*4 + 0xfe550]
xor r8d, dword [rdi + rax*4 + 0xff150]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0xfe550]
movzx eax, r9b
mov r9d, dword [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0xfe950]
movzx ecx, byte [rdi + rax*4 + 0xfe550]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0xff550]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10 + 4], r8d
movzx edx, byte [rdi + rcx*4 + 0xfe550]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0xfed50]
movzx eax, byte [rdi + rcx*4 + 0xfe550]
xor r8d, dword [rdi + rax*4 + 0xff150]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0xfe550]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0xfe950]
movzx ecx, byte [rdi + rax*4 + 0xfe550]
xor r8d, dword [rdi + rcx*4 + 0xff550]
mov dword [r10 + 8], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x1400018c0
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400329c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
lea rcx, [rbp - 0x20]
call fcn.1400053e0
nop
mov dword [rbp + 0x18], 0x400
mov dword [rbp + 0x20], 0x6e65704f
mov byte [rbp + 0x24], 0
mov edx, 0x400
lea rcx, [rbp - 0x20]
call fcn.140031e50
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
mov r8, rbx
mov ebx, 2
mov edx, ebx
xor ecx, ecx
call fcn.14007c200
lea edx, [rbx - 3]
lea rcx, [rbp - 0x20]
call fcn.140036030
lea rcx, [rbp - 0x20]
call fcn.140034a90
mov dword [rbp - 0x17], 0x46455249
mov byte [rbp - 0x18], 0x46
mov word [rbp - 0x12], 0x58
mov byte [rbp - 0x13], 0x4f
xor r8d, r8d
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x20]
call fcn.140031b00
test eax, eax
jns 0x140032b0b
mov dword [rbp + 0x2a], 0x454c474f
mov word [rbp + 0x28], 0x4f47
mov byte [rbp + 0x2e], 0
xor r8d, r8d
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x20]
call fcn.140031b00
test eax, eax
js 0x140032ab0
mov dword [rbp - 0x2e], 0x454d4f52
mov word [rbp - 0x30], 0x4843
mov byte [rbp - 0x2a], 0
xor r8d, r8d
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call fcn.140031b00
test eax, eax
js 0x140032ab0
mov ebx, 1
jmp 0x140032b0b
mov dword [rbp - 0xb], 0x45524f
mov dword [rbp - 0xf], 0x4c505845
mov byte [rbp - 0x10], 0x49
xor r8d, r8d
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x20]
call fcn.140031b00
test eax, eax
js 0x140032add
mov ebx, 3
jmp 0x140032b0b
mov dword [rbp - 0x27], 0x47444553
mov byte [rbp - 0x28], 0x4d
mov word [rbp - 0x23], 0x45
xor r8d, r8d
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x20]
call fcn.140031b00
test eax, eax
js 0x140032b09
mov ebx, 4
jmp 0x140032b0b
xor ebx, ebx
lea rcx, [rbp - 0x20]
call fcn.140005630
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x14003cce0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
mov eax, 0xffffffff
movzx ecx, byte [rcx]
test cl, cl
je 0x14003cd8c
movzx edx, cl
lea r8, [r8 + 1]
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x14003ccf3
not eax
ret

Function at 0x14003dc50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1020]
mov eax, 0x1120
call fcn.1400d0e60
sub rsp, rax
movsxd r15, r8d
mov r14, rcx
lea rcx, [rbp - 0x80]
call fcn.140002b60
nop
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.14003e0b0
nop
lea rcx, [rbp - 0x80]
call fcn.140002e00
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x820]
call fcn.1400d2f90
xor ebx, ebx
lea rcx, [rsp + 0x58]
call fcn.14003e410
test rax, rax
je 0x14003dcfa
mov esi, ebx
lea rdi, [rbp + 0x820]
nop
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.14003dbd0
movzx ecx, byte [rax]
mov byte [rdi], cl
inc ebx
lea rdi, [rdi + 1]
movsxd rsi, ebx
lea rcx, [rsp + 0x58]
call fcn.14003e410
cmp rsi, rax
jb 0x14003dcd0
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0xc20]
call fcn.1400d2f90
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x420]
call fcn.1400d2f90
mov dword [rsp + 0x37], 0x41324443
mov word [rsp + 0x3b], 0x4537
mov dword [rsp + 0x47], 0x46434243
mov dword [rsp + 0x30], 0x37383843
mov word [rsp + 0x3e], 0x3646
mov word [rsp + 0x4f], 0x39
mov word [rsp + 0x34], 0x3444
mov dword [rsp + 0x43], 0x42413436
mov word [rsp + 0x4c], 0x4638
mov word [rsp + 0x41], 0x4232
mov byte [rsp + 0x4e], 0x39
mov byte [rsp + 0x36], 0x32
mov byte [rsp + 0x4b], 0x36
mov byte [rsp + 0x3d], 0x39
mov byte [rsp + 0x40], 0x44
lea r8, [rsp + 0x30]
mov edx, 0x400
lea rcx, [rbp + 0x420]
call fcn.1400d7534
lea rcx, [rbp - 0x60]
call fcn.140081470
nop
mov dword [rsp + 0x20], 0x10
mov r9d, 0x20
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0x420]
lea rcx, [rbp - 0x60]
call fcn.140082650
lea rcx, [rsp + 0x58]
call fcn.14003e410
mov r9, rax
mov dword [rsp + 0x20], 1
lea r8, [rbp + 0xc20]
lea rdx, [rbp + 0x820]
lea rcx, [rbp - 0x60]
call fcn.140081520
lea rdx, [rbp + 0xc20]
add rdx, r15
mov rcx, r14
call fcn.140002b60
nop
lea rcx, [rbp - 0x60]
call fcn.1400814d0
nop
lea rcx, [rsp + 0x58]
call fcn.14003dba0
mov rax, r14
lea r11, [rsp + 0x1120]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140080650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rsi, rdx
xor edi, edi
mov dword [rbp - 0x30], edi
lea rdx, [rbp - 0x28]
call fcn.140080720
mov rcx, rsi
call fcn.140002bf0
mov dword [rbp - 0x30], 1
lea edx, [rdi + 0x20]
mov rcx, rsi
call fcn.1400813d0
nop word [rax + rax]
mov dword [rbp - 0xd], 0x65646362
mov dword [rbp - 0x18], 0x33323130
mov word [rbp - 9], 0x66
mov word [rbp - 0x10], 0x3938
mov word [rbp - 0x13], 0x3635
mov byte [rbp - 0x11], 0x37
mov byte [rbp - 0xe], 0x61
mov byte [rbp - 0x14], 0x34
movzx ebx, byte [rbp + rdi - 0x28]
mov eax, ebx
shr rax, 4
movzx edx, byte [rbp + rax - 0x18]
mov rcx, rsi
call fcn.140005d10
and ebx, 0xf
movzx edx, byte [rbp + rbx - 0x18]
mov rcx, rsi
call fcn.140005d10
inc rdi
cmp rdi, 0x10
jl 0x1400806a0
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x140082c10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
cmp byte [rcx + 8], 0
mov r9, rcx
je 0x140082c4b
xor ecx, ecx
cmp dword [r9 + 0x3d0], ecx
jle 0x140082c46
sub r8, rdx
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
inc ecx
xor byte [rdx], al
lea rdx, [rdx + 1]
cmp ecx, dword [r9 + 0x3d0]
jl 0x140082c30
add rsp, 0x48
ret
mov rdx, qword [str.Object_not_Initialized]
lea rcx, [rsp + 0x20]
call fcn.140081490
lea rdx, [0x14011ffa0]
lea rcx, [rsp + 0x20]
call fcn.1400d1a98
int3
Function at 0x140084d90
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [rcx], 0x6a09e667
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
ret
Function at 0x140085290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
movsxd rbx, edx
mov rdi, rcx
xor edx, edx
lea rcx, [rbp - 0x70]
mov r8d, 0x200
call fcn.1400d2f90
mov r10d, 0x6f
mov dword [rbp + 0x1e0], 0x200
mov eax, 0x68
mov dword [rsp + 0x70], 0x740066
mov word [rbp - 0x76], ax
lea rdx, [rsp + 0x50]
lea rax, [rsp + 0x30]
mov dword [rbp - 0x7a], 0x700061
lea r8d, [r10 + 3]
mov dword [rsp + 0x74], 0x43005c
mov word [rsp + 0x68], r8w
lea r12d, [r10 - 0x22]
mov word [rbp - 0x7c], r8w
mov r9d, 0x20019
xor r8d, r8d
mov dword [rsp + 0x6a], 0x73006f
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x58], 0x410057
mov dword [rsp + 0x78], 0x790072
mov dword [rsp + 0x60], 0x4d005c
mov dword [rsp + 0x7c], 0x740070
mov dword [rsp + 0x64], 0x630069
mov dword [rbp - 0x80], 0x67006f
mov dword [rsp + 0x5c], 0x450052
mov dword [rsp + 0x50], 0x4f0053
mov dword [rsp + 0x54], 0x540046
mov dword [rbp - 0x74], 0x79
mov word [rsp + 0x6e], r10w
mov qword [rsp + 0x20], rax
call fcn.14007edd0
test eax, eax
jne 0x140085475
mov rcx, qword [rsp + 0x30]
lea r9, [rbp + 0x1e8]
mov eax, 0x68
mov dword [rsp + 0x40], 0x6e0069
mov word [rsp + 0x3e], ax
lea rdx, [rsp + 0x38]
lea rax, [rbp + 0x1e0]
mov dword [rsp + 0x4c], 0x64
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp - 0x70]
mov dword [rsp + 0x44], 0x470065
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x3a], 0x630061
mov dword [rsp + 0x48], 0x690075
mov word [rsp + 0x38], r12w
call fcn.14007ef80
test eax, eax
je 0x140085455
lea rax, [rsp + 0x30]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call fcn.14007edd0
test eax, eax
jne 0x140085475
mov rcx, qword [rsp + 0x30]
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x1e8]
lea rax, [rbp - 0x70]
xor r8d, r8d
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call fcn.14007ef80
test eax, eax
jne 0x140085475
mov rdx, rbx
lea r8, [rbp - 0x70]
mov r9, 0xffffffffffffffff
mov rcx, rdi
call fcn.1400dea3c
mov rcx, qword [rsp + 0x30]
call fcn.14007eaa0
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret