joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push r13
push r14
push r15
mov qword [rsp + 0x28], rbp
xor r10d, r10d
mov qword [rsp + 0x30], rsi
mov rbx, rdx
mov qword [rsp + 0x38], rdi
mov rax, rcx
mov qword [rsp + 0x40], r12
mov r14d, r10d
lea r15, [0x140000000]
mov r13, rax
test rbx, rbx
je 0x140006f90
cmp rax, rbx
jae 0x14000713c
movzx r8d, byte [rax]
test r8b, r8b
je 0x14000713c
mov r11d, r10d
mov ecx, r8d
shr rcx, 3
mov rdx, rbx
movsx r9, byte [rcx + r15 + 0x1186b0]
test r9d, r9d
sete r11b
add r11d, r9d
test rbx, rbx
jne 0x140006fc8
movsxd rdx, r11d
add rdx, rax
cmp rax, rdx
lea rcx, [rax + 1]
mov edi, r8d
cmovae edi, r10d
cmp rcx, rdx
jae 0x140006fe1
movzx r12d, byte [rcx]
jmp 0x140006fe4
xor r12b, r12b
lea rcx, [rax + 2]
cmp rcx, rdx
jae 0x140006ff2
movzx ebp, byte [rcx]
jmp 0x140006ff5
xor bpl, bpl
lea rcx, [rax + 3]
cmp rcx, rdx
jae 0x140007003
movzx esi, byte [rcx]
jmp 0x140007006
xor sil, sil
lea r9, [r9*4]
movzx ecx, dil
mov r15d, dword [r9 + r15 + 0x1186e8]
and r15d, ecx
movzx r8d, r12b
shl r15d, 6
mov ecx, r8d
and ecx, 0x3f
movzx edx, bpl
or r15d, ecx
movzx r10d, sil
shl r15d, 6
mov ecx, edx
and ecx, 0x3f
and edx, 0xc0
or r15d, ecx
and r8d, 0xc0
mov ecx, r10d
shl r15d, 6
and ecx, 0x3f
shr r10d, 2
or r10d, edx
or r15d, ecx
shr r10d, 2
lea rcx, [0x140000000]
mov ecx, dword [r9 + rcx + 0x118698]
or r10d, r8d
shr r15d, cl
lea rcx, [0x140000000]
shr r10d, 2
mov edx, r15d
cmp r15d, dword [r9 + rcx + 0x118680]
sbb ecx, ecx
and edx, 0xfffff800
and ecx, 0x40
xor r8d, r8d
or r10d, ecx
mov ecx, 0x80
cmp edx, 0xd800
cmove r8d, ecx
xor edx, edx
or r10d, r8d
mov ecx, 0x100
cmp r15d, 0xffff
cmova edx, ecx
lea rcx, [0x140000000]
mov ecx, dword [r9 + rcx + 0x1186d0]
or r10d, edx
xor r10d, 0x2a
sar r10d, cl
test r10d, r10d
je 0x140007126
xor r10d, r10d
test dil, dil
mov eax, r10d
mov ecx, r10d
setne cl
test sil, sil
setne al
add ecx, eax
mov eax, r10d
test bpl, bpl
setne al
add ecx, eax
mov eax, r10d
test r12b, r12b
setne al
add ecx, eax
cmp r11d, ecx
cmovl ecx, r11d
movsxd rax, ecx
add rax, r13
inc r14d
jmp 0x140006f78
movsxd rcx, r11d
add rax, rcx
test r15d, r15d
je 0x14000713c
xor r10d, r10d
inc r14d
jmp 0x140006f78
mov r12, qword [rsp + 0x40]
mov eax, r14d
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
pop r15
pop r14
pop r13
pop rbx
ret
Function at 0x1400096a0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xd8]
lea r8, [0x1400f4a60]
movsxd rcx, dword [rcx + 0xd0]
mov r11d, edx
shr r11d, 0x18
mov r9d, edx
shr r9d, 8
mov r10d, edx
shr r10d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r10b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, r11
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
mov rcx, qword [0x14012fa10]
not ebx
cmp dword [rcx + 0x3ed4], ebx
jne 0x140009735
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.14001bdf0
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140009740
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm0, dword [rcx + 0xf0]
lea r10, [0x1400f4a60]
mov rax, qword [rcx + 0xd8]
movss xmm1, dword [rcx + 0xf4]
movss xmm2, dword [rdx]
movss xmm4, dword [rdx + 8]
subss xmm2, xmm0
movss xmm3, dword [rdx + 4]
subss xmm4, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm3, xmm1
movsxd rcx, dword [rcx + 0xd0]
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp], xmm2
mov r9d, dword [rax + rcx*4 - 4]
movzx eax, byte [rsp]
not r9d
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
movss dword [rsp + 4], xmm3
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 8], xmm4
movss dword [rsp + 0xc], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x18
ret
Function at 0x1400162e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14012e0c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14012fa10]
mov edi, ecx
cmp byte [rbx + 0x424d], 0
jne 0x140016341
cmp byte [rbx + 0x424e], 0
jne 0x140016341
movsx r9d, word [rbx + 0x5342]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.1400066f0
test dil, 1
je 0x140016468
jmp 0x1400163cc
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5342]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x14011b258]
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x14011b23c]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
mov qword [rbx + 0x3fb8], rax
mov dword [rbx + 0x3fa4], 1
movss dword [rbx + 0x3fb0], xmm0
movss dword [rbx + 0x3fb4], xmm1
movss xmm0, dword [rbx + 0x38f4]
mulss xmm0, dword [0x14011b0f8]
or dword [rbx + 0x3fa0], 0x41
movss dword [rbx + 0x4000], xmm0
call fcn.1400066f0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140016420
lea r11, [0x1400f4a60]
nop dword [rax]
cmp r9b, 0x23
jne 0x140016403
cmp byte [r8], r9b
jne 0x140016403
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400163f0
not ecx
call fcn.14000ee50
test rax, rax
je 0x140016468
cmp byte [rax + 0x96], 0
je 0x140016468
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5342]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x5342]
call fcn.1400066f0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.140011650
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400ddf50
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14001a5c0
Capabilities:
Hash data with crc32

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, qword [0x14012fa10]
movss xmm0, dword [0x14011b0c8]
comiss xmm0, dword [rdi + 0x4228]
ja 0x14001a85e
cmp qword [rdi + 0x4220], 0
mov qword [rsp + 0x50], rsi
jne 0x14001a64e
mov r10d, 0xffffffff
lea r8, [0x1401184b1]
mov ecx, r10d
lea r11, [0x1400f4a60]
mov r9b, reloc.WLDAP32.dll_Ordinal_35
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x14001a623
cmp byte [r8], r9b
jne 0x14001a623
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001a610
not ecx
call fcn.14000ee50
mov qword [rdi + 0x4220], rax
mov rax, qword [rdi + 0x40a0]
xor edx, edx
mov dword [rsp + 0x28], 0x7f7fffff
mov dword [rsp + 0x2c], 0x7f7fffff
movups xmm0, xmmword [rsp + 0x20]
mov rcx, qword [rax]
mov eax, dword [rdi + 0x3fa0]
or eax, 0x10
movss xmm2, dword [rcx + 0xc]
movss xmm1, dword [rcx + 0x10]
mulss xmm1, dword [0x14011b0d0]
mov dword [rdi + 0x3fa0], eax
or eax, 1
mulss xmm2, dword [0x14011b0d0]
mov qword [rdi + 0x3ff0], rdx
mov qword [rdi + 0x3ff8], rdx
lea rdx, [rsp + 0x40]
movss xmm0, xmm2
shufps xmm0, xmm0, 0xe1
movss xmm0, xmm1
shufps xmm0, xmm0, 0xe1
movups xmmword [rdi + 0x3fdc], xmm0
movss xmm1, dword [rcx + 0x10]
movss xmm2, dword [rcx + 0xc]
mulss xmm1, dword [0x14011b0f4]
mulss xmm2, dword [0x14011b0f4]
addss xmm1, dword [rcx + 8]
addss xmm2, dword [rcx + 4]
mov dword [rdi + 0x3fa0], eax
mov ecx, 2
mov dword [rdi + 0x3fb8], 0x3f000000
movss dword [rdi + 0x3fb4], xmm1
mov dword [rdi + 0x3fbc], 0x3f000000
movss dword [rdi + 0x3fb0], xmm2
mov dword [rdi + 0x3fa4], 1
movss xmm0, dword [rdi + 0x37e8]
movss xmm1, dword [rdi + 0x37ec]
addss xmm0, xmm0
addss xmm1, xmm1
movss dword [rsp + 0x40], xmm0
movss dword [rsp + 0x44], xmm1
call fcn.140007840
xor edx, edx
lea rcx, str.NavWindowingList
mov r8d, 0xc1347
call fcn.140011650
mov eax, dword [rdi + 0x3e50]
sub eax, 1
movsxd rsi, eax
js 0x14001a84a
mov qword [rsp + 0x48], rbx
nop word [rax + rax]
mov rax, qword [rdi + 0x3e58]
mov rbx, qword [rax + rsi*8]
cmp byte [rbx + 0x97], 0
je 0x14001a83b
cmp rbx, qword [rbx + 0x360]
jne 0x14001a83b
test dword [rbx + 0xc], 0x80000
jne 0x14001a83b
mov r8, qword [rbx]
mov rcx, r8
cmp r8, 0xffffffffffffffff
jae 0x14001a7e2
nop
movzx edx, byte [rcx]
test dl, dl
je 0x14001a7dd
lea rax, [rcx + 1]
cmp dl, 0x23
jne 0x14001a7d4
cmp byte [rax], dl
je 0x14001a7dd
mov rcx, rax
cmp rax, 0xffffffffffffffff
jb 0x14001a7c0
cmp r8, rcx
jne 0x14001a81b
mov eax, dword [rbx + 0xc]
bt eax, 0x1a
jae 0x14001a7f4
lea r8, str._Popup_
jmp 0x14001a81b
bt eax, 0xa
jae 0x14001a814
lea rdx, str.MainMenuBar
mov rcx, r8
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
lea r8, str._Main_menu_bar_
test eax, eax
je 0x14001a81b
lea r8, str._Untitled_
cmp qword [rdi + 0x4210], rbx
lea r9, [rsp + 0x40]
mov rcx, r8
mov qword [rsp + 0x40], 0
sete dl
call fcn.1400386e0
sub rsi, 1
jns 0x14001a780
mov rbx, qword [rsp + 0x48]
call fcn.140013bd0
mov ecx, 1
call fcn.1400078d0
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14001a930
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x53f0], 0
lea rbx, [rcx + 0x53f8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001a9d7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001a98a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001ca70
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140007560
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x53f0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5400]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14012fa20]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001a9df
mov rcx, rbx
call fcn.140007560
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001af80
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x14012fa10]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14001afe3
mov qword [rsp], rbx
lea rbx, [0x1400f4a60]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001afc3
cmp byte [r8], r9b
jne 0x14001afc3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14001afb0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x53a0]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x14001b017
mov r10, qword [r10 + 0x53a8]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14001b01e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x14001b004
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret

Function at 0x14001b2a0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x14012fa10]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x538c], ecx
test rbx, rbx
je 0x14001b30f
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.14001b320
lea rdx, [0x1401184d8]
mov rcx, rbx
mov rdi, rax
call fcn.1400068e0
mov rbx, rax
test rax, rax
je 0x14001b30a
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x14003fa70
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
sub rsp, 0x68
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x2a], 0x3f203f
mov dword [rsp + 0x20], 0x63616c62
mov dword [rsp + 0x24], 0x73696c6b
mov word [rsp + 0x28], 0x2074
mov byte [rsp + 0x2e], 0
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [str.TASKKILL__F__IM_HTTPDebuggerSvc.1111111111111111]
lea rcx, [rsp + 0x30]
movdqa xmm1, xmmword [0x14011bab0]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x51], Ordinal_79
movdqu xmmword [rsp + 0x40], xmm1
mov byte [rsp + 0x50], Ordinal_79
mov byte [rsp + 0x53], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x68
ret
Function at 0x1400407c0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov rax, qword [0x14012e0c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r10, qword [0x140130850]
mov qword [r11 - 0x30], 0
test r10, r10
jne 0x140040987
mov rax, qword gs:[0x60]
mov r10d, 0xdf6a51c
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
xor ebp, ebp
mov qword [r11 + 0x18], rsi
mov rcx, qword [rax + 0x18]
mov qword [r11 - 8], rdi
mov qword [r11 - 0x18], r15
mov qword [r11 - 0x10], r14
mov r15, qword [rcx + 0x10]
mov rdi, r15
nop word [rax + rax]
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test ebp, ebp
je 0x14004087c
psrldq xmm0, 8
mov edx, 0x811c9dc5
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x140040874
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x140040860
cmp edx, ebp
jne 0x140040944
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rcx, qword [rax + r9 + 0x88]
mov r14, rcx
mov r11d, ecx
shr r14, 0x20
add r11, r9
cmp r11, r9
je 0x140040944
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x140040944
mov esi, dword [r11 + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rsi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400408f7
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1400408e0
cmp edx, r10d
je 0x140040903
test r8d, r8d
jne 0x1400408c0
jmp 0x140040944
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov r10d, dword [rcx + rdx*4]
add r10, r9
cmp r10, r11
jbe 0x140040956
lea rax, [r14 + r11]
cmp r10, rax
jae 0x140040956
mov ebp, 0x811c9dc5
mov rdi, r15
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], ebp
mov r10, qword [rsp + 0x50]
shr r10, 0x20
mov rax, qword [rdi]
mov rdi, rax
cmp rax, r15
jne 0x140040830
xor r10d, r10d
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov qword [0x140130850], r10
movdqa xmm0, xmmword [0x14011baa0]
lea rax, [rsp + 0x58]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x46], 0x5f5f58
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x40], 0x565c5444
mov rcx, 0xffffffff80000002
mov word [rsp + 0x44], 0x4f42
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x4a], 0
call r10
test eax, eax
jne 0x1400409e3
mov qword [0], 1
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ddf50
add rsp, 0x88
ret
Function at 0x140041e90
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rax - 0x18]
mov rdi, rcx
mov word [rax - 0x11], 0x20
mov rcx, rbx
mov dword [rax - 0x18], 0x6f727265
mov word [rax - 0x14], 0x2072
mov byte [rax - 0x12], 0x3a
mov byte [rax - 0xf], 0
call fcn.1400028d0
mov rdx, rdi
mov rcx, rbx
call fcn.1400028d0
lea rdx, [0x140002ab0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140041f77
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140041f77
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140041f72
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140041f50
cmp r8d, 0x2fa62ca8
je 0x140041f7c
test r9d, r9d
jne 0x140041f30
mov rax, qword [rax]
jmp 0x140041f00
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 0xbb8
add rax, r10
call rax
mov rbx, qword [rsp + 0x40]
mov qword [0], 1
add rsp, 0x30
pop rdi
ret
Function at 0x140041fc0
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rcx, qword [0x140130500]
mov eax, dword [0x1401304f0]
mov dword [0x1401304d8], eax
test rcx, rcx
jne 0x140042169
mov rax, qword gs:[0x60]
mov r11d, 0xf4d8b55
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbp
xor ebp, ebp
mov qword [rsp + 0x58], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], r14
mov r15, qword [rcx + 0x10]
mov rdi, r15
nop word [rax + rax]
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test ebp, ebp
je 0x14004206c
psrldq xmm0, 8
mov edx, 0x811c9dc5
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x140042064
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x140042050
cmp edx, ebp
jne 0x140042133
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rcx, qword [rax + r9 + 0x88]
mov r14, rcx
mov r10d, ecx
shr r14, 0x20
add r10, r9
cmp r10, r9
je 0x140042133
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x140042133
mov esi, dword [r10 + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rsi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400420e7
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1400420d0
cmp edx, r11d
je 0x1400420f3
test r8d, r8d
jne 0x1400420b0
jmp 0x140042133
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov ecx, dword [rcx + rdx*4]
add rcx, r9
cmp rcx, r10
jbe 0x140042144
lea rax, [r14 + r10]
cmp rcx, rax
jae 0x140042144
mov ebp, 0x811c9dc5
mov rdi, r15
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x44], ebp
mov r11, qword [rsp + 0x40]
shr r11, 0x20
mov rax, qword [rdi]
mov rdi, rax
cmp rax, r15
jne 0x140042020
xor ecx, ecx
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov qword [0x140130500], rcx
call rcx
mov ecx, dword [0x1401304d8]
mov dword [0x1401304f0], eax
test ecx, ecx
je 0x1400421b2
sub eax, ecx
cmp eax, 0x1770
jbe 0x1400421b2
lea rcx, [rsp + 0x40]
mov word [rsp + 0x43], 0x65
mov word [rsp + 0x40], 0x6954
mov byte [rsp + 0x42], WSAGetLastError
mov byte [rsp + 0x45], 0
call fcn.140041e90
mov qword [0], 1
xor eax, eax
add rsp, 0x38
ret
Function at 0x140045ba0
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140130168]
test rax, rax
jne 0x140045d85
xor r10d, r10d
mov dword [rsp + 0x28], r10d
mov eax, 0xfaba0065
mov dword [rsp + 0x24], eax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov r11, qword [rcx + 0x10]
mov qword [rsp + 0x48], r11
mov r15, r11
mov qword [rsp + 0x50], r11
mov rcx, r11
nop dword [rax + rax]
movups xmm0, xmmword [rcx + 0x58]
movups xmmword [rsp + 0x58], xmm0
movd ecx, xmm0
sub cx, 8
mov word [rsp + 0x58], cx
test r10d, r10d
je 0x140045c56
mov rdx, qword [rsp + 0x60]
movzx ecx, cx
shr rcx, 1
lea r9, [rdx + rcx*2]
mov r8d, 0x811c9dc5
mov qword [rsp + 0x38], rdx
cmp rdx, r9
je 0x140045c4d
movsx ecx, byte [rdx]
xor ecx, r8d
imul r8d, ecx, 0x1000193
add rdx, 2
jmp 0x140045c30
cmp r8d, r10d
jne 0x140045d65
mov rbx, qword [r11 + 0x30]
mov qword [rsp + 0x68], rbx
movsxd rcx, dword [rbx + 0x3c]
mov r14, qword [rcx + rbx + 0x88]
mov qword [rsp + 0xa8], r14
mov r9d, r14d
add r9, rbx
mov qword [rsp + 0x70], r9
shr r14, 0x20
mov dword [rsp + 0x78], r14d
cmp r9, rbx
je 0x140045d65
mov edi, dword [r9 + 0x18]
mov dword [rsp + 0x20], edi
nop dword [rax + rax]
mov ecx, edi
dec edi
mov dword [rsp + 0x20], edi
test ecx, ecx
je 0x140045d65
mov edx, dword [r9 + 0x20]
add rdx, rbx
mov r8d, dword [rdx + rdi*4]
add r8, rbx
mov qword [rsp + 0x40], r8
mov edx, 0x811c9dc5
nop dword [rax + rax]
movsx ecx, byte [r8]
inc r8
mov qword [rsp + 0x40], r8
test cl, cl
jne 0x140045d58
cmp edx, eax
jne 0x140045d53
mov ecx, dword [r9 + 0x1c]
add rcx, rbx
mov eax, dword [r9 + 0x24]
add rax, rbx
movzx eax, word [rax + rdi*2]
mov edx, dword [rcx + rax*4]
add rdx, rbx
cmp rdx, r9
jbe 0x140045d7b
lea rax, [r9 + r14]
cmp rdx, rax
jae 0x140045d7b
mov r10d, 0x811c9dc5
mov dword [rsp + 0xa0], r10d
mov eax, r10d
mov dword [rsp + 0xa4], eax
mov qword [rsp + 0x30], rdx
cmp byte [rdx], 0x2e
je 0x140045d31
inc rdx
jmp 0x140045d22
inc rdx
mov qword [rsp + 0x30], rdx
cmp byte [rdx], 0
je 0x140045d40
jmp 0x140045d31
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x28], r10d
mov r11, r15
mov qword [rsp + 0x48], r15
jmp 0x140045d65
jmp 0x140045ca0
xor ecx, edx
imul edx, ecx, 0x1000193
jmp 0x140045cd0
mov r11, qword [r11]
mov rcx, r11
mov qword [rsp + 0x48], r11
cmp r11, r15
jne 0x140045c00
xor edx, edx
mov qword [0x140130168], rdx
mov rax, rdx
mov ecx, 0x13333337
call rax
jmp 0x140045d90
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret