joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f5f40
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x1b0
mov rax, qword [0x1403721e8]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rbx, rcx
call fcn.1400d71c0
cmp byte [0x14043b9a1], 0
jne 0x1400f5fc3
xor edx, edx
mov r8d, 0x200
lea rcx, [0x14043bb70]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0x100
lea rdx, [rsp + 0x20]
lea rcx, [0x14043bb70]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x1400f5fbc
movsd xmm0, qword [str.Win32]
movsd qword [0x14043bb70], xmm0
movzx eax, word [0x140265990]
mov word [0x14043bb78], ax
mov byte [0x14043b9a1], 1
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x30]
call fcn.1400aa360
nop
lea rdx, [0x14043bb70]
lea rcx, [rsp + 0x30]
call fcn.1400ab040
lea rcx, [rsp + 0x30]
call fcn.1400ad740
mov rdx, rax
mov rcx, rbx
call fcn.1400d4cb0
nop
lea rcx, [rsp + 0x30]
call fcn.1400aa3c0
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1402545b0
add rsp, 0x1b0
pop rbx
ret
Function at 0x14011f9e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbp
push rbx
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x1403721e8]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rax, qword [rbp + 0x210]
mov r13, rcx
mov rcx, qword [rbp + 0x218]
mov r14d, r9d
mov qword [rsp + 0x20], rcx
mov ebx, r8d
mov qword [rsp + 0x28], rax
mov r15, rdx
test rax, rax
je 0x14011fc37
mov qword [rsp + 0x2b8], rsi
lea eax, [r9 - 2]
mov ecx, 0x80
mov qword [rsp + 0x2b0], rdi
cmp eax, 1
mov qword [rsp + 0x2a8], r12
mov esi, 0x40
cmovbe esi, ecx
mov ecx, r14d
call fcn.140120d90
movsxd r12, eax
cmp ebx, esi
jle 0x14011fa89
lea r9, [rbp + 0x50]
mov r8d, r14d
mov edx, ebx
mov rcx, r15
call fcn.14011fde0
lea r15, [rbp + 0x50]
mov ebx, r12d
mov r8d, esi
lea rcx, [rsp + 0x30]
xor edx, edx
mov edi, esi
call sub.VCRUNTIME140.dll_memset
mov r8d, esi
lea rcx, [rbp - 0x40]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp ebx, esi
lea rcx, [rsp + 0x30]
mov eax, esi
mov rdx, r15
cmovle eax, ebx
movsxd rbx, eax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8, rbx
lea rcx, [rbp - 0x40]
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
movdqa xmm2, xmmword [str.6666666666666666_sha3]
xor ecx, ecx
movdqa xmm3, xmmword [0x14029cbe0]
mov eax, ecx
nop word [rax + rax]
movdqu xmm0, xmmword [rsp + rax + 0x30]
add ecx, 0x40
movdqa xmm1, xmm2
pxor xmm0, xmm2
movdqu xmmword [rsp + rax + 0x30], xmm0
movdqu xmm0, xmmword [rbp + rax - 0x40]
pxor xmm0, xmm3
movdqu xmmword [rbp + rax - 0x40], xmm0
movdqu xmm0, xmmword [rsp + rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax - 0x30]
movdqu xmmword [rsp + rax + 0x40], xmm1
pxor xmm0, xmm3
movdqa xmm1, xmm3
movdqu xmmword [rbp + rax - 0x30], xmm0
movdqu xmm0, xmmword [rsp + rax + 0x50]
pxor xmm0, xmm2
movdqu xmmword [rsp + rax + 0x50], xmm0
movdqu xmm0, xmmword [rbp + rax - 0x20]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rsp + rax + 0x60]
movdqu xmmword [rbp + rax - 0x20], xmm1
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax - 0x10]
movdqu xmmword [rsp + rax + 0x60], xmm1
pxor xmm0, xmm3
movdqu xmmword [rbp + rax - 0x10], xmm0
add rax, 0x40
cmp rax, rdi
jl 0x14011faf0
movsxd rax, ecx
cmp rax, rdi
jge 0x14011fbb2
nop dword [rax]
nop dword [rax + rax]
xor byte [rsp + rax + 0x30], 0x36
xor byte [rbp + rax - 0x40], 0x5c
inc rax
cmp rax, rdi
jl 0x14011fba0
mov r9, qword [rsp + 0x20]
lea rax, [rsp + 0x30]
lea r8, [rbp + 0x90]
mov qword [r13 + 8], rax
mov edx, r14d
mov dword [r13 + 0x808], esi
mov rcx, r13
call fcn.140120140
mov r8, rdi
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xd0]
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0xd0]
mov r8, r12
add rcx, rdi
lea rdx, [rbp + 0x90]
call sub.VCRUNTIME140.dll_memcpy
mov r9, qword [rsp + 0x28]
lea edx, [r12 + rsi]
mov r8d, r14d
lea rcx, [rbp + 0xd0]
call fcn.14011fde0
mov r12, qword [rsp + 0x2a8]
mov al, 1
mov rdi, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2b8]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1402545b0
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop rbx
pop rbp
ret
Function at 0x14013aa80
Capabilities:
Hash data using crc32b

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx ecx, byte [0x14043c8d0]
movzx eax, byte [0x14043c8d1]
test cl, cl
jne 0x14013ac70
test al, al
jne 0x14013ac78
cmp qword [0x14043c8d8], 0
jne 0x14013ac9d
mov ecx, 0x100
mov byte [0x14043c8d1], 1
call fcn.1400b7250
mov rdi, rax
test rax, rax
je 0x14013ac9d
xor ebx, ebx
mov r11, rax
mov r10d, ebx
nop dword [rax + rax]
mov ecx, r10d
mov r8d, r10d
and ecx, 1
shr r8d, 1
shl ecx, 7
mov r9d, ebx
mov edx, ecx
or edx, 0x40
test r8b, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
or ecx, 0x20
test r8b, 1
cmove ecx, edx
shr r8d, 1
mov edx, ecx
or edx, 0x10
test r8b, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
or ecx, 8
test r8b, 1
cmove ecx, edx
shr r8d, 1
mov edx, ecx
or edx, 4
test r8b, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
or ecx, 2
test r8b, 1
cmove ecx, edx
mov eax, ecx
or eax, 1
test r8b, 2
mov r8d, 0x1e
cmove eax, ecx
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov eax, ecx
add ecx, ecx
sar eax, 0x1f
and eax, 0x4c11db7
xor eax, ecx
nop dword [rax + rax]
test al, 1
je 0x14013abf2
lea ecx, [r8 + 1]
mov edx, 1
shl edx, cl
or r9d, edx
shr eax, 1
test al, 1
je 0x14013ac05
mov ecx, r8d
mov edx, 1
shl edx, cl
or r9d, edx
shr eax, 1
sub r8d, 2
cmp r8d, 0xfffffffe
jg 0x14013abe0
mov dword [r11], r9d
inc r10d
add r11, 4
cmp r10d, 0xff
jbe 0x14013aae0
cmp qword [0x14043c8d8], rbx
jne 0x14013ac50
mov qword [0x14043c8d8], rdi
mov byte [0x14043c8d0], 1
mov byte [0x14043c8d1], bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call fcn.1402545d0
mov byte [0x14043c8d0], 1
mov byte [0x14043c8d1], bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test al, al
je 0x14013ac9d
test cl, cl
jne 0x14013ac9d
xor ebx, ebx
test al, al
je 0x14013ac9d
nop
mov ecx, 2
call sub.KERNEL32.dll_Sleep
inc ebx
cmp ebx, 0xc8
ja 0x14013ac9d
cmp byte [0x14043c8d1], 0
jne 0x14013ac80
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14013acb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
mov r11, rcx
test rdx, rdx
je 0x14013af0c
test r8d, r8d
je 0x14013af0c
cmp r8d, 0x10
jb 0x14013aecb
mov r9d, r8d
mov qword [rsp], rbx
mov ebx, dword [rcx + 8]
shr r9, 4
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r10]
mov ecx, ebx
shr ecx, 8
movzx edx, bl
xor rdx, rax
mov rax, qword [0x14043c8d8]
xor ecx, dword [rax + rdx*4]
mov edx, ecx
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 1]
movzx ecx, cl
xor rcx, rax
shr edx, 8
mov rax, qword [0x14043c8d8]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 2]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x14043c8d8]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 3]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x14043c8d8]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x14043c8d8]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 5]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x14043c8d8]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 6]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x14043c8d8]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 7]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x14043c8d8]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 8]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x14043c8d8]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 9]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x14043c8d8]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 0xa]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x14043c8d8]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 0xb]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x14043c8d8]
add r8d, 0xfffffff0
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 0xc]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x14043c8d8]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 0xd]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x14043c8d8]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 0xe]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x14043c8d8]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 0xf]
add r10, 0x10
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x14043c8d8]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
mov ebx, edx
sub r9, 1
jne 0x14013acf0
mov rbx, qword [rsp]
test r8d, r8d
je 0x14013af0c
mov r9d, dword [r11 + 8]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r10]
lea r10, [r10 + 1]
movzx edx, r9b
mov ecx, r9d
xor rdx, rax
shr ecx, 8
mov rax, qword [0x14043c8d8]
xor ecx, dword [rax + rdx*4]
mov dword [r11 + 8], ecx
mov r9d, ecx
add r8d, 0xffffffff
jne 0x14013aee0
add rsp, 8
ret
Function at 0x14013c720
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov rax, qword [0x1403721e8]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r14, r9
mov rbx, r8
mov r15, rdx
mov r12, rcx
xor ecx, ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
xor sil, sil
test eax, eax
jne 0x14013c8bd
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x14013c933
call fcn.1400b71c0
mov rdi, rax
test rax, rax
je 0x14013c937
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, r15
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r12d, eax
test eax, eax
jne 0x14013c83d
mov r8d, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
cmp eax, 4
jne 0x14013c800
cmp r8d, eax
jne 0x14013c822
mov edx, dword [rdi]
mov rcx, rbx
call fcn.1400d4ba0
mov sil, 1
mov rcx, rdi
call fcn.1402545d0
jmp 0x14013c933
dec eax
cmp eax, 1
ja 0x14013c822
mov rdx, rdi
mov rcx, rbx
call fcn.1400d4cb0
mov sil, 1
mov rcx, rdi
call fcn.1402545d0
jmp 0x14013c933
mov rdx, rdi
mov rcx, rbx
call fcn.1400d52f0
mov sil, 1
mov rcx, rdi
call fcn.1402545d0
jmp 0x14013c933
xorps xmm0, xmm0
movups xmmword [rbp - 0x79], xmm0
movups xmmword [rbp - 0x69], xmm0
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
lea rcx, [rbp - 0x79]
call fcn.1400d4580
nop
mov edx, r12d
lea rcx, [rbp - 0x79]
call fcn.1400d5d80
mov rbx, qword [r14]
lea rcx, [rbp - 0x79]
call fcn.1400da480
mov r8, rax
lea rdx, str.RegistryQueryError2
mov rcx, r14
call qword [rbx + 0x58]
mov rax, qword [r14]
mov r8, r15
lea rdx, str.ValueName
mov rcx, r14
call qword [rax + 0x58]
nop
lea rcx, [rbp - 0x79]
call fcn.1400d45d0
mov rcx, rdi
call fcn.1402545d0
jmp 0x14013c933
xorps xmm0, xmm0
movups xmmword [rbp - 0x79], xmm0
movups xmmword [rbp - 0x69], xmm0
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
lea rcx, [rbp - 0x79]
call fcn.1400d4580
nop
mov edx, edi
lea rcx, [rbp - 0x79]
call fcn.1400d5d80
mov rbx, qword [r14]
lea rcx, [rbp - 0x79]
call fcn.1400da480
mov r8, rax
lea rdx, str.RegistryQueryError
mov rcx, r14
call qword [rbx + 0x58]
mov r9, qword [r14]
mov r8, r15
lea rdx, str.ValueName
mov rcx, r14
call qword [r9 + 0x58]
nop
lea rcx, [rbp - 0x79]
call fcn.1400d45d0
movzx eax, sil
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1402545b0
add rsp, 0xe0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14015ed20
Capabilities:
Hash data using djb2

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xc0
mov rax, qword [0x1403721e8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [r11 - 0x48], xmm0
movups xmmword [r11 - 0x38], xmm0
movups xmmword [r11 - 0x28], xmm0
lea rcx, [rsp + 0x20]
call fcn.1400d4470
nop
cmp dword [rbx + 0x10], 0x6119a407
je 0x14015ed92
xor ecx, ecx
call fcn.1400b09c0
xor bl, bl
jmp 0x14015ee19
lea rcx, [rsp + 0x20]
call fcn.1400da480
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x14015edc0
nop dword [rax + rax]
lea rcx, [rcx + 1]
imul eax, eax, 0x21
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14015edb0
xor edx, edx
div dword [rbx + 0x14]
cmp edx, dword [rbx + 0x14]
jae 0x14015ee11
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14015ee11
mov rcx, qword [rcx + rdx*8]
test rcx, rcx
je 0x14015ee11
call fcn.140208040
mov rbx, rax
test rax, rax
je 0x14015ee11
nop dword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1402080d0
test al, al
jne 0x14015ee13
mov rcx, rbx
call fcn.1402080a0
mov rbx, rax
test rax, rax
jne 0x14015edf0
xor ebx, ebx
test rbx, rbx
setne bl
lea rcx, [rsp + 0x20]
call fcn.1400d45d0
movzx eax, bl
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1402545b0
add rsp, 0xc0
pop rbx
ret
Function at 0x14015ee40
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x1403721e8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rdx
mov rdi, rcx
cmp dword [rcx + 0x10], 0x6119a407
je 0x14015ee7e
xor ecx, ecx
call fcn.1400b09c0
xor al, al
jmp 0x14015eef3
test rbx, rbx
je 0x14015ee7a
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
lea rcx, [rsp + 0x20]
call fcn.1400d4580
nop
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400d4cb0
cmp dword [rdi + 0x10], 0x6119a407
je 0x14015ef18
xor ecx, ecx
call fcn.1400b09c0
xor bl, bl
lea rcx, [rsp + 0x20]
call fcn.1400d45d0
movzx eax, bl
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1402545b0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
cmp qword [rdi + 0x18], 0
je 0x14015eee4
lea rcx, [rsp + 0x20]
call fcn.1400da480
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x14015ef50
nop dword [rax + rax]
lea rcx, [rcx + 1]
imul eax, eax, 0x21
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14015ef40
xor edx, edx
div dword [rdi + 0x14]
cmp edx, dword [rdi + 0x14]
jae 0x14015eedd
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x14015eee4
lea rsi, [rdx*8]
mov rcx, qword [rsi + rcx]
test rcx, rcx
je 0x14015eee4
call fcn.140208040
mov rbx, rax
test rax, rax
je 0x14015eee4
nop dword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1402080d0
test al, al
jne 0x14015efb6
mov rcx, rbx
call fcn.1402080a0
mov rbx, rax
test rax, rax
jne 0x14015ef90
jmp 0x14015eee4
mov eax, dword [rdi + 0x20]
test eax, eax
je 0x14015efc2
dec eax
mov dword [rdi + 0x20], eax
mov rcx, qword [rdi + 0x18]
mov rdx, rbx
mov rcx, qword [rcx + rsi]
call fcn.140208110
mov bl, 1
jmp 0x14015eee6

Function at 0x14015f070
Capabilities:
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x10], 0x6119a407
mov rbx, rcx
je 0x14015f091
xor ecx, ecx
call fcn.1400b09c0
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rdx
call fcn.1400da480
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x14015f0c0
nop dword [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14015f0b0
xor edx, edx
div dword [rbx + 0x14]
mov eax, edx
add rsp, 0x20
pop rbx
ret
Function at 0x14015f2e0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x10], 0x6119a407
mov rdi, rdx
mov rbx, rcx
je 0x14015f30d
xor ecx, ecx
call fcn.1400b09c0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call fcn.1400da480
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x14015f340
nop dword [rax]
nop dword [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14015f330
xor edx, edx
mov r8, rdi
div dword [rbx + 0x14]
mov rcx, rbx
call fcn.14015ebe0
test rax, rax
je 0x14015f300
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140208070

Function at 0x14015f370
Capabilities:
Hash data using djb2

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x1403721e8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp dword [rcx + 0x10], 0x6119a407
je 0x14015f3aa
xor ecx, ecx
call fcn.1400b09c0
xor al, al
jmp 0x14015f41d
mov rcx, rsi
call fcn.1400e2070
test rdi, rdi
je 0x14015f3a6
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400d4470
nop
cmp dword [rbx + 0x10], 0x6119a407
je 0x14015f438
xor ecx, ecx
call fcn.1400b09c0
xor bl, bl
lea rcx, [rsp + 0x20]
call fcn.1400d45d0
movzx eax, bl
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1402545b0
add rsp, 0xc0
pop rdi
pop rsi
pop rbx
ret
lea rcx, [rsp + 0x20]
call fcn.1400da480
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x14015f461
lea rcx, [rcx + 1]
imul eax, eax, 0x21
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14015f451
xor edx, edx
div dword [rbx + 0x14]
cmp edx, dword [rbx + 0x14]
jae 0x14015f40e
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14015f40e
mov rcx, qword [rcx + rdx*8]
test rcx, rcx
je 0x14015f40e
call fcn.140208040
mov rbx, rax
test rax, rax
je 0x14015f40e
nop word [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1402080d0
mov rcx, rbx
test al, al
jne 0x14015f4b6
call fcn.1402080a0
mov rbx, rax
test rax, rax
jne 0x14015f490
jmp 0x14015f40e
call fcn.140208070
test rax, rax
je 0x14015f40e
mov rdx, rax
mov rcx, rsi
call fcn.1400d4910
mov bl, 1
jmp 0x14015f410
Function at 0x1401663c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x1403721e8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r12, r8
mov rdi, rcx
mov qword [rsp + 0x28], rcx
cmp dword [rcx + 8], 0x62cb09e3
je 0x1401663fb
xor al, al
jmp 0x1401665b5
xor esi, esi
mov r15d, esi
test rdx, rdx
cmovns r15, rdx
cmp byte [0x14043b955], sil
je 0x140166434
cmp byte [rcx + 0xdc], sil
jne 0x140166434
cmp qword [rcx + 0xb8], rsi
jle 0x140166434
mov r8, r15
lea rdx, str.consumeProgress
mov rcx, r12
call fcn.1400f6c90
mov byte [rsp + 0x30], sil
mov dword [rsp + 0x20], esi
movzx r14d, byte [rdi + 0xdc]
movzx ebx, r14b
test r14b, r14b
jne 0x1401664ef
cmp qword [rdi + 0xb8], rsi
jle 0x1401664ef
mov rbx, qword [rdi + 0xc0]
mov r8, qword [rdi + 0xb8]
mov rdx, rbx
mov rcx, rdi
call fcn.140166a00
mov dword [rsp + 0x20], eax
lea rax, [rbx + r15]
mov qword [rdi + 0xc0], rax
movzx ebx, r14b
cmp rax, qword [rdi + 0xb8]
jle 0x1401664ef
cmp byte [0x14043b955], sil
je 0x1401664e1
mov rax, qword [r12]
lea rdx, str.Amount_consumed_is_greater_than_the_total.
mov rcx, r12
call qword [rax + 0x28]
mov r8, qword [rdi + 0xc0]
lea rdx, str.m_consumed64
mov rcx, r12
call fcn.1400f6c90
mov r8, qword [rdi + 0xb8]
lea rdx, str.m_totalAmount64
mov rcx, r12
call fcn.1400f6c90
movzx ebx, byte [rdi + 0xdc]
mov rax, qword [rdi + 0xb8]
mov qword [rdi + 0xc0], rax
test bl, bl
jne 0x140166510
mov r8, qword [rdi + 0xb8]
test r8, r8
jle 0x140166510
mov rdx, qword [rdi + 0xc0]
mov rcx, rdi
call fcn.140166a00
mov esi, eax
cmp qword [rdi + 0xa8], 0
je 0x1401665ae
test bl, bl
jne 0x1401665d7
cmp esi, dword [rsp + 0x20]
jbe 0x1401665d7
cmp esi, dword [rdi + 0xa0]
jbe 0x1401665d7
call sub.KERNEL32.dll_GetTickCount
mov dword [rdi + 0xb4], eax
cmp byte [rdi + 0xde], bl
je 0x140166557
cmp esi, dword [rdi + 0xd4]
je 0x1401665a0
mov dword [rdi + 0xa0], esi
cmp byte [0x14043b955], 0
je 0x140166579
mov r8d, esi
lea rdx, str.percentDoneCB
mov rcx, r12
call fcn.1400f6d00
nop
mov rcx, qword [rdi + 0xa8]
cmp dword [rcx + 0x10], 0x77109acd
jne 0x140166596
mov rax, qword [rcx]
lea r8, [rsp + 0x30]
mov edx, esi
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x140166636
cmp byte [rsp + 0x30], 0
je 0x1401665ae
mov byte [rdi + 0xb1], 1
movzx eax, byte [rdi + 0xb1]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402545b0
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
cmp byte [rdi + 0xdd], 0
jne 0x1401665ae
cmp dword [rdi + 0xd0], 0
je 0x1401665ae
call sub.KERNEL32.dll_GetTickCount
mov edx, eax
mov ecx, eax
sub ecx, dword [rdi + 0xb4]
mov eax, dword [rdi + 0xd0]
mov r8d, 0x12c
test eax, eax
cmove eax, r8d
cmp ecx, eax
jbe 0x1401665ae
mov dword [rdi + 0xd8], edx
mov dword [rdi + 0xb4], edx
mov rcx, qword [rdi + 0xa8]
cmp dword [rcx + 0x10], 0x77109acd
jne 0x140166636
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x18]
nop
jmp 0x1401665a0