joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f5f50
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x1b0
mov rax, qword [0x1403dd7c0]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rbx, rcx
call fcn.1400d6bf0
cmp byte [0x1404781b1], 0
jne 0x1400f5fd3
xor edx, edx
mov r8d, 0x200
lea rcx, [0x140478380]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0x100
lea rdx, [rsp + 0x20]
lea rcx, [0x140478380]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x1400f5fcc
movsd xmm0, qword [str.Win32]
movsd qword [0x140478380], xmm0
movzx eax, word [0x14028ac50]
mov word [0x140478388], ax
mov byte [0x1404781b1], 1
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x30]
call fcn.1400a6dd0
nop
lea rdx, [0x140478380]
lea rcx, [rsp + 0x30]
call fcn.1400a7ab0
lea rcx, [rsp + 0x30]
call fcn.1400aa530
mov rdx, rax
mov rcx, rbx
call fcn.1400d46e0
nop
lea rcx, [rsp + 0x30]
call fcn.1400a6e30
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140278f40
add rsp, 0x1b0
pop rbx
ret
Function at 0x140120160
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbp
push rbx
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x1403dd7c0]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rax, qword [rbp + 0x210]
mov r13, rcx
mov rcx, qword [rbp + 0x218]
mov r14d, r9d
mov qword [rsp + 0x20], rcx
mov ebx, r8d
mov qword [rsp + 0x28], rax
mov r15, rdx
test rax, rax
je 0x1401203b7
mov qword [rsp + 0x2b8], rsi
lea eax, [r9 - 2]
mov ecx, 0x80
mov qword [rsp + 0x2b0], rdi
cmp eax, 1
mov qword [rsp + 0x2a8], r12
mov esi, 0x40
cmovbe esi, ecx
mov ecx, r14d
call fcn.140121510
movsxd r12, eax
cmp ebx, esi
jle 0x140120209
lea r9, [rbp + 0x50]
mov r8d, r14d
mov edx, ebx
mov rcx, r15
call fcn.140120560
lea r15, [rbp + 0x50]
mov ebx, r12d
mov r8d, esi
lea rcx, [rsp + 0x30]
xor edx, edx
mov edi, esi
call sub.VCRUNTIME140.dll_memset
mov r8d, esi
lea rcx, [rbp - 0x40]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp ebx, esi
lea rcx, [rsp + 0x30]
mov eax, esi
mov rdx, r15
cmovle eax, ebx
movsxd rbx, eax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8, rbx
lea rcx, [rbp - 0x40]
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
movdqa xmm2, xmmword [str.6666666666666666_sha3]
xor ecx, ecx
movdqa xmm3, xmmword [0x1402c1ea0]
mov eax, ecx
nop word [rax + rax]
movdqu xmm0, xmmword [rsp + rax + 0x30]
add ecx, 0x40
movdqa xmm1, xmm2
pxor xmm0, xmm2
movdqu xmmword [rsp + rax + 0x30], xmm0
movdqu xmm0, xmmword [rbp + rax - 0x40]
pxor xmm0, xmm3
movdqu xmmword [rbp + rax - 0x40], xmm0
movdqu xmm0, xmmword [rsp + rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax - 0x30]
movdqu xmmword [rsp + rax + 0x40], xmm1
pxor xmm0, xmm3
movdqa xmm1, xmm3
movdqu xmmword [rbp + rax - 0x30], xmm0
movdqu xmm0, xmmword [rsp + rax + 0x50]
pxor xmm0, xmm2
movdqu xmmword [rsp + rax + 0x50], xmm0
movdqu xmm0, xmmword [rbp + rax - 0x20]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rsp + rax + 0x60]
movdqu xmmword [rbp + rax - 0x20], xmm1
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax - 0x10]
movdqu xmmword [rsp + rax + 0x60], xmm1
pxor xmm0, xmm3
movdqu xmmword [rbp + rax - 0x10], xmm0
add rax, 0x40
cmp rax, rdi
jl 0x140120270
movsxd rax, ecx
cmp rax, rdi
jge 0x140120332
nop dword [rax]
nop dword [rax + rax]
xor byte [rsp + rax + 0x30], 0x36
xor byte [rbp + rax - 0x40], 0x5c
inc rax
cmp rax, rdi
jl 0x140120320
mov r9, qword [rsp + 0x20]
lea rax, [rsp + 0x30]
lea r8, [rbp + 0x90]
mov qword [r13 + 8], rax
mov edx, r14d
mov dword [r13 + 0x808], esi
mov rcx, r13
call fcn.1401208c0
mov r8, rdi
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xd0]
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0xd0]
mov r8, r12
add rcx, rdi
lea rdx, [rbp + 0x90]
call sub.VCRUNTIME140.dll_memcpy
mov r9, qword [rsp + 0x28]
lea edx, [r12 + rsi]
mov r8d, r14d
lea rcx, [rbp + 0xd0]
call fcn.140120560
mov r12, qword [rsp + 0x2a8]
mov al, 1
mov rdi, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2b8]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140278f40
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop rbx
pop rbp
ret
Function at 0x14013ca70
Capabilities:
Hash data using crc32b

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx ecx, byte [0x1404790e8]
movzx eax, byte [0x1404790e9]
test cl, cl
jne 0x14013cc60
test al, al
jne 0x14013cc68
cmp qword [0x1404790f0], 0
jne 0x14013cc8d
mov ecx, 0x100
mov byte [0x1404790e9], 1
call fcn.1400b5be0
mov rdi, rax
test rax, rax
je 0x14013cc8d
xor ebx, ebx
mov r11, rax
mov r10d, ebx
nop dword [rax + rax]
mov ecx, r10d
mov r8d, r10d
and ecx, 1
shr r8d, 1
shl ecx, 7
mov r9d, ebx
mov edx, ecx
or edx, 0x40
test r8b, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
or ecx, 0x20
test r8b, 1
cmove ecx, edx
shr r8d, 1
mov edx, ecx
or edx, 0x10
test r8b, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
or ecx, 8
test r8b, 1
cmove ecx, edx
shr r8d, 1
mov edx, ecx
or edx, 4
test r8b, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
or ecx, 2
test r8b, 1
cmove ecx, edx
mov eax, ecx
or eax, 1
test r8b, 2
mov r8d, 0x1e
cmove eax, ecx
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov eax, ecx
add ecx, ecx
sar eax, 0x1f
and eax, 0x4c11db7
xor eax, ecx
nop dword [rax + rax]
test al, 1
je 0x14013cbe2
lea ecx, [r8 + 1]
mov edx, 1
shl edx, cl
or r9d, edx
shr eax, 1
test al, 1
je 0x14013cbf5
mov ecx, r8d
mov edx, 1
shl edx, cl
or r9d, edx
shr eax, 1
sub r8d, 2
cmp r8d, 0xfffffffe
jg 0x14013cbd0
mov dword [r11], r9d
inc r10d
add r11, 4
cmp r10d, 0xff
jbe 0x14013cad0
cmp qword [0x1404790f0], rbx
jne 0x14013cc40
mov qword [0x1404790f0], rdi
mov byte [0x1404790e8], 1
mov byte [0x1404790e9], bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call fcn.140278f60
mov byte [0x1404790e8], 1
mov byte [0x1404790e9], bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test al, al
je 0x14013cc8d
test cl, cl
jne 0x14013cc8d
xor ebx, ebx
test al, al
je 0x14013cc8d
nop
mov ecx, 2
call sub.KERNEL32.dll_Sleep
inc ebx
cmp ebx, 0xc8
ja 0x14013cc8d
cmp byte [0x1404790e9], 0
jne 0x14013cc70
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14013cca0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
mov r11, rcx
test rdx, rdx
je 0x14013cefc
test r8d, r8d
je 0x14013cefc
cmp r8d, 0x10
jb 0x14013cebb
mov r9d, r8d
mov qword [rsp], rbx
mov ebx, dword [rcx + 8]
shr r9, 4
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r10]
mov ecx, ebx
shr ecx, 8
movzx edx, bl
xor rdx, rax
mov rax, qword [0x1404790f0]
xor ecx, dword [rax + rdx*4]
mov edx, ecx
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 1]
movzx ecx, cl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1404790f0]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 2]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1404790f0]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 3]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1404790f0]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1404790f0]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 5]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1404790f0]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 6]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1404790f0]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 7]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1404790f0]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 8]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1404790f0]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 9]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1404790f0]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 0xa]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1404790f0]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 0xb]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1404790f0]
add r8d, 0xfffffff0
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 0xc]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1404790f0]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 0xd]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1404790f0]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 0xe]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1404790f0]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 0xf]
add r10, 0x10
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1404790f0]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
mov ebx, edx
sub r9, 1
jne 0x14013cce0
mov rbx, qword [rsp]
test r8d, r8d
je 0x14013cefc
mov r9d, dword [r11 + 8]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r10]
lea r10, [r10 + 1]
movzx edx, r9b
mov ecx, r9d
xor rdx, rax
shr ecx, 8
mov rax, qword [0x1404790f0]
xor ecx, dword [rax + rdx*4]
mov dword [r11 + 8], ecx
mov r9d, ecx
add r8d, 0xffffffff
jne 0x14013ced0
add rsp, 8
ret
Function at 0x14013e710
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov rax, qword [0x1403dd7c0]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r14, r9
mov rbx, r8
mov r15, rdx
mov r12, rcx
xor ecx, ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
xor sil, sil
test eax, eax
jne 0x14013e8ad
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x14013e923
call fcn.1400b5b50
mov rdi, rax
test rax, rax
je 0x14013e927
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, r15
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r12d, eax
test eax, eax
jne 0x14013e82d
mov r8d, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
cmp eax, 4
jne 0x14013e7f0
cmp r8d, eax
jne 0x14013e812
mov edx, dword [rdi]
mov rcx, rbx
call fcn.1400d45d0
mov sil, 1
mov rcx, rdi
call fcn.140278f60
jmp 0x14013e923
dec eax
cmp eax, 1
ja 0x14013e812
mov rdx, rdi
mov rcx, rbx
call fcn.1400d46e0
mov sil, 1
mov rcx, rdi
call fcn.140278f60
jmp 0x14013e923
mov rdx, rdi
mov rcx, rbx
call fcn.1400d4d20
mov sil, 1
mov rcx, rdi
call fcn.140278f60
jmp 0x14013e923
xorps xmm0, xmm0
movups xmmword [rbp - 0x79], xmm0
movups xmmword [rbp - 0x69], xmm0
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
lea rcx, [rbp - 0x79]
call fcn.1400d3fb0
nop
mov edx, r12d
lea rcx, [rbp - 0x79]
call fcn.1400d57b0
mov rbx, qword [r14]
lea rcx, [rbp - 0x79]
call fcn.1400d9f80
mov r8, rax
lea rdx, str.RegistryQueryError2
mov rcx, r14
call qword [rbx + 0x58]
mov rax, qword [r14]
mov r8, r15
lea rdx, str.ValueName
mov rcx, r14
call qword [rax + 0x58]
nop
lea rcx, [rbp - 0x79]
call fcn.1400d4000
mov rcx, rdi
call fcn.140278f60
jmp 0x14013e923
xorps xmm0, xmm0
movups xmmword [rbp - 0x79], xmm0
movups xmmword [rbp - 0x69], xmm0
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
lea rcx, [rbp - 0x79]
call fcn.1400d3fb0
nop
mov edx, edi
lea rcx, [rbp - 0x79]
call fcn.1400d57b0
mov rbx, qword [r14]
lea rcx, [rbp - 0x79]
call fcn.1400d9f80
mov r8, rax
lea rdx, str.RegistryQueryError
mov rcx, r14
call qword [rbx + 0x58]
mov r9, qword [r14]
mov r8, r15
lea rdx, str.ValueName
mov rcx, r14
call qword [r9 + 0x58]
nop
lea rcx, [rbp - 0x79]
call fcn.1400d4000
movzx eax, sil
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140278f40
add rsp, 0xe0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140163fe0
Capabilities:
Hash data using djb2

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xc0
mov rax, qword [0x1403dd7c0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [r11 - 0x48], xmm0
movups xmmword [r11 - 0x38], xmm0
movups xmmword [r11 - 0x28], xmm0
lea rcx, [rsp + 0x20]
call fcn.1400d3ea0
nop
cmp dword [rbx + 0x10], 0x6119a407
je 0x140164052
xor ecx, ecx
call fcn.1400a1ee0
xor bl, bl
jmp 0x1401640d9
lea rcx, [rsp + 0x20]
call fcn.1400d9f80
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x140164080
nop dword [rax + rax]
lea rcx, [rcx + 1]
imul eax, eax, 0x21
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x140164070
xor edx, edx
div dword [rbx + 0x14]
cmp edx, dword [rbx + 0x14]
jae 0x1401640d1
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1401640d1
mov rcx, qword [rcx + rdx*8]
test rcx, rcx
je 0x1401640d1
call fcn.140219f50
mov rbx, rax
test rax, rax
je 0x1401640d1
nop dword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140219fe0
test al, al
jne 0x1401640d3
mov rcx, rbx
call fcn.140219fb0
mov rbx, rax
test rax, rax
jne 0x1401640b0
xor ebx, ebx
test rbx, rbx
setne bl
lea rcx, [rsp + 0x20]
call fcn.1400d4000
movzx eax, bl
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140278f40
add rsp, 0xc0
pop rbx
ret
Function at 0x140164100
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x1403dd7c0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rdx
mov rdi, rcx
cmp dword [rcx + 0x10], 0x6119a407
je 0x14016413e
xor ecx, ecx
call fcn.1400a1ee0
xor al, al
jmp 0x1401641b3
test rbx, rbx
je 0x14016413a
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
lea rcx, [rsp + 0x20]
call fcn.1400d3fb0
nop
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400d46e0
cmp dword [rdi + 0x10], 0x6119a407
je 0x1401641d8
xor ecx, ecx
call fcn.1400a1ee0
xor bl, bl
lea rcx, [rsp + 0x20]
call fcn.1400d4000
movzx eax, bl
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140278f40
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
cmp qword [rdi + 0x18], 0
je 0x1401641a4
lea rcx, [rsp + 0x20]
call fcn.1400d9f80
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x140164210
nop dword [rax + rax]
lea rcx, [rcx + 1]
imul eax, eax, 0x21
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x140164200
xor edx, edx
div dword [rdi + 0x14]
cmp edx, dword [rdi + 0x14]
jae 0x14016419d
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1401641a4
lea rsi, [rdx*8]
mov rcx, qword [rsi + rcx]
test rcx, rcx
je 0x1401641a4
call fcn.140219f50
mov rbx, rax
test rax, rax
je 0x1401641a4
nop dword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140219fe0
test al, al
jne 0x140164276
mov rcx, rbx
call fcn.140219fb0
mov rbx, rax
test rax, rax
jne 0x140164250
jmp 0x1401641a4
mov eax, dword [rdi + 0x20]
test eax, eax
je 0x140164282
dec eax
mov dword [rdi + 0x20], eax
mov rcx, qword [rdi + 0x18]
mov rdx, rbx
mov rcx, qword [rcx + rsi]
call fcn.14021a020
mov bl, 1
jmp 0x1401641a6

Function at 0x140164330
Capabilities:
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x10], 0x6119a407
mov rbx, rcx
je 0x140164351
xor ecx, ecx
call fcn.1400a1ee0
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rdx
call fcn.1400d9f80
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x140164380
nop dword [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x140164370
xor edx, edx
div dword [rbx + 0x14]
mov eax, edx
add rsp, 0x20
pop rbx
ret
Function at 0x1401645a0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x10], 0x6119a407
mov rdi, rdx
mov rbx, rcx
je 0x1401645cd
xor ecx, ecx
call fcn.1400a1ee0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call fcn.1400d9f80
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x140164600
nop dword [rax]
nop dword [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x1401645f0
xor edx, edx
mov r8, rdi
div dword [rbx + 0x14]
mov rcx, rbx
call fcn.140163e40
test rax, rax
je 0x1401645c0
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140219f80

Function at 0x140164630
Capabilities:
Hash data using djb2

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x1403dd7c0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp dword [rcx + 0x10], 0x6119a407
je 0x14016466a
xor ecx, ecx
call fcn.1400a1ee0
xor al, al
jmp 0x1401646dd
mov rcx, rsi
call fcn.1400e1c90
test rdi, rdi
je 0x140164666
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400d3ea0
nop
cmp dword [rbx + 0x10], 0x6119a407
je 0x1401646f8
xor ecx, ecx
call fcn.1400a1ee0
xor bl, bl
lea rcx, [rsp + 0x20]
call fcn.1400d4000
movzx eax, bl
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140278f40
add rsp, 0xc0
pop rdi
pop rsi
pop rbx
ret
lea rcx, [rsp + 0x20]
call fcn.1400d9f80
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x140164721
lea rcx, [rcx + 1]
imul eax, eax, 0x21
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x140164711
xor edx, edx
div dword [rbx + 0x14]
cmp edx, dword [rbx + 0x14]
jae 0x1401646ce
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1401646ce
mov rcx, qword [rcx + rdx*8]
test rcx, rcx
je 0x1401646ce
call fcn.140219f50
mov rbx, rax
test rax, rax
je 0x1401646ce
nop word [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140219fe0
mov rcx, rbx
test al, al
jne 0x140164776
call fcn.140219fb0
mov rbx, rax
test rax, rax
jne 0x140164750
jmp 0x1401646ce
call fcn.140219f80
test rax, rax
je 0x1401646ce
mov rdx, rax
mov rcx, rsi
call fcn.1400d4340
mov bl, 1
jmp 0x1401646d0
Function at 0x14016b7e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x1403dd7c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r12, r8
mov rdi, rcx
mov qword [rsp + 0x28], rcx
cmp dword [rcx + 8], 0x62cb09e3
je 0x14016b81b
xor al, al
jmp 0x14016b9d5
xor esi, esi
mov r15d, esi
test rdx, rdx
cmovns r15, rdx
cmp byte [0x140478165], sil
je 0x14016b854
cmp byte [rcx + 0xdc], sil
jne 0x14016b854
cmp qword [rcx + 0xb8], rsi
jle 0x14016b854
mov r8, r15
lea rdx, str.consumeProgress
mov rcx, r12
call fcn.1400f6cf0
mov byte [rsp + 0x30], sil
mov dword [rsp + 0x20], esi
movzx r14d, byte [rdi + 0xdc]
movzx ebx, r14b
test r14b, r14b
jne 0x14016b90f
cmp qword [rdi + 0xb8], rsi
jle 0x14016b90f
mov rbx, qword [rdi + 0xc0]
mov r8, qword [rdi + 0xb8]
mov rdx, rbx
mov rcx, rdi
call fcn.14016be20
mov dword [rsp + 0x20], eax
lea rax, [rbx + r15]
mov qword [rdi + 0xc0], rax
movzx ebx, r14b
cmp rax, qword [rdi + 0xb8]
jle 0x14016b90f
cmp byte [0x140478165], sil
je 0x14016b901
mov rax, qword [r12]
lea rdx, str.Amount_consumed_is_greater_than_the_total.
mov rcx, r12
call qword [rax + 0x28]
mov r8, qword [rdi + 0xc0]
lea rdx, str.m_consumed64
mov rcx, r12
call fcn.1400f6cf0
mov r8, qword [rdi + 0xb8]
lea rdx, str.m_totalAmount64
mov rcx, r12
call fcn.1400f6cf0
movzx ebx, byte [rdi + 0xdc]
mov rax, qword [rdi + 0xb8]
mov qword [rdi + 0xc0], rax
test bl, bl
jne 0x14016b930
mov r8, qword [rdi + 0xb8]
test r8, r8
jle 0x14016b930
mov rdx, qword [rdi + 0xc0]
mov rcx, rdi
call fcn.14016be20
mov esi, eax
cmp qword [rdi + 0xa8], 0
je 0x14016b9ce
test bl, bl
jne 0x14016b9f7
cmp esi, dword [rsp + 0x20]
jbe 0x14016b9f7
cmp esi, dword [rdi + 0xa0]
jbe 0x14016b9f7
call sub.KERNEL32.dll_GetTickCount
mov dword [rdi + 0xb4], eax
cmp byte [rdi + 0xde], bl
je 0x14016b977
cmp esi, dword [rdi + 0xd4]
je 0x14016b9c0
mov dword [rdi + 0xa0], esi
cmp byte [0x140478165], 0
je 0x14016b999
mov r8d, esi
lea rdx, str.percentDoneCB
mov rcx, r12
call fcn.1400f6d60
nop
mov rcx, qword [rdi + 0xa8]
cmp dword [rcx + 0x10], 0x77109acd
jne 0x14016b9b6
mov rax, qword [rcx]
lea r8, [rsp + 0x30]
mov edx, esi
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x14016ba56
cmp byte [rsp + 0x30], 0
je 0x14016b9ce
mov byte [rdi + 0xb1], 1
movzx eax, byte [rdi + 0xb1]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140278f40
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
cmp byte [rdi + 0xdd], 0
jne 0x14016b9ce
cmp dword [rdi + 0xd0], 0
je 0x14016b9ce
call sub.KERNEL32.dll_GetTickCount
mov edx, eax
mov ecx, eax
sub ecx, dword [rdi + 0xb4]
mov eax, dword [rdi + 0xd0]
mov r8d, 0x12c
test eax, eax
cmove eax, r8d
cmp ecx, eax
jbe 0x14016b9ce
mov dword [rdi + 0xd8], edx
mov dword [rdi + 0xb4], edx
mov rcx, qword [rdi + 0xa8]
cmp dword [rcx + 0x10], 0x77109acd
jne 0x14016ba56
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x18]
nop
jmp 0x14016b9c0