joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14015a198]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov r14, rcx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rdx
mov word [rbp - 0x30], 0x3636
mov dword [rbp - 0x2d], 0x2e352e30
mov dword [rbp - 0x29], 0x36363037
mov byte [rbp - 0x2e], 0x2e
mov byte [rbp - 0x25], 0
call fcn.140036710
mov rcx, rax
test rax, rax
je 0x14000b653
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x30]
mov rbx, 0xffffffffffffffff
cmp rax, 0x10000
jae 0x14000b4a2
lea rax, [rbp - 0x30]
movzx edx, ax
lea rcx, [rbp - 0x48]
call fcn.140036ea0
jmp 0x14000b4ca
lea rcx, [rbp - 0x30]
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x14000b4b0
mov r8d, eax
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x48]
call fcn.1400399e0
nop
mov rcx, qword [rdi]
cmp dword [rcx - 0x10], 0
jne 0x14000b525
mov rsi, qword [rbp - 0x48]
lea rcx, [rsi - 0x18]
call fcn.140035ce0
add rax, 0x18
mov qword [r14], rax
mov eax, ebx
lock xadd dword [rsi - 8], eax
sub eax, 1
jg 0x14000b502
mov rcx, qword [rsi - 0x18]
mov rax, qword [rcx]
lea rdx, [rsi - 0x18]
call qword [rax + 8]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14000b62d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x14000b62d
xor eax, eax
mov dword [rbp - 0x50], eax
mov dword [rbp - 0x4c], eax
mov qword [rbp - 0x40], rax
lea rdx, [rbp - 0x50]
call fcn.140024df0
mov esi, eax
test eax, eax
je 0x14000b5e3
mov ecx, esi
call fcn.140043bcc
mov r15, rax
mov r9, rax
mov r8d, esi
mov edx, dword [rbp - 0x50]
mov rcx, qword [rdi]
call fcn.140024d00
test eax, eax
je 0x14000b5db
lea r9, [rbp - 0x4c]
lea r8, [rbp - 0x40]
lea rdx, [0x140177680]
mov rcx, r15
call fcn.140029190
test eax, eax
je 0x14000b5db
cmp dword [rbp - 0x4c], 0
je 0x14000b5db
mov rax, qword [rbp - 0x40]
cmp dword [rax], 0xfeef04bd
jne 0x14000b5db
mov word [rbp - 0x1e], 0x252e
mov dword [rbp - 0x19], 0x64252e64
mov word [rbp - 0x1b], 0x252e
mov word [rbp - 0x20], 0x6425
mov byte [rbp - 0x15], 0
mov byte [rbp - 0x1c], 0x64
mov ecx, dword [rax + 0xc]
mov r8d, dword [rax + 8]
movzx eax, cx
shr ecx, 0x10
movzx r9d, r8w
shr r8d, 0x10
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x48]
call fcn.1400363e0
mov rcx, r15
call fcn.140043b0c
mov rsi, qword [rbp - 0x48]
lea rcx, [rsi - 0x18]
call fcn.140035ce0
add rax, 0x18
mov qword [r14], rax
mov eax, ebx
lock xadd dword [rsi - 8], eax
sub eax, 1
jg 0x14000b612
mov rcx, qword [rsi - 0x18]
mov rax, qword [rcx]
lea rdx, [rsi - 0x18]
call qword [rax + 8]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14000b62d
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rax, r14
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140043aa0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140035ad0
int3
Function at 0x14000cbd0
Capabilities:
Compute adler32 checksum
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x14015a198]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
mov dword [rsp + 0x24], ebx
call fcn.140036710
mov rcx, rax
test rax, rax
je 0x14000cd85
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
lea rdx, [0x140176fa9]
cmp rdx, 0x10000
jae 0x14000cc43
movzx edx, dx
mov rcx, rsi
call fcn.140036ea0
jmp 0x14000cc65
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x14000cc50
mov r8d, eax
mov rcx, rsi
call fcn.1400399e0
nop
mov edi, 1
mov dword [rsp + 0x24], edi
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x50]
call fcn.140073280
mov dword [rsp + 0x3c], 0x6b636954
mov dword [rsp + 0x38], 0x5f4f5353
mov word [rsp + 0x41], 0x74
mov byte [rsp + 0x40], 0x65
lea r9, [rdi - 2]
lea r8, [0x1401777b8]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.1400a2958
lea r9, [rdi - 2]
lea r8, [rsp + 0x38]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.1400a27a0
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.1400a38cc
mov r8, rax
lea r9, [rsp + 0x50]
test rax, rax
je 0x14000cd28
nop word [rax + rax]
movzx ecx, byte [r9]
add ecx, edi
mov edi, ecx
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
lea r9, [r9 + 1]
add ebx, edi
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ebx, eax
sub r8, 1
jne 0x14000ccf0
mov dword [rsp + 0x31], 0x25783830
mov byte [rsp + 0x30], 0x25
mov word [rsp + 0x35], 0x73
mov dword [rsp + 0x20], 0x74745f
shl ebx, 0x10
lea r8d, [rdi + rbx]
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400363e0
mov rax, rsi
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.140043aa0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov ecx, 0x80004005
call fcn.140035ad0
int3
Function at 0x140019670
Capabilities:
Acquire debug privileges

Disassembly:
push rdi
sub rsp, 0x180
mov rax, qword [0x14015a198]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov ecx, 0x2710
mov dword [0x1401616b8], 1
call fcn.140028d10
call fcn.14000dc60
xor edi, edi
mov qword [rsp + 0x38], rdi
call fcn.140024ad0
mov rcx, rax
lea r8, [rsp + 0x38]
lea edx, [rdi + 0x20]
call fcn.140026a60
test eax, eax
je 0x14001971e
lea r8, [rsp + 0x40]
xor ecx, ecx
lea rdx, [0x140177958]
call fcn.1400267e0
test eax, eax
je 0x140019714
mov rax, qword [rsp + 0x40]
lea r9d, [rdi + 0x10]
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x4c], rax
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x54], 2
mov qword [rsp + 0x20], rdi
call fcn.140023220
mov rcx, qword [rsp + 0x38]
call fcn.140023630
call fcn.140018ec0
mov rcx, qword [0x140161728]
cmp dword [rcx - 8], 1
jle 0x140019746
mov edx, dword [rcx - 0x10]
lea rcx, [0x140161728]
call fcn.140036310
mov rcx, qword [0x140161728]
call fcn.14000fac0
mov rax, qword [0x140161728]
test rax, rax
jne 0x14001975b
mov ecx, edi
jmp 0x140019779
movsxd rdx, dword [rax - 0xc]
mov rcx, rax
call fcn.1400a38cc
mov rcx, rax
test eax, eax
js 0x14001985d
mov rax, qword [0x140161728]
cmp ecx, dword [rax - 0xc]
jg 0x14001985d
mov dword [rax - 0x10], ecx
xor edx, edx
mov rax, qword [0x140161728]
mov r8d, 0x104
mov ecx, ecx
mov qword [rsp + 0x190], rbx
mov byte [rcx + rax], dil
lea rcx, [rsp + 0x60]
mov dword [0x140161708], edi
call fcn.140073280
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call fcn.140024f80
test eax, eax
je 0x1400197e6
mov r9d, 0x20
mov dword [rsp + 0x20], edi
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [0x140161708]
call fcn.1400a6360
mov dword [rsp + 0x30], edi
mov ebx, edi
nop dword [rax]
cmp qword [0x1401616c0], rdi
jne 0x140019837
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x140017580]
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call fcn.1400243e0
mov qword [0x1401616c0], rax
test rax, rax
jne 0x140019837
mov ecx, 0xbb8
call fcn.140028d10
inc ebx
cmp ebx, 3
jl 0x1400197f0
mov rbx, qword [rsp + 0x190]
mov eax, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140043aa0
add rsp, 0x180
pop rdi
ret
mov ecx, 0x80070057
call fcn.140035ad0
int3
Function at 0x14001ad30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
mov eax, 0xffffffff
movzx ecx, byte [rcx]
test cl, cl
je 0x14001addc
movzx edx, cl
lea r8, [r8 + 1]
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x14001ad43
not eax
ret

Function at 0x14001c000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14015a198]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rcx + 0x18], 0xf
mov qword [rcx], rax
mov rbx, rcx
mov qword [rcx + 0x10], rax
mov r8, 0xffffffffffffffff
mov byte [rcx], al
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x39], 0x29616c
mov dword [rsp + 0x34], 0x697a6f4d
mov word [rsp + 0x2b], 0x5f53
mov dword [rsp + 0x2f], 0x20637465
mov word [rsp + 0x28], 0x534e
mov word [rsp + 0x2d], 0x6e49
mov byte [rsp + 0x33], 0x28
mov byte [rsp + 0x2a], 0x49
mov byte [rsp + 0x38], 0x6c
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14001c080
lea rdx, [rsp + 0x28]
call fcn.14002e200
mov rax, rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140043aa0
add rsp, 0x50
pop rbx
ret
Function at 0x14001c0b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov r9d, r8d
mov r15, rdx
mov rbx, rcx
xor eax, eax
nop dword [rax]
nop word [rax + rax]
mov byte [rcx], al
lea rcx, [rcx + 1]
inc eax
cmp eax, 0x100
jl 0x14001c0e0
xor edi, edi
movzx ebp, r9b
xor r8b, r8b
lea r14, [rbx + 0xff]
mov ecx, 0xff
nop dword [rax]
nop dword [rax + rax]
xor esi, esi
mov r10d, 1
cmp ecx, r10d
jbe 0x14001c130
nop dword [rax]
lea r10d, [r10*2 + 1]
cmp r10d, ecx
jb 0x14001c120
nop dword [rax]
movzx edx, byte [rdi + r15]
lea r9d, [rdi + 1]
movzx eax, r8b
add dl, byte [rax + rbx]
movzx r8d, dl
cmp r9d, ebp
lea eax, [r8 + rbp]
movzx edx, al
cmovb edx, r8d
xor edi, edi
cmp r9d, ebp
movzx r11d, dl
mov eax, r11d
cmovb edi, r9d
and eax, r10d
inc esi
cmp esi, 0xb
jbe 0x14001c172
xor edx, edx
div ecx
mov eax, edx
movzx r8d, r11b
cmp eax, ecx
ja 0x14001c130
movzx r8d, byte [r14]
movzx edx, al
movzx eax, byte [rdx + rbx]
mov byte [r14], al
dec r14
mov byte [rdx + rbx], r8b
movzx r8d, r11b
sub ecx, 1
jne 0x14001c110
movzx eax, byte [rbx + 1]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov byte [rbx + 0x100], al
movzx eax, byte [rbx + 3]
mov byte [rbx + 0x101], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 0x102], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0x103], al
mov rax, rbx
movzx ecx, byte [r11 + rbx]
mov byte [rbx + 0x104], cl
mov rbx, qword [rsp + 0x18]
pop r15
pop r14
ret

Function at 0x14001cc90
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xa0
mov rax, qword [0x14015a198]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
lea rax, [0x140177d38]
mov qword [r11 - 0x78], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
xor eax, eax
mov qword [r11 - 0x30], rax
mov dword [r11 - 0x28], 0x67452301
mov dword [r11 - 0x24], 0xefcdab89
mov dword [r11 - 0x20], 0x98badcfe
mov dword [r11 - 0x1c], 0x10325476
lea rcx, [r11 - 0x78]
call fcn.14001d600
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14001c900
nop
mov rax, rbx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140043aa0
add rsp, 0xa0
pop rbx
ret
Function at 0x14001d6f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x1040]
mov eax, 0x1140
call fcn.1400443a0
sub rsp, rax
mov rax, qword [0x14015a198]
xor rax, rsp
mov qword [rbp + 0x1030], rax
movsxd rsi, r8d
mov rdi, rcx
mov qword [rbp + 0x418], rcx
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], r14b
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop
inc r8
cmp byte [rdx + r8], r14b
jne 0x14001d750
lea rcx, [rsp + 0x48]
call fcn.14002e200
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.14001dcd0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14001d7b1
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d7ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d9c5
call fcn.140043b04
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x430]
call fcn.140073280
mov edx, r14d
mov r9, qword [rsp + 0x38]
mov r8, qword [rsp + 0x30]
sub r9, r8
je 0x14001d805
lea rcx, [rbp + 0x430]
lea rax, [rbp + 0x430]
sub r8, rax
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
mov byte [rcx], al
inc edx
lea rcx, [rcx + 1]
movsxd rax, edx
cmp rax, r9
jb 0x14001d7f0
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0xc30]
call fcn.140073280
xorps xmm0, xmm0
movups xmmword [rbp + 0x418], xmm0
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x830]
call fcn.140073280
mov dword [rbp + 0x406], 0x43424342
mov dword [rbp + 0x3f7], 0x41324443
mov dword [rbp + 0x40d], 0x393946
mov word [rbp + 0x401], 0x4232
mov dword [rbp + 0x3f1], 0x44373838
mov word [rbp + 0x404], 0x4134
mov word [rbp + 0x3fe], 0x3646
mov byte [rbp + 0x3f0], 0x43
mov word [rbp + 0x3fb], 0x4537
mov word [rbp + 0x3f5], 0x3234
mov byte [rbp + 0x400], 0x44
mov byte [rbp + 0x3fd], 0x39
mov word [rbp + 0x40a], 0x3646
mov byte [rbp + 0x403], 0x36
mov byte [rbp + 0x40c], 0x38
lea r8, [rbp + 0x3f0]
mov edx, 0x400
lea rcx, [rbp + 0x830]
call fcn.1400a93e0
lea rcx, [rsp + 0x70]
call fcn.14001e630
nop
mov dword [rsp + 0x20], 0x10
mov r9d, 0x20
lea r8, [rbp + 0x418]
lea rdx, [rbp + 0x830]
lea rcx, [rsp + 0x70]
call fcn.14001fab0
mov r9, qword [rsp + 0x38]
sub r9, qword [rsp + 0x30]
mov dword [rsp + 0x20], 1
lea r8, [rbp + 0xc30]
lea rdx, [rbp + 0x430]
lea rcx, [rsp + 0x70]
call fcn.14001e660
lea rdx, [rbp + 0xc30]
add rdx, rsi
mov qword [rdi], r14
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
inc rbx
cmp byte [rdx + rbx], 0
jne 0x14001d947
mov r8, rbx
mov rcx, rdi
call fcn.14002e200
nop
lea rcx, [rsp + 0x70]
call fcn.14001e650
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14001d99f
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d99a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d9bf
call fcn.140043b04
mov rax, rdi
mov rcx, qword [rbp + 0x1030]
xor rcx, rsp
call fcn.140043aa0
add rsp, 0x1140
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140080f48
nop
call fcn.140080f48
nop
int3
Function at 0x14001e660
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0x40
cmp byte [rcx + 8], 0
mov r12, r9
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14001e865
test r9, r9
je 0x14001e842
movsxd rcx, dword [rcx + 0x3d0]
xor edx, edx
mov rax, r9
div rcx
test rdx, rdx
jne 0x14001e842
mov ecx, dword [rsp + 0x80]
mov qword [rsp + 0x60], rbp
xor ebp, ebp
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r15
cmp ecx, 1
jne 0x14001e767
mov r15d, ebp
test rax, rax
je 0x14001e74a
nop dword [rax]
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.14001e8d0
mov rcx, rdi
cmp byte [rbx + 8], bpl
je 0x14001e888
mov eax, dword [rbx + 0x3d0]
mov edx, ebp
test eax, eax
jle 0x14001e718
lea r8, [rbx + 0x3f8]
sub r8, rdi
movzx eax, byte [r8 + rcx]
inc edx
xor byte [rcx], al
lea rcx, [rcx + 1]
mov eax, dword [rbx + 0x3d0]
cmp edx, eax
jl 0x14001e701
movsxd r8, eax
lea rcx, [rbx + 0x3f8]
mov rdx, rsi
call fcn.1400715f0
movsxd rcx, dword [rbx + 0x3d0]
xor edx, edx
mov rax, r12
inc r15d
div rcx
add rsi, rcx
add rdi, rcx
movsxd rcx, r15d
cmp rcx, rax
jb 0x14001e6d0
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r15, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
cmp ecx, 2
jne 0x14001e7ff
mov r15d, ebp
test rax, rax
je 0x14001e74a
nop dword [rax + rax]
mov r8, rdi
lea rdx, [rbx + 0x3f8]
mov rcx, rbx
call fcn.14001f740
mov rax, rdi
cmp byte [rbx + 8], bpl
je 0x14001e8ab
mov ecx, dword [rbx + 0x3d0]
mov edx, ebp
test ecx, ecx
jle 0x14001e7c8
mov r8, rsi
sub r8, rdi
movzx ecx, byte [r8 + rax]
inc edx
xor byte [rax], cl
lea rax, [rax + 1]
mov ecx, dword [rbx + 0x3d0]
cmp edx, ecx
jl 0x14001e7b1
movsxd r8, ecx
mov rdx, rsi
lea rcx, [rbx + 0x3f8]
call fcn.1400715f0
movsxd rcx, dword [rbx + 0x3d0]
xor edx, edx
mov rax, r12
inc r15d
div rcx
add rsi, rcx
add rdi, rcx
movsxd rcx, r15d
cmp rcx, rax
jb 0x14001e780
jmp 0x14001e74a
test rax, rax
je 0x14001e74a
nop dword [rax + rax]
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.14001e8d0
movsxd rcx, dword [rbx + 0x3d0]
xor edx, edx
mov rax, r12
inc ebp
div rcx
add rsi, rcx
add rdi, rcx
movsxd rcx, ebp
cmp rcx, rax
jb 0x14001e810
jmp 0x14001e74a
mov rdx, qword [0x14015a0e0]
lea rcx, [rsp + 0x20]
call fcn.140042510
lea rdx, [0x1401a9c18]
lea rcx, [rsp + 0x20]
call fcn.1400720b4
int3
mov rdx, qword [0x14015a0d8]
lea rcx, [rsp + 0x20]
call fcn.140042510
lea rdx, [0x1401a9c18]
lea rcx, [rsp + 0x20]
call fcn.1400720b4
int3
mov rdx, qword [0x14015a0d8]
lea rcx, [rsp + 0x20]
call fcn.140042510
lea rdx, [0x1401a9c18]
lea rcx, [rsp + 0x20]
call fcn.1400720b4
int3
mov rdx, qword [0x14015a0d8]
lea rcx, [rsp + 0x20]
call fcn.140042510
lea rdx, [0x1401a9c18]
lea rcx, [rsp + 0x20]
call fcn.1400720b4
int3
Function at 0x14001f4c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0x40
cmp byte [rcx + 8], 0
mov r12, r9
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14001f6d5
test r9, r9
je 0x14001f6b2
movsxd r8, dword [rcx + 0x3d0]
xor edx, edx
mov rax, r9
div r8
test rdx, rdx
jne 0x14001f6b2
mov ecx, dword [rsp + 0x80]
mov qword [rsp + 0x60], rbp
xor ebp, ebp
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r15
cmp ecx, 1
jne 0x14001f5d2
mov r15d, ebp
test rax, rax
je 0x14001f5b5
lea r14, [rbx + 0x3f8]
nop dword [rax + rax]
mov rax, r14
cmp byte [rbx + 8], bpl
je 0x14001f6f8
mov edx, ebp
test r8d, r8d
jle 0x14001f575
mov r8, rsi
sub r8, r14
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
inc edx
xor byte [rax], cl
lea rax, [rax + 1]
cmp edx, dword [rbx + 0x3d0]
jl 0x14001f560
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call fcn.14001f740
movsxd r8, dword [rbx + 0x3d0]
mov rdx, rdi
mov rcx, r14
call fcn.1400715f0
movsxd r8, dword [rbx + 0x3d0]
xor edx, edx
mov rax, r12
inc r15d
div r8
add rsi, r8
movsxd rcx, r15d
add rdi, r8
cmp rcx, rax
jb 0x14001f540
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r15, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
cmp ecx, 2
jne 0x14001f672
mov r15d, ebp
test rax, rax
je 0x14001f5b5
mov r8, rdi
lea rdx, [rbx + 0x3f8]
mov rcx, rbx
call fcn.14001f740
mov rcx, rdi
cmp byte [rbx + 8], bpl
je 0x14001f71b
mov eax, dword [rbx + 0x3d0]
mov edx, ebp
test eax, eax
jle 0x14001f637
mov r8, rsi
sub r8, rdi
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
inc edx
xor byte [rcx], al
lea rcx, [rcx + 1]
mov eax, dword [rbx + 0x3d0]
cmp edx, eax
jl 0x14001f620
movsxd r8, eax
lea rcx, [rbx + 0x3f8]
mov rdx, rdi
call fcn.1400715f0
movsxd rcx, dword [rbx + 0x3d0]
xor edx, edx
mov rax, r12
inc r15d
div rcx
add rsi, rcx
add rdi, rcx
movsxd rcx, r15d
cmp rcx, rax
jb 0x14001f5e3
jmp 0x14001f5b5
test rax, rax
je 0x14001f5b5
nop dword [rax + rax]
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.14001f740
movsxd rcx, dword [rbx + 0x3d0]
xor edx, edx
mov rax, r12
inc ebp
div rcx
add rsi, rcx
add rdi, rcx
movsxd rcx, ebp
cmp rcx, rax
jb 0x14001f680
jmp 0x14001f5b5
mov rdx, qword [0x14015a0e0]
lea rcx, [rsp + 0x20]
call fcn.140042510
lea rdx, [0x1401a9c18]
lea rcx, [rsp + 0x20]
call fcn.1400720b4
int3
mov rdx, qword [0x14015a0d8]
lea rcx, [rsp + 0x20]
call fcn.140042510
lea rdx, [0x1401a9c18]
lea rcx, [rsp + 0x20]
call fcn.1400720b4
int3
mov rdx, qword [0x14015a0d8]
lea rcx, [rsp + 0x20]
call fcn.140042510
lea rdx, [0x1401a9c18]
lea rcx, [rsp + 0x20]
call fcn.1400720b4
int3
mov rdx, qword [0x14015a0d8]
lea rcx, [rsp + 0x20]
call fcn.140042510
lea rdx, [0x1401a9c18]
lea rcx, [rsp + 0x20]
call fcn.1400720b4
int3
Function at 0x140020160
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rax, r8
xor ecx, ecx
mov rdi, rdx
mov r8, r9
mov rdx, rax
mov qword [rbx], rcx
mov qword [rbx + 8], rcx
mov rcx, rbx
mov dword [rbx + 0x50], 0x6a09e667
mov dword [rbx + 0x54], 0xbb67ae85
mov dword [rbx + 0x58], 0x3c6ef372
mov dword [rbx + 0x5c], 0xa54ff53a
mov dword [rbx + 0x60], 0x510e527f
mov dword [rbx + 0x64], 0x9b05688c
mov dword [rbx + 0x68], 0x1f83d9ab
mov dword [rbx + 0x6c], 0x5be0cd19
call fcn.140020250
mov rdx, rdi
mov rcx, rbx
call fcn.140020340
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x140023220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x14015a198]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x70]
mov r14d, edx
mov r13, qword [rbp + 0x68]
lea rdx, [0x14017bba0]
mov rsi, rcx
mov qword [rbp - 0x30], rax
lea rcx, [rbp - 0x38]
mov r12d, r9d
mov r15, r8
xor ebx, ebx
call fcn.14001c1f0
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdx, qword [rbp - 0x38]
mov ecx, 0xffffffff
add rdx, 0xffffffffffffffe8
mov rdi, rax
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140023299
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x140023307
lea rdx, [rbp - 0x28]
mov word [rbp - 0x19], 0x6c69
mov rcx, rdi
mov dword [rbp - 0x24], 0x6f547473
mov dword [rbp - 0x20], 0x506e656b
mov dword [rbp - 0x28], 0x756a6441
mov word [rbp - 0x1c], 0x6972
mov dword [rbp - 0x16], 0x736567
mov byte [rbp - 0x1a], 0x76
mov byte [rbp - 0x17], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400232fe
mov rcx, qword [rbp - 0x30]
mov r9d, r12d
mov qword [rsp + 0x28], rcx
mov r8, r15
mov rcx, rsi
mov qword [rsp + 0x20], r13
mov edx, r14d
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140043aa0
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140023420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x14015a198]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r12, qword [rsp + 0xd0]
mov ebp, edx
mov r13, qword [rsp + 0xd8]
lea rdx, [0x14017bbc0]
mov esi, ecx
mov r15, r9
lea rcx, [rsp + 0x30]
mov r14, r8
mov ebx, 1
call fcn.14001c1f0
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdx, qword [rsp + 0x30]
mov ecx, 0xffffffff
add rdx, 0xffffffffffffffe8
mov rdi, rax
lock xadd dword [rdx + 0x10], ecx
sub ecx, ebx
jg 0x14002349d
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test rdi, rdi
je 0x14002350f
lea rdx, [rsp + 0x38]
mov word [rsp + 0x39], 0x7373
mov rcx, rdi
mov dword [rsp + 0x3c], 0x65755163
mov word [rsp + 0x45], 0x6e69
mov byte [rsp + 0x38], 0x41
mov word [rsp + 0x48], 0x41
mov byte [rsp + 0x47], 0x67
mov dword [rsp + 0x40], 0x74537972
mov byte [rsp + 0x44], 0x72
mov byte [rsp + 0x3b], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140023506
mov qword [rsp + 0x28], r13
mov r9, r15
mov r8, r14
mov qword [rsp + 0x20], r12
mov edx, ebp
mov ecx, esi
call rax
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140043aa0
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret