joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d9050
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x1b0
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rbx, rcx
call fcn.1400b9c60
cmp byte [0x1403aee21], 0
jne 0x1400d90d3
xor edx, edx
mov r8d, 0x200
lea rcx, [0x1403aeff0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0x100
lea rdx, [rsp + 0x20]
lea rcx, [0x1403aeff0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x1400d90cc
movsd xmm0, qword [str.Win32]
movsd qword [0x1403aeff0], xmm0
movzx eax, word [0x1402738f0]
mov word [0x1403aeff8], ax
mov byte [0x1403aee21], 1
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x30]
call fcn.14008d340
nop
lea rdx, [0x1403aeff0]
lea rcx, [rsp + 0x30]
call fcn.14008e020
lea rcx, [rsp + 0x30]
call fcn.140090aa0
mov rdx, rax
mov rcx, rbx
call fcn.1400b7750
nop
lea rcx, [rsp + 0x30]
call fcn.14008d3a0
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14008b8a0
add rsp, 0x1b0
pop rbx
ret
Function at 0x140104880
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbp
push rbx
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rax, qword [rbp + 0x210]
mov r13, rcx
mov rcx, qword [rbp + 0x218]
mov r14d, r9d
mov qword [rsp + 0x20], rcx
mov ebx, r8d
mov qword [rsp + 0x28], rax
mov r15, rdx
test rax, rax
je 0x140104ad7
mov qword [rsp + 0x2b8], rsi
lea eax, [r9 - 2]
mov ecx, 0x80
mov qword [rsp + 0x2b0], rdi
cmp eax, 1
mov qword [rsp + 0x2a8], r12
mov esi, 0x40
cmovbe esi, ecx
mov ecx, r14d
call fcn.1400ecc10
movsxd r12, eax
cmp ebx, esi
jle 0x140104929
lea r9, [rbp + 0x50]
mov r8d, r14d
mov edx, ebx
mov rcx, r15
call fcn.1400ebc60
lea r15, [rbp + 0x50]
mov ebx, r12d
mov r8d, esi
lea rcx, [rsp + 0x30]
xor edx, edx
mov edi, esi
call sub.VCRUNTIME140.dll_memset
mov r8d, esi
lea rcx, [rbp - 0x40]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp ebx, esi
lea rcx, [rsp + 0x30]
mov eax, esi
mov rdx, r15
cmovle eax, ebx
movsxd rbx, eax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8, rbx
lea rcx, [rbp - 0x40]
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
movdqa xmm2, xmmword [str.6666666666666666_]
xor ecx, ecx
movdqa xmm3, xmmword [0x1402aae70]
mov eax, ecx
nop word [rax + rax]
movdqu xmm0, xmmword [rsp + rax + 0x30]
add ecx, 0x40
movdqa xmm1, xmm2
pxor xmm0, xmm2
movdqu xmmword [rsp + rax + 0x30], xmm0
movdqu xmm0, xmmword [rbp + rax - 0x40]
pxor xmm0, xmm3
movdqu xmmword [rbp + rax - 0x40], xmm0
movdqu xmm0, xmmword [rsp + rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax - 0x30]
movdqu xmmword [rsp + rax + 0x40], xmm1
pxor xmm0, xmm3
movdqa xmm1, xmm3
movdqu xmmword [rbp + rax - 0x30], xmm0
movdqu xmm0, xmmword [rsp + rax + 0x50]
pxor xmm0, xmm2
movdqu xmmword [rsp + rax + 0x50], xmm0
movdqu xmm0, xmmword [rbp + rax - 0x20]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rsp + rax + 0x60]
movdqu xmmword [rbp + rax - 0x20], xmm1
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax - 0x10]
movdqu xmmword [rsp + rax + 0x60], xmm1
pxor xmm0, xmm3
movdqu xmmword [rbp + rax - 0x10], xmm0
add rax, 0x40
cmp rax, rdi
jl 0x140104990
movsxd rax, ecx
cmp rax, rdi
jge 0x140104a52
nop dword [rax]
nop dword [rax + rax]
xor byte [rsp + rax + 0x30], 0x36
xor byte [rbp + rax - 0x40], 0x5c
inc rax
cmp rax, rdi
jl 0x140104a40
mov r9, qword [rsp + 0x20]
lea rax, [rsp + 0x30]
lea r8, [rbp + 0x90]
mov qword [r13 + 8], rax
mov edx, r14d
mov dword [r13 + 0x808], esi
mov rcx, r13
call fcn.1400ebfc0
mov r8, rdi
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xd0]
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0xd0]
mov r8, r12
add rcx, rdi
lea rdx, [rbp + 0x90]
call sub.VCRUNTIME140.dll_memcpy
mov r9, qword [rsp + 0x28]
lea edx, [r12 + rsi]
mov r8d, r14d
lea rcx, [rbp + 0xd0]
call fcn.1400ebc60
mov r12, qword [rsp + 0x2a8]
mov al, 1
mov rdi, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2b8]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.14008b8a0
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop rbx
pop rbp
ret
Function at 0x14011f2a0
Capabilities:
Hash data using crc32b

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx ecx, byte [0x1403afd48]
movzx eax, byte [0x1403afd49]
test cl, cl
jne 0x14011f490
test al, al
jne 0x14011f498
cmp qword [0x1403afd50], 0
jne 0x14011f4bd
mov ecx, 0x100
mov byte [0x1403afd49], 1
call fcn.140098b80
mov rdi, rax
test rax, rax
je 0x14011f4bd
xor ebx, ebx
mov r11, rax
mov r10d, ebx
nop dword [rax + rax]
mov ecx, r10d
mov r8d, r10d
and ecx, 1
shr r8d, 1
shl ecx, 7
mov r9d, ebx
mov edx, ecx
or edx, 0x40
test r8b, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
or ecx, 0x20
test r8b, 1
cmove ecx, edx
shr r8d, 1
mov edx, ecx
or edx, 0x10
test r8b, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
or ecx, 8
test r8b, 1
cmove ecx, edx
shr r8d, 1
mov edx, ecx
or edx, 4
test r8b, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
or ecx, 2
test r8b, 1
cmove ecx, edx
mov eax, ecx
or eax, 1
test r8b, 2
mov r8d, 0x1e
cmove eax, ecx
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov eax, ecx
add ecx, ecx
sar eax, 0x1f
and eax, 0x4c11db7
xor eax, ecx
nop dword [rax + rax]
test al, 1
je 0x14011f412
lea ecx, [r8 + 1]
mov edx, 1
shl edx, cl
or r9d, edx
shr eax, 1
test al, 1
je 0x14011f425
mov ecx, r8d
mov edx, 1
shl edx, cl
or r9d, edx
shr eax, 1
sub r8d, 2
cmp r8d, 0xfffffffe
jg 0x14011f400
mov dword [r11], r9d
inc r10d
add r11, 4
cmp r10d, 0xff
jbe 0x14011f300
cmp qword [0x1403afd50], rbx
jne 0x14011f470
mov qword [0x1403afd50], rdi
mov byte [0x1403afd48], 1
mov byte [0x1403afd49], bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call fcn.14008b8c0
mov byte [0x1403afd48], 1
mov byte [0x1403afd49], bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test al, al
je 0x14011f4bd
test cl, cl
jne 0x14011f4bd
xor ebx, ebx
test al, al
je 0x14011f4bd
nop
mov ecx, 2
call sub.KERNEL32.dll_Sleep
inc ebx
cmp ebx, 0xc8
ja 0x14011f4bd
cmp byte [0x1403afd49], 0
jne 0x14011f4a0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14011f4d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
mov r11, rcx
test rdx, rdx
je 0x14011f72c
test r8d, r8d
je 0x14011f72c
cmp r8d, 0x10
jb 0x14011f6eb
mov r9d, r8d
mov qword [rsp], rbx
mov ebx, dword [rcx + 8]
shr r9, 4
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r10]
mov ecx, ebx
shr ecx, 8
movzx edx, bl
xor rdx, rax
mov rax, qword [0x1403afd50]
xor ecx, dword [rax + rdx*4]
mov edx, ecx
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 1]
movzx ecx, cl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1403afd50]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 2]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1403afd50]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 3]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1403afd50]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1403afd50]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 5]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1403afd50]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 6]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1403afd50]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 7]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1403afd50]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 8]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1403afd50]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 9]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1403afd50]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 0xa]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1403afd50]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 0xb]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1403afd50]
add r8d, 0xfffffff0
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 0xc]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1403afd50]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 0xd]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1403afd50]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 0xe]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1403afd50]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
movzx eax, byte [r10 + 0xf]
add r10, 0x10
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1403afd50]
xor edx, dword [rax + rcx*4]
mov dword [r11 + 8], edx
mov ebx, edx
sub r9, 1
jne 0x14011f510
mov rbx, qword [rsp]
test r8d, r8d
je 0x14011f72c
mov r9d, dword [r11 + 8]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r10]
lea r10, [r10 + 1]
movzx edx, r9b
mov ecx, r9d
xor rdx, rax
shr ecx, 8
mov rax, qword [0x1403afd50]
xor ecx, dword [rax + rdx*4]
mov dword [r11 + 8], ecx
mov r9d, ecx
add r8d, 0xffffffff
jne 0x14011f700
add rsp, 8
ret
Function at 0x140120ec0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r14, r9
mov rbx, r8
mov r15, rdx
mov r12, rcx
xor ecx, ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
xor sil, sil
test eax, eax
jne 0x14012105d
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x1401210d3
call fcn.140098af0
mov rdi, rax
test rax, rax
je 0x1401210d7
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, r15
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r12d, eax
test eax, eax
jne 0x140120fdd
mov r8d, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
cmp eax, 4
jne 0x140120fa0
cmp r8d, eax
jne 0x140120fc2
mov edx, dword [rdi]
mov rcx, rbx
call fcn.1400b7640
mov sil, 1
mov rcx, rdi
call fcn.14008b8c0
jmp 0x1401210d3
dec eax
cmp eax, 1
ja 0x140120fc2
mov rdx, rdi
mov rcx, rbx
call fcn.1400b7750
mov sil, 1
mov rcx, rdi
call fcn.14008b8c0
jmp 0x1401210d3
mov rdx, rdi
mov rcx, rbx
call fcn.1400b7d90
mov sil, 1
mov rcx, rdi
call fcn.14008b8c0
jmp 0x1401210d3
xorps xmm0, xmm0
movups xmmword [rbp - 0x79], xmm0
movups xmmword [rbp - 0x69], xmm0
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
lea rcx, [rbp - 0x79]
call fcn.1400b7020
nop
mov edx, r12d
lea rcx, [rbp - 0x79]
call fcn.1400b8820
mov rbx, qword [r14]
lea rcx, [rbp - 0x79]
call fcn.1400bcff0
mov r8, rax
lea rdx, str.RegistryQueryError2
mov rcx, r14
call qword [rbx + 0x58]
mov rax, qword [r14]
mov r8, r15
lea rdx, str.ValueName
mov rcx, r14
call qword [rax + 0x58]
nop
lea rcx, [rbp - 0x79]
call fcn.1400b7070
mov rcx, rdi
call fcn.14008b8c0
jmp 0x1401210d3
xorps xmm0, xmm0
movups xmmword [rbp - 0x79], xmm0
movups xmmword [rbp - 0x69], xmm0
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
lea rcx, [rbp - 0x79]
call fcn.1400b7020
nop
mov edx, edi
lea rcx, [rbp - 0x79]
call fcn.1400b8820
mov rbx, qword [r14]
lea rcx, [rbp - 0x79]
call fcn.1400bcff0
mov r8, rax
lea rdx, str.RegistryQueryError
mov rcx, r14
call qword [rbx + 0x58]
mov r9, qword [r14]
mov r8, r15
lea rdx, str.ValueName
mov rcx, r14
call qword [r9 + 0x58]
nop
lea rcx, [rbp - 0x79]
call fcn.1400b7070
movzx eax, sil
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14008b8a0
add rsp, 0xe0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1401467c0
Capabilities:
Hash data using djb2

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xc0
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [r11 - 0x48], xmm0
movups xmmword [r11 - 0x38], xmm0
movups xmmword [r11 - 0x28], xmm0
lea rcx, [rsp + 0x20]
call fcn.1400b6f10
nop
cmp dword [rbx + 0x10], 0x6119a407
je 0x140146832
xor ecx, ecx
call fcn.140001920
xor bl, bl
jmp 0x1401468b9
lea rcx, [rsp + 0x20]
call fcn.1400bcff0
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x140146860
nop dword [rax + rax]
lea rcx, [rcx + 1]
imul eax, eax, 0x21
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x140146850
xor edx, edx
div dword [rbx + 0x14]
cmp edx, dword [rbx + 0x14]
jae 0x1401468b1
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1401468b1
mov rcx, qword [rcx + rdx*8]
test rcx, rcx
je 0x1401468b1
call fcn.140203ec0
mov rbx, rax
test rax, rax
je 0x1401468b1
nop dword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140203f50
test al, al
jne 0x1401468b3
mov rcx, rbx
call fcn.140203f20
mov rbx, rax
test rax, rax
jne 0x140146890
xor ebx, ebx
test rbx, rbx
setne bl
lea rcx, [rsp + 0x20]
call fcn.1400b7070
movzx eax, bl
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14008b8a0
add rsp, 0xc0
pop rbx
ret
Function at 0x1401468e0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rdx
mov rdi, rcx
cmp dword [rcx + 0x10], 0x6119a407
je 0x14014691e
xor ecx, ecx
call fcn.140001920
xor al, al
jmp 0x140146993
test rbx, rbx
je 0x14014691a
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
lea rcx, [rsp + 0x20]
call fcn.1400b7020
nop
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400b7750
cmp dword [rdi + 0x10], 0x6119a407
je 0x1401469b8
xor ecx, ecx
call fcn.140001920
xor bl, bl
lea rcx, [rsp + 0x20]
call fcn.1400b7070
movzx eax, bl
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14008b8a0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
cmp qword [rdi + 0x18], 0
je 0x140146984
lea rcx, [rsp + 0x20]
call fcn.1400bcff0
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x1401469f0
nop dword [rax + rax]
lea rcx, [rcx + 1]
imul eax, eax, 0x21
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x1401469e0
xor edx, edx
div dword [rdi + 0x14]
cmp edx, dword [rdi + 0x14]
jae 0x14014697d
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x140146984
lea rsi, [rdx*8]
mov rcx, qword [rsi + rcx]
test rcx, rcx
je 0x140146984
call fcn.140203ec0
mov rbx, rax
test rax, rax
je 0x140146984
nop dword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140203f50
test al, al
jne 0x140146a56
mov rcx, rbx
call fcn.140203f20
mov rbx, rax
test rax, rax
jne 0x140146a30
jmp 0x140146984
mov eax, dword [rdi + 0x20]
test eax, eax
je 0x140146a62
dec eax
mov dword [rdi + 0x20], eax
mov rcx, qword [rdi + 0x18]
mov rdx, rbx
mov rcx, qword [rcx + rsi]
call fcn.140203f90
mov bl, 1
jmp 0x140146986

Function at 0x140146b10
Capabilities:
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x10], 0x6119a407
mov rbx, rcx
je 0x140146b31
xor ecx, ecx
call fcn.140001920
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rdx
call fcn.1400bcff0
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x140146b60
nop dword [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x140146b50
xor edx, edx
div dword [rbx + 0x14]
mov eax, edx
add rsp, 0x20
pop rbx
ret
Function at 0x140146d80
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x10], 0x6119a407
mov rdi, rdx
mov rbx, rcx
je 0x140146dad
xor ecx, ecx
call fcn.140001920
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call fcn.1400bcff0
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x140146de0
nop dword [rax]
nop dword [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x140146dd0
xor edx, edx
mov r8, rdi
div dword [rbx + 0x14]
mov rcx, rbx
call fcn.140146620
test rax, rax
je 0x140146da0
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140203ef0

Function at 0x140146e10
Capabilities:
Hash data using djb2

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp dword [rcx + 0x10], 0x6119a407
je 0x140146e4a
xor ecx, ecx
call fcn.140001920
xor al, al
jmp 0x140146ebd
mov rcx, rsi
call fcn.1400c4d90
test rdi, rdi
je 0x140146e46
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400b6f10
nop
cmp dword [rbx + 0x10], 0x6119a407
je 0x140146ed8
xor ecx, ecx
call fcn.140001920
xor bl, bl
lea rcx, [rsp + 0x20]
call fcn.1400b7070
movzx eax, bl
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14008b8a0
add rsp, 0xc0
pop rdi
pop rsi
pop rbx
ret
lea rcx, [rsp + 0x20]
call fcn.1400bcff0
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x140146f01
lea rcx, [rcx + 1]
imul eax, eax, 0x21
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x140146ef1
xor edx, edx
div dword [rbx + 0x14]
cmp edx, dword [rbx + 0x14]
jae 0x140146eae
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140146eae
mov rcx, qword [rcx + rdx*8]
test rcx, rcx
je 0x140146eae
call fcn.140203ec0
mov rbx, rax
test rax, rax
je 0x140146eae
nop word [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140203f50
mov rcx, rbx
test al, al
jne 0x140146f56
call fcn.140203f20
mov rbx, rax
test rax, rax
jne 0x140146f30
jmp 0x140146eae
call fcn.140203ef0
test rax, rax
je 0x140146eae
mov rdx, rax
mov rcx, rsi
call fcn.1400b73b0
mov bl, 1
jmp 0x140146eb0
Function at 0x14014e010
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r12, r8
mov rdi, rcx
mov qword [rsp + 0x28], rcx
cmp dword [rcx + 8], 0x62cb09e3
je 0x14014e04b
xor al, al
jmp 0x14014e205
xor esi, esi
mov r15d, esi
test rdx, rdx
cmovns r15, rdx
cmp byte [0x1403aedd5], sil
je 0x14014e084
cmp byte [rcx + 0xdc], sil
jne 0x14014e084
cmp qword [rcx + 0xb8], rsi
jle 0x14014e084
mov r8, r15
lea rdx, str.consumeProgress
mov rcx, r12
call fcn.1400d9de0
mov byte [rsp + 0x30], sil
mov dword [rsp + 0x20], esi
movzx r14d, byte [rdi + 0xdc]
movzx ebx, r14b
test r14b, r14b
jne 0x14014e13f
cmp qword [rdi + 0xb8], rsi
jle 0x14014e13f
mov rbx, qword [rdi + 0xc0]
mov r8, qword [rdi + 0xb8]
mov rdx, rbx
mov rcx, rdi
call fcn.14014e650
mov dword [rsp + 0x20], eax
lea rax, [rbx + r15]
mov qword [rdi + 0xc0], rax
movzx ebx, r14b
cmp rax, qword [rdi + 0xb8]
jle 0x14014e13f
cmp byte [0x1403aedd5], sil
je 0x14014e131
mov rax, qword [r12]
lea rdx, str.Amount_consumed_is_greater_than_the_total.
mov rcx, r12
call qword [rax + 0x28]
mov r8, qword [rdi + 0xc0]
lea rdx, str.m_consumed64
mov rcx, r12
call fcn.1400d9de0
mov r8, qword [rdi + 0xb8]
lea rdx, str.m_totalAmount64
mov rcx, r12
call fcn.1400d9de0
movzx ebx, byte [rdi + 0xdc]
mov rax, qword [rdi + 0xb8]
mov qword [rdi + 0xc0], rax
test bl, bl
jne 0x14014e160
mov r8, qword [rdi + 0xb8]
test r8, r8
jle 0x14014e160
mov rdx, qword [rdi + 0xc0]
mov rcx, rdi
call fcn.14014e650
mov esi, eax
cmp qword [rdi + 0xa8], 0
je 0x14014e1fe
test bl, bl
jne 0x14014e227
cmp esi, dword [rsp + 0x20]
jbe 0x14014e227
cmp esi, dword [rdi + 0xa0]
jbe 0x14014e227
call sub.KERNEL32.dll_GetTickCount
mov dword [rdi + 0xb4], eax
cmp byte [rdi + 0xde], bl
je 0x14014e1a7
cmp esi, dword [rdi + 0xd4]
je 0x14014e1f0
mov dword [rdi + 0xa0], esi
cmp byte [0x1403aedd5], 0
je 0x14014e1c9
mov r8d, esi
lea rdx, str.percentDoneCB
mov rcx, r12
call fcn.1400d9e50
nop
mov rcx, qword [rdi + 0xa8]
cmp dword [rcx + 0x10], 0x77109acd
jne 0x14014e1e6
mov rax, qword [rcx]
lea r8, [rsp + 0x30]
mov edx, esi
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x14014e286
cmp byte [rsp + 0x30], 0
je 0x14014e1fe
mov byte [rdi + 0xb1], 1
movzx eax, byte [rdi + 0xb1]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008b8a0
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
cmp byte [rdi + 0xdd], 0
jne 0x14014e1fe
cmp dword [rdi + 0xd0], 0
je 0x14014e1fe
call sub.KERNEL32.dll_GetTickCount
mov edx, eax
mov ecx, eax
sub ecx, dword [rdi + 0xb4]
mov eax, dword [rdi + 0xd0]
mov r8d, 0x12c
test eax, eax
cmove eax, r8d
cmp ecx, eax
jbe 0x14014e1fe
mov dword [rdi + 0xd8], edx
mov dword [rdi + 0xb4], edx
mov rcx, qword [rdi + 0xa8]
cmp dword [rcx + 0x10], 0x77109acd
jne 0x14014e286
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x18]
nop
jmp 0x14014e1f0