joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140167b10
Capabilities:
Check os version
Get system information on windows

Disassembly:
push rdi
sub rsp, 0x20
cmp dword [0x1402479bc], 0
jne 0x140167c2f
lea rcx, [0x140247840]
mov edi, 1
mov dword [0x140247840], 0x94
mov dword [0x1402479bc], edi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
xor r11d, r11d
cmp dword [0x140247850], 2
sete r11b
mov dword [0x14022bdbc], r11d
test r11d, r11d
je 0x140167c0f
lea rcx, [0x1402478e0]
mov qword [rsp + 0x30], rbx
mov dword [0x1402478e0], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
lea rcx, [0x1401e04b8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProductInfo
mov rcx, rbx
mov qword [0x140247838], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x30]
mov qword [0x1402479b0], rax
mov rax, qword [0x140247838]
lea rcx, [0x140247980]
test rax, rax
je 0x140167bd9
call rax
jmp 0x140167bdf
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x1402478e4]
cmp eax, 6
jae 0x140167bf8
cmp eax, 5
jne 0x140167c0f
cmp dword [0x1402478e8], 2
jb 0x140167c0f
mov ecx, dword [0x140247830]
cmp word [0x140247980], 9
cmove ecx, edi
mov dword [0x140247830], ecx
lea rdx, [0x140247848]
lea rcx, [0x140247844]
call fcn.140167680
call fcn.1401677f0
mov eax, edi
add rsp, 0x20
pop rdi
ret
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x140167d60
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x140229d30]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov rsi, r8
mov edi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.14014b070
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x140167ddb
lea rcx, [rsp + 0x20]
mov edx, 0x5c
call fcn.140151090
test rax, rax
je 0x140167dc7
mov byte [rax], 0
lea r8, [rsp + 0x20]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.140167cc0
jmp 0x140167de1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x1402479c0], eax
test eax, eax
je 0x140167df5
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140148510
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret
jmp 0x140167d60
Function at 0x140167e20
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x140229d30]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov rsi, r8
mov edi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.14014b070
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x140167ddb
lea rcx, [rsp + 0x20]
mov edx, 0x5c
call fcn.140151090
test rax, rax
je 0x140167dc7
mov byte [rax], 0
lea r8, [rsp + 0x20]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.140167cc0
jmp 0x140167de1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x1402479c0], eax
test eax, eax
je 0x140167df5
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140148510
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret
jmp 0x140167d60

Function at 0x140168430
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
shr edx, 4
mov rsi, r9
inc dx
movzx r9d, r8w
mov rdi, rcx
movzx r8d, dx
mov edx, 6
and ebx, 0xf
call qword [sym.imp.KERNEL32.dll_FindResourceExA]
test rax, rax
je 0x140168493
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140168493
xor edx, edx
nop dword [rax + rax]
movzx ecx, word [rax]
cmp ebx, edx
je 0x1401684a5
inc edx
lea rax, [rax + rcx*2 + 2]
cmp edx, 0x10
jl 0x140168480
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rbx, dword [rsp + 0x50]
lea rdx, [rax + 2]
mov rcx, rsi
mov r8, rbx
call fcn.1401680a0
test eax, eax
jne 0x1401684c3
mov byte [rbx + rsi - 1], al
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
dec eax
add rsp, 0x20
pop rdi
ret
Function at 0x1401693b0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140247e24]
test ecx, ecx
jne 0x140169570
mov eax, dword [0x140247e20]
cmp eax, 3
ja 0x140169570
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x140247e20], eax
call fcn.140167c60
test eax, eax
je 0x1401693f6
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x140169403
lea rcx, [0x1401e0f50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x140169415
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.WTSOpenServerA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSOpenServerW
mov rcx, rbx
mov qword [0x140247db0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSCloseServer
mov rcx, rbx
mov qword [0x140247db8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSFreeMemory
mov rcx, rbx
mov qword [0x140247dc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSEnumerateSessionsA
mov rcx, rbx
mov qword [0x140247dc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSEnumerateSessionsW
mov rcx, rbx
mov qword [0x140247dd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSTerminateProcess
mov rcx, rbx
mov qword [0x140247dd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSEnumerateProcessesA
mov rcx, rbx
mov qword [0x140247de0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSEnumerateProcessesW
mov rcx, rbx
mov qword [0x140247de8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSSendMessageA
mov rcx, rbx
mov qword [0x140247df0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSSendMessageW
mov rcx, rbx
mov qword [0x140247df8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSQuerySessionInformationA
mov rcx, rbx
mov qword [0x140247e00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSQuerySessionInformationW
mov rcx, rbx
mov qword [0x140247e08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSWaitSystemEvent
mov rcx, rbx
mov qword [0x140247e10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov qword [0x140247e18], rax
mov dword [0x140247e24], 1
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret
Function at 0x14016b830
Capabilities:
Terminate process

Disassembly:
mov eax, 0x28
call fcn.14014a6f0
sub rsp, rax
mov r9, r8
mov r8d, edx
mov rdx, rcx
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
call fcn.14016b560
add rsp, 0x28
jmp fcn.140158168
Function at 0x14016faa0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, 0x20
call fcn.14014a6f0
sub rsp, rax
mov rbx, r8
call fcn.14016f4b0
test eax, eax
js 0x14016fcde
mov eax, dword [rbx + 0xf0]
xor r10d, r10d
shl eax, 2
movsxd r9, eax
test eax, eax
jle 0x14016fb29
lea rdx, [rbx + r9*4 + 8]
lea r8, [rbx + 8]
nop dword [rax + rax]
mov eax, dword [rdx - 8]
mov ecx, dword [r8 - 8]
add r10, 4
mov dword [r8 - 8], eax
mov eax, dword [rdx - 4]
mov dword [rdx - 8], ecx
mov ecx, dword [r8 - 4]
mov dword [r8 - 4], eax
mov eax, dword [rdx]
mov dword [rdx - 4], ecx
mov ecx, dword [r8]
mov dword [r8], eax
mov eax, dword [rdx + 4]
mov dword [rdx], ecx
mov ecx, dword [r8 + 4]
mov dword [r8 + 4], eax
sub r9, 4
mov dword [rdx + 4], ecx
sub rdx, 0x10
add r8, 0x10
cmp r10, r9
jl 0x14016fae0
mov r11d, 1
cmp dword [rbx + 0xf0], r11d
jle 0x14016fcdc
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 2]
lea rdi, [0x140000000]
nop dword [rax]
mov r8d, dword [r10 + 0xe]
add r10, 0x10
inc r11d
mov eax, r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x1e2ed0]
movzx eax, byte [r10 - 1]
movzx ecx, byte [rdi + rax*4 + 0x1e2ed0]
mov r9d, dword [rdi + rdx*4 + 0x1e3ad0]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0x1e42d0]
movzx ecx, byte [rdi + rax*4 + 0x1e2ed0]
movzx eax, byte [r10]
xor r9d, dword [rdi + rcx*4 + 0x1e46d0]
movzx ecx, byte [rdi + rax*4 + 0x1e2ed0]
xor r9d, dword [rdi + rcx*4 + 0x1e3ed0]
mov dword [r10 - 2], r9d
mov r9d, dword [r10 + 2]
mov eax, r9d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x1e2ed0]
movzx eax, byte [r10 + 3]
movzx ecx, byte [rdi + rax*4 + 0x1e2ed0]
mov r8d, dword [rdi + rdx*4 + 0x1e3ad0]
movzx eax, byte [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0x1e42d0]
movzx ecx, byte [rdi + rax*4 + 0x1e2ed0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x1e3ed0]
movzx ecx, byte [rdi + rax*4 + 0x1e2ed0]
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0x1e46d0]
mov eax, r9d
mov dword [r10 + 2], r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x1e2ed0]
movzx eax, byte [r10 + 7]
movzx ecx, byte [rdi + rax*4 + 0x1e2ed0]
mov r8d, dword [rdi + rdx*4 + 0x1e3ad0]
movzx eax, byte [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0x1e42d0]
movzx ecx, byte [rdi + rax*4 + 0x1e2ed0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x1e3ed0]
movzx ecx, byte [rdi + rax*4 + 0x1e2ed0]
movzx eax, byte [r10 + 0xb]
xor r8d, dword [rdi + rcx*4 + 0x1e46d0]
mov r9d, dword [r10 + 0xa]
mov dword [r10 + 6], r8d
movzx edx, byte [rdi + rax*4 + 0x1e2ed0]
movzx eax, byte [r10 + 0xc]
movzx ecx, byte [rdi + rax*4 + 0x1e2ed0]
mov r8d, dword [rdi + rdx*4 + 0x1e42d0]
mov eax, r9d
xor r8d, dword [rdi + rcx*4 + 0x1e3ed0]
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x1e2ed0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x1e3ad0]
movzx ecx, byte [rdi + rax*4 + 0x1e2ed0]
xor r8d, dword [rdi + rcx*4 + 0x1e46d0]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x14016fb50
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140170a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.14014a6f0
sub rsp, rax
mov rax, qword [0x140229d30]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov rsi, rcx
movzx r10d, byte [rax]
mov ebx, dword [r15]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov qword [rbp - 0x18], rax
movzx eax, byte [rdi]
shl eax, 8
mov r14, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r12d, r8d
lea r8, [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 2]
xor r13d, r13d
shl eax, 0x18
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r15
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0x10], r10b
or edx, eax
movzx eax, byte [r8]
or ecx, eax
mov eax, r10d
shr eax, 8
shl ecx, 0x10
mov byte [rbp - 0xf], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
test r12d, r12d
je 0x140170c1c
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx r8d, dl
movzx r9d, r10b
dec r12d
test ebx, ebx
jne 0x140170bb8
lea r8d, [rbx + 1]
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.14016c580
mov r10d, dword [rbp - 0x30]
mov edx, dword [rbp - 0x2c]
movzx r9d, byte [rbp - 0x30]
movzx r8d, byte [rbp - 0x2c]
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
inc r13d
mov byte [rbp - 9], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x140170b52
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x140170c1c
mov rax, qword [rbp - 0x18]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140148510
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002d8c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002dd6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002dd6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002dd6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002dd6
cmp dword [rcx + 0x84], 0xe
jbe 0x140002dd6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002dd8
xor al, al
add rsp, 0x28
ret
Function at 0x140001ef0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x160
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
mov r8d, edx
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x104
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov r8, rbx
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, 0x104
mov qword [rsp + 0x20], 0
mov rdx, rax
lea r8, [rsp + 0x40]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
mov qword [rsp + 0x30], 0
xor edx, edx
mov dword [rsp + 0x28], 0
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 4
mov r8d, 0x3000
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400033e0
mov rbx, qword [rsp + 0x180]
add rsp, 0x160
pop rdi
ret
Function at 0x1400092a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1403bbac0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1403bc0d0]
mov edi, edx
mov esi, ecx
cmp byte [rbx + 0x424d], 0
jne 0x140009308
cmp byte [rbx + 0x424e], 0
jne 0x140009308
movsx r9d, word [rbx + 0x5356]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.14000e240
test sil, 1
je 0x140009439
jmp 0x1400093a1
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400c2530]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1400c2528]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
or dword [rbx + 0x3fa0], 1
mov qword [rbx + 0x3fb8], rax
movss dword [rbx + 0x3fb0], xmm0
mov dword [rbx + 0x3fa4], 1
movss dword [rbx + 0x3fb4], xmm1
movss xmm0, dword [rbx + 0x38f4]
mov rax, qword [0x1403bc0d0]
mulss xmm0, dword [0x1400c0c90]
or dword [rax + 0x3fa0], 0x40
movss dword [rax + 0x4000], xmm0
movsx r9d, word [rbx + 0x5356]
call fcn.14000e240
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400093f1
lea r11, [0x1400c0dd0]
cmp r9b, 0x23
jne 0x1400093d4
cmp byte [r8], r9b
jne 0x1400093d4
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400093c1
not ecx
call fcn.14000cf00
test rax, rax
je 0x140009439
cmp byte [rax + 0x96], 0
je 0x140009439
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5356]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x5356]
call fcn.14000e240
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.140006160
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400ba4e0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14000ce50
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1403bc0d0]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14000ceb3
mov qword [rsp], rbx
lea rbx, [0x1400c0dd0]
nop dword [rax]
cmp r9b, 0x23
jne 0x14000ce93
cmp byte [r8], r9b
jne 0x14000ce93
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14000ce80
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x53b0]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x14000cee7
mov r10, qword [r10 + 0x53b8]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14000ceee
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x14000ced4
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x14000d650
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xd8]
lea r8, [0x1400c0dd0]
movsxd rcx, dword [rcx + 0xd0]
mov r11d, edx
shr r11d, 0x18
mov r9d, edx
shr r9d, 8
mov r10d, edx
shr r10d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r10b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, r11
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
mov rcx, qword [0x1403bc0d0]
not ebx
cmp dword [rcx + 0x3ed4], ebx
jne 0x14000d6e8
movsxd r8, edx
xor r9d, r9d
mov edx, 4
mov ecx, ebx
call fcn.14000b260
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x14000d770
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm0, dword [rcx + 0xf0]
lea r10, [0x1400c0dd0]
mov rax, qword [rcx + 0xd8]
movss xmm1, dword [rcx + 0xf4]
movss xmm2, dword [rdx]
movss xmm4, dword [rdx + 8]
subss xmm2, xmm0
movss xmm3, dword [rdx + 4]
subss xmm4, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm3, xmm1
movsxd rcx, dword [rcx + 0xd0]
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp], xmm2
mov r9d, dword [rax + rcx*4 - 4]
movzx eax, byte [rsp]
not r9d
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
movss dword [rsp + 4], xmm3
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 8], xmm4
movss dword [rsp + 0xc], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x18
ret
Function at 0x14000e490
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000e4ed
lea rbx, [0x1400c0dd0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14000e4d4
cmp r10, 2
jb 0x14000e4d4
cmp byte [r9], r8b
jne 0x14000e4d4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14000e4b0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000e52f
lea rbx, [0x1400c0dd0]
cmp r8b, 0x23
jne 0x14000e513
cmp byte [r9], r8b
jne 0x14000e513
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14000e500
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x14000e800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push r13
push r14
push r15
mov qword [rsp + 0x28], rbp
xor r10d, r10d
mov qword [rsp + 0x30], rsi
mov rbx, rdx
mov qword [rsp + 0x38], rdi
mov rax, rcx
mov qword [rsp + 0x40], r12
mov r14d, r10d
lea r15, [0x140000000]
mov r13, rax
test rbx, rbx
je 0x14000e840
cmp rax, rbx
jae 0x14000e9ec
movzx r8d, byte [rax]
test r8b, r8b
je 0x14000e9ec
mov r11d, r10d
mov ecx, r8d
shr rcx, 3
mov rdx, rbx
movsx r9, byte [rcx + r15 + 0xc1780]
test r9d, r9d
sete r11b
add r11d, r9d
test rbx, rbx
jne 0x14000e878
movsxd rdx, r11d
add rdx, rax
cmp rax, rdx
lea rcx, [rax + 1]
mov edi, r8d
cmovae edi, r10d
cmp rcx, rdx
jae 0x14000e891
movzx r12d, byte [rcx]
jmp 0x14000e894
xor r12b, r12b
lea rcx, [rax + 2]
cmp rcx, rdx
jae 0x14000e8a2
movzx ebp, byte [rcx]
jmp 0x14000e8a5
xor bpl, bpl
lea rcx, [rax + 3]
cmp rcx, rdx
jae 0x14000e8b3
movzx esi, byte [rcx]
jmp 0x14000e8b6
xor sil, sil
lea r9, [r9*4]
movzx ecx, dil
mov r15d, dword [r9 + r15 + 0xc17a0]
and r15d, ecx
movzx r8d, r12b
shl r15d, 6
mov ecx, r8d
and ecx, 0x3f
movzx edx, bpl
or r15d, ecx
movzx r10d, sil
shl r15d, 6
mov ecx, edx
and ecx, 0x3f
and edx, 0xc0
or r15d, ecx
and r8d, 0xc0
mov ecx, r10d
shl r15d, 6
and ecx, 0x3f
shr r10d, 2
or r10d, edx
or r15d, ecx
shr r10d, 2
lea rcx, [0x140000000]
mov ecx, dword [r9 + rcx + 0xc17d0]
or r10d, r8d
shr r15d, cl
lea rcx, [0x140000000]
shr r10d, 2
mov edx, r15d
cmp r15d, dword [r9 + rcx + 0xc17b8]
sbb ecx, ecx
and edx, 0xfffff800
and ecx, 0x40
xor r8d, r8d
or r10d, ecx
mov ecx, 0x80
cmp edx, 0xd800
cmove r8d, ecx
xor edx, edx
or r10d, r8d
mov ecx, 0x100
cmp r15d, 0xffff
cmova edx, ecx
lea rcx, [0x140000000]
mov ecx, dword [r9 + rcx + 0xc17e8]
or r10d, edx
xor r10d, 0x2a
sar r10d, cl
test r10d, r10d
je 0x14000e9d6
xor r10d, r10d
test dil, dil
mov eax, r10d
mov ecx, r10d
setne cl
test sil, sil
setne al
add ecx, eax
mov eax, r10d
test bpl, bpl
setne al
add ecx, eax
mov eax, r10d
test r12b, r12b
setne al
add ecx, eax
cmp r11d, ecx
cmovl ecx, r11d
movsxd rax, ecx
add rax, r13
inc r14d
jmp 0x14000e828
movsxd rcx, r11d
add rax, rcx
test r15d, r15d
je 0x14000e9ec
xor r10d, r10d
inc r14d
jmp 0x14000e828
mov r12, qword [rsp + 0x40]
mov eax, r14d
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
pop r15
pop r14
pop r13
pop rbx
ret