joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008d3a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov r14, r8
mov rbp, rdx
cmp byte [rcx + 0x15], 0
jne 0x14008d3c5
xor eax, eax
jmp 0x14008d4bc
call fcn.14007f0f0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.Wow64SetThreadContext
lea rcx, [rsp + 0x20]
call fcn.14000b230
nop
call fcn.140082880
lea rsi, [rdi + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
movabs r9, 0xcbf29ce484222325
mov ecx, ebx
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x14008d453
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x14008d440
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14007fb50
mov r8, qword [rax + 8]
test r8, r8
je 0x14008d492
cmp r8, qword [rdi + 8]
je 0x14008d492
mov rdi, qword [r8 + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x14008d49b
mov rdx, r14
mov rcx, rbp
call rdi
mov edi, eax
jmp 0x14008d49d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, ebx
lea rcx, [rsp + 0x20]
call fcn.14000a070
test edi, edi
jne 0x14008d4ba
mov rax, qword gs:[0x30]
mov ebx, dword [rax + 0x1250]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x14008d4e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov r15, r9
mov r14, r8
mov rbp, rdx
cmp dword [rcx + 0x10], 3
jne 0x14008d5f1
call fcn.14007f0f0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
mov r8d, reloc.WLDAP32.dll_Ordinal_22
lea rdx, str.RtlQueueApcWow64Thread
lea rcx, [rsp + 0x30]
call fcn.14000b230
nop
call fcn.140082880
lea rdi, [rbx + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r8, qword [rsp + 0x30]
movabs r9, 0xcbf29ce484222325
mov ecx, esi
mov r10, qword [rsp + 0x40]
test r10, r10
je 0x14008d594
movabs rdx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor r9, rax
imul r9, rdx
inc rcx
cmp rcx, r10
jb 0x14008d580
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14007fb50
mov r9, qword [rax + 8]
test r9, r9
je 0x14008d5de
cmp r9, qword [rbx + 8]
je 0x14008d5de
mov rbx, qword [r9 + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14008d5e7
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, r15
mov rdx, r14
mov rcx, rbp
call rbx
mov ebx, eax
jmp 0x14008d5ec
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
jmp 0x14008d6dc
call fcn.14007f0f0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.NtQueueApcThread
lea rcx, [rsp + 0x30]
call fcn.14000b230
nop
call fcn.140082880
lea rdi, [rbx + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r8, qword [rsp + 0x30]
movabs r9, 0xcbf29ce484222325
mov ecx, esi
mov r10, qword [rsp + 0x40]
test r10, r10
je 0x14008d684
movabs rdx, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
xor r9, rax
imul r9, rdx
inc rcx
cmp rcx, r10
jb 0x14008d670
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14007fb50
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14008d6ce
cmp rdx, qword [rbx + 8]
je 0x14008d6ce
mov rbx, qword [rdx + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14008d6d7
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, r15
mov rdx, r14
mov rcx, rbp
call rbx
mov ebx, eax
jmp 0x14008d6dc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
lea rcx, [rsp + 0x30]
call fcn.14000a070
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008d700
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x140229680]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, rdx
mov rbx, rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
cmp byte [rcx + 0x15], r14b
jne 0x14008d73f
xor eax, eax
jmp 0x14008d87a
mov qword [rsp + 0x68], r14
call fcn.14007f0f0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
mov r8d, Ordinal_27
lea rdx, str.NtQueryInformationProcess
lea rcx, [rsp + 0x38]
call fcn.14000b230
nop
mov dword [rsp + 0x30], 1
call fcn.140082880
lea rbp, [rdi + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rdx, qword [rsp + 0x38]
movabs r9, 0xcbf29ce484222325
mov rcx, r14
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x14008d7d5
movabs r10, 0x100000001b3
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x14008d7c2
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.14007fb50
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14008d837
cmp rdx, qword [rdi + 8]
je 0x14008d837
mov rdi, qword [rdx + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x14008d840
add rbx, 8
mov qword [rsp + 0x20], r14
mov r9d, 8
lea r8, [rsp + 0x68]
mov edx, reloc.WLDAP32.dll_Ordinal_26
mov rcx, qword [rbx]
call rdi
mov rcx, rbx
test eax, eax
js 0x14008d844
test rsi, rsi
je 0x14008d844
mov dil, 1
jmp 0x14008d84a
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rbx + 8]
xor dil, dil
mov rbx, rcx
lea rcx, [rsp + 0x38]
call fcn.14000a070
test dil, dil
je 0x14008d875
mov qword [rsp + 0x20], r14
mov r9d, 0x250
mov r8, rsi
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400f3120
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14008d8a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x140229680]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rsi, rdx
mov rbp, rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [r11 - 0x40], xmm0
mov dword [r11 - 0x30], r14d
call fcn.14007f0f0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
mov r8d, Ordinal_27
lea rdx, str.NtQueryInformationProcess
lea rcx, [rsp + 0x38]
call fcn.14000b230
nop
mov dword [rsp + 0x30], 1
call fcn.140082880
lea rbx, [rdi + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rdx, qword [rsp + 0x38]
movabs r9, 0xcbf29ce484222325
mov ecx, r14d
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x14008d983
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x14008d970
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.14007fb50
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14008d9ea
cmp rdx, qword [rdi + 8]
je 0x14008d9ea
mov rdi, qword [rdx + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x14008d9f3
lea rbx, [rbp + 8]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, Ordinal_50
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, qword [rbx]
call rdi
mov rcx, rbx
test eax, eax
js 0x14008d9f7
test rsi, rsi
je 0x14008d9f7
mov dil, 1
jmp 0x14008d9fd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rbp + 8]
xor dil, dil
mov rbx, rcx
lea rcx, [rsp + 0x38]
call fcn.14000a070
test dil, dil
je 0x14008da28
mov qword [rsp + 0x20], r14
mov r9d, 0x388
mov r8, rsi
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400f3120
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14008da60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x140229680]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rdi, r8
mov r14, rdx
mov rbp, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
cmp byte [rcx + 0x15], r15b
jne 0x14008daa3
xor eax, eax
jmp 0x14008dbfa
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x88], xmm0
mov dword [rsp + 0x98], r15d
call fcn.14007f0f0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
mov r8d, Ordinal_27
lea rdx, str.NtQueryInformationThread
lea rcx, [rsp + 0x38]
call fcn.14000b230
nop
mov dword [rsp + 0x30], 1
call fcn.140082880
lea rsi, [rbx + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rdx, qword [rsp + 0x38]
movabs r9, 0xcbf29ce484222325
mov rcx, r15
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x14008db53
movabs r10, 0x100000001b3
nop
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x14008db40
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.14007fb50
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14008dbb2
cmp rcx, qword [rbx + 8]
je 0x14008dbb2
mov rbx, qword [rcx + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14008dbbb
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, Ordinal_50
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, r14
call rbx
test eax, eax
js 0x14008dbbb
test rdi, rdi
je 0x14008dbbb
mov bl, 1
jmp 0x14008dbbd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor bl, bl
lea rcx, [rsp + 0x38]
call fcn.14000a070
test bl, bl
je 0x14008dbef
mov rdx, qword [rsp + 0x70]
add rdx, 0x2000
mov qword [rsp + 0x20], r15
mov r9d, 0x1000
mov r8, rdi
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x70]
add rax, 0x2000
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400f3120
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008dc30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x140229680]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rsi, r8
mov r14, rdx
mov rbp, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [r11 - 0x50], xmm0
mov dword [r11 - 0x40], r15d
call fcn.14007f0f0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
mov r8d, Ordinal_27
lea rdx, str.NtQueryInformationThread
lea rcx, [rsp + 0x38]
call fcn.14000b230
nop
mov dword [rsp + 0x30], 1
call fcn.140082880
lea rdi, [rbx + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rdx, qword [rsp + 0x38]
movabs r9, 0xcbf29ce484222325
mov ecx, r15d
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x14008dd13
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x14008dd00
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.14007fb50
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14008dd72
cmp rcx, qword [rbx + 8]
je 0x14008dd72
mov rbx, qword [rcx + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14008dd7b
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, Ordinal_50
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, r14
call rbx
test eax, eax
js 0x14008dd7b
test rsi, rsi
je 0x14008dd7b
mov bl, 1
jmp 0x14008dd7d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor bl, bl
lea rcx, [rsp + 0x38]
call fcn.14000a070
test bl, bl
je 0x14008dda8
mov qword [rsp + 0x20], r15
mov r9d, 0x1838
mov r8, rsi
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400f3120
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140097a80
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov rax, qword [0x140229680]
xor rax, rsp
mov qword [rbp + 0x280], rax
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], r14
xorps xmm0, xmm0
movups xmmword [rcx + 0x20], xmm0
mov qword [rcx + 0x30], r14
mov qword [rcx + 0x38], 7
mov word [rcx + 0x20], r14w
lea rbx, [rcx + 0x40]
mov qword [rsp + 0x20], rbx
mov dword [rbx], r14d
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov ecx, gethostname
call fcn.1400f3140
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbx + 8], rax
lea rcx, [rbx + 0x18]
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov qword [rbx + 0x30], 7
mov qword [rbx + 0x38], 8
mov dword [rbx], 0x3f800000
mov r8, qword [rbx + 8]
mov edx, reloc.WS2_32.dll_recv
call fcn.14007f750
nop
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x70]
call fcn.14012ade0
mov r8d, 0x104
lea rdx, [rbp + 0x70]
lea rcx, str._NT_SYMBOL_PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x140097c9e
lea rdx, [rbp + 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140097c9e
xor edx, edx
mov r8d, 0xf8
lea rcx, [rsp + 0x70]
call fcn.14012ade0
lea rcx, [rsp + 0x70]
call fcn.140098c70
nop
lea rdx, str.srv
lea rcx, [rbp - 0x80]
call fcn.140099530
mov rcx, rax
lea rdx, [rbp + 0x70]
call fcn.140099530
mov rcx, rax
lea rdx, str.Symbolshttp:__msdl.microsoft.com_download_symbols
call fcn.140099530
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
movdqa xmm1, xmmword [0x14020bb00]
movdqu xmmword [rsp + 0x38], xmm1
mov word [rsp + 0x28], r14w
mov dword [rsp + 0x20], 2
movups xmmword [rsp + 0x48], xmm0
mov rcx, qword [rbp - 8]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x140097c33
mov rax, qword [rbp - 0x38]
mov r8, qword [rax]
test r8, r8
je 0x140097c33
mov rax, qword [rbp - 0x58]
mov rdx, qword [rax]
cmp r8, qword [rbp - 0x10]
cmovb r8, qword [rbp - 0x10]
sub r8, rdx
sar r8, 1
jmp 0x140097c6a
test cl, 4
jne 0x140097c60
mov rax, qword [rbp - 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140097c60
mov rax, qword [rbp - 0x60]
mov rdx, qword [rax]
mov rax, qword [rbp - 0x28]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
jmp 0x140097c6a
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140097c7a
lea rcx, [rsp + 0x28]
call fcn.14007f890
nop
lea rdx, [rsp + 0x28]
lea rcx, [rdi + 0x20]
call fcn.14007fd70
lea rcx, [rsp + 0x28]
call fcn.14007f6e0
nop
lea rcx, [rsp + 0x70]
call fcn.140097d00
nop
mov rax, rdi
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.1400f3120
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14009be40
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14009c01b
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.14007f750
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14009bfe4
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14009bf5c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14009bfd3
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x14009bf99
mov r10, qword [rdx]
cmp r10, rax
je 0x14009bf93
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14009bfd3
cmp r9, rdx
je 0x14009bfaf
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x14009bff5
cmp r9, rdx
jne 0x14009bfa0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x14009bee0
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14009bfd3
lea rcx, str.invalid_hash_bucket_count
call fcn.1400f07c0
int3

Function at 0x14009c030
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140229680]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400f3120
add rsp, 0x68
ret
Function at 0x1400a57a0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400a5882
call fcn.1400bbb20
test al, al
jne 0x1400a5882
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x1400a57d2
mov r8, rdi
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov rcx, rbx
call fcn.1400c5b60
test rax, rax
je 0x1400a5817
sub rax, rbx
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov r8, rax
mov rcx, rbx
call fcn.1400c5b60
mov rsi, rax
test rax, rax
je 0x1400a5817
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x1400a584b
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.1400b7d50
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x1400a5830
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400c6300
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
movaps xmmword [rsp + 0x50], xmm6
lea rcx, [rsp + 0x30]
mov rdi, rdx
call fcn.1400a5b90
mov rcx, rbx
movups xmm6, xmmword [rax]
call case.0x1400a7025.2
mov rcx, rdi
mov rsi, rax
call case.0x1400a7025.2
mov r8d, 1
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x1400c63b0
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.1400a5b90
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
call fcn.1400a5c20
cmp rax, 0x3e8
ja 0x1400c63e1
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x1400c6360
test rsi, rsi
je 0x1400c63bd
mov rcx, rsi
call fcn.1400f9794
test rbx, rbx
je 0x1400c63ca
mov rcx, rbx
call fcn.1400f9794
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
test rsi, rsi
je 0x1400c63ee
mov rcx, rsi
call fcn.1400f9794
test rbx, rbx
je 0x1400c63fb
mov rcx, rbx
call fcn.1400f9794
mov eax, 1
jmp 0x1400c63cc
Function at 0x1400c6960
Capabilities:
Resolve dns

Disassembly:
push rbp
push rdi
push r12
push r13
sub rsp, 0x28
mov r13, r9
xor edi, edi
mov qword [r9], rdi
xor ebp, ebp
lea r9, [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r12d, eax
test eax, eax
jne 0x1400c6aff
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x1400c6adf
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x20], r15
nop dword [rax]
mov rax, qword [rsi + 0x18]
test rax, rax
je 0x1400c69ce
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400c69c0
inc rbx
jmp 0x1400c69d0
xor ebx, ebx
mov eax, dword [rsi + 4]
cmp eax, 2
jne 0x1400c69e0
mov r15d, reloc.WS2_32.dll_recv
jmp 0x1400c69ef
cmp eax, 0x17
jne 0x1400c6a88
mov r15d, Ordinal_33
cmp qword [rsi + 0x20], 0
je 0x1400c6a88
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x1400c6a88
cmp rax, r15
jb 0x1400c6a88
lea rcx, [rbx + 0x30]
add rcx, r15
call qword [section..data]
mov r14, rax
test rax, rax
je 0x1400c6a97
mov ecx, dword [rsi]
mov r8, r15
mov dword [rax], ecx
mov ecx, dword [rsi + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rsi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rsi + 0xc]
mov dword [rax + 0xc], ecx
lea rcx, [r14 + 0x30]
mov dword [rax + 0x10], r15d
xor eax, eax
mov qword [r14 + 0x18], rax
mov qword [r14 + 0x28], rax
mov qword [r14 + 0x20], rcx
mov rdx, qword [rsi + 0x20]
call fcn.14012a740
test rbx, rbx
je 0x1400c6a75
mov rcx, qword [r14 + 0x20]
mov r8, rbx
add rcx, r15
mov qword [r14 + 0x18], rcx
mov rdx, qword [rsi + 0x18]
call fcn.14012a740
test rdi, rdi
cmove rdi, r14
test rbp, rbp
je 0x1400c6a85
mov qword [rbp + 0x28], r14
mov rbp, r14
mov rsi, qword [rsi + 0x28]
test rsi, rsi
jne 0x1400c69b0
jmp 0x1400c6a9d
mov r12d, 8
mov rcx, qword [rsp + 0x68]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x60]
test rcx, rcx
je 0x1400c6ab7
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r12d, r12d
je 0x1400c6ada
test rdi, rdi
je 0x1400c6ad6
mov rbx, qword [rdi + 0x28]
mov rcx, rdi
call qword [fcn.1400f9794]
mov rdi, rbx
test rbx, rbx
jne 0x1400c6ac1
xor edi, edi
jmp 0x1400c6aee
test rdi, rdi
jne 0x1400c6aee
mov r12d, 0x2af9
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rsi, qword [rsp + 0x58]
mov eax, r12d
mov rbx, qword [rsp + 0x50]
mov qword [r13], rdi
add rsp, 0x28
pop r13
pop r12
pop rdi
pop rbp
ret