joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400158a0
Capabilities:
Hash data using murmur3

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [rdx + 3]
test rdx, rdx
mov rbp, rcx
mov rsi, rdx
cmovns rdi, rdx
and rdi, 0xfffffffffffffffc
jle 0x14001584f
test rdx, rdx
jle 0x140015716
mov ebx, dword [rcx]
mov rcx, qword [0x1400d7510]
call fcn.1400a4c00
cmp byte [rax], 0
jne 0x140015730
xor r12d, r12d
mov ecx, 4
imul eax, ebx, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, r12d
rol eax, 0xd
lea r12d, [rax + rax*4 - 0x19ab949c]
cmp rcx, rdi
jge 0x140015738
cmp rsi, rcx
jle 0x140015718
mov ebx, dword [rbp + rcx]
add rcx, 4
jmp 0x1400156e5
xor ecx, ecx
lea rdx, [rsi - 1]
call fcn.14000b7e0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor eax, eax
jmp 0x140015723
mov rax, rsi
and eax, 3
je 0x14001587a
sub rax, 1
mov r8, rcx
xor edx, edx
add r8, rax
js 0x140015881
cmp r8, rax
jb 0x140015881
test rdx, rdx
jne 0x140015843
cmp rsi, r8
jle 0x140015830
test r8, r8
js 0x140015830
movzx edx, byte [rbp + r8]
test rax, rax
je 0x1400157dc
sub rax, 1
mov r9, rcx
xor r10d, r10d
add r9, rax
js 0x14001588b
cmp r9, rax
jb 0x14001588b
mov r8, r9
test r10, r10
jne 0x140015843
cmp rsi, r9
jle 0x140015830
test r9, r9
js 0x140015830
movzx r8d, byte [rbp + r9]
shl edx, 8
or edx, r8d
test rax, rax
je 0x1400157dc
test rcx, rcx
js 0x14001582d
cmp rsi, rcx
jle 0x14001582d
movzx eax, byte [rbp + rcx]
shl edx, 8
or edx, eax
imul ebx, edx, 0xcc9e2d51
rol ebx, 0xf
mov rcx, qword [0x1400d7510]
call fcn.1400a4c00
cmp byte [rax], 0
jne 0x140015730
imul ebx, ebx, 0x1b873593
mov eax, r12d
xor eax, esi
xor eax, ebx
mov edx, eax
shr edx, 0x10
xor eax, edx
imul edx, eax, 0x85ebca6b
mov eax, edx
shr eax, 0xd
xor eax, edx
imul edx, eax, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
jmp 0x140015723
mov r8, rcx
lea rdx, [rsi - 1]
mov rcx, r8
call fcn.14000b7e0
xor eax, eax
jmp 0x140015723
call fcn.140008cf0
xor eax, eax
jmp 0x140015723
sar rdx, 0x3f
shr rdx, 0x3e
lea rax, [rsi + rdx]
and eax, 3
sub rax, rdx
test rax, rax
jle 0x140015877
sub rax, 1
xor ecx, ecx
xor r12d, r12d
mov r8, rax
jmp 0x140015768
xor r12d, r12d
xor ebx, ebx
jmp 0x1400157e5
mov edx, 1
jmp 0x14001575f
mov r10d, 1
jmp 0x1400157a1
sub rsp, 0x28
mov rdx, qword [rcx]
mov rcx, qword [rcx + 8]
test rdx, rdx
js 0x1400158c8
lea rax, [rcx + 8]
test rcx, rcx
cmovne rcx, rax
add rsp, 0x28
jmp 0x1400156a0
lea r9, [rdx - 1]
mov r8, rdx
xor ecx, ecx
mov rdx, r9
call fcn.14000e760
xor eax, eax
add rsp, 0x28
ret
Function at 0x140052b00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push r14
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
test rdx, rdx
lea rbp, [rdx + 7]
mov rsi, rcx
mov r14, rdx
cmovns rbp, rdx
mov ebx, r8d
sar rbp, 3
cmp rdx, 7
jle 0x140052c15
mov rcx, qword [0x1400d7510]
call fcn.1400a4c00
cmp byte [rax], 0
jne 0x140052c08
xor ecx, ecx
lea r8, [0x1400b9ac0]
nop word [rax + rax]
mov edx, dword [rsi + rcx*8 + 4]
mov eax, dword [rsi + rcx*8]
add rcx, 1
mov r9d, edx
xor eax, ebx
movzx r10d, dl
movzx edi, dh
shr r9d, 0x18
shr edx, 0x10
mov ebx, dword [r8 + r9*4]
movzx r9d, al
xor ebx, dword [r8 + r10*4 + 0xc00]
movzx edx, dl
xor ebx, dword [r8 + r9*4 + 0x1c00]
mov r9d, eax
shr r9d, 0x18
xor ebx, dword [r8 + r9*4 + 0x1000]
xor ebx, dword [r8 + rdi*4 + 0x800]
xor ebx, dword [r8 + rdx*4 + 0x400]
movzx edx, ah
shr eax, 0x10
xor ebx, dword [r8 + rdx*4 + 0x1800]
movzx edx, al
xor ebx, dword [r8 + rdx*4 + 0x1400]
cmp rbp, rcx
jg 0x140052b50
lea rdx, [rbp*8]
cmp r14, 7
mov ebp, 8
cmovle rdx, rbp
cmp r14, rdx
jle 0x140052c08
add rdx, rsi
lea r8, [0x1400b9ac0]
add rsi, r14
nop dword [rax]
movzx ecx, byte [rdx]
add rdx, 1
xor ecx, ebx
shr ebx, 8
movzx ecx, cl
xor ebx, dword [r8 + rcx*4]
cmp rsi, rdx
jne 0x140052bf0
mov eax, ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r14
ret
xor edx, edx
jmp 0x140052bdb
Function at 0x14006f230
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xa8
movups xmmword [rsp + 0x60], xmm6
movups xmmword [rsp + 0x70], xmm7
movups xmmword [rsp + 0x80], xmm8
movups xmmword [rsp + 0x90], xmm9
movdqu xmm4, xmmword [rcx]
movdqu xmm6, xmmword [rcx + 0x10]
movdqu xmm1, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
mov r9, rdx
movd xmm0, r8d
lea rdx, [rdx - 0x40]
mov qword [rsp], 0
mov qword [rsp + 8], 0
pxor xmm0, xmm4
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
cmp rdx, 0x3f
jle 0x14006f500
lea rdx, [r9 - 0x80]
movdqu xmm5, xmmword [0x1400cdf00]
lea rax, [rcx + 0x40]
mov r8, rdx
and r8, 0xffffffffffffffc0
lea r8, [rcx + r8 + 0x80]
nop word [rax + rax]
movdqu xmm9, xmm0
movdqu xmm7, xmm1
movdqu xmm4, xmm3
add rax, 0x40
movdqu xmm8, xmm6
pclmulqdq xmm6, xmm5, 0x11
pclmulqdq xmm9, xmm5, 0
movdqu xmm2, xmm6
pclmulqdq xmm0, xmm5, 0x11
movdqu xmm6, xmmword [rax - 0x40]
pclmulqdq xmm8, xmm5, 0
pxor xmm0, xmm9
pclmulqdq xmm7, xmm5, 0
pxor xmm2, xmm8
pxor xmm0, xmm6
movdqu xmm6, xmmword [rax - 0x30]
pclmulqdq xmm1, xmm5, 0x11
pclmulqdq xmm4, xmm5, 0
pxor xmm1, xmm7
pclmulqdq xmm3, xmm5, 0x11
movdqu xmm7, xmmword [rax - 0x20]
pxor xmm6, xmm2
movdqu xmm2, xmmword [rax - 0x10]
pxor xmm3, xmm4
pxor xmm1, xmm7
pxor xmm3, xmm2
cmp r8, rax
jne 0x14006f310
mov r8, rdx
shr r8, 6
lea rax, [r8 + 2]
shl r8, 6
shl rax, 6
sub rdx, r8
movdqu xmm4, xmmword [0x1400cdef0]
movdqu xmm5, xmm0
movdqu xmm2, xmm0
pclmulqdq xmm5, xmm4, 0
pclmulqdq xmm2, xmm4, 0x11
pxor xmm2, xmm5
pxor xmm2, xmm6
movdqu xmm0, xmm2
pclmulqdq xmm2, xmm4, 0x11
pclmulqdq xmm0, xmm4, 0
pxor xmm2, xmm0
pxor xmm1, xmm2
movdqu xmm0, xmm1
pclmulqdq xmm1, xmm4, 0x11
pclmulqdq xmm0, xmm4, 0
pxor xmm0, xmm1
pxor xmm0, xmm3
cmp rdx, 0xf
jle 0x14006f474
movdqu xmm1, xmm0
movdqu xmm7, xmmword [rcx + rax]
pclmulqdq xmm0, xmm4, 0x11
lea r8, [rdx - 0x10]
pclmulqdq xmm1, xmm4, 0
pxor xmm0, xmm1
pxor xmm0, xmm7
cmp r8, 0xf
jle 0x14006f474
movdqu xmm1, xmm0
movdqu xmm7, xmmword [rcx + rax + 0x10]
pclmulqdq xmm0, xmm4, 0x11
pclmulqdq xmm1, xmm4, 0
pxor xmm0, xmm1
pxor xmm0, xmm7
cmp rdx, 0x2f
jle 0x14006f474
movdqu xmm1, xmm0
movdqu xmm2, xmmword [rcx + rax + 0x20]
pclmulqdq xmm0, xmm4, 0x11
pclmulqdq xmm1, xmm4, 0
pxor xmm0, xmm1
pxor xmm0, xmm2
movdqu xmm1, xmm0
psrldq xmm0, 8
movups xmm6, xmmword [rsp + 0x60]
movdqu xmm2, xmmword [0x1400cdf10]
pclmulqdq xmm1, xmm4, 0x10
movups xmm7, xmmword [rsp + 0x70]
movdqu xmm3, xmmword [0x1400cdf30]
movups xmm8, xmmword [rsp + 0x80]
pxor xmm0, xmm1
movups xmm9, xmmword [rsp + 0x90]
movdqu xmm1, xmm0
pand xmm0, xmm2
pclmulqdq xmm0, xmmword [0x1400cdf20], 0
psrldq xmm1, 4
pxor xmm1, xmm0
movdqu xmm0, xmm1
pand xmm0, xmm2
pclmulqdq xmm0, xmm3, 0x10
pand xmm0, xmm2
pclmulqdq xmm0, xmm3, 0
pxor xmm0, xmm1
pextrd eax, xmm0, 1
add rsp, 0xa8
ret
mov eax, 0x40
jmp 0x14006f3b1
Function at 0x14006f510
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rbx
test rdx, rdx
lea r11, [rdx + 7]
mov r9, rcx
mov r10, rdx
cmovns r11, rdx
mov eax, r8d
lea rcx, [0x1400cdf40]
xor ebx, ebx
sar r11, 3
cmp rdx, 7
jle 0x14006f600
nop dword [rax]
mov edx, dword [r9 + rbx*8 + 4]
xor eax, dword [r9 + rbx*8]
add rbx, 1
mov esi, edx
movzx r8d, dl
shr esi, 0x18
mov r8d, dword [rcx + r8*4 + 0xc00]
xor r8d, dword [rcx + rsi*4]
movzx esi, al
xor r8d, dword [rcx + rsi*4 + 0x1c00]
mov esi, eax
shr esi, 0x18
xor r8d, dword [rcx + rsi*4 + 0x1000]
movzx esi, dh
shr edx, 0x10
movzx edx, dl
xor r8d, dword [rcx + rsi*4 + 0x800]
xor r8d, dword [rcx + rdx*4 + 0x400]
movzx edx, ah
shr eax, 0x10
xor r8d, dword [rcx + rdx*4 + 0x1800]
movzx edx, al
mov eax, dword [rcx + rdx*4 + 0x1400]
xor eax, r8d
cmp r11, rbx
jg 0x14006f540
shl r11, 3
mov edx, 8
cmp r10, 7
cmovle r11, rdx
cmp r10, r11
jle 0x14006f5fb
add r11, r9
lea rcx, [0x1400cdf40]
add r9, r10
nop word cs:[rax + rax]
movzx r8d, byte [r11]
add r11, 1
xor r8d, eax
shr eax, 8
movzx r8d, r8b
xor eax, dword [rcx + r8*4]
cmp r9, r11
jne 0x14006f5e0
pop rbx
pop rsi
ret
xor r11d, r11d
jmp 0x14006f5c4
Function at 0x1400a0060
Capabilities:
Parse pe header

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
mov rcx, qword [0x1400d7510]
call fcn.1400a4c00
mov rbx, rax
nop dword [rax]
cmp word [r12], 0x5a4d
jne 0x1400a00ad
movsxd rdx, dword [r12 + 0x3c]
lea eax, [rdx - 0x41]
cmp eax, 0x3be
ja 0x1400a00ad
mov rcx, r12
call fcn.140078e70
cmp byte [rbx], 0
jne 0x1400a00c2
cmp dword [rax], 0x4550
je 0x1400a00cc
mov rcx, r12
mov edx, 1
call fcn.140078e80
cmp byte [rbx], 0
mov r12, rax
je 0x1400a0080
xor eax, eax
add rsp, 0x28
pop rbx
pop r12
ret
mov rax, r12
jmp 0x1400a00c4

Function at 0x1400a3ca0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400ae230
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400ae230
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x1400a3d10
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x1400e1b24]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x1400a3ec0
mov rax, qword [0x1400e1b28]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x1400a3d5c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x1400a3de7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x1400a3d40
mov rcx, r12
call fcn.1400a47c0
mov rbp, rax
test rax, rax
je 0x1400a3f1d
mov rax, qword [0x1400e1b28]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.1400a48f0
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1400e1b28]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400a3f02
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400a3de0
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400a3e70
add dword [0x1400e1b24], 1
cmp ebx, 8
jae 0x1400a3e18
test bl, 4
jne 0x1400a3ed0
test ebx, ebx
je 0x1400a3e09
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x1400a3ef0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x1400a3e09
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x1400a3e4a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x1400e1b28]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400a3de0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400a3ca0
xor edi, edi
jmp 0x1400a3d67
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x1400a3e09
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x1400a3e09
mov rax, qword [0x1400e1b28]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.1400a3ca0
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1400a3ca0
nop
nop dword [rax]
Function at 0x1400a4430
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1400e1b80]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400e1b60]
test rbx, rbx
je 0x1400a4484
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x1400a447b
test r12, r12
je 0x1400a447b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400a4460
lea rcx, [0x1400e1b80]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400a47c0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x1400d7530]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x1400a4839
mov rcx, r10
call fcn.1400a4690
test eax, eax
je 0x1400a4839
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x1400a4836
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x1400a482d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x1400a4839
add r8, 0x28
cmp r8, r9
jne 0x1400a4818
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x1400a4ba0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
xor ecx, ecx
xor r9d, r9d
mov r8d, 0xffff
mov dword [0x1400e1c00], 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [0x1400e1c08], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
cmp eax, 0xffffffff
je 0x1400a4bf0
lea rdx, [0x1400a4ab0]
mov dword [0x1400e1bf8], eax
call fcn.1400ae560
test eax, eax
jne 0x1400a4bf8
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400a4be7
call sub.msvcrt.dll_abort
nop
nop
Function at 0x1400a4c00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r13, qword [0x1400d7470]
mov r11d, dword [r13]
mov r12, rcx
test r11d, r11d
jne 0x1400a4c40
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x1400a4ca8
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
mov rsi, qword [rcx + 0x10]
test rsi, rsi
je 0x1400a4cc0
mov r13d, dword [0x1400e1bf8]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
mov r14d, eax
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, r14d
mov r13, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r13, r13
je 0x1400a4d38
mov rbx, qword [r13]
cmp rbx, rsi
jb 0x1400a4d80
sub rsi, 1
mov rax, qword [r13 + rsi*8 + 8]
test rax, rax
jne 0x1400a4c29
mov rcx, r12
call fcn.1400a4b00
mov qword [r13 + rsi*8 + 8], rax
jmp 0x1400a4c29
call fcn.1400a4b00
mov qword [r12 + 0x10], rax
jmp 0x1400a4c29
mov r10d, dword [r13]
test r10d, r10d
je 0x1400a4de2
mov r9d, dword [0x1400afce0]
test r9d, r9d
je 0x1400a4e10
lock add dword [0x1400e1c00], 1
jne 0x1400a4e44
mov rsi, qword [r12 + 0x10]
test rsi, rsi
je 0x1400a4df0
mov eax, dword [r13]
test eax, eax
je 0x1400a4c49
mov eax, 0xffffffff
lock xadd dword [0x1400e1c00], eax
sub eax, 1
js 0x1400a4c49
mov rcx, qword [0x1400e1c08]
xor r8d, r8d
mov edx, 1
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x1400a4c49
lea rcx, [rsi + 0x21]
mov edx, 8
lea rbx, [rsi + 0x20]
call sub.msvcrt.dll_calloc
mov r13, rax
test rax, rax
je 0x1400a4e6b
mov qword [rax], rbx
mov ecx, dword [0x1400e1bf8]
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1400a4c87
call rdi
jmp 0x1400a4c87
lea r14, [rbx + rbx]
lea rax, [rsi + 0x20]
mov rcx, r13
cmp rsi, r14
cmova r14, rax
lea rdx, [r14*8 + 8]
call sub.msvcrt.dll_realloc
mov r13, rax
test rax, rax
je 0x1400a4e6b
mov qword [rax], r14
sub r14, rbx
lea rcx, [rax + rbx*8 + 8]
xor edx, edx
lea r8, [r14*8]
call sub.msvcrt.dll_memset
jmp 0x1400a4d59
call fcn.1400a4ba0
mov dword [0x1400afce0], 1
mov edx, dword [r13]
test edx, edx
jne 0x1400a4cdd
mov rsi, qword [r12 + 0x10]
test rsi, rsi
jne 0x1400a4c49
mov rax, qword [0x1400e1bf0]
lea rsi, [rax + 1]
mov qword [0x1400e1bf0], rsi
mov qword [r12 + 0x10], rsi
jmp 0x1400a4cf9
lock add dword [0x1400afce4], 1
je 0x1400a4dc7
mov r8d, dword [0x1400afce0]
mov rsi, qword [sym.imp.KERNEL32.dll_Sleep]
lea rbx, [0x1400afce0]
test r8d, r8d
jne 0x1400a4dd6
nop dword [rax]
xor ecx, ecx
call rsi
mov ecx, dword [rbx]
test ecx, ecx
je 0x1400a4e38
jmp 0x1400a4dd6
mov rcx, qword [0x1400e1c08]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400a4ceb
lock sub dword [0x1400e1c00], 1
jmp 0x1400a4ceb
call sub.msvcrt.dll_abort
nop
nop word cs:[rax + rax]
nop dword [rax]
cmp qword [rcx], rdx
jae 0x1400a4e90
mov qword [rcx], rdx
mov qword [rcx + 0x18], 0
cmp qword [rcx + 8], r8
jae 0x1400a4e9a
mov qword [rcx + 8], r8
test r9, r9
je 0x1400a4ea4
cmp qword [rcx], rdx
je 0x1400a4ea8
ret
mov qword [rcx + 0x18], r9
ret
Function at 0x140001050
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, 0x5a4d
mov ebp, r8d
mov r14d, edx
mov rdi, rcx
cmp word [rcx], ax
jne 0x14000114f
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x14000114f
mov ecx, 0x8664
cmp word [rax + 4], cx
jne 0x14000114f
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x14000114f
cmp dword [rax + 0x84], 0
jbe 0x14000114f
cmp dword [rax + 0x8c], 0
je 0x14000114f
mov ecx, dword [rax + 0x88]
add rcx, rdi
je 0x14000114f
mov ebx, dword [rcx + 0x20]
xor r11d, r11d
mov r15d, dword [rcx + 0x24]
add rbx, rdi
mov r12d, dword [rcx + 0x1c]
add r15, rdi
mov esi, dword [rcx + 0x18]
add r12, rdi
test esi, esi
je 0x14000114f
nop word [rax + rax]
mov r10d, dword [rbx]
mov r9d, r14d
add r10, rdi
xor eax, eax
nop dword [rax + rax]
movsx ecx, byte [rax + r10]
movzx edx, cl
lea ecx, [rdx - 0x61]
cmp ecx, 0x19
lea r8d, [rdx - 0x20]
cmova r8d, edx
xor r9d, r8d
rol r9d, 8
add r9d, r8d
test r8d, r8d
je 0x14000113e
inc rax
cmp rax, 0xffffffffffffffff
jne 0x140001110
cmp r9d, ebp
je 0x14000116c
inc r11d
add rbx, 4
cmp r11d, esi
jb 0x140001100
xor eax, eax
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
movzx ecx, word [r15 + r11*2]
mov eax, dword [r12 + rcx*4]
add rax, rdi
jmp 0x140001151
Function at 0x1406740e7
Capabilities:
Encode data using xor

Disassembly:
push r12
movabs r12, 0x26883c310a941d83
neg r12d
and r12d, 0x789076dc
neg r12b
and r12b, 0x15
not r12
push r10
movabs r10, 0x107a350b6d6e7872
push rbp
movabs rbp, 0x46400df06b987ce9
or ebp, 0x49017548
bswap ebp
push rbx
push qword [rsp + 0x28]
popfq
mov qword [rsp + 0x28], 0x2584f86d
pushfq
movabs rbx, 0x11f27d84011e7ad2
sub ebp, 0x2e91271b
and r12, rbp
add qword [rsp + 0x28], 0x6cda98
or r12b, 0x5a
push r10
xor r10d, ebx
add r12d, 0x31ff33ff
sets r10b
push 0x7cbc6beb
push r15
movabs r15, 0x124757092e81684f
movsx r10d, word [rsp + 0xc]
jbe 0x140674104
add rbx, qword [rsp + 8]
and r15w, 0x590
mov r12, qword [rsp + 0x38]
mov r10, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
push qword [rsp + 0x18]
popfq
mov r15, qword [rsp]
lea rsp, [rsp + 0x40]
ret

Function at 0x1406836d2
Capabilities:
Encode data using xor

Disassembly:
fldenv [rdx + rdx*4]
and dword [rbx + rcx*4 + 0x64], ecx
and al, 0x20
and qword [rsp + 0x30], 0x53e569f1
mov qword [rsp + 0x30], 0x72e31071
call fcn.14069ae92
xor byte [rsp + 0x40], 0x79
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x50]
call fcn.140dd7765
xor r15, r15
add qword [rsp + 0x38], 0xfffffffffff8c181
test dword [rsp + 0x5b], r15d
not r15b
mov r15, qword [rsp + 0x50]
mov byte [rsp + 0x58], 0x96
call fcn.14070eaa6
add ah, byte [rcx + rsi*4]
mov dword [rbx + 0x7d234cf], esp
mov eax, 0x95916722
mov dl, 0xc2
sub eax, 0xf11f72e3
imul ebx, dword [rsi], 0xfffffff2
jp 0x14068369e
mov ebp, 0x7d5941eb
sbb eax, 0x937865db
invalid
Function at 0x1406a4455
Capabilities:
Execute anti-debugging instructions

Disassembly:
sete byte [rsp + 0x50]
jns 0x140dad6d2
and qword [rsp + 0x60], 0x629a1a05
call fcn.1406766a5
add byte [rax], al
add byte [rcx], al
add byte [rax], al
add byte [rdi], cl
sahf
and al, 0x30
add qword [rsp + 0x38], r12
call fcn.1406b93c3
call rax
add rsp, 0x138
jmp 0x140dacd43
ret
test bl, r8b
setg bl
not r8d
push r9
push rbx
mov r9, r8
movsx ebx, byte [rsp + 0x1c]
or word [rsp + 0x18], r9w
test byte [rsp + 0x18], r8b
lea r9, [r9*8 + 0x7e834d8f]
setne bl
xor r9w, 0x1726
push r10
test byte [rsp + 9], bl
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x30], 0x5d7a17fe
push r8
push r9
call fcn.140d6ef7a
popfq
rdtsc
nop
push 0x3d921665
pushfq
and word [rsp + 8], 0x449
push rdx
push r11
mov dword [rsp + 0x18], 0x18541358
movabs rdx, 0x433b5f7527621b40
push rbp
mov rbp, rdx
cmp rdx, qword [rsp + 0x20]
push r8
push r15
call fcn.1406acdd4
push rdx
movabs rdx, 0x30ea4f9134174488
not dl
not dl
pushfq
or rdx, 0x4ddf12b5
not dx
or edx, edx
call fcn.1406c71b0
popfq
rdtsc
nop
push rdx
pushfq
movabs rdx, 0x756822be7dc86e39
and edx, edx
and edx, edx
push rbx
movabs rbx, 0xb6a17ae039b1258
push r14
neg bl
movsx dx, dx
movabs r14, 0x327b347c678226c0
push rbp
push r8
test r14d, 0x1b929be
push r14
mov r8, qword [rsp]
jg 0x1406f4f48
call fcn.140d3e6c5
popfq
cpuid
nop
push rsi
push r8
movabs rsi, 0x66d84286511c6f6c
pushfq
and si, 0x1aad
lea rsi, [rsi + 0x7bdc5ca2]
mov esi, 0x756343b3
push rdx
push rsi
mov rdx, rsi
movabs r8, 0xb0103af701628fd
not rdx
not rdx
xor si, dx
sub edx, dword [rsp + 4]
add byte [rsp], dh
and edx, esi
movsx r8d, byte [rsp + 3]
call fcn.140739835
sbb bl, byte [rcx + rax*2 + 0x72be4956]
push 0x57233ea2
sbb byte [0xf1a15970], dh
ror dword [0x13033b316], cl
call [rdi]
push r12
pushfq
movabs r12, 0x409f280010020d81
call fcn.140d18c00
repne scasw ax, word [rdi]
push rdx
pushfq
movabs rdx, 0x3d2e2ab123e32ecb
and edx, 0x41474093
xor dx, 0xf11
neg dx
setbe dl
lea rdx, [rdx*2 + 0x1c100e75]
call fcn.1406bc565
invalid

Function at 0x1406b93c3
Capabilities:
Authenticate hmac

Disassembly:
lea rbp, [rbp*8 + 0x6c7e0e0c]
jge 0x140cbdc5e
movzx ebp, bpl
neg byte [rsp + 0x40]
test byte [rsp + 0x40], 0xa6
mov dword [rsp + 0x30], 0x1ffc2462
mov rbp, qword [rsp + 0x50]
not dword [rsp + 0x38]
call fcn.140671c9c
sub eax, 0x8e2828df
pop rbx
xchg edi, eax
lahf
pmulhuw mm2, mm6
int 0xe4
mov dh, 0xb7
invalid

Function at 0x1406c5e00
Capabilities:
Authenticate hmac

Disassembly:
sete r14b
cmp qword [rsp + 0x48], 0x7caf4e8e
not dword [rsp + 0x48]
mov word [rsp + 0x48], r13w
not byte [rsp + 0x30]
movsx r13w, r14b
jge 0x140d66004
movzx r13, word [rsp + 0x30]
mov rcx, qword [rsp + 0x28]

Function at 0x1406c5e36
Capabilities:
Authenticate hmac

Disassembly:
push r11
push 0x17e63bb7
mov qword [rsp], 0x79443884
mov dword [rsp], 0x7a747fd3
movabs r11, 0x7091677f5d715396
ja 0x140d2f60a
push r9
call fcn.140d941fe

Function at 0x1406d51ce
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movsx r9w, r9b
not r9
jae fcn.140d5be89
setne r9b
cmp r9w, 0x38bd
lea r9, [r9 + r9*4 + 0xf436202]
lea r9, [r9 + 0x24367b6c]
call fcn.140d078ac