joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b7690
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r12
push r14
push r15
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
xor r12d, r12d
mov r10d, dword [rcx + 0x10]
mov r11d, r10d
mov r8, qword [rcx]
mov r9d, dword [rcx + 0x14]
cmp r10d, 4
jl 0x1400b7708
mov edx, r10d
shr rdx, 2
mov eax, edx
neg eax
lea r10d, [r10 + rax*4]
nop dword [rax]
imul eax, dword [r8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
imul r9d, r9d, 0x5bd1e995
xor r9d, eax
add r8, 4
sub rdx, 1
jne 0x1400b76e0
mov ecx, r12d
sub r10d, 1
je 0x1400b772f
sub r10d, 1
je 0x1400b7725
cmp r10d, 1
jne 0x1400b7735
movzx ecx, byte [r8 + 2]
shl ecx, 0x10
movzx eax, byte [r8 + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [r8]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r8d, ecx, 0x5bd1e995
imul eax, r11d, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul edx, ecx, 0x5bd1e995
imul eax, r9d, 0x5bd1e995
xor eax, r8d
imul ecx, eax, 0x5bd1e995
xor ecx, edx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r15d, ecx
shr r15d, 0xf
xor r15d, ecx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rbx, r14
nop word [rax + rax]
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
je 0x1400b77bf
lea rdx, [0x14015ce80]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400b77c4
cmp r14, rbx
jne 0x1400b77a0
mov dword [rsp + 0x20], 0xa
mov r9d, ntohs
mov r8d, 0x929d631a
mov rdx, qword [rbx + 0x30]
call fcn.14000bac0
mov rcx, qword [rdi + 8]
call rax
mov ecx, dword [rdi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.14000bac0
mov qword [rsp + 0x78], r12
mov qword [rsi + 0x38], r12
test rax, rax
je 0x1400b7853
lea rcx, vtable.std::_Func_impl_no_alloc_void____cdecl___struct__SYSTEMTIME____ptr64___void__struct__SYSTEMTIME____ptr64_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rsi + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400b7853
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rax, rsi
jmp 0x1400b7860
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x1400b7880
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r12
push r14
push r15
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
xor r12d, r12d
mov r10d, dword [rcx + 0x10]
mov r11d, r10d
mov r8, qword [rcx]
mov r9d, dword [rcx + 0x14]
cmp r10d, 4
jl 0x1400b78f8
mov edx, r10d
shr rdx, 2
mov eax, edx
neg eax
lea r10d, [r10 + rax*4]
nop dword [rax]
imul eax, dword [r8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
imul r9d, r9d, 0x5bd1e995
xor r9d, eax
add r8, 4
sub rdx, 1
jne 0x1400b78d0
mov ecx, r12d
sub r10d, 1
je 0x1400b791f
sub r10d, 1
je 0x1400b7915
cmp r10d, 1
jne 0x1400b7925
movzx ecx, byte [r8 + 2]
shl ecx, 0x10
movzx eax, byte [r8 + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [r8]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r8d, ecx, 0x5bd1e995
imul eax, r11d, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul edx, ecx, 0x5bd1e995
imul eax, r9d, 0x5bd1e995
xor eax, r8d
imul ecx, eax, 0x5bd1e995
xor ecx, edx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r15d, ecx
shr r15d, 0xf
xor r15d, ecx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rbx, r14
nop word [rax + rax]
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
je 0x1400b79af
lea rdx, [0x14015ce80]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400b79b4
cmp r14, rbx
jne 0x1400b7990
mov dword [rsp + 0x20], 0xa
mov r9d, ntohs
mov r8d, 0x929d631a
mov rdx, qword [rbx + 0x30]
call fcn.14000bac0
mov rcx, qword [rdi + 8]
call rax
mov ecx, dword [rdi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.14000bac0
mov qword [rsp + 0x78], r12
mov qword [rsi + 0x38], r12
test rax, rax
je 0x1400b7a43
lea rcx, vtable.std::_Func_impl_no_alloc_int____cdecl___unsigned_long_int__unsigned_long_int__char____ptr64__int___int__unsigned_long_int__unsigned_long_int__char____ptr64__int_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rsi + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400b7a43
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rax, rsi
jmp 0x1400b7a50
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x1400b7a70
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r12
push r14
push r15
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
xor r12d, r12d
mov r10d, dword [rcx + 0x10]
mov r11d, r10d
mov r8, qword [rcx]
mov r9d, dword [rcx + 0x14]
cmp r10d, 4
jl 0x1400b7ae8
mov edx, r10d
shr rdx, 2
mov eax, edx
neg eax
lea r10d, [r10 + rax*4]
nop dword [rax]
imul eax, dword [r8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
imul r9d, r9d, 0x5bd1e995
xor r9d, eax
add r8, 4
sub rdx, 1
jne 0x1400b7ac0
mov ecx, r12d
sub r10d, 1
je 0x1400b7b0f
sub r10d, 1
je 0x1400b7b05
cmp r10d, 1
jne 0x1400b7b15
movzx ecx, byte [r8 + 2]
shl ecx, 0x10
movzx eax, byte [r8 + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [r8]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r8d, ecx, 0x5bd1e995
imul eax, r11d, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul edx, ecx, 0x5bd1e995
imul eax, r9d, 0x5bd1e995
xor eax, r8d
imul ecx, eax, 0x5bd1e995
xor ecx, edx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r15d, ecx
shr r15d, 0xf
xor r15d, ecx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rbx, r14
nop word [rax + rax]
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
je 0x1400b7b9f
lea rdx, [0x14015ce80]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400b7ba4
cmp r14, rbx
jne 0x1400b7b80
mov dword [rsp + 0x20], 0xa
mov r9d, ntohs
mov r8d, 0x929d631a
mov rdx, qword [rbx + 0x30]
call fcn.14000bac0
mov rcx, qword [rdi + 8]
call rax
mov ecx, dword [rdi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.14000bac0
mov qword [rsp + 0x78], r12
mov qword [rsi + 0x38], r12
test rax, rax
je 0x1400b7c33
lea rcx, vtable.std::_Func_impl_no_alloc_int____cdecl___char____ptr64__unsigned_long_int____ptr64___int__char____ptr64__unsigned_long_int____ptr64_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rsi + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400b7c33
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rax, rsi
jmp 0x1400b7c40
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x1400bd250
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
xor ebx, ebx
lea r8, str.GSteel
mov qword [0x140181f98], r8
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x140181fa0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
xorps xmm0, xmm0
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x1f], rbx
lea rcx, [rbp + 7]
movups xmmword [rbp + 7], xmm0
cmp eax, 0xb7
jne 0x1400bd3c5
mov r8d, 0x1b
lea rdx, str.Application_already_running
call fcn.140003040
nop
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rbp + 0x17]
sub rax, rcx
cmp rax, 6
jb 0x1400bd4c5
lea rax, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rax, qword [rbp + 7]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 6
lea r9, str.INFO:
lea rcx, [rbp + 0x2f]
call fcn.1400b1730
nop
lea rdx, [rbp + 0x2f]
call fcn.1400bcf60
nop
mov rdx, qword [rbp + 0x47]
cmp rdx, 0xf
jbe 0x1400bd353
inc rdx
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bd34d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400bd34d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401386d0
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x1400bd38e
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bd389
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bd4a0
call fcn.1401386d0
mov rcx, qword [0x140181fa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 1
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret
mov r8d, 0x21
lea rdx, str.Application_started_successfully_
call fcn.140003040
nop
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rbp + 0x17]
sub rax, rcx
cmp rax, 6
jb 0x1400bd4bf
lea rax, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rax, qword [rbp + 7]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 6
lea r9, str.INFO:
lea rcx, [rbp + 0x2f]
call fcn.1400b1730
nop
lea rdx, [rbp + 0x2f]
call fcn.1400bcf60
nop
mov rdx, qword [rbp + 0x47]
cmp rdx, 0xf
jbe 0x1400bd46e
inc rdx
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bd468
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400bd468
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401386d0
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x1400bd4ac
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bd4a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400bd4a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401386d0
xor eax, eax
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret
call fcn.1400012e0
nop
call fcn.1400012e0
int3
Function at 0x1400c1880
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1400c18e1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400c18a0
mov ecx, dword [r9]
jmp 0x1400c19cb
cmp ecx, 0x4e0
jb 0x1400c19cb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1400c1900
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1400c1950
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1400c32a0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
call fcn.1400c3300
mov ecx, 2
mov rbx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
lea rdx, str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_to:_bzip2_devel_sourceware.org.__If_this_happened_nwhen_you_were_using_some_program_which_uses_libbzip2_as_a_ncomponent__you_should_also_report_this_bug_to_the_author_s__nof_that_program.__Please_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks._n_n
mov r9, rbx
mov r8d, edi
call fcn.1400c3670
cmp edi, 0x3ef
jne 0x1400c32f4
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
lea rdx, str._n_A_special_note_about_internal_error_number_1007__n_nExperience_suggests_that_a_common_cause_of_i.e._1007_nis_unreliable_memory_or_other_hardware.__The_1007_assertion_njust_happens_to_cross_check_the_results_of_huge_numbers_of_nmemory_reads_writes__and_so_acts__unintendedly__as_a_stress_ntest_of_your_memory_system._n_nI_suggest_the_following:_try_compressing_the_file_again__npossibly_monitoring_progress_in_detail_with_the__vv_flag._n_n_If_the_error_cannot_be_reproduced__and_or_happens_at_different_n__points_in_compression__you_may_have_a_flaky_memory_system._n__Try_a_memory_test_program.__I_have_used_Memtest86_n___www.memtest86.com_.__At_the_time_of_writing_it_is_free__GPLd_._n__Memtest86_tests_memory_much_more_thorougly_than_your_BIOSs_n__power_on_test__and_may_find_failures_that_the_BIOS_doesnt._n_n_If_the_error_can_be_repeatably_reproduced__this_is_a_bug_in_n__bzip2__and_I_would_very_much_like_to_hear_about_it.__Please_n__let_me_know__and__ideally__save_a_copy_of_the_file_causing_the_n__problem____without_which_I_will_be_unable_to_investigate_it._n_n
call fcn.1400c3670
mov ecx, 3
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x1400c3350
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x60]
movzx r8d, byte [rcx + 0x5c]
test eax, eax
jle 0x1400c338c
mov edx, dword [rcx + 0x288]
lea r11, [0x14017db30]
mov r9d, eax
nop dword [rax]
mov eax, edx
shr rax, 0x18
xor rax, r8
shl edx, 8
xor edx, dword [r11 + rax*4]
mov dword [rcx + 0x288], edx
sub r9, 1
jne 0x1400c3370
mov eax, dword [rcx + 0x5c]
mov byte [rax + rcx + 0x80], 1
movsxd r9, dword [rcx + 0x60]
mov edx, r9d
sub edx, 1
je 0x1400c3464
sub edx, 1
je 0x1400c3456
cmp edx, 1
je 0x1400c3420
mov byte [r9 + rcx + 0x7c], 1
mov rax, qword [rcx + 0x40]
movsxd rdx, dword [rcx + 0x6c]
mov byte [rdx + rax], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
movzx r8d, byte [rcx + 0x60]
mov rax, qword [rcx + 0x40]
sub r8b, 4
mov byte [rdx + rax + 1], r8b
inc dword [rcx + 0x6c]
ret
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
inc dword [rcx + 0x6c]
ret
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
jmp 0x1400c343f
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
inc dword [rcx + 0x6c]
ret
Function at 0x1400cb800
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov r10, qword [rcx + 0x40]
mov qword [rax + 0x10], rbx
mov rbx, qword [rcx + 0x38]
mov qword [rax + 0x18], rbp
mov ebp, dword [rcx + 0x290]
mov qword [rax + 0x20], rsi
mov esi, dword [rcx + 0x6c]
mov qword [rax - 8], rdi
mov rdi, rcx
mov qword [rax - 0x18], r15
mov r15, qword [rcx + 0x28]
mov ecx, dword [rcx + 0x58]
cmp esi, 0x2710
jl 0x1400cb921
mov qword [rax - 0x10], r14
mov eax, esi
and eax, 1
add eax, 0x22
add eax, esi
movsxd r8, eax
add r8, r10
cmp ecx, 1
jge 0x1400cb862
mov ecx, 1
jmp 0x1400cb86c
mov eax, 0x64
cmp ecx, eax
cmovg ecx, eax
dec ecx
mov eax, 0x55555556
imul ecx
lea rax, [rsp + 0x70]
mov r9, r15
mov r14d, edx
mov qword [rsp + 0x30], rax
shr r14d, 0x1f
mov rcx, rbx
add r14d, edx
mov dword [rsp + 0x28], ebp
imul r14d, esi
mov rdx, r10
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x70], r14d
call fcn.1400cd0d0
cmp ebp, 3
jl 0x1400cb8f7
sub r14d, dword [rsp + 0x70]
mov ecx, 2
movd xmm0, esi
cvtdq2ps xmm0, xmm0
movd xmm1, r14d
cvtdq2ps xmm1, xmm1
movaps xmmword [rsp + 0x40], xmm6
divss xmm1, xmm0
cvtps2pd xmm6, xmm1
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov r9d, esi
lea rdx, str._______d_work___d_block__ratio__5.2f_n
mov r8d, r14d
movsd qword [rsp + 0x20], xmm6
call fcn.1400c3670
movaps xmm6, xmmword [rsp + 0x40]
cmp dword [rsp + 0x70], 0
mov r14, qword [rsp + 0x58]
jge 0x1400cb938
cmp ebp, 2
jl 0x1400cb921
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
lea rdx, str.____too_repetitive__using_fallback_sorting_algorithm_n
call fcn.1400c3670
mov rdx, qword [rdi + 0x20]
mov r9d, esi
mov rcx, qword [rdi + 0x18]
mov r8, r15
mov dword [rsp + 0x20], ebp
call fcn.1400cbd50
mov ecx, dword [rdi + 0x6c]
xor eax, eax
mov r15, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov dword [rdi + 0x30], 0xffffffff
test ecx, ecx
jle 0x1400cb974
nop dword [rax]
cmp dword [rbx], 0
je 0x1400cb971
inc eax
add rbx, 4
cmp eax, ecx
jl 0x1400cb960
jmp 0x1400cb974
mov dword [rdi + 0x30], eax
cmp dword [rdi + 0x30], 0xffffffff
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x78]
jne 0x1400cb992
mov ecx, 0x3eb
add rsp, 0x68
jmp fcn.1400c32a0
add rsp, 0x68
ret
Function at 0x1400d8e40
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400d8f22
call fcn.1400f6520
test al, al
jne 0x1400d8f22
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x1400d8e72
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.1401003d0
test rax, rax
je 0x1400d8eb7
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.1401003d0
mov rsi, rax
test rax, rax
je 0x1400d8eb7
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x1400d8eeb
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.1400f0300
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x1400d8ed0
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400e8300
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
cmp byte [rcx + 0xa5e], 0
mov rbp, r9
mov r14, r8
movsxd rsi, edx
mov rdi, rcx
je 0x1400e83cb
cmp qword [rcx + 0x270], 0
je 0x1400e837e
mov qword [rsp + 0x40], rbx
call fcn.1400d3280
mov dl, 1
mov rcx, rdi
movzx ebx, al
call fcn.1400d3c90
mov rcx, qword [rdi + 0x1e8]
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov r8, r14
mov rcx, rdi
mov edx, esi
call qword [rdi + 0x270]
movzx edx, bl
mov rcx, rdi
call fcn.1400d3c90
mov rbx, qword [rsp + 0x40]
jmp 0x1400e83cb
mov ecx, esi
test edx, edx
je 0x1400e838e
sub ecx, 1
je 0x1400e838e
cmp ecx, 1
jne 0x1400e83cb
mov r9, qword [rdi + 0x1e0]
lea rax, [0x140143348]
lea rcx, [rsi + rsi*2]
mov edx, 2
add rcx, rax
mov r8d, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r9, qword [rdi + 0x1e0]
mov r8d, 1
mov rdx, rbp
mov rcx, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1400ec500
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
cdqe
add rsp, 0x28
ret
Function at 0x1400ec7e0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x1400ec80a
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.LoadLibraryExW
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x140143e98]
mov rcx, rbx
mov r14, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_wcspbrk
test rax, rax
je 0x1400ec86b
mov rcx, rbx
test r14, r14
je 0x1400ec858
xor edx, edx
mov r8d, 8
mov rax, r14
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp rax
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test r14, r14
je 0x1400ec8a2
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400ec8a2
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
mov rax, r14
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp rax
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r15d, eax
test eax, eax
je 0x1400ec96c
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x40], rsi
mov rdx, rdi
nop dword [rax + rax]
inc rdx
cmp word [rbx + rdx*2], bp
jne 0x1400ec8d0
lea ecx, [rax + 1]
add rcx, rdx
add rcx, rcx
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1400ec95e
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400ec95e
mov rax, rdi
cmp word [rsi + rax*2 + 2], bp
lea rax, [rax + 1]
jne 0x1400ec903
mov dword [rsi + rax*2], 0x5c
inc rdi
cmp word [rsi + rdi*2], bp
jne 0x1400ec915
add rdi, rdi
sub rdi, rbx
add rdi, rsi
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rbx + rdi], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x1400ec930
mov rcx, rsi
test r14, r14
je 0x1400ec955
xor edx, edx
mov r8d, 8
call r14
jmp 0x1400ec95b
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbp, rax
mov rcx, rsi
call qword [fcn.140139ca5]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret