joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d540
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42d7e6
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x1270]
mov rcx, qword [rax + 0x1260]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42d7da
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1260], 0
cmp byte [0x005e93b1], 0
jne 0x42d5a2
xor edx, edx
xor ebx, ebx
nop
jmp 0x42d5ea
xor edx, edx
jmp 0x42d5cd
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1270]
mov rax, rcx
call fcn.0041ce80
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42d5a6
add rax, 0x1260
call fcn.0042d400
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42d774
mov rsi, qword [rax + rdx*8 + 0x1270]
nop dword [rax + rax]
cmp rsi, 0x1000
jb 0x42d5e7
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00411f20
test rax, rax
jne 0x42d642
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42d5e7
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
nop
mov r8, rcx
shr rcx, 3
movzx r9d, byte [rsi + rcx]
and r8d, 7
mov rdx, rcx
mov rcx, r8
mov r10d, 1
shl r10d, cl
add rsi, rdx
test r10b, r9b
je 0x42d689
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42d5e7
nop
lock or byte [rsi], r10b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42d7cd
lea r10, [0x005bb7f0]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r10d, byte [r9 + rcx + 0x11440]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x11440]
shr r8, 0xd
and r8d, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42d70f
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42d745
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1248]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1248], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42d5e7
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42d7c5
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1270], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42d5e7
cmp rbx, 0x200
ja 0x42d7b8
lea rdx, [rax + 0x1270]
lea rsi, [rax + 0x1238]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00423000
mov rax, qword [rsp + 0x48]
add rax, 0x1260
call fcn.0042d400
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
call fcn.0045f240
mov rax, r8
call fcn.0045f1c0
mov rax, r8
mov ecx, 0x40
call fcn.0045f1e0
mov edx, 0x200
nop
call fcn.0045f220
nop
mov qword [rsp + 8], rax
call fcn.004615c0
mov rax, qword [rsp + 8]
jmp fcn.0042d540
Function at 0x442400
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44256a
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x442418
cmp edx, ecx
jne 0x442558
nop dword [rax]
test rsi, rsi
jne 0x442558
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x442474
nop
call fcn.00460b60
xorps xmm15, xmm15
mov r14, qword [0x005e95a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00442300
mov rcx, qword [0x005965c8]
mov rdx, qword [0x005965c0]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
mov r8d, esi
and esi, 0xffffffe0
sub edi, esi
test edi, edi
jl 0x442553
cmp edi, 0x20
sbb esi, esi
sar r8d, 5
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x442548
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x005970b0]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x005970b0], rbx
nop
mov edx, 1
lea rsi, [0x005970b8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1220]
shr rdx, 0x3d
test dl, dl
jne 0x442537
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1220], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x004dfc80]
mov ebx, 0x28
call fcn.00433cc0
mov rcx, rax
mov rax, rsi
call fcn.0045f1c0
call fcn.004322e0
lea rax, [0x004deed1]
mov ebx, 0x23
call fcn.00433cc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045cb60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00442400
Function at 0x44d520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44d698
movzx edx, byte [rax]
nop
test edx, edx
jne 0x44d55c
test r8b, r8b
jne 0x44d55c
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x44d56f
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44d658
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x44d646
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x44d63c
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x44d5c3
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x44d606
mov eax, 1
cmp rax, rbx
ja 0x44d5f5
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.0045f280
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x44d634
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x44d5fd
mov r8d, eax
mov eax, r10d
jmp 0x44d5c8
mov rcx, rbx
call fcn.0045f1c0
xor eax, eax
mov rcx, rax
call fcn.0045f1c0
mov eax, r8d
mov rcx, rbx
call fcn.0045f280
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44d68e
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x44d651
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44d575
mov eax, edx
mov rcx, rbx
call fcn.0045f1c0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0045f1c0
nop
int3
Function at 0x454d80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x454e39
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x00454e80]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045ca20
xorps xmm15, xmm15
mov r14, qword [0x005e95a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045cb60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00454d80
Function at 0x45ec00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4028cf
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00408f60
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045cb60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4028a0
cmp byte [0x005e93b0], 0
je 0x45ec15
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45bc60
jmp 0x4028a0

Function at 0x45ec20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005e96a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005e93b0], 0
je 0x45ec55
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005e99e0]
aesenc xmm0, xmmword [0x005e99f0]
aesenc xmm0, xmmword [0x005e9a00]
movq rax, xmm0
ret
jmp 0x409160

Function at 0x45ec60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005e96a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005e93b0], 0
je 0x45ec96
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005e99e0]
aesenc xmm0, xmmword [0x005e99f0]
aesenc xmm0, xmmword [0x005e9a00]
movq rax, xmm0
ret
jmp 0x4091c0

Function at 0x460680
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x005e9960]
mov qword [rsp + 8], rdx
lea r8d, [0x005e93c8]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.0045eb40
add rsp, 0x30
ret

Function at 0x460bc0
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x460bf0
mov rcx, 0x28
jmp 0x460bfb
shl rcx, 3
add rcx, 0x1480
mov qword [0x005e95a8], rcx
ret
Function at 0x4a1240
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a147c
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
call fcn.004a01c0
xorps xmm15, xmm15
mov r14, qword [0x005e95a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x4a138a
nop
cmp rdx, 0x40
ja 0x4a146e
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x4a12f9
mov rax, rdx
mov rcx, rsi
nop
call fcn.0045fb40
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x4a1361
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.004a18a0
xorps xmm15, xmm15
mov r14, qword [0x005e95a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x4a1463
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rax
sub rax, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x4a1397
mov rdx, rax
mov rbx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
cmp rax, 0x40
jl 0x4a1417
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and rax, 0xffffffffffffffc0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], r8
call fcn.004a18a0
xorps xmm15, xmm15
mov r14, qword [0x005e95a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rdx, qword [rsp + 0x68]
mov rax, rcx
mov rcx, qword [rsp + 0x58]
test rax, rax
je 0x4a1452
cmp rax, 0x40
mov esi, 0x40
cmovl rsi, rax
lea rax, [rcx + 0x20]
cmp rbx, rax
je 0x4a144e
mov qword [rsp + 0x38], rsi
mov rcx, rsi
call fcn.0045fb40
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, rax
mov rax, rsi
call fcn.0045f280
mov rax, rdx
mov ecx, 0x40
call fcn.0045f280
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045cb60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004a1240
Function at 0x14019eb15
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov rdx, r8
mov byte [rsp], al
lea r15, [r10 + riz + 0x4c3267ad]
mov r14d, dword [rsp + 0xd]
sub rsp, 0
jmp 0x14019eb5c
stc
push word [rsp + 0xd]
bswap rbp
not r13w
sub rsp, 0xa
jmp 0x14019eb46

Function at 0x14019f091
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp], r8
mov r13, 0x727f742f
jmp 0x14019f0a2
inc rax
not r15d
mov qword [rsp], r8
mov bx, word [rsp + 1]
xchg byte [rsp], r13b
jmp 0x14019f060
xchg r10, rax
mov rax, r9
mov edx, 0xc302de1e
mov r13, qword [rsp + 3]
jmp 0x14019f076
lea rdx, [rdx*8]
pop word [rsp + 3]
mov ebp, dword [rsp + 2]
mov eax, 0x5c520ab4
xchg r12, r13
jmp 0x14019f0f7
mov dword [rsp], r12d
setg r10b
bswap r13d
cmc
mov dx, ax
jmp 0x14019f1a4
lea rbx, [rdx + rbx]
dec r13b
mov byte [rsp], r14b
not rdx
jmp 0x14019f0e1
rcl bl, cl
lea rsp, [rsp + 1]
mov r13, 0x12d11745
jmp 0x14019f165
add rsp, 2
lea rsp, [rsp + 4]
push r10w
rdtsc
xchg ebx, ebp
not r13
jmp 0x14019f121
xchg r15b, r12b
pop r10w
btr ebp, r9d
bswap rbx
jmp 0x14019f186
lea r15, [rdx + riz - 0x97]
mov r15w, word [rsp + 1]
add rsp, 0
mov word [rsp], si
mov ebx, 0xdc9ccbf3
bsf r15, r14
jmp 0x14019f14d
mov ebp, 0xfad23838
bt r15w, ax
xchg r10w, ax
stc
call fcn.14019f29f
invalid
xchg dword [rsp], r12d
rdtsc
xchg r12, r15
lea r10, [r15 + r15]
setne bpl
xchg r14, rax
jmp 0x14019f137
Function at 0x14019f29f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp]
mov r15b, r10b
mov ebx, dword [rsp + 3]
dec r14
mov bx, r11w
jmp 0x14019f218
bswap r10d
mov byte [rsp + 1], r11b
lea rdx, [rbx*8]
mov r12d, dword [rsp + 3]
xchg byte [rsp + 2], bl
cmc
jmp 0x14019f1bd
not rbp
pop word [rsp + 1]
mov ax, word [rsp]
mov r12, 0xfffffffffe4de81f
mov r14w, r8w
lea rsp, [rsp + 3]
jmp 0x14019f22c
mov r12b, byte [rsp + 1]
cld
std
rdtsc
mov r10d, dword [rsp + 3]
mov rdx, qword [rsp]
jmp 0x14019f1f4
bswap rdx
bsr dx, cx
rdtsc
mov r14d, r8d
xchg r10, rbp
bsr rdx, r13
jmp 0x14019f274
and rbp, r15
push word [rsp + 1]
lea r15, [rdx*4]
mov rdx, 0xffffffffbbc260d4
setae bpl
xchg r15w, ax
jmp 0x14019f1d8
lea r12, [rax + rax]
btr ebx, esp
mov r15, 0xffffffff99a9c6ea
add rsp, 0
mov r13, r15
bt r14w, r11w
jmp 0x14019f2d1
add rsp, 4
mov word [rsp], sp
jmp 0x14019f251
not r10w
mov word [rsp + 4], r9w
cmc
pop rax
mov r15d, dword [rsp]
mov byte [rsp], spl
jmp 0x14019f2e6
xchg r13, r12
mov r14w, bx
lea r10, [r12 + rbp]
xchg byte [rsp], r15b
push rdx
btc eax, edi
jmp 0x14019f2a9
mov r10, rsi
bsr rbx, rsp
add rsp, 0
mov r15w, word [rsp]
bswap r13d
mov r13w, r15w
jmp 0x14019f34e
rdtsc
clc
cmp rbx, 0x58130030
call fcn.14019f32b
sbb ebp, esp
mov r12w, word [rsp + 8]
mov qword [rsp + 0x16], rax
jmp 0x14019f38c
mov r12w, word [rsp + 0xe]
inc r15w
mov byte [rsp + 0x11], r9b
mov r10w, word [rsp + 0x27]
jmp 0x14019f681
mov dl, 0xc4
push qword [rsp + 0x23]
push qword [rsp + 0x12]
xchg rbx, rbp
call fcn.14019f653
adc al, 0xf7
mov bp, r10w
mov byte [rsp + 0x1a], sil
bswap rbx
jmp 0x14019f6f2
xchg word [rsp + 6], r14w
mov dword [rsp + 0x31], r12d
mov bl, byte [rsp + 2]
xchg ebp, eax
jmp 0x14019f706
neg r12
inc r10b
stc
mov r12w, 0xa407
lea r13, [r11 + riz]
inc eax
jmp 0x14019f6dc
xchg word [rsp + 0x11], ax
bswap r12d
xchg r13w, ax
mov r14w, word [rsp + 0x28]
mov bl, r15b
mov r15w, word [rsp + 0x13]
jmp 0x14019f74a
mov rbx, qword [rsp + 0x1e]
mov edx, esi
add rsp, 0xf
call fcn.14019f764
and dword ss:[rax - 0x5d], esp
fidiv dword [reloc.USER32.dll_CreateWindowExW]
xchg esi, ebp
mov rdx, rbp
xchg r14, r13
dec ebp
push qword [rsp + 0x1f]
mov rax, qword [rsp + 2]
xchg word [rsp + 0x30], r12w
jmp 0x14019f734
Function at 0x14019f764
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rax, [rbx*8]
mov r10w, word [rsp + 0x32]
mov rbp, 0x277b82c3
jmp 0x14019f96d
mov r15d, 0x1a846b5b
sub rsp, 0x18
push bx
neg r10b
jmp 0x14019f7ce
mov r12b, al
mov rbp, qword [rsp + 6]
mov edx, 0xa9c95367
xchg qword [rsp + 0xd], r10
rdtsc
rdtsc
jmp 0x14019f7a0
xchg r12, rax
mov al, r8b
mov bx, 0x7bed
std
mov al, r14b
pop word [rsp + 0x18]
jmp 0x14019f825
mov r10b, byte [rsp + 8]
std
neg r13d
pop r12w
add rsp, 0x1a
lea rsp, [rsp + 0xe]
jmp 0x14019f7b6
xchg r13d, r10d
mov dword [rsp + 8], edi
mov r14, qword [rsp + 0x18]
mov r15w, r11w
jmp 0x14019f83b
push qword [rsp + 0x28]
bswap r14
push word [rsp + 0x1d]
push rsi
lea rsp, [rsp + 0x18]
cld
jmp 0x14019f80f
mov r14b, byte [rsp + 0x25]
sete al
mov r14w, 0x62ef
push si
jmp 0x14019f894
mov byte [rsp + 5], r8b
xchg r15b, r13b
bswap r15d
mov r13b, spl
lea rax, [rsp + r11]
push qword [rsp + 0xb]
jmp 0x14019f7f7
xchg r13, rax
mov bp, word [rsp + 5]
neg al
inc rbx
mov byte [rsp + 0x15], r10b
xchg dx, bx
jmp 0x14019f8f4
pop word [rsp + 0x13]
std
not r10d
pop qword [rsp + 0x19]
xchg dword [rsp + 0xe], r12d
mov dl, byte [rsp + 0xa]
jmp 0x14019f86b
push r15w
xchg qword [rsp], rbx
bt r12d, r12d
call fcn.14019f8d8
rol dword [rax + reloc.USER32.dll_CreateWindowExW], 0x44
mov esp, dword [rsp + 0x14]
mov r12w, word [rsp + 0x14]
xchg r10w, dx
clc
lea rsp, [rsp + 5]
pop r12
cmc
jmp 0x14019f8ad
bsr eax, eax
setnp bl
stc
pop r15
mov qword [rsp + 6], r14
mov rax, qword [rsp + 0x19]
jmp 0x14019f8c3
mov byte [rsp + 0x31], bl
lea r12, [0xffffffffa00f4012]
mov r14d, dword [rsp + 0xd]
lea rax, [r11 + r11]
mov r10w, 0xc31d
xchg qword [rsp + 0x26], r13
jmp 0x14019f852

Function at 0x14019f936
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
jmp 0x14019fac6
rdtsc
xchg byte [rsp + 1], bl
lea rbp, [rdx + rdx]
std
add rsp, 2
mov bl, byte [rsp]
call fcn.14019f991
outsd dx, dword [rsi]
jbe 0x14019fa22
movabs al, byte [0xde8b4166f88644e3]
xchg al, r15b
mov bx, r14w
mov r13w, word [rsp + 2]
mov eax, dword [rsp]
xchg r14w, bp
mov rax, 0x3937bfa
jmp 0x14019f9a7
sub al, 0x24
jmp 0x14019fa7e
mov r14w, word [rsp]
rdtsc
call fcn.14019fa64
mov r13b, byte [rsp + 0xd]
setge r12b
dec rdx
mov r15b, 0xd2
jmp 0x14019fafb
mov r13, 0xffffffffa33caef4
mov dword [rsp + 3], r11d
add rsp, 6
xchg bpl, r10b
bswap r12d
mov r13, qword [rsp]
jmp 0x14019f9c3
not r12
mov dword [rsp + 6], r13d
mov r15d, 0xb5ecf525
call fcn.14019fae5
lea r12, [rsi + riz + 0xb2fc]
xchg qword [rsp + 9], r12
mov r10, 0x2db47a7a
xchg r12, r15
mov eax, 0x1531c6ea
call int.14019ffcf
mov byte [rbx], ch
std
int3

Function at 0x14019f991
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x14019f9f6
add rsp, 8
neg r12b
mov rbp, qword [rsp]
mov bp, word [rsp]
jmp 0x14019fa38
mov r15b, byte [rsp + 6]
xchg rbx, rax
xchg qword [rsp], rax
inc r10b
rdtsc
xchg word [rsp + 1], dx
jmp 0x14019f9e0
lea r10, [rax + rax]
mov r15d, ecx
mov ebx, dword [rsp]
sub rsp, 1
lea rsp, [rsp + 1]
mov r13b, byte [rsp]
mov ebx, edi
lea rsp, [rsp]
mov ax, dx
btr rax, r9
xchg dl, r12b
shr r14w, cl
jmp 0x14019fa0d
Function at 0x140009294
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [rcx + 0x1e8]
mov r10, r8
movsxd r9, dword [rcx + 0x1e0]
mov r11, rdx
mov rcx, r11
mov r8d, dword [rax + r9*4 - 4]
mov eax, r10d
sub eax, edx
neg r10
sbb edx, edx
and edx, eax
jmp fcn.140009cec

Function at 0x14000997c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r15, r9d
mov rsi, r8
test r8, r8
je 0x1400099a3
and qword [r8], 0
call fcn.140009ab8
mov rbx, rax
test rax, rax
je 0x140009a9c
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140009a93
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140009a93
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140009a93
mov rax, qword [0x1400722a8]
mov rbp, rdi
test rax, rax
je 0x140009a0b
inc dword [rax + 0x3c8]
mov rdx, qword [0x1400722b8]
lea rcx, [r15 + rdi]
call qword [0x14005a050]
mov rdi, rax
test rax, rax
je 0x140009a93
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rbp
je 0x140009a6a
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1400722a8]
test rax, rax
je 0x140009a58
dec dword [rax + 0x3c8]
mov rdx, qword [0x1400722b8]
mov rcx, rdi
call qword [0x14005a058]
jmp 0x140009a9c
test r15d, r15d
jle 0x140009a7d
lea rcx, [rdi + rbp]
mov r8, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x140009a8e
mov qword [rsi], rbp
mov rax, rdi
jmp 0x140009a9e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x140009cec
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
cmp dword [0x1400722d4], 0
lea rsi, [0x1400722d0]
mov ebx, r8d
mov edi, edx
mov r10, rcx
jne 0x140009d53
xor r9d, r9d
mov r11, rsi
mov r8d, r9d
mov edx, 8
mov ecx, r8d
mov eax, r8d
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov r8d, ecx
xor r8d, eax
sub rdx, 1
jne 0x140009d21
mov dword [r11], r8d
inc r9d
add r11, 4
cmp r9d, 0x100
jb 0x140009d19
not ebx
mov edx, ebx
test edi, edi
jle 0x140009d75
movzx eax, byte [r10]
inc r10
movzx ecx, dl
xor rcx, rax
shr edx, 8
xor edx, dword [rsi + rcx*4]
sub edi, 1
jne 0x140009d5b
jmp 0x140009daf
mov r8b, byte [r10]
inc r10
test r8b, r8b
je 0x140009daf
mov r9b, 0x23
cmp r8b, r9b
jne 0x140009d94
cmp byte [r10], r9b
jne 0x140009d94
cmp byte [r10 + 1], r9b
cmove edx, ebx
movzx ecx, dl
movzx eax, r8b
mov r8b, byte [r10]
xor rcx, rax
shr edx, 8
inc r10
xor edx, dword [rsi + rcx*4]
test r8b, r8b
jne 0x140009d83
mov rbx, qword [rsp + 8]
not edx
mov rsi, qword [rsp + 0x10]
mov eax, edx
mov rdi, qword [rsp + 0x18]
ret
Function at 0x14000fbf4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x1400722a8]
mov rbx, rcx
and dword [rax + 0x2d9c], 0
test rcx, rcx
je 0x14000fc5d
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.14000fc68
lea rdx, [0x14004cb04]
mov rcx, rbx
mov rdi, rax
call fcn.140009ab8
mov rbx, rax
test rax, rax
je 0x14000fc5d
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret