joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a94e0
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x20
mov r15, qword [rcx + 0xe8]
xor r10d, r10d
mov r12, r15
xor dil, dil
and r12, 0xffffffffffff0000
mov rbp, rcx
movzx esi, r10w
cmp r10w, r15w
jae 0x1400a96ae
mov qword [rsp + 0x58], rbx
movabs rcx, 0x100000001b3
mov qword [rsp + 0x60], r13
movabs r9, 0xcbf29ce484222325
mov qword [rsp + 0x68], r14
movzx r13d, r15w
nop dword [rax + rax]
movzx r14d, dil
bt r13d, r14d
jae 0x1400a967f
movzx r8d, dil
add r8, r12
mov qword [rsp + 0x50], r8
movzx eax, byte [rsp + 0x51]
movzx edx, r8b
xor rdx, r9
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x52]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x53]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x54]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x55]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x56]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x57]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [rbp + 0x100]
and rdx, qword [rbp + 0x128]
shl rdx, 4
add rdx, qword [rbp + 0x110]
mov r9, qword [rdx + 8]
mov rbx, r9
cmp r9, rcx
je 0x1400a95f8
mov rax, qword [rdx]
cmp r8, qword [r9 + 0x10]
je 0x1400a95fb
cmp rbx, rax
je 0x1400a95f8
mov rbx, qword [rbx + 8]
cmp r8, qword [rbx + 0x10]
jne 0x1400a95e7
jmp 0x1400a95fb
mov rbx, r10
test rbx, rbx
je 0x1400a965d
mov rax, qword [rdx]
cmp r9, rbx
jne 0x1400a9620
cmp rax, rbx
jne 0x1400a9616
mov qword [rdx], rcx
mov qword [rdx + 8], rcx
jmp 0x1400a962b
mov rcx, qword [rbx + 8]
mov qword [rdx + 8], rcx
jmp 0x1400a962b
cmp rax, rbx
jne 0x1400a962b
mov rax, qword [rbx]
mov qword [rdx], rax
mov rdx, qword [rbx]
lea rcx, [rbx + 0x18]
dec qword [rbp + 0x108]
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
call fcn.14011f910
mov edx, 0xf8
mov rcx, rbx
call fcn.140249860
xor r10d, r10d
mov ecx, r14d
mov eax, 1
shl ax, cl
movabs r9, 0xcbf29ce484222325
add si, ax
movabs rcx, 0x100000001b3
inc dil
cmp si, r15w
jb 0x1400a9540
mov r14, qword [rsp + 0x68]
mov r13, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov qword [rbp + 0xe8], r12
add rsp, 0x20
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rcx + 0xe8], r12
add rsp, 0x20
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400cbc10
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
mov ebp, 0xfffd
nop word [rax + rax]
movzx ecx, word [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp ax, 9
ja 0x1400cbcf3
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x1400cbcf3
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x1400cbd11
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x1400cbce3
cmp word [rax], 0x5c
jne 0x1400cbcdc
lea rdx, [rax + 2]
cmp rdx, rcx
je 0x1400cbcdc
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x1400cbcc7
movzx ecx, word [rdx]
sub cx, 0x28
cmp cx, 1
jbe 0x1400cbcd9
test r8b, 0x10
jne 0x1400cbcdc
movzx ecx, word [rdx]
sub cx, 0x7b
test bp, cx
jne 0x1400cbcdc
mov rax, rdx
add rax, 2
mov qword [rbx], rax
mov rcx, rbx
call fcn.1400cdad0
test edi, edi
jne 0x1400cbc40
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.1400ccd00
int3

Function at 0x1400ce2a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rax, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x1400ce2e4
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1400ce2d0
ret
Function at 0x1400e88f0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
lea rsi, [rcx + 0xdd8]
mov qword [rcx + 0xdf0], 0
mov rbx, qword [rsi]
mov r14, rdx
mov rdi, qword [rsi + 8]
mov rbp, rcx
cmp rbx, rdi
je 0x1400e8951
nop
lea rcx, [rbx + 0x18]
call fcn.140011870
mov rcx, rbx
call fcn.140022c08
add rbx, 0x40
cmp rbx, rdi
jne 0x1400e8930
mov rax, qword [rsi]
mov qword [rsi + 8], rax
mov rdx, r14
mov rcx, rsi
call fcn.1400e62c0
mov rcx, qword [rbp + 0xcb8]
cmp qword [rbp + 0xdf0], 0
seta dl
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rdx, qword [rsi + 8]
sub rdx, qword [rsi]
mov rcx, qword [rbp + 0xcc8]
mov rax, qword [rbp + 0xdf0]
sar rdx, 6
inc rax
cmp rax, rdx
mov r8, qword [rcx]
setb dl
call qword [r8 + 0x38]
xor r8d, r8d
mov rdx, r14
mov rcx, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.1400e3020
Function at 0x140101520
Capabilities:
Parse pe header

Disassembly:
cmp ecx, 0x64
ja case.0x14010153d.54
movsxd rax, ecx
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x10179c]
add rcx, rdx
jmp rcx
xor eax, eax
ret
mov eax, 1
ret
mov eax, 2
ret
mov eax, 3
ret
mov eax, 4
ret
mov eax, 5
ret
mov eax, 6
ret
mov eax, 7
ret
mov eax, 8
ret
mov eax, 9
ret
mov eax, 0xa
ret
mov eax, 0xb
ret
mov eax, 0xc
ret
mov eax, 0xd
ret
mov eax, 0xe
ret
mov eax, 0xf
ret
mov eax, 0x10
ret
mov eax, 0x11
ret
mov eax, 0x12
ret
mov eax, 0x13
ret
mov eax, 0x14
ret
mov eax, 0x15
ret
mov eax, 0x16
ret
mov eax, 0x17
ret
mov eax, 0x18
ret
mov eax, 0x19
ret
mov eax, 0x1a
ret
mov eax, 0x1b
ret
mov eax, 0x1c
ret
mov eax, 0x1d
ret
mov eax, 0x1e
ret
mov eax, 0x1f
ret
mov eax, 0x20
ret
mov eax, 0x21
ret
mov eax, 0x22
ret
mov eax, 0x23
ret
mov eax, 0x24
ret
mov eax, 0x25
ret
mov eax, 0x26
ret
mov eax, 0x27
ret
mov eax, 0x28
ret
mov eax, 0x29
ret
mov eax, 0x2a
ret
mov eax, 0x2b
ret
mov eax, 0x2c
ret
mov eax, 0x2d
ret
mov eax, 0x2e
ret
mov eax, 0x2f
ret
mov eax, 0x30
ret
mov eax, 0x31
ret
mov eax, 0x32
ret
mov eax, 0x33
ret
mov eax, 0x34
ret
mov eax, 0x35
ret
mov eax, 0x37
ret
mov eax, 0x38
ret
mov eax, 0x39
ret
mov eax, 0x3a
ret
mov eax, 0x3b
ret
mov eax, 0x3c
ret
mov eax, 0x3d
ret
mov eax, 0x3e
ret
mov eax, 0x3f
ret
mov eax, 0x40
ret
mov eax, 0x41
ret
mov eax, 0x42
ret
mov eax, 0x43
ret
mov eax, 0x44
ret
mov eax, 0x45
ret
mov eax, 0x46
ret
mov eax, 0x47
ret
mov eax, 0x48
ret
mov eax, 0x49
ret
mov eax, 0x4a
ret
mov eax, 0x4b
ret
mov eax, 0x4c
ret
mov eax, 0x4d
ret
mov eax, 0x4e
ret
mov eax, 0x4f
ret
mov eax, 0x50
ret
mov eax, 0x51
ret
mov eax, 0x52
ret
mov eax, 0x53
ret
mov eax, 0x54
ret
mov eax, 0x55
ret
mov eax, 0x56
ret
mov eax, 0x57
ret
mov eax, 0x58
ret
mov eax, 0x59
ret
mov eax, 0x5a
ret
mov eax, 0x5b
ret
mov eax, 0x5c
ret
mov eax, 0x5d
ret
mov eax, 0x5e
ret
mov eax, 0x5f
ret
mov eax, 0x60
ret
mov eax, 0x61
ret
mov eax, 0x62
ret
mov eax, 0x63
ret
mov eax, 0x64
ret
mov eax, 0xffffffff
ret
Function at 0x140105450
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x14010562f
lea rax, [rdx - 1]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x40], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.1400a4e00
mov rcx, qword [rsi + 8]
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x1401055f4
mov qword [rsp + 0x30], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rbx
xor r9, rdx
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rdi
jne 0x14010556c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1401055e3
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x1401055a9
mov r10, qword [rdx]
cmp r10, rax
je 0x1401055a3
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1401055e3
cmp r9, rdx
je 0x1401055bf
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x140105609
cmp r9, rdx
jne 0x1401055b0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
jne 0x1401054f0
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1401055e3
lea rcx, str.invalid_hash_bucket_count
call fcn.140247978
int3
Function at 0x1401058a0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
movzx r8d, byte [rdx]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r11, rdx
movzx eax, byte [rdx + 1]
mov r9, qword [r10 + 8]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [r10 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
shl rdx, 4
add rdx, qword [r10 + 0x18]
mov rcx, qword [rdx + 8]
cmp rcx, r9
je 0x140105951
mov rax, qword [r11]
mov r8, qword [rdx]
cmp rax, qword [rcx + 0x10]
je 0x140105953
nop
cmp rcx, r8
je 0x140105951
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x140105940
jmp 0x140105953
xor ecx, ecx
test rcx, rcx
je 0x1401059ae
mov rax, qword [rdx]
cmp qword [rdx + 8], rcx
jne 0x140105979
cmp rax, rcx
jne 0x14010596f
mov qword [rdx], r9
mov qword [rdx + 8], r9
jmp 0x140105984
mov r9, qword [rcx + 8]
mov qword [rdx + 8], r9
jmp 0x140105984
cmp rax, rcx
jne 0x140105984
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
dec qword [r10 + 0x10]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x18
call fcn.140249860
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x14010be30
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rdi
push r14
sub rsp, 0x68
mov rax, qword [0x140400788]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, rdx
mov qword [rsp + 0x20], rcx
mov rbx, rcx
lea rdx, [rsp + 0x30]
xor ebp, ebp
mov rcx, rax
mov r14, r8
mov qword [rsp + 0x20], rbp
call fcn.140089850
cmp qword [rax + 0x18], 8
jb 0x14010be75
mov rax, qword [rax]
lea r8, [0x1402aba98]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14025bd34
mov rdx, qword [rsp + 0x48]
test eax, eax
setne dil
cmp rdx, 8
jb 0x14010bed1
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010becc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010bfb3
call fcn.140249860
test dil, dil
jne 0x14010bf96
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14010bf96
xor edx, edx
lea r8d, [rdx + 2]
call fcn.14025799c
mov rcx, qword [rsp + 0x20]
call fcn.14025c470
mov rcx, qword [rsp + 0x20]
xor r8d, r8d
xor edx, edx
movsxd rdi, eax
call fcn.14025799c
lea ecx, [rdi - 1]
cmp ecx, 0x7ffffffd
ja 0x14010bf8c
mov qword [rsp + 0x60], rsi
mov rcx, rdi
mov rsi, rdi
mov qword [r14], rdi
call fcn.140249868
mov rdi, rax
test rax, rax
je 0x14010bf44
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.14024b0d0
jmp 0x14010bf47
mov rdi, rbp
mov r9, qword [rsp + 0x20]
mov edx, 1
mov r8, qword [r14]
mov rcx, rdi
call fcn.140257594
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x20]
cmp rax, qword [r14]
je 0x14010bf82
call fcn.140256af0
mov qword [rbx], rbp
test rdi, rdi
je 0x14010bf99
mov rcx, rdi
call fcn.140249860
jmp 0x14010bf99
call fcn.140256af0
mov qword [rbx], rdi
jmp 0x14010bf99
mov rcx, qword [rsp + 0x20]
call fcn.140256af0
mov qword [rbx], rbp
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402499e0
add rsp, 0x68
pop r14
pop rdi
pop rbp
pop rbx
ret
call fcn.140250d14
int3
Function at 0x140128040
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
movzx r8d, byte [rdx]
mov r9, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r10, rdx
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [r9 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
shl rdx, 4
add rdx, qword [r9 + 0x18]
mov rax, qword [rdx + 8]
cmp rax, qword [r9 + 8]
je 0x1401280f8
mov rcx, qword [r10]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x1401280ef
nop dword [rax + rax]
cmp rax, rdx
je 0x1401280f8
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1401280e0
add rax, 0x18
add rsp, 0x28
ret
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.14024799c
int3
Function at 0x140129750
Capabilities:
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbx
sub rsp, 0x40
movzx edx, cl
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs r8, 0x100000001b3
imul rdx, r8
movzx eax, byte [r11 + 9]
xor rdx, rax
imul rdx, r8
movzx eax, byte [r11 + 0xa]
xor rdx, rax
imul rdx, r8
movzx eax, byte [r11 + 0xb]
xor rdx, rax
imul rdx, r8
movzx eax, byte [r11 + 0xc]
xor rdx, rax
imul rdx, r8
movzx eax, byte [r11 + 0xd]
xor rdx, rax
imul rdx, r8
movzx eax, byte [r11 + 0xe]
xor rdx, rax
imul rdx, r8
movzx eax, byte [r11 + 0xf]
xor rdx, rax
imul rdx, r8
and rdx, qword [0x140415890]
shl rdx, 4
mov rax, qword [0x140415878]
add rax, rdx
mov rdx, qword [rax + 8]
mov r8, qword [0x140415868]
cmp rdx, r8
je 0x140129811
mov rax, qword [rax]
cmp rcx, qword [rdx + 0x10]
je 0x140129813
nop dword [rax]
cmp rdx, rax
je 0x140129811
mov rdx, qword [rdx + 8]
cmp rcx, qword [rdx + 0x10]
jne 0x140129800
jmp 0x140129813
xor edx, edx
test rdx, rdx
je 0x140129928
cmp rdx, r8
je 0x140129928
add rdx, 0x18
lea rcx, [rsp + 0x20]
call fcn.140127150
nop
mov rcx, qword [rsp + 0x20]
mov rbx, qword [rcx]
cmp byte [rbx + 0x19], 0
jne 0x1401298de
nop word [rax + rax]
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x30]
lea rcx, [0x1404158e0]
call fcn.140126830
mov rcx, qword [rax]
mov rcx, qword [rcx + 0x50]
test rcx, rcx
je 0x14012992e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x1401298a8
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401298a3
nop
cmp rbx, qword [rax + 0x10]
jne 0x1401298a3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140129890
mov rbx, rax
jmp 0x1401298cf
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x1401298cf
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x1401298c0
cmp byte [rbx + 0x19], 0
je 0x140129850
mov rcx, qword [rsp + 0x20]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x14012991e
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x20]
call fcn.140072f80
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, 0x28
call fcn.140249860
cmp byte [rbx + 0x19], 0
je 0x1401298f0
mov rcx, qword [rsp + 0x20]
mov edx, 0x28
call fcn.140249860
add rsp, 0x40
pop rbx
ret
call fcn.140247934
nop
int3
Function at 0x1401524c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x30], edi
lea rcx, [rsp + 0x60]
call fcn.1401525c0
nop
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov eax, dword [0x1402ab188]
mov dword [rbx + 0x18], eax
movzx eax, byte [0x1402ab18c]
mov byte [rbx + 0x1c], al
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x28], rdi
mov qword [rbx + 0x30], rdi
mov qword [rbx + 0x38], rdi
xorps xmm0, xmm0
movups xmmword [rbx + 0x40], xmm0
mov qword [rbx + 0x50], rdi
mov qword [rbx + 0x58], 3
mov dword [rbx + 0x40], edi
mov qword [rbx + 0x98], rdi
mov qword [rbx + 0xd8], rdi
mov dword [rsp + 0x30], 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14015259a
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x3c], eax
movzx eax, byte [0x1403ff7a0]
mov byte [rsp + 0x28], al
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
mov r8, rcx
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.140120af0
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1401525a4
call fcn.140249860
mov rax, rbx
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret

Function at 0x140152d00
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov rdi, rdx
mov rbx, rcx
je 0x140152e12
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x140152e12
cmp qword [rbx + 0x40], 0
je 0x140152e12
cmp byte [rbx + 0x28], 0
mov qword [rsp + 0x40], rsi
je 0x140152d5b
mov rdx, qword [rbx + 0x30]
xor r9d, r9d
mov r8d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rbx + 0x68]
call fcn.140152210
lea rsi, [rbx + 0x50]
cmp rsi, rdi
je 0x140152da7
mov rcx, qword [rdi + 8]
movabs rax, 0x8888888888888889
sub rcx, qword [rdi]
imul rcx
add rdx, rcx
mov rcx, rsi
sar rdx, 6
mov r8, rdx
shr r8, 0x3f
add r8, rdx
mov rdx, qword [rdi]
call fcn.1400daff0
xor eax, eax
mov byte [rbx + 0x28], 1
mov qword [rsp + 0x28], rax
lea r9, [rbx + 0x48]
lea r8, [0x140152bb0]
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x140152e0d
mov byte [rbx + 0x28], al
mov rbx, qword [rsi]
mov rdi, qword [rsi + 8]
cmp rbx, rdi
je 0x140152e0d
lea rcx, [rbx + 0x38]
call fcn.140011870
lea rcx, [rbx + 0x20]
call fcn.140022c08
mov rcx, rbx
call fcn.140011870
add rbx, 0x78
cmp rbx, rdi
jne 0x140152de3
mov rax, qword [rsi]
mov qword [rsi + 8], rax
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140193b20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140400788]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, rdx
mov rsi, rcx
xor ebp, ebp
mov qword [rcx], rbp
mov qword [rcx + 8], rbp
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140089830
nop
cmp qword [rax + 0x18], 0x10
jb 0x140193b68
mov rax, qword [rax]
lea rdx, [0x140299658]
mov rcx, rax
call fcn.14025bd8c
mov rdi, rax
test rax, rax
je 0x140193c10
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call fcn.14025799c
mov rcx, rdi
call fcn.14025c470
movsxd r14, eax
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.14025799c
lea rcx, [r14 + 1]
call fcn.14025c70c
mov rbx, rax
test rax, rax
je 0x140193bfb
mov r9, rdi
mov r8, r14
mov edx, 1
mov rcx, rax
call fcn.140257594
cmp rax, r14
jne 0x140193bfb
mov byte [r14 + rbx], 0
mov rcx, rdi
call fcn.140256af0
movsd xmm2, qword [0x140361d90]
lea rdx, [0x140361cd4]
mov rcx, rbx
call fcn.140193e30
mov rbp, rax
jmp 0x140193c08
mov rcx, rdi
call fcn.140256af0
test rbx, rbx
je 0x140193c10
mov rcx, rbx
call fcn.140252d50
mov qword [rsi], rbp
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140193c4c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140193c47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140193c71
call fcn.140249860
mov rax, rsi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1402499e0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140250d14
int3
Function at 0x1401a9ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x1401a9b14
cmp ecx, r10d
jge 0x1401a9b02
mov rcx, rbx
call fcn.140051cf0
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x1401a9b4e
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x14], ecx
movzx r9d, cl
test eax, eax
jg 0x1401a9b30
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x1401a9b7d
mov edx, dword [0x1404161d0]
mov rax, qword gs:[0x58]
mov ecx, 0x40
mov rax, qword [rax + rdx*8]
lea rdx, str.zlib_corrupt
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x1401a9baf
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
nop dword [rax]
cmp rax, r8
jb 0x1401a9b99
xor dl, dl
jmp 0x1401a9ba2
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x1401a9b90
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x1401a9b52
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x1401a9c24
mov edx, dword [0x1404161d0]
mov rax, qword gs:[0x58]
mov ecx, 0x40
mov rax, qword [rax + rdx*8]
lea rdx, str.read_past_buffer
mov qword [rcx + rax], rdx
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x1401a9c3e
mov rcx, rbx
call fcn.1401adeb0
test eax, eax
je 0x1401a9c17
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call fcn.14024aa30
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret

Function at 0x1401b8dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, r8d
mov rbx, rcx
test rcx, rcx
jne 0x1401b8de3
lea eax, [rcx + 0x23]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rcx + 0x88]
test rcx, rcx
je 0x1401b8e00
mov rax, qword [rcx + 0x10]
call qword [rax + 0x18]
mov edx, eax
xor eax, eax
cmp edx, dword [rbx + 0x10]
cmovae edx, eax
mov r8d, edi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1401b8e20