joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401fd890
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov edi, r8d
mov rsi, rdx
test ecx, ecx
je 0x1401fd8cc
mov rcx, rsi
test edi, edi
je 0x1401fda75
call fcn.140319a68
jmp 0x1401fda7a
cmp byte [rsi + 0x19], 0
jne 0x1401fda7a
jmp 0x1401fd8ff
call fcn.140084550
mov edx, 0x40
mov rcx, rsi
call fcn.140084550
cmp byte [rbx + 0x19], 0
mov rsi, rbx
jne 0x1401fda7a
mov rdx, qword [rsi + 0x10]
xor ecx, ecx
mov r8d, edi
xor r9d, r9d
call fcn.1401fd890
mov rbx, qword [rsi]
mov r14, qword [rsi + 0x28]
test r14, r14
je 0x1401fd8e5
mov rax, qword [0x140459898]
movsxd r15, dword [rax]
mov r12d, dword [0x14036d8e4]
mov r13, qword [rsi + 0x30]
cmp r14, r13
je 0x1401fda40
add r15, rax
jmp 0x1401fd9b3
mov r11, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r11
cmp rcx, 0x20
jae 0x1401fda8c
add rax, 0x28
movzx ecx, word [0x14036d8e8]
and r8d, r9d
cmp r8d, 1
mov edx, 0
sbb edx, edx
sub ecx, r10d
test cx, dx
setne cl
or cl, byte [0x1404902fc]
and cl, 1
mov byte [0x1404902fc], cl
mov rdx, rax
mov rcx, r11
call fcn.140084550
mov qword [r14 + 0x18], 0
mov qword [r14 + 0x20], 0xf
mov byte [r14 + 8], 0
add r14, 0x30
cmp r14, r13
je 0x1401fda40
mov rax, qword [r14 + 0x20]
mov r8d, dword [0x140459894]
lea r9d, [r8 - 0x2403c701]
add r9d, 0x2403c702
mov dword [0x140459894], r9d
test r8d, r9d
je 0x1401fd9e0
xor r10d, r10d
jmp 0x1401fda00
xor ecx, ecx
mov r10d, 0
test r12d, r12d
jle 0x1401fda00
xor r10d, r10d
movsxd rcx, ecx
xor r10w, word [r15 + rcx]
add ecx, 2
cmp ecx, r12d
jl 0x1401fd9f0
cmp rax, 0xf
jbe 0x1401fd991
mov rcx, qword [r14 + 8]
cmp byte [0x1404905d4], 0
jne 0x1401fd940
test byte [0x1404902fc], 1
jne 0x1401fd940
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1401fd98c
jmp 0x1401fd940
mov rcx, qword [rsi + 0x28]
mov rdx, qword [rsi + 0x38]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1401fd8e0
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x1401fda91
add rdx, 0x27
mov rcx, rax
jmp 0x1401fd8e0
call fcn.140319a08
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.1402f9bec
call fcn.1402f9bec
int3
Function at 0x1401fff40
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x458
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3d0], 0xfffffffffffffffe
mov rsi, rdx
cmp qword [0x140491988], 0
je 0x1401fff94
mov ecx, 0x5fff0dbe
call fcn.140200170
mov rcx, qword [rax]
mov r8, qword [rcx + 8]
mov rcx, rax
mov rdx, rsi
mov rax, r8
call qword [case.0x1400eabdd.0]
jmp 0x1402000b7
lea rdx, [0x14035cd08]
mov rcx, rsi
mov r8d, 0xc5673c7d
call fcn.1400deba0
mov qword [rbp + 0x3c8], rsi
mov rsi, qword [0x140459ee8]
movsxd rbx, dword [rsi]
mov r14d, dword [0x14036e2c4]
xor ecx, ecx
call fcn.14014c9b0
add rbx, rsi
mov esi, dword [0x140459ee0]
lea edi, [rsi + 1]
mov dword [0x140459ee0], edi
xor esi, edi
not esi
test esi, edi
je 0x1401fffe7
xor r15d, r15d
jmp 0x14020000e
xor ecx, ecx
mov r15d, 0
test r14d, r14d
jle 0x14020000e
xor r15d, r15d
nop word [rax + rax]
movsxd rcx, ecx
xor r15b, byte [rbx + rcx]
inc ecx
cmp ecx, r14d
jl 0x140200000
lea rdx, [rbp - 0x60]
mov rcx, rax
mov r8d, 0x400
call fcn.140131a00
and esi, edi
movzx eax, byte [0x14036e2c8]
xor ecx, ecx
cmp esi, 1
sbb ecx, ecx
sub al, r15b
and al, cl
movzx eax, al
add qword [0x1404917b8], rax
lea rcx, [rbp + 0x3a0]
lea rdx, [rbp - 0x60]
call fcn.1401e5820
lea rdx, [rbp + 0x3a0]
mov rcx, qword [rbp + 0x3c8]
call fcn.1401e5980
mov rax, qword [0x1404917b8]
add rax, qword [rbp + 0x3c0]
cmp rax, 0x10
mov rsi, qword [rbp + 0x3c8]
jb 0x1402000b7
mov rcx, qword [rbp + 0x3a8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1402000ac
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1402000ca
add rax, 0x28
mov rdx, rax
mov rcx, r8
mov r8d, 0xad2d7175
call fcn.140084550
mov rax, rsi
add rsp, 0x458
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
call fcn.1402f9bec
int3
Function at 0x140223000
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x258
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1d0], 0xfffffffffffffffe
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
mov ecx, 0xcb359193
call fcn.1401ea2d0
mov r15, rax
mov ecx, 0xcb359193
call fcn.1401ea2d0
mov r12, rax
mov ecx, 0xcb359193
call fcn.1401ea2d0
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x30], 0xe9c9f63d
lea rcx, [rbp + 0xc8]
mov rdx, r14
mov r8, rsi
mov r9, rax
call fcn.1401ed5c0
lea rax, [0x14036bc88]
mov qword [rbp + 0xc8], rax
lea rsi, [rbp + 0x1a0]
mov qword [rbp + 0x1b8], 0
mov qword [rbp + 0x1c0], 0xf
mov byte [rbp + 0x1a8], 0
movsxd r15, dword [0x1403717c4]
mov r12d, dword [0x1403717c0]
lea r14, [0x14035e258]
mov qword [rbp + 0x1a0], r14
mov qword [rbp + 0x1c8], rbx
add rdi, 8
mov rcx, rsi
mov rdx, rdi
call fcn.1401e5980
mov eax, dword [0x140461270]
lea ecx, [rax + 1]
mov dword [0x140461270], ecx
xor ecx, eax
not ecx
test ecx, eax
setne bl
or bl, byte [0x140491914]
xor edi, edi
mov r13d, 0
test bl, 1
jne 0x140223143
xor eax, eax
mov edi, 0
mov r13d, 0
test r12d, r12d
jle 0x140223143
lea rcx, [0x1403717c4]
add r15, rcx
xor edi, edi
xor r13d, r13d
nop dword [rax]
cdqe
xor r13, qword [r15 + rax + 8]
xor rdi, qword [r15 + rax]
add eax, 0x10
cmp eax, r12d
jl 0x140223130
lea rcx, [rbp - 0x40]
lea rdx, [rbp + 0xc8]
call fcn.1401f6910
mov rax, qword [0x1403717b8]
mov rcx, qword [0x1403717b0]
movzx edx, bl
mov r8d, edx
and r8d, 1
xor r9d, r9d
bt edx, 0
adc r9, 0xffffffffffffffff
dec r8
sub rcx, rdi
sbb rax, r13
and rax, r9
and rcx, r8
or rcx, rax
setne al
or al, byte [0x1404908b1]
and al, 1
mov byte [0x1404908b1], al
lea rax, [0x14036bc88]
mov qword [rbp - 0x40], rax
lea rcx, [rbp + 0x98]
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xb8], 0xf
mov byte [rbp + 0xa0], 0
mov qword [rbp + 0x98], r14
mov qword [rbp + 0xc0], 0
mov rdx, rsi
call fcn.1401e5980
mov rax, qword [rbp + 0x1c8]
mov qword [rbp + 0xc0], rax
lea rdx, [0x1403ec3c0]
lea rcx, [rbp - 0x40]
call fcn.140341eec
int3
Function at 0x140231910
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x158
mov rax, qword [0x14047f698]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov edi, dword [rcx + 0x10]
mov esi, dword [rcx + 0x14]
mov r11d, dword [rcx + 0x18]
mov r10d, dword [rcx + 0x1c]
mov r13d, dword [rcx + 0x20]
mov r14d, dword [rcx + 0x24]
mov ebp, dword [rcx + 0x28]
mov ebx, dword [rcx + 0x2c]
movups xmm0, xmmword [rcx + 0x30]
movups xmm1, xmmword [rcx + 0x40]
movups xmm2, xmmword [rcx + 0x50]
mov qword [rsp + 0x48], rcx
movups xmm3, xmmword [rcx + 0x60]
movaps xmmword [rsp + 0x80], xmm3
movaps xmmword [rsp + 0x70], xmm2
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
mov eax, 0x10
nop word cs:[rax + rax]
mov ecx, dword [rsp + rax*4 + 0x48]
mov edx, ecx
rol edx, 0xf
mov r8d, ecx
rol r8d, 0xd
xor r8d, edx
shr ecx, 0xa
xor ecx, r8d
add ecx, dword [rsp + rax*4 + 0x34]
mov edx, dword [rsp + rax*4 + 0x14]
mov r8d, edx
rol r8d, 0x19
mov r9d, edx
rol r9d, 0xe
xor r9d, r8d
shr edx, 3
xor edx, r9d
add ecx, dword [rsp + rax*4 + 0x10]
add ecx, edx
mov dword [rsp + rax*4 + 0x50], ecx
inc rax
cmp rax, 0x40
jne 0x140231990
xor r15d, r15d
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x3c], r14d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x34], r10d
mov r9d, r10d
mov dword [rsp + 0x30], r11d
mov r8d, r11d
mov dword [rsp + 0x2c], esi
mov dword [rsp + 0x28], edi
nop dword [rax + rax]
mov ecx, r13d
mov r12d, r14d
mov eax, ebp
mov edx, r13d
rol edx, 0x1a
mov r10d, r13d
rol r10d, 0x15
xor r10d, edx
mov edx, r13d
rol edx, 7
xor edx, r10d
mov r10d, r14d
and r10d, r13d
add r10d, ebx
mov ebx, r13d
not ebx
and ebx, ebp
add ebx, r10d
add ebx, edx
lea rdx, [0x140375430]
add ebx, dword [r15 + rdx]
add ebx, dword [rsp + r15 + 0x50]
mov r10d, edi
rol edi, 0x1e
mov edx, esi
mov esi, r10d
rol esi, 0x13
mov r11d, r8d
mov r8d, r10d
rol r8d, 0xa
xor esi, edi
xor r8d, esi
mov esi, r11d
or esi, edx
and esi, r10d
mov edi, r11d
and edi, edx
or edi, esi
add edi, r8d
mov r13d, r9d
add r13d, ebx
add edi, ebx
add r15, 4
mov ebx, ebp
mov ebp, r14d
mov r14d, ecx
mov r9d, r11d
mov r8d, edx
mov esi, r10d
cmp r15, 0x100
jne 0x140231a10
add edi, dword [rsp + 0x28]
mov r8, qword [rsp + 0x48]
mov dword [r8 + 0x10], edi
add r10d, dword [rsp + 0x2c]
mov dword [r8 + 0x14], r10d
add edx, dword [rsp + 0x30]
mov dword [r8 + 0x18], edx
add r11d, dword [rsp + 0x34]
mov dword [r8 + 0x1c], r11d
add r13d, dword [rsp + 0x38]
mov dword [r8 + 0x20], r13d
add ecx, dword [rsp + 0x3c]
mov dword [r8 + 0x24], ecx
add r12d, dword [rsp + 0x40]
mov dword [r8 + 0x28], r12d
add eax, dword [rsp + 0x44]
mov dword [r8 + 0x2c], eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1403198b0
nop
add rsp, 0x158
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14028a320
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x14028a51b
mov rsi, rcx
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov ebx, 1
shl rbx, cl
lea rax, [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, rdi
call fcn.14011ccd0
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
cmp byte [0x140490429], 0
jne 0x14028a50f
mov rax, qword [rsi + 8]
mov r8, qword [rax]
cmp r8, rdi
je 0x14028a50f
movabs rax, 0xcbf29ce484222325
movabs rcx, 0x100000001b3
jmp 0x14028a3d1
mov qword [r9 + r10*8], rdx
mov qword [r9 + r11*8], rdx
cmp r8, rdi
je 0x14028a50f
mov rdx, r8
movzx r8d, byte [r8 + 0x10]
xor r8, rax
imul r8, rcx
movzx r9d, byte [rdx + 0x11]
xor r9, r8
imul r9, rcx
movzx r8d, byte [rdx + 0x12]
xor r8, r9
imul r8, rcx
movzx r9d, byte [rdx + 0x13]
xor r9, r8
imul r9, rcx
movzx r8d, byte [rdx + 0x14]
xor r8, r9
imul r8, rcx
movzx r9d, byte [rdx + 0x15]
xor r9, r8
imul r9, rcx
movzx r8d, byte [rdx + 0x16]
xor r8, r9
imul r8, rcx
movzx ebx, byte [rdx + 0x17]
xor rbx, r8
imul rbx, rcx
and rbx, qword [rsi + 0x30]
mov r8, qword [rdx]
mov r9, qword [rsi + 0x18]
lea r10, [rbx + rbx]
lea r11, [rbx + rbx]
inc r11
shl rbx, 4
mov r14, qword [r9 + rbx]
cmp r14, rdi
je 0x14028a3c0
mov rbx, qword [r9 + r11*8]
mov r15, qword [rdx + 0x10]
cmp r15, qword [rbx + 0x10]
je 0x14028a4b0
nop dword [rax + rax]
cmp r14, rbx
je 0x14028a4e5
mov rbx, qword [rbx + 8]
cmp r15, qword [rbx + 0x10]
jne 0x14028a470
mov r9, qword [rbx]
mov r10, qword [rdx + 8]
mov qword [r10], r8
mov r11, qword [r8 + 8]
mov qword [r11], r9
mov rbx, qword [r9 + 8]
mov qword [rbx], rdx
mov qword [r9 + 8], r11
mov qword [r8 + 8], r10
mov qword [rdx + 8], rbx
jmp 0x14028a3c8
mov r10, qword [rbx]
cmp r10, rdx
je 0x14028a4d9
mov rbx, qword [rdx + 8]
mov qword [rbx], r8
mov r14, qword [r8 + 8]
mov qword [r14], r10
mov r15, qword [r10 + 8]
mov qword [r15], rdx
mov qword [r10 + 8], r14
mov qword [r8 + 8], rbx
mov qword [rdx + 8], r15
add rdx, qword [0x140490898]
jmp 0x14028a3c4
mov r11, qword [rdx + 8]
mov qword [r11], r8
mov r14, qword [r8 + 8]
mov qword [r14], rbx
mov r15, qword [rbx + 8]
mov qword [r15], rdx
mov qword [rbx + 8], r14
mov qword [r8 + 8], r11
mov qword [rdx + 8], r15
mov qword [r9 + r10*8], rdx
jmp 0x14028a3c8
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 1
xor r8d, r8d
mov r9d, 0x229b45c1
call fcn.14028aaf0
mov rcx, rax
call fcn.14031b1e4
int3
Function at 0x1402b2970
Capabilities:
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rax, qword [0x14047f698]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
nop word [rax + rax]
movzx r8d, byte [0x14049056c]
add r8b, byte [rdx + rax*4]
movzx r9d, r8b
shl r9d, 0x18
movzx r8d, byte [rdx + rax*4 + 1]
shl r8d, 0x10
or r8d, r9d
movzx r9d, byte [rdx + rax*4 + 2]
shl r9d, 8
or r9d, r8d
movzx r8d, byte [rdx + rax*4 + 3]
or r8d, r9d
mov dword [rsp + rax*4 + 0x50], r8d
inc rax
cmp rax, 0x10
jne 0x1402b29a0
mov eax, dword [rcx]
mov edx, dword [rcx + 4]
mov r11d, dword [rcx + 8]
mov r13d, dword [rcx + 0xc]
mov r10d, dword [rcx + 0x10]
mov r14d, dword [rcx + 0x14]
mov ebp, dword [rcx + 0x18]
mov qword [rsp + 0x48], rcx
mov ebx, dword [rcx + 0x1c]
lea r15, [0x1403878d0]
xor r12d, r12d
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x3c], r14d
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x34], r13d
mov dword [rsp + 0x24], r13d
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x2c], edx
mov dword [rsp + 0x28], eax
jmp 0x1402b2b3b
lea eax, [r12 + 0xe]
and eax, 0xf
add rax, qword [0x140491768]
mov r10d, dword [rsp + rax*4 + 0x50]
mov eax, r10d
rol eax, 0xf
mov edx, r10d
rol edx, 0xd
xor edx, eax
shr r10d, 0xa
xor r10d, edx
lea eax, [r12 + 9]
and eax, 0xf
add r10d, dword [rsp + rax*4 + 0x50]
lea eax, [r12 + 1]
and eax, 0xf
mov eax, dword [rsp + rax*4 + 0x50]
mov edx, eax
rol edx, 0x19
mov esi, r8d
mov r8d, r11d
mov r11d, eax
rol r11d, 0xe
xor r11d, edx
shr eax, 3
xor eax, r11d
mov r11d, r8d
mov r8d, esi
mov edx, r12d
and edx, 0xf
add r10d, dword [rsp + rdx*4 + 0x50]
add r10d, eax
mov dword [rsp + rdx*4 + 0x50], r10d
mov edi, dword [rsp + 0x24]
mov eax, r8d
rol eax, 0x1a
mov edx, r8d
rol edx, 0x15
xor edx, eax
mov eax, r8d
rol eax, 7
xor eax, edx
add eax, r10d
mov edx, ebp
xor edx, r13d
and edx, r8d
xor edx, ebp
add ebx, edx
add ebx, eax
add ebx, dword [r15]
mov eax, ecx
rol eax, 0x1e
mov edx, ecx
rol edx, 0x13
xor edx, eax
mov r10d, ecx
rol r10d, 0xa
xor r10d, edx
mov edx, r9d
and edx, ecx
mov eax, r9d
xor eax, ecx
and eax, r11d
or eax, edx
add eax, r10d
mov r10d, edi
add r10d, ebx
add eax, ebx
inc r12
add r15, 4
mov ebx, ebp
mov esi, ebp
mov ebp, r13d
mov r14d, r8d
mov dword [rsp + 0x24], r11d
mov edi, r8d
mov r8d, r11d
mov r11d, r9d
mov edx, ecx
cmp r12, 0x40
je 0x1402b2b5a
mov ecx, eax
mov r9d, edx
mov r8d, r10d
mov r13d, r14d
cmp r12, 0xf
ja 0x1402b2a40
mov r10d, dword [rsp + r12*4 + 0x50]
jmp 0x1402b2ab6
add eax, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x48]
mov dword [rdx], eax
add ecx, dword [rsp + 0x2c]
mov dword [rdx + 4], ecx
add r9d, dword [rsp + 0x30]
mov dword [rdx + 8], r9d
add r8d, dword [rsp + 0x34]
mov dword [rdx + 0xc], r8d
add r10d, dword [rsp + 0x38]
mov dword [rdx + 0x10], r10d
add edi, dword [rsp + 0x3c]
mov dword [rdx + 0x14], edi
add r13d, dword [rsp + 0x40]
mov dword [rdx + 0x18], r13d
add esi, dword [rsp + 0x44]
mov dword [rdx + 0x1c], esi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1403198b0
nop
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1402e3ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov ecx, edx
mov rax, qword [0x14047f698]
xor rax, rsp
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [0x14038f7d0]
movaps xmmword [rsp + 0x20], xmm0
movabs rax, 0x1716151413121110
mov qword [rsp + 0x30], rax
mov word [rsp + 0x38], 0x1918
mov byte [rsp + 0x3a], 0x1a
mov r8d, 0x1b
nop word cs:[rax + rax]
mov eax, ecx
xor edx, edx
div r8d
movzx eax, byte [rsp + r8 + 0x1f]
movzx r9d, byte [rsp + rdx + 0x20]
mov byte [rsp + r8 + 0x1f], r9b
mov byte [rsp + rdx + 0x20], al
imul eax, ecx, 0x6255
add eax, 0x3619
movzx ecx, ax
dec r8
cmp r8, 1
ja 0x1402e3f30
xor eax, eax
lea rdx, [0x140494fa0]
xor r8d, r8d
jmp 0x1402e3fc8
mov r10d, r8d
and r10b, 7
mov ecx, r8d
and ecx, 7
mov r11d, 0xffffffff
shl r11d, cl
lea edi, [r9 + r8]
add ecx, r9d
mov ebx, 0xffffffff
shl ebx, cl
xor ebx, r11d
shr r8d, 3
mov byte [rdx + rsi*4], r8b
mov byte [rdx + rsi*4 + 3], r10b
mov byte [rdx + rsi*4 + 1], bl
mov byte [rdx + rsi*4 + 2], bh
inc rax
mov r8d, edi
cmp rax, 0x1b
je 0x1402e4010
movzx esi, byte [rsp + rax + 0x20]
mov r9d, 6
cmp rsi, 0xf
ja 0x1402e3f80
mov r9d, 5
cmp sil, 7
ja 0x1402e3f80
mov r9d, 4
cmp sil, 3
ja 0x1402e3f80
mov r9d, 3
cmp sil, 1
ja 0x1402e3f80
cmp rsi, 1
mov r9d, 2
sbb r9d, 0
jmp 0x1402e3f80
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1403198b0
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14004d100]
mov dword [rax], 1
mov rax, qword [0x14004d110]
mov dword [rax], 1
mov rax, qword [0x14004d120]
mov dword [rax], 1
mov rax, qword [0x14004d080]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400277e0
Capabilities:
Query environment variable

Disassembly:
push r14
mov eax, 0x10080
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140030940
sub rsp, rax
xor eax, eax
xor edx, edx
lea rdi, str.PYTHON_FROZEN_MODULES
mov ebp, 0x50
lea r13, [rdi + 0x28]
mov word [rsp + 0x30], dx
lea r14, [rsp + 0x30]
lea r12, [rsp + 0x2e]
mov word [rsp + 0x80], ax
mov rsi, r14
nop dword [rax]
mov rax, r13
mov rbx, rsi
sub rax, rdi
cmp word [rsi], 0
je 0x14002784e
nop word [rax + rax]
add rbx, 2
sub rax, 1
cmp word [rbx], 0
jne 0x140027840
test rax, rax
je 0x14004181c
mov rcx, rbx
add rdi, 1
add rsi, 2
call sub.msvcrt.dll_wcslen
mov r8d, 2
mov rdx, r12
mov byte [rsp + 0x2e], bpl
lea rcx, [rbx + rax*2]
mov byte [rsp + 0x2f], 0
call sub.msvcrt.dll_mbstowcs
movzx ebp, byte [rdi]
test bpl, bpl
jne 0x140027828
lea rbx, [rsp + 0x80]
mov r8d, 0x10000
mov rcx, r14
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x1400278ba
mov rcx, rbx
call sub.msvcrt.dll__wcsdup
add rsp, 0x10080
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x14002f620
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.140040db0
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.140040db0
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x1400302f2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1400550e8]
test eax, eax
je 0x14003038a
lea rax, [0x1400550c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400550f0]
mov qword [rbp - 8], rax
jmp 0x14003036e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140030362
cmp qword [rbp - 0x10], 0
je 0x140030362
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140030328
lea rax, [0x1400550c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14003038b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140030490
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400304b8
mov eax, 0
jmp 0x140030506
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400304e1
mov eax, 0
jmp 0x140030506
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140030501
mov eax, 0
jmp 0x140030506
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x14003050c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14003058a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140030581
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140030581
mov rax, qword [rbp - 8]
jmp 0x14003059f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140030554
mov eax, 0
add rsp, 0x20
pop rbp
ret