joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3906b1850
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x3906bc064]
mov rbx, rcx
test esi, esi
jle 0x3906b1980
mov rax, qword [0x3906bc068]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x3906b189b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x3906b1925
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x3906b1880
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x3906b19a2
mov rax, qword [0x3906bc068]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call dbg._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x3906bc068]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x3906b1987
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x3906b191e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x3906b1930
add dword [0x3906bc064], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x3906bc068]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x3906b191e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor esi, esi
jmp 0x3906b18a8
mov rax, qword [0x3906bc068]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x3906b1d20
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x3906bc0a0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x3906bc080]
test rbx, rbx
je 0x3906b1d7c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x3906b1d73
test eax, eax
jne 0x3906b1d73
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x3906b1d58
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x3906b1f90
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x3906b1fa8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x3906b1fb0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x3906b1fc0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x3906b200d
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x3906b2004
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x3906b200f
add rax, 0x28
cmp rax, r9
jne 0x3906b1ff0
xor eax, eax
ret

Function at 0x3906b2010
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x3906b20a0
mov rdx, qword [0x3906b95c0]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x3906b208e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x3906b208e
cmp word [rax + 0x18], 0x20b
jne 0x3906b208e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x3906b20a0
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x3906b2079
add rbx, 0x28
cmp rbx, rdi
je 0x3906b20a0
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x3906b2070
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x3906b20b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x3906b95c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x3906b20d0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x3906b20d8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x3906b20d0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x3906b212d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x3906b2124
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x3906b20d0
add rax, 0x28
cmp rax, r9
jne 0x3906b2110
xor eax, eax
ret

Function at 0x3906b2130
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x3906b95c0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x3906b214f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x3906b2158
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x3906b214f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x3906b2170
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x3906b95c0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x3906b2190
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x3906b2198
ret
cmp word [rdx + 0x18], 0x20b
jne 0x3906b2190
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x3906b21e0
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x3906b21d7
test rcx, rcx
je 0x3906b2190
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x3906b21c8
xor eax, eax
ret
Function at 0x3906b21f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x3906b95c0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x3906b220f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x3906b2218
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x3906b2230
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x3906b95c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x3906b2250
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x3906b2258
ret
cmp word [r8 + 0x18], 0x20b
jne 0x3906b2250
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x3906b2250
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x3906b22a4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x3906b22b0
add rdx, 0x28
cmp rdx, r9
jne 0x3906b2290
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x3906b22c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x3906b95c0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x3906b22e2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x3906b22f0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x3906b22e2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x3906b22e2
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x3906b22e2
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x3906b2345
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x3906b2358
add rdx, 0x28
cmp r10, rdx
jne 0x3906b2330
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x3906b2367
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x3906b2377
mov edx, dword [rax + 0xc]
test edx, edx
je 0x3906b234e
test ecx, ecx
jg 0x3906b2360
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x14170e058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14170e1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14170e089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14170e06f
add dl, dl
jne 0x14170e096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14170e0f6
xor eax, eax
add dl, dl
jne 0x14170e0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14170e1ad
add dl, dl
jne 0x14170e0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14170e0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14170e0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14170e0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14170e0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14170e07e
mov eax, 1
add dl, dl
jne 0x14170e106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14170e113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14170e0fb
sub eax, ebx
mov ebx, 1
jne 0x14170e14c
mov ecx, 1
add dl, dl
jne 0x14170e12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14170e13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14170e123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14170e07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14170e168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14170e175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14170e15d
cmp eax, 0x7d00
jae 0x14170e19b
cmp eax, 0x500
jb 0x14170e196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14170e07e
cmp eax, 0x7f
ja 0x14170e19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14170e07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14170e1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14170e07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x141e47478
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141e475ff
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141e474a9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141e4748f
add dl, dl
jne 0x141e474b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141e47516
xor eax, eax
add dl, dl
jne 0x141e474c5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141e475cd
add dl, dl
jne 0x141e474d6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141e474e3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141e474f0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141e474fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141e4750a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141e4749e
mov eax, 1
add dl, dl
jne 0x141e47526
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141e47533
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141e4751b
sub eax, ebx
mov ebx, 1
jne 0x141e4756c
mov ecx, 1
add dl, dl
jne 0x141e4754e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141e4755b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141e47543
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141e4749e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141e47588
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141e47595
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141e4757d
cmp eax, 0x7d00
jae 0x141e475bb
cmp eax, 0x500
jb 0x141e475b6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141e4749e
cmp eax, 0x7f
ja 0x141e475be
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141e4749e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141e475f2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141e4749e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140010510
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
push rbx
push rsi
push rdi
mov rax, qword [rdx]
mov qword [rbp - 0x28], rax
mov rbx, qword [rdx]
mov rdx, qword [rdx + 8]
mov qword [rbp - 0x20], rdx
shr rax, 2
mov dword [rbp - 0x18], ecx
lea rsi, [rdx + rax*4]
mov qword [rbp - 0x10], rsi
mov rcx, qword [rbp - 0x20]
cmp rcx, qword [rbp - 0x10]
je 0x140010588
mov rdi, qword [rbp - 0x20]
mov eax, dword [rdi]
mov dword [rbp - 8], eax
imul edx, dword [rbp - 8], 0xcc9e2d51
mov dword [rbp - 8], edx
rol edx, 0xf
mov dword [rbp - 8], edx
imul ebx, dword [rbp - 8], 0x1b873593
mov dword [rbp - 8], ebx
xor dword [rbp - 0x18], ebx
mov ecx, dword [rbp - 0x18]
rol ecx, 0xd
mov dword [rbp - 0x18], ecx
lea ecx, [rcx + rcx*4]
lea esi, [rcx - 0x19ab949c]
mov dword [rbp - 0x18], esi
add qword [rbp - 0x20], 4
jmp 0x14001053c
mov dword [rbp - 4], 0
mov rax, qword [rbp - 0x28]
and rax, 3
cmp rax, 1
je 0x1400105c9
cmp rax, 2
je 0x1400105bb
cmp rax, 3
je 0x1400105ad
jmp 0x1400105f0
mov rbx, qword [rbp - 0x20]
movzx edx, byte [rbx + 2]
shl edx, 0x10
xor dword [rbp - 4], edx
mov rsi, qword [rbp - 0x20]
movzx ecx, byte [rsi + 1]
shl ecx, 8
xor dword [rbp - 4], ecx
mov rdx, qword [rbp - 0x20]
movzx eax, byte [rdx]
xor dword [rbp - 4], eax
imul ebx, dword [rbp - 4], 0xcc9e2d51
mov dword [rbp - 4], ebx
rol ebx, 0xf
mov dword [rbp - 4], ebx
imul ecx, dword [rbp - 4], 0x1b873593
mov dword [rbp - 4], ecx
xor dword [rbp - 0x18], ecx
mov esi, dword [rbp - 0x18]
mov rax, qword [rbp - 0x28]
xor esi, eax
mov dword [rbp - 0x18], esi
shr esi, 0x10
xor esi, dword [rbp - 0x18]
imul edx, esi, 0x85ebca6b
mov dword [rbp - 0x18], edx
shr edx, 0xd
xor edx, dword [rbp - 0x18]
imul ebx, edx, 0xc2b2ae35
mov dword [rbp - 0x18], ebx
shr ebx, 0x10
xor dword [rbp - 0x18], ebx
mov eax, dword [rbp - 0x18]
pop rdi
pop rsi
pop rbx
mov rsp, rbp
pop rbp
ret
Function at 0x140013d30
Capabilities:
Accept command line arguments

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp - 0x48], 0x90
mov qword [rbp - 0x88], rbx
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r15
mov qword [rbp + 0x20], r8
mov dword [0x1402c1950], ecx
mov qword [0x1402c1958], rdx
sub rsp, 0x20
call sub.KERNEL32.dll_GetCommandLineW
add rsp, 0x20
mov rsi, rax
mov rcx, rsi
sub rsp, 0x20
call fcn.140053b88
add rsp, 0x20
mov rdi, rax
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
mov rcx, rsi
sub rsp, 0x20
call sub.SHELL32.dll_CommandLineToArgvW
add rsp, 0x20
mov r12, rax
movsxd rcx, dword [rbp - 0x40]
shl rcx, 4
sub rsp, 0x20
lea rdx, [rbp - 0x48]
call fcn.140019f90
add rsp, 0x20
mov qword [rbp - 0x30], rax
movsxd r8, dword [rbp - 0x40]
mov qword [rbp - 0x38], r8
push 0
push 0
push 0
push 0
mov r9d, edi
mov r8, rsi
xor edx, edx
mov ecx, 0xfde9
sub rsp, 0x20
call sub.KERNEL32.dll_WideCharToMultiByte
add rsp, 0x40
cdqe
mov r14, rax
mov rcx, r14
sub rsp, 0x20
lea rdx, [rbp - 0x48]
call fcn.140019f90
add rsp, 0x20
mov qword [rbp - 0x20], rax
xor edi, edi
mov qword [rbp - 0x28], r14
xor r14d, r14d
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x18], eax
cmp eax, edi
jle 0x140013eda
movsxd rbx, r14d
mov rcx, qword [r12 + rbx*8]
sub rsp, 0x20
call fcn.140053b88
add rsp, 0x20
mov r13, rax
push 0
push 0
push 0
push 0
mov r9d, r13d
mov r8, qword [r12 + rbx*8]
xor edx, edx
mov ecx, 0xfde9
sub rsp, 0x20
call sub.KERNEL32.dll_WideCharToMultiByte
add rsp, 0x40
mov r15d, eax
movsxd rax, r15d
lea rsi, [rax + rdi]
sub rsi, rdi
mov r8, qword [rbp - 0x20]
lea rdx, [rdi + r8]
mov qword [rbp - 0x50], rbx
shl rbx, 4
mov rcx, qword [rbp - 0x30]
mov qword [rbx + rcx], rsi
mov qword [rbx + rcx + 8], rdx
test r15d, r15d
je 0x140013ecd
add rdi, rax
push 0
push 0
push r15
mov rax, qword [rbp - 0x50]
shl rax, 4
add rax, qword [rbp - 0x30]
push qword [rax + 8]
mov r9d, r13d
mov rbx, qword [rbp - 0x50]
mov r8, qword [r12 + rbx*8]
xor edx, edx
mov ecx, 0xfde9
sub rsp, 0x20
call sub.KERNEL32.dll_WideCharToMultiByte
add rsp, 0x40
inc r14d
cmp r14d, dword [rbp - 0x18]
jl 0x140013e2d
mov r14, qword [rbp - 0x28]
mov rcx, r12
sub rsp, 0x20
call sub.KERNEL32.dll_LocalFree
add rsp, 0x20
mov dword [rbp - 0x40], 0
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x10], rax
mov rbx, qword [rbp - 0x30]
mov qword [rbp - 8], rbx
mov r8, qword [rbp + 0x20]
mov rdx, r14
lea rcx, [rbp - 0x10]
sub rsp, 0x20
call fcn.140019ff0
add rsp, 0x20
mov rbx, qword [rbp - 0x88]
mov rsi, qword [rbp - 0x80]
mov rdi, qword [rbp - 0x78]
mov r12, qword [rbp - 0x70]
mov r13, qword [rbp - 0x68]
mov r14, qword [rbp - 0x60]
mov r15, qword [rbp - 0x58]
mov rsp, rbp
pop rbp
ret
Function at 0x140019b70
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r14
mov r14, rcx
mov r13, rdx
mov rdi, r8
test r14, r14
je 0x140019bb0
mov rcx, rdi
mov rax, qword [rdi]
call qword [rax + 0x48]
mov r12, rax
test r12, r12
jne 0x140019bcf
xor eax, eax
mov rbx, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x30]
mov r12, qword [rbp - 0x28]
mov r13, qword [rbp - 0x20]
mov r14, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret
mov rcx, rdi
call fcn.140019c90
xor al, 1
je 0x140019c12
mov rcx, r12
imul rcx, r14
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], r13
lea rdx, [rbp - 0x10]
xor ecx, ecx
call fcn.14001b710
mov rbx, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x30]
mov r12, qword [rbp - 0x28]
mov r13, qword [rbp - 0x20]
mov r14, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret
xor ebx, ebx
xor esi, esi
test r14, r14
je 0x140019c67
mov rdx, rsi
imul rdx, r12
add rdx, r13
mov rcx, rdi
mov r8, qword [rdi]
call qword [r8 + 0x30]
movabs r9, 0x87c37b91114253d5
mul r9
rol rax, 0x1f
movabs r10, 0x4cf5ad432745937f
mul r10
xor rax, rbx
rol rax, 0x1b
lea rdx, [rax + rax*4 + 0x52dce729]
mov rbx, rdx
inc rsi
cmp rsi, r14
jb 0x140019c1b
mov rax, rbx
mov rbx, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x30]
mov r12, qword [rbp - 0x28]
mov r13, qword [rbp - 0x20]
mov r14, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret

Function at 0x14001b710
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rdi
mov rdi, qword [rdx]
mov rsi, qword [rdx + 8]
mov rax, rdi
shr rax, 2
mov dword [rbp - 8], ecx
mov qword [rbp - 0x10], rdi
lea rdi, [rsi + rax*4]
cmp rsi, rdi
je 0x14001b78a
mov rcx, rsi
call fcn.140010630
mov ebx, eax
imul edx, ebx, 0xcc9e2d51
mov ebx, edx
rol edx, 0xf
mov ebx, edx
imul r8d, ebx, 0x1b873593
mov ebx, r8d
xor dword [rbp - 8], ebx
mov r9d, dword [rbp - 8]
rol r9d, 0xd
mov dword [rbp - 8], r9d
lea r9d, [r9 + r9*4]
lea r10d, [r9 - 0x19ab949c]
mov dword [rbp - 8], r10d
add rsi, 4
cmp rsi, rdi
jne 0x14001b742
mov rdi, qword [rbp - 0x10]
xor ecx, ecx
mov r11, rdi
and r11, 3
cmp r11, 1
je 0x14001b7be
cmp r11, 2
je 0x14001b7b5
cmp r11, 3
je 0x14001b7ae
jmp 0x14001b7dd
movzx ecx, byte [rsi + 2]
shl ecx, 0x10
movzx edx, byte [rsi + 1]
shl edx, 8
xor ecx, edx
movzx r8d, byte [rsi]
xor ecx, r8d
imul eax, ecx, 0xcc9e2d51
mov ecx, eax
rol eax, 0xf
mov ecx, eax
imul ebx, ecx, 0x1b873593
mov ecx, ebx
xor dword [rbp - 8], ecx
xor dword [rbp - 8], edi
movzx ecx, word [rbp - 6]
xor ecx, dword [rbp - 8]
imul edx, ecx, 0x85ebca6b
mov dword [rbp - 8], edx
shr edx, 0xd
xor edx, dword [rbp - 8]
imul esi, edx, 0xc2b2ae35
mov dword [rbp - 8], esi
movzx eax, word [rbp - 6]
xor dword [rbp - 8], eax
mov eax, dword [rbp - 8]
mov rbx, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
mov rdi, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret
Function at 0x1400283b0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xb0
mov qword [rbp - 0x88], rbx
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r15
mov rsi, rdx
mov rax, qword [rcx]
mov qword [rbp - 0x40], rax
cmp qword [rbp - 0x40], 0
je 0x1400283f9
mov rcx, qword [rbp - 0x40]
mov r8d, dword [rcx + 0x10]
sub r8d, dword [rcx + 0x14]
jne 0x14002841f
xor eax, eax
mov rbx, qword [rbp - 0x88]
mov rsi, qword [rbp - 0x80]
mov rdi, qword [rbp - 0x78]
mov r12, qword [rbp - 0x70]
mov r13, qword [rbp - 0x68]
mov r14, qword [rbp - 0x60]
mov r15, qword [rbp - 0x58]
mov rsp, rbp
pop rbp
ret
mov rcx, rsi
call fcn.140019030
mov rdi, rax
mov rdx, qword [rbp - 0x40]
mov r12d, dword [rdx + 0x2c]
mov r13, qword [rdi + 0x18]
mov qword [rbp - 0x50], r13
mov rax, qword [rbp - 0x50]
mov rbx, qword [rax]
mov r14, qword [rbx + 0x30]
mov r15, qword [rdi + 0x10]
mov qword [rbp - 0x50], r15
mov rsi, qword [rbp - 0x50]
mov rcx, qword [rsi]
mov r8, qword [rcx + 0x30]
mov qword [rbp - 0x38], r8
xor esi, esi
mov rax, qword [rdx]
mov rdx, qword [rdx + 8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
cmp qword [rbp - 0x30], rsi
je 0x140028504
mov rbx, qword [rbp - 0x28]
mov r9, qword [rbp - 0x30]
shl r9, 4
add r9, qword [rbp - 0x28]
mov qword [rbp - 0x10], r9
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
cmp qword [rbp - 0x20], 0
jns 0x1400284fa
mov edx, r12d
add rdx, qword [rbp - 0x18]
mov rcx, r15
call qword [rbp - 0x38]
movabs r8, 0x87c37b91114253d5
mul r8
mov rdi, rax
rol rdi, 0x1f
mov rax, rdi
movabs r9, 0x4cf5ad432745937f
mul r9
mov qword [rbp - 0x48], rax
mov rdx, qword [rbp - 0x18]
mov rcx, r13
call r14
mov r8, rax
mov rax, qword [rbp - 0x48]
xor rax, r8
rol rax, 0x1b
lea r10, [rax + rax*4 + 0x52dce729]
add rsi, r10
add rbx, 0x10
cmp rbx, qword [rbp - 0x10]
jb 0x14002848b
mov rax, rsi
mov rbx, qword [rbp - 0x88]
mov rsi, qword [rbp - 0x80]
mov rdi, qword [rbp - 0x78]
mov r12, qword [rbp - 0x70]
mov r13, qword [rbp - 0x68]
mov r14, qword [rbp - 0x60]
mov r15, qword [rbp - 0x58]
mov rsp, rbp
pop rbp
ret
Function at 0x14002c150
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x140
mov qword [rbp - 0x118], rbx
mov qword [rbp - 0x110], rsi
mov qword [rbp - 0x108], rdi
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rsi, rcx
call fcn.14002c260
mov qword [rbp - 0x100], rax
cmp rax, 0xffffffffffffffff
jne 0x14002c18f
ud2
lea rax, str.Aborting_from
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x80], 0xe
mov rcx, qword [rbp + 0x18]
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdx
lea rbx, [0x1402b1a70]
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x60], 1
mov rdx, rsi
lea rdi, [rbp - 0xc0]
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x20], 0x40
lea rcx, [rbp - 0x20]
call fcn.140004b80
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea rax, [0x1402b6d10]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 2
mov rbx, qword [rbp + 0x20]
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
lea rsi, [rbp - 0x80]
mov rdx, qword [rsi + 8]
mov rax, qword [rsi]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
xor ecx, ecx
mov qword [rbp - 0x120], rcx
mov r9, rcx
mov r8d, dword [rbp - 0x10]
mov rdx, qword [rbp - 8]
mov rcx, qword [rbp - 0x100]
call sub.KERNEL32.dll_WriteFile
add rsi, 0x10
lea rax, [rbp - 0x20]
cmp rsi, rax
jb 0x14002c219
call fcn.14005a264
int3

Function at 0x14002fb52
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
xor r9d, r9d
mov eax, r8d
shr eax, 8
mov ecx, r8d
and ecx, 0xff
mov ecx, ecx
lea rdx, [0x1402b7690]
xor eax, dword [rdx + rcx*4]
mov r8d, eax
inc r9d
cmp r9d, 4
jb 0x14002fb58
ret